topic Migration from one FMC to another in Network Security

Migration from one FMC to another

rjadhav163 — Tue, 12 Mar 2019 08:06:39 GMT

Hello

I want to migrate all the devices from our current virtual Firepower management center to a new firepower management center. Following are the conditions:

1. The new management center will also be on VMWare and will have exact version number as the current one.

2. The devices managed by current FMC are ASAs with FTD images and are in High Availability (only 1 pair)

3. The new FMC must have exact same configuration as the current one. (like security policies and all. I can export the config from the current FMC I guess.)

4. The new FMC should take over the IP Address of the current FMC

How can I achieve this migration? Is there a document? Or can someone jot down the process i should follow?

Thanks and Regards,

Additional Note: FMC version

rjadhav163 — Tue, 09 Aug 2016 14:25:19 GMT

Additional Note: FMC version is 6.0.1.1

Hi there, have you looked at

nspasov — Tue, 16 Aug 2016 20:03:01 GMT

Hi there, have you looked at the backup and restore process?

http://www.cisco.com/c/en/us/td/docs/security/firepower/601/configuration/guide/fpmc-config-guide-v601/Backup_and_Restore.html

Thank you for rating helpful posts!

Hi

rjadhav163 — Wed, 17 Aug 2016 06:23:58 GMT

yes I took a look there. But that is a Backup and Restore procedure and there it says the following:

Do not use the backup and restore process to copy configurations between appliances. A backup file contains information that uniquely identifies an appliance, and cannot be shared.

Since we are installing a new FMC, I am not sure about the process in this guide!

Have you tried it yourself?

Hi,

Ashley Sahonta — Wed, 17 Aug 2016 17:04:37 GMT

Hi,

I have done this in my lab and I was able to backup and restore the configuration of one FMC to another FMC. One thing to be careful of is that the vulnerability database needs to be exactly the same, as that was the only issue I found.

Re: Hi

StevenH9608 — Tue, 12 Nov 2019 13:57:27 GMT

I know this thread is old but if anyone else comes across it...
From the link from @nspasov it also says "You can restore a backup onto a replacement appliance or device only if the two appliances or devices are the same model and are running the same version of the Firepower System software".
I believe your @rjadhav163 quote is meant to mean: do not use the back up and restore as a way to copy configuration to multiple devices.

When I restored my firewall (with the help of TAC) this I used backup and restore and like @Ashley Sahonta said I just had to make sure all the versions were the same.

Re: Hi

diegodeoliveira — Thu, 29 Oct 2020 00:30:06 GMT

Hi There,

Did you manage to do this Migration? I am facing the same challenge, but I will need to get the Management IP changed.

Re: Migration from one FMC to another

Dill — Tue, 14 Mar 2023 21:36:37 GMT

Old topic, but I am move from an obsolete FMC1000 to an Virtual FMC (VMWare). I tried doing a backup and restore but it won't let me. (Restore will not be available: Product model mismatch)

Re: Migration from one FMC to another

p.lan — Mon, 10 Apr 2023 15:33:41 GMT

In the same boat, did you find a solution?

Re: Migration from one FMC to another

Gustavo Medina — Mon, 10 Apr 2023 17:42:22 GMT

After 6.5 you can use the Firepower Management Center Model Migration feature. Just make sure you follow a supported migration path:

https://www.cisco.com/c/en/us/td/docs/security/firepower/fmc_model_migration/b_FMC_Model_Migration_Guide/about_fmc_model_migration.html

Re: Migration from one FMC to another

p.lan — Mon, 10 Apr 2023 17:51:07 GMT

Hi Gustavo,

I've read that guide and digested it fully. Only issue is, Cisco has only paved a path to allow people to go from one FMC to an equal size or larger FMC. There is no solution to go from FMC 1000 to FMCv. A lot of our customers have FMC 1000 becuase it was given to them free with their 4 or 6 FTD purchases, but now that we want to go to FMCv, we have no option but to go to the super sized FMCv300.

Do you know of a way to go from FMC1000 to FMCv and bypass the "Restore will not be available: Product model mismatch" error?

Re: Migration from one FMC to another

Dill — Mon, 10 Apr 2023 18:36:27 GMT

My Cisco TAC found this for me.
Change the VM model, Import your backup, then change the VM back.
https://community.cisco.com/t5/network-security/can-fmc-running-in-vsphere-be-migrated-to-aws/td-p/4569305

Re: Migration from one FMC to another

p.lan — Mon, 10 Apr 2023 18:52:47 GMT

you are amazing, thank you so much. Im going to try this right now to trick it into being FMCv300 and then attempt the migration process. After that, I will change it back and evaluate if everything worked out. Will report back soon!

Re: Migration from one FMC to another

Gustavo Medina — Mon, 10 Apr 2023 19:02:08 GMT

You are right, due to database sizes differences between models the Model Migration feature only supports moving to a larger model. There are plans to add support for some other paths in newer versions but for now you can always export and import the configuration between any models, it is not as seamless as the Model Migration feature but you will not have to configure the new device from scratch. https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/configuration_import_and_export.html

The other option if possible is using the Migration Tool and move to cdFMC: https://www.cisco.com/c/en/us/td/docs/security/cdo/managing-fmc-with-cdo/managing-fmc-with-cisco-defense-orchestrator/m-preface-managing-fmc-with-cisco-defense-orchestrator.html

Re: Migration from one FMC to another

Gustavo Medina — Mon, 10 Apr 2023 19:26:38 GMT

This procedure is only intended for TAC lab use only and not supported for production environments. Any issues would be supported as best effort only.

Re: Migration from one FMC to another

p.lan — Tue, 13 Jun 2023 21:59:31 GMT

Forgot to report back, this worked perfect. sized the FMCv to FMCv300, imported the config from FMC1000. Then sized it back down to FMCv.

Re: Migration from one FMC to another

Ivan Zhang — Mon, 05 Aug 2024 05:54:05 GMT

Hi @p.lan

Did you experience any downtime when you migrated from FMC1000 to FMCv? Thank you.

Re: Migration from one FMC to another

p.lan — Mon, 05 Aug 2024 12:40:59 GMT

We did not experience any downtime. When shutting down the old FMC and turning up the "newly restored" FMC, it acted like it normally would-- it needed to do a full deploy to the firewalls, but no impact was noticed since the configs were the same between the old and new FMC.

As I noted before in this thread, I needed to run the commands in that other thread that "tricked" my new FMCv into being a FMCv300, restored the FMC1000 backup onto it (and deployed to the firewalls), then downsized it back to a FMCv at the end, with no issues.

Re: Migration from one FMC to another

Ivan Zhang — Mon, 05 Aug 2024 14:32:49 GMT

@p.lan Thank you very much, your experiences are very helpful. One more question, how many FTD devices you have reregistered with the old FMC1000, and did you move all FTD to the new FMCv in a single time? Because I plan to use different IP address for the new FMCv, I consider to move a HA pair FTD one time, and move another HA pair FTD next time.

Re: Migration from one FMC to another

p.lan — Mon, 05 Aug 2024 15:12:03 GMT

Sure thing! We had 3 HA pairs registered to the FMC1000. We kept the IP of our old and new FMC the same.

If you want to migrate one or a few FTDs at a time to the new FMCv, your new FMCv will need a unique IP address of course, and I believe you will need to use the "configure manager edit" command on each FTD and point them to the new FMCv IP. As long as they are on 7.0+, I believe this will also be seamless and not cause any interruption. You should have a pending deploy once it begins to talk to the new FMCv.