topic Migrating ASA to FTD in Network Security

Migrating ASA to FTD

dvalinho — Fri, 21 Feb 2020 16:49:14 GMT

Hello Cisco

My ASA is in Active/Standby and my Ftd boxes have to be in HA as well:

1)Is an FMC or FMCv mandatory to perform HA on FTD?

2)Do i need to configure HA on my FTD boxes before migrating the ASA Configuration? If not, Can the migrated file be uploaded on just one box then we configure HA for config sync?

3)Can i migrate the ASA configuration with the Migration Tool then export it from the Firepower Device Manager for each box?

4) Finally do i need any specific license?

Thanks for your return.

Re: Migrating ASA to FTD

Marvin Rhoads — Sun, 17 Feb 2019 03:41:10 GMT

1. As of release 6.3 you can now do High Availability with either FMC or the local firepower Device Manager (FDM).

2. You can configure either way - start with migrating to standalone and then make it HA or migrate direct to HA.

3. If you use the migration tool (vs. manual migration) then you have to use FMC.

4. No. Note that when in HA, each FTD device requires the relevant feature licenses such as Base, URL Filtering or Malware.

Re: Migrating ASA to FTD

dvalinho — Fri, 22 Feb 2019 09:23:28 GMT

Thanks Marvin for your return, it is helpful.

Let's say i go for the manual migration from ASA-X to FTD 4100. Do i need to collect VPN Pre-shared keys or other keys or can I just copy and paste from the old config file?

Re: Migrating ASA to FTD

Marvin Rhoads — Fri, 22 Feb 2019 10:25:40 GMT

For VPN pre-shared keys you need to have them in plain text. You can retrieve them from the ASA if you get the running-config using the command:

more system:running-config

If your ASA is using a CA-signed certificate that will have to be rehosted on the new appliances. Unless you have the original private key used (e.g. if you used OpenSSL to create the original CSR) or made it exportable when you first created it, you will have to regenerate a CSR and get the CA to issue the certificate.

Re: Migrating ASA to FTD

dvalinho — Mon, 25 Feb 2019 15:45:51 GMT

Thank you so much.

One last question, can the FMCv can do the same job the FMC do(in regard to the migration tool)??

Re: Migrating ASA to FTD

Marvin Rhoads — Mon, 25 Feb 2019 16:11:50 GMT

FMCv vs. FMC physical appliance are equivalent with respect to migration tool functionality.

The physical appliances can themselves be configured as HA and have increased scalability (for managing more sensors and ingesting and storing more events). Other than that, they are functionally equivalent.

Re: Migrating ASA to FTD

dvalinho — Tue, 26 Feb 2019 06:21:38 GMT

Thanks.