topic Re: ASA to FTD migration failing when selecting RAVPN. in Network Security

ASA to FTD migration failing when selecting RAVPN.

NetworkMonkey101 — Fri, 13 Sep 2024 22:59:04 GMT

I am attempting to migrate an ASA configuration to FTD and when I run the migration tool and the below selected the parsing fails.

When I deselect RAVPN option the parsing is successful. What could be causing this?

I have checked the licencing on the FMC and it is missing the Anyconnect features as does the licencing portal, would this cause this migration to fail at this step?

I have add the Anyconnect win/linux/mac profiles to the FMC. Is anything else required to start the migration of RAVPN?

Re: ASA to FTD migration failing when selecting RAVPN.

Mark Elsen — Sat, 14 Sep 2024 06:49:14 GMT

- Check this thread : https://community.cisco.com/t5/network-security/can-t-migrate-ravpn-config-from-asa-to-ftd/td-p/4772716

Re: ASA to FTD migration failing when selecting RAVPN.

NetworkMonkey101 — Tue, 17 Sep 2024 10:20:40 GMT

Thanks for the reply. I have a single context and used the live connect so not sure if this thread is related. Parsing fails when RAVPN option is selected and returns a list index error seen below. When I deselect RAVPN the parsing is successful.

Re: ASA to FTD migration failing when selecting RAVPN.

Sheraz.Salim — Tue, 17 Sep 2024 10:35:50 GMT

The error message "list index out of range" typically indicates that you're trying to access an element in a list that doesn't exist.

Check for any syntax errors or inconsistencies. Verify that the RAVPN profile names and settings are valid and match the corresponding profiles in your FTD environment. As you mentioned, the AnyConnect license might be missing or incorrect. Check the FMC and licensing portal to confirm that the necessary licenses are in place. I cant think of anything else.

Re: ASA to FTD migration failing when selecting RAVPN.

NetworkMonkey101 — Tue, 17 Sep 2024 10:46:56 GMT

I will check the config for syntax errors. The FMC/FTD having AnyConnect Apex licensing selected but it is showing out of compliance would this prevent the migration tool from parsing the config?

Re: ASA to FTD migration failing when selecting RAVPN.

NetworkMonkey101 — Tue, 17 Sep 2024 11:01:30 GMT

I have not copied profiles across from the current ASA configuration. Does this need to be done before parsing?

These are the profiles I have found on the ASA

anyconnect profiles Mobile_ACP disk0:/Mobile_ACP.xml
anyconnect profiles PortalUser_client_profile disk0:/PortalUser_client_profile.xml
anyconnect profiles Resilient_ACP disk0:/Resilient_ACP.xml

Is there a guide on how to do this?

Re: ASA to FTD migration failing when selecting RAVPN.

Sheraz.Salim — Tue, 17 Sep 2024 11:04:35 GMT

Yes, you need to copy the AnyConnect profiles from your current ASA configuration to the FMC before running the migration tool. These profiles contain important settings and configurations that are necessary for the successful migration of your AnyConnect VPN. Without them, the migration tool might not be able to properly configure the AnyConnect VPN features on your FTD.

Re: ASA to FTD migration failing when selecting RAVPN.

Sheraz.Salim — Tue, 17 Sep 2024 11:05:04 GMT

I think yes but I am not sure of this.

Re: ASA to FTD migration failing when selecting RAVPN.

NetworkMonkey101 — Tue, 17 Sep 2024 11:06:28 GMT

Ok, I will look into this and re-run the migration tool

Re: ASA to FTD migration failing when selecting RAVPN.

Sheraz.Salim — Tue, 17 Sep 2024 11:12:45 GMT

check this video might help you out
https://www.youtube.com/watch?time_continue=3&v=Beha9K7oPhI&embeds_referring_euri=https%3A%2F%2Fwww.perplexity.ai%2F

Re: ASA to FTD migration failing when selecting RAVPN.

NetworkMonkey101 — Thu, 19 Sep 2024 07:31:13 GMT

Hi,

I have a list of the profiles and am attempting to upload them to the FMC via objects > vpn > anyconnect file.

Here are files I have pulled off the ASA.

How do I determine which file type to use for each of the above?

Re: ASA to FTD migration failing when selecting RAVPN.

Sheraz.Salim — Fri, 20 Sep 2024 10:24:26 GMT

you have to select anyconnect profile