topic Re: Migrate from Cisco ASA (Active/Standby) to Firepower - Best Practices in Network Security

Migrate from Cisco ASA (Active/Standby) to Firepower - Best Practices

ravindra962 — Fri, 21 Feb 2020 17:51:17 GMT

Hello

I am about to migrate a Cisco ASA (Active Standby Cluster) to Firepower.

My ASA Cluster has L2L VPN Tunels (Policy based and Route Based) and Extended ACL's applied to different interfaces for Multiple Clients Traffic.

I am looking for Best Practices to do this migration so that it will have no impact on Production

Any Help here would be much appreciated.

Thanks

Ravi

Re: Migrate from Cisco ASA (Active/Standby) to Firepower - Best Practices

Rob Ingram — Wed, 22 Jan 2020 14:00:01 GMT

Hi,

Have a look at the Firepower Migration tool, this will assist in migrating from ASA to Firepower.

https://www.cisco.com/c/en/us/products/security/firewalls/firepower-migration-tool.html

Beware FTD does NOT currently support route based VPNs, you can only use policy based.

HTH

Re: Migrate from Cisco ASA (Active/Standby) to Firepower - Best Practices

ravindra962 — Fri, 24 Jan 2020 16:09:27 GMT

When you say it doesn't support Route based VPN, do you mean the Migration Tool doesn't support the route based VPN or the firewall itself doesn't support route based VPN

Re: Migrate from Cisco ASA (Active/Standby) to Firepower - Best Practices

Rob Ingram — Fri, 24 Jan 2020 16:27:47 GMT

The firewall (FTD) itself does not currently support route based VPNs, only policy based.

Re: Migrate from Cisco ASA (Active/Standby) to Firepower - Best Practices

ravindra962 — Wed, 29 Jan 2020 14:43:18 GMT

Is it Possible to Migrate the ASA code to Firepower without converting the ASA code to the Firepower code. Like a Cisco Firepower with ASA code

Re: Migrate from Cisco ASA (Active/Standby) to Firepower - Best Practices

Rob Ingram — Wed, 29 Jan 2020 14:50:00 GMT

If you mean can you run ASA code on the Firepower hardware (1000, 2100, 4000 or 9300 series appliances) then yes you can run either ASA or FTD.

HTH

Re: Migrate from Cisco ASA (Active/Standby) to Firepower - Best Practices

ravindra962 — Wed, 29 Jan 2020 18:55:29 GMT

So if run the ASA code then that migration is pretty easy or is there any limitations for that as well? or any compatibility issues

Re: Migrate from Cisco ASA (Active/Standby) to Firepower - Best Practices

Rob Ingram — Wed, 29 Jan 2020 19:05:48 GMT

If the existing firewall is an ASA HA pair then it should be a simple migration to the new ASA HA pair using the firepower hardware.

Re: Migrate from Cisco ASA (Active/Standby) to Firepower - Best Practices

ravindra962 — Wed, 29 Jan 2020 19:23:51 GMT

Thank you

This means there won't be any kind of configuration changes correct?

Re: Migrate from Cisco ASA (Active/Standby) to Firepower - Best Practices

Rob Ingram — Wed, 29 Jan 2020 19:28:06 GMT

Possibly the only thing I can thing of is the interfaces maybe different, so you'll have to investigate that.

Other than that you should be able to migrate the configuration. If you are using Pre-Shared Keys (PSK) then this is not displayed when you run "show run", so if you use the command "more system:running-config" this will display the PSK.

Re: Migrate from Cisco ASA (Active/Standby) to Firepower - Best Practices

ravindra962 — Wed, 29 Jan 2020 20:54:03 GMT

The Physical Interface Code for ASA will be changed to FXOS code.

The rest will be the same