https://community.cisco.com/t5/network-security/ftd-impact-of-migrating-fmc-from-vmware-to-aws/m-p/5281695#M1120618 <P>Hey,</P><P>We have a production FMC running in VMWare that needs migrating to AWS. Having looked through a bunch of docos and peoples posts on this community and Reddit, it seems migrating FMC is just as painful as the actual product itself. As far as I could find I have three option:<BR />1) Import and export - Not suitable as doesn't export objects, certificates, remote access config and much more.<BR />2) Backup restore - apparently only to be used for disaster recovery and doesn't work cross model (VMWare and AWS are different models)<BR />3) Model migration script - Doesn't support migrating from VMWare to AWS<BR /><BR />As none of the above seemed suitable for our use case, I searched the web and seen that people said tricking an FMC to think its a different model allows to restore from backup so I didnt he following:<BR /><BR />1) Deployed FMC on AWS<BR />2) Blocked it from talking to the FTDs on the management port as to avoid any issues with having 2 FMCs online<BR />3) Ran the '<SPAN>/var/sf/etc/model-info/configure-model.sh' script and tricked the AWS model to think its VMWare model.<BR />4) Backed up the production VMWare FMC<BR />5) Uploaded the WMware FMC backup to the AWS FMC which thinks its VMWare<BR />6) Restored AWS FMC from backup<BR />7) Changed the AWS FMC back to AWS model by running the script again<BR /><span class="lia-unicode-emoji" title=":smiling_face_with_sunglasses:">😎</span>Changed the AWS FMC back to its AWS allocated IP address instead of the one restored from backup<BR /><BR />I don't have much experience with FTD and FMC so I'm not sure what happens when I allow the AWS FMC to talk to the FTDs and shut down the VMWare one. It's technically been restored from backup but obviously I messed around with the models and on top of that the FMC has a different IP address (unfortunately it has to). I'm wondering if anybody has done a similar thing and noticed if they need to reregister the firewall or whether there was any downtime observed.<BR /><BR /></SPAN></P><P>Our FMC version is 7.2.5</P><P><SPAN>Any help would be hugely appriciated!</SPAN></P> Tue, 15 Apr 2025 20:21:10 GMT szymonsikorski 2025-04-15T20:21:10Z https://community.cisco.com/t5/network-security/ftd-impact-of-migrating-fmc-from-vmware-to-aws/m-p/5281695#M1120618 <P>Hey,</P><P>We have a production FMC running in VMWare that needs migrating to AWS. Having looked through a bunch of docos and peoples posts on this community and Reddit, it seems migrating FMC is just as painful as the actual product itself. As far as I could find I have three option:<BR />1) Import and export - Not suitable as doesn't export objects, certificates, remote access config and much more.<BR />2) Backup restore - apparently only to be used for disaster recovery and doesn't work cross model (VMWare and AWS are different models)<BR />3) Model migration script - Doesn't support migrating from VMWare to AWS<BR /><BR />As none of the above seemed suitable for our use case, I searched the web and seen that people said tricking an FMC to think its a different model allows to restore from backup so I didnt he following:<BR /><BR />1) Deployed FMC on AWS<BR />2) Blocked it from talking to the FTDs on the management port as to avoid any issues with having 2 FMCs online<BR />3) Ran the '<SPAN>/var/sf/etc/model-info/configure-model.sh' script and tricked the AWS model to think its VMWare model.<BR />4) Backed up the production VMWare FMC<BR />5) Uploaded the WMware FMC backup to the AWS FMC which thinks its VMWare<BR />6) Restored AWS FMC from backup<BR />7) Changed the AWS FMC back to AWS model by running the script again<BR /><span class="lia-unicode-emoji" title=":smiling_face_with_sunglasses:">😎</span>Changed the AWS FMC back to its AWS allocated IP address instead of the one restored from backup<BR /><BR />I don't have much experience with FTD and FMC so I'm not sure what happens when I allow the AWS FMC to talk to the FTDs and shut down the VMWare one. It's technically been restored from backup but obviously I messed around with the models and on top of that the FMC has a different IP address (unfortunately it has to). I'm wondering if anybody has done a similar thing and noticed if they need to reregister the firewall or whether there was any downtime observed.<BR /><BR /></SPAN></P><P>Our FMC version is 7.2.5</P><P><SPAN>Any help would be hugely appriciated!</SPAN></P> Tue, 15 Apr 2025 20:21:10 GMT https://community.cisco.com/t5/network-security/ftd-impact-of-migrating-fmc-from-vmware-to-aws/m-p/5281695#M1120618 szymonsikorski 2025-04-15T20:21:10Z https://community.cisco.com/t5/network-security/ftd-impact-of-migrating-fmc-from-vmware-to-aws/m-p/5281971#M1120623 <P>Why 7.2 and not 7.4 or 7.6? Also yes, there are ways to "hack" the migration scripts. Just note they have no support from Cisco.</P> Wed, 16 Apr 2025 13:37:17 GMT https://community.cisco.com/t5/network-security/ftd-impact-of-migrating-fmc-from-vmware-to-aws/m-p/5281971#M1120623 ahollifield 2025-04-16T13:37:17Z https://community.cisco.com/t5/network-security/ftd-impact-of-migrating-fmc-from-vmware-to-aws/m-p/5283410#M1120667 <P>I did this about 2 years ago when moving from an op-premise FMC 4500 to an AWS FMCv300. In my case we removed the device from the on-prem FMC and registered it anew on the AWS instance and restored a device backup. It may have been a bit more than necessary, but we wanted to make doubly sure that nothing was missed as we were moving over about 50 production firewalls.</P> Mon, 21 Apr 2025 15:11:13 GMT https://community.cisco.com/t5/network-security/ftd-impact-of-migrating-fmc-from-vmware-to-aws/m-p/5283410#M1120667 Marvin Rhoads 2025-04-21T15:11:13Z https://community.cisco.com/t5/network-security/ftd-impact-of-migrating-fmc-from-vmware-to-aws/m-p/5283473#M1120674 <P>Please consider following the advice of <a href="https://community.cisco.com/t5/user/viewprofilepage/user-id/326046">@Marvin Rhoads</a>. He has assisted many, including myself, with the migration of the FMC100 and brings valuable expertise to this community.</P> Mon, 21 Apr 2025 18:15:45 GMT https://community.cisco.com/t5/network-security/ftd-impact-of-migrating-fmc-from-vmware-to-aws/m-p/5283473#M1120674 Sheraz.Salim 2025-04-21T18:15:45Z