I need to migrate a virtual Firepower Management Center to a physical Firepower Management Center

[Edgar Machado]

I need to migrate a virtual Firepower Management Center to a physical Firepower Management Center (Version 6.2.0-362 / Patch-6.2.0.1-59.sh)

Per documentation the backup/restore procedure is not recommended.

http://www.cisco.com/c/en/us/td/docs/security/firepower/610/configuration/guide/fpmc-config-guide-v61/backup_and_restore.html#ID-2200-00000297

"Do not restore backups created on virtual Firepower Management Centers to physical Firepower Management Centers — this may stress system resources."

 So, do we need to follow the export/import procedure?

 We've tried this procedure in a lab environment:

- Update physical FMC to the same Patch than Virtual

- Export configuration on virtual FMC

- Import configuration on physical FMC

- Disabled the HA on virtual FMC

- Desassociate both FTDs from virtual FMC

- Associate both FTDs on physical FMC

 We noticed that the static routes and NATs are not imported in export/import procedure, both configuration disappears from FTD after associate on physical FMC.

 The customer doesn't want downtime, is this the right procedure? Is there any way to keep static routes and NAT?

[Marvin Rhoads]

I'd recommend opening a TAC case on this one.

The static routes and NATs not transferring sounds like a bug.

Even with that resolved, I'm pretty sure there is going to be downtime involved.

[ivanradevradev_]

You gonna have some downtime. Event with import export features it is difficult to have 0 downtime migration. 

Once you start importing the policies to the new FMC, you need to associate the zones from you ACP rules with interfaces. This means you need to connect your FTDs before policy import. If you have identity policy, than you should do the integration before the policy import because ACP rules are using identities from external sources. 

NAT and routing are features without export functions. It is expected (but not pleasant) behavior. 

Since Firepower 6.3 FTD could be backuped. My suggestion is to create backup of the sensors with all the policies they have(routing, NAT, interface conf, flexconfig, etc), and then revert the backup from the new FMC. You cannot revert a backup of FMCv to FMC hardware, but FTD backup is just for the FTD, whatever is the FMC managing it. 

I suppose Edgar did this long time ago, but I am sharing my thought for the rest interested. 

And call TAC only you are facing an issue. If you need assistance for migration, than advanced services is the team you need. Or third party Firepower experts like me :P