topic Re: FMC conflicts and overlaps in Network Security

FMC conflicts and overlaps

NetworkMonkey101 — Thu, 24 Jul 2025 05:24:30 GMT

Hi,

I have exported an ACP from on FMC 2500 onto a blank new FMCv. I have then upgraded the FMCv and plan on migrating that ACP to a newer FMC already in production and migrating two firewalls.

My issue is when I imported the ACP onto the blank FMCv I have conflict errors. I am unsure what these are and how to resolve them or if they need resolving before exporting and importing again onto the final destination FMC.

Are these naming conflicts or something else? As it is a blank FMC i wouldn't of thought that was the case.

How do I resolve?

Re: FMC conflicts and overlaps

Mark Elsen — Wed, 25 Jun 2025 08:26:18 GMT

- @NetworkMonkey101 FYI : https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwp29808

Re: FMC conflicts and overlaps

Marvin Rhoads — Wed, 25 Jun 2025 09:03:54 GMT

The policy analysis conflicts are just highlighting that some of your objects and/or rules have overlaps and are thus not entirely internally consistent. You have the opportunity to analyze them and potentially combine some unless you prefer to keep them as separately defined names for reasons external to the firewall (e.g., to better follow the business logic from a human-readable point of view).

Re: FMC conflicts and overlaps

rovianjaxiel — Wed, 25 Jun 2025 09:34:51 GMT

Yes, those conflict errors can still happen even on a blank FMC. Here's why:

Why You’re Seeing Conflicts

The ACP you're importing likely has objects (like network, service, or zone objects) that are referencing things that don't exist yet on the new FMC.
Some objects might have duplicate names or missing dependencies from the export.
Even though the FMC is clean, the ACP still depends on certain settings or objects it used before.

What You Should Do

Check the conflict details on the FMC. It should tell you what objects are causing the problem.
If the object is unused, delete it.
If it’s needed, check if:
- The name is already in use
- It’s missing a reference
- It can be renamed
Try resolving the conflict by either:
- Renaming the object
- Creating the missing item manually
Make sure you can deploy the policy on the test FMCv without errors before exporting it to the production FMC.

Final Tip

If you’re unsure, try importing the same ACP into another test FMCv running the same version as production. That way you can catch errors before pushing it live.