Migrate from Cisco ASA (Active/Standby) to Firepower - Best Practices

[ravindra962]

Hello

I am about to migrate a Cisco ASA (Active Standby Cluster) to Firepower.

My ASA Cluster has L2L VPN Tunels (Policy based and Route Based) and Extended ACL's applied to different interfaces for Multiple Clients Traffic.

I am looking for Best Practices to do this migration so that it will have no impact on Production

Any Help here would be much appreciated.

Thanks

Ravi

[Rob Ingram]

Hi,

Have a look at the Firepower Migration tool, this will assist in migrating from ASA to Firepower.

https://www.cisco.com/c/en/us/products/security/firewalls/firepower-migration-tool.html

Beware FTD does NOT currently support route based VPNs, you can only use policy based.

HTH

[ravindra962]

When you say it doesn't support Route based VPN, do you mean the Migration Tool doesn't support the route based VPN or the firewall itself doesn't support route based VPN

[Rob Ingram]

The firewall (FTD) itself does not currently support route based VPNs, only policy based.

[ravindra962]

Is it Possible to Migrate the ASA code to Firepower without converting the ASA code to the Firepower code. Like a Cisco Firepower with ASA code

[Rob Ingram]

If you mean can you run ASA code on the Firepower hardware (1000, 2100, 4000 or 9300 series appliances) then yes you can run either ASA or FTD.

HTH

[ravindra962]

So if run the ASA code then that migration is pretty easy or is there any limitations for that as well? or any compatibility issues

[Rob Ingram]

If the existing firewall is an ASA HA pair then it should be a simple migration to the new ASA HA pair using the firepower hardware.

[ravindra962]

Thank you

This means there won't be any kind of configuration changes correct?

[Rob Ingram · Accepted solution]

Possibly the only thing I can thing of is the interfaces maybe different, so you'll have to investigate that.

Other than that you should be able to migrate the configuration. If you are using Pre-Shared Keys (PSK) then this is not displayed when you run "show run", so if you use the command "more system:running-config" this will display the PSK.

[ravindra962]

The Physical Interface Code for ASA will be changed to FXOS code.

The rest will be the same