topic Migrate FMC 2500 to FMC 2700 in Network Security

Migrate FMC 2500 to FMC 2700

Andres Martin Herrero — Fri, 13 Sep 2024 08:34:17 GMT

Hi all!

We are trying to migrate an from FMC 2500 deployment to SFMC 2700. Our scenario in our 2500 FMC is the following:

- Version 7.0.5
- devices managed by this FMC:
· FTD v7.0.6.2
· SFR ASA5516-X v7.0.6
· SFR ASA5500-X v6.6.7.1

Reading the official documentation about the migration from FMC 2500 chassis to 2700 chassis

https://www.cisco.com/c/en/us/td/docs/security/firepower/fmc_model_migration/b_FMC_Model_Migration_Guide/m_fmc_migration_workflow.html

we have to upgrade the FMC 2500 version to the special release 7.4 for taking a backup and restore it in the new chassis.

The problem is the following, we need the FMC 2500 in version 7.0 to keep the service given to the SFR ASA 5500-X in version 6.6.7.1. We can't upgrade this FMC 2500. Only we can work with the backup for a restore or the Import/Export objects.

Could you help me giving us your best procedure to take the configuration from FMC 2500 in version 7.0 and import it in the new FMC 2700 chassis in version 7.4?

Thank you!!

Regards

Re: Migrate FMC 2500 to FMC 2700

Marvin Rhoads — Fri, 13 Sep 2024 17:14:14 GMT

Is the policy for 6.6.7.1 pretty basic (i.e. just a Firepower service module with a few ACP entries)? If so, I would just keep run that on an FMCv 7.0.x that you stand up for only as long as the time until you retire that past-end-of-support device. May even for both sets of devices with SFR modules.

Then do the model migration as noted for the rest of the devices (FTD and possibly the 5516-X firepower modules).

Re: Migrate FMC 2500 to FMC 2700

Massimo Baschieri — Sat, 14 Sep 2024 04:04:03 GMT

Hi Marvin,

I take the chance for a question of mine

In caso of migration to FMC2700 the upgrade to 7.4 is needed because target FMC doesn't support release 7.0, but in case of migration from FMC2500 to, for example, FMCv300, is it allowed to migrate maintaining same 7.0 release?

Re: Migrate FMC 2500 to FMC 2700

Marvin Rhoads — Sun, 15 Sep 2024 02:37:14 GMT

That's correct - you can do model migration within the same release to any supported model.

The problem with the 2700 is that versions prior to 7.4 aren't supported on it.

Re: Migrate FMC 2500 to FMC 2700

Peter Beshay — Fri, 01 Nov 2024 17:46:03 GMT

i have the FMC2500 on version 7.0.6.2 and i could not update it to 7.4.0.118 special release for migration
it shows this error "Unable to upgrade DC while some Sensor versions are too old(< 7.0.0)."

Do anyone have solution for that ?

Re: Migrate FMC 2500 to FMC 2700

Mark Elsen — Fri, 01 Nov 2024 17:56:06 GMT

- @Peter Beshay FYI : https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvz92275

Re: Migrate FMC 2500 to FMC 2700

Marvin Rhoads — Fri, 01 Nov 2024 17:58:49 GMT

@Peter Beshay What models and versions are your managed devices?

Re: Migrate FMC 2500 to FMC 2700

Peter Beshay — Fri, 01 Nov 2024 17:59:59 GMT

From FMC2500 to FMC 2700

Re: Migrate FMC 2500 to FMC 2700

Peter Beshay — Fri, 01 Nov 2024 18:11:18 GMT

i am on FMC2500 7.0.6.2 moving to FMC2700 7.4.0.118
i tried the fix for that bug and does not work for some reason , give access denied even i use the admin
https://bst.cisco.com/bugsearch/bug/CSCvv13619?rfs=qvred

Re: Migrate FMC 2500 to FMC 2700

Marvin Rhoads — Fri, 01 Nov 2024 18:18:27 GMT

@Peter Beshay the managed device models and versions are what I am asking, not the FMC.

Re: Migrate FMC 2500 to FMC 2700

Peter Beshay — Fri, 01 Nov 2024 18:19:56 GMT

Firepower 4110 with the same version 7.0.6.2

Re: Migrate FMC 2500 to FMC 2700

Peter Beshay — Fri, 01 Nov 2024 20:29:46 GMT

Problem found, I found 1 sensor in the old 6.0.7 version that has been added recently with an update to 7.0.x
I updated and am now able to upgrade FMC2500 to 7.4.0.118