ASA to FTD Migration, manually migrate and HA mode

[yong khang NG]

Hi All

I would like to migrate a pair of legacy ASA replace with new ASA running in FTD 6.2.3

With no using any tools migrate the existing config (reconfig from scratch), i would like to know the sequence of setting up the FTD in HA.

This is my thought, please correct me

a. Should i create the object at the FMC,

b. or should i prep the single unit ASA in FDM (example object, access rules etc), ready second unit with minimal setting ready for HA. Then using FMC register both unit of ASA and let them sync up the config, in HA mode.

Will this propagate the object, access rules created before into FMC?

what is the correct way in doing this?

Noel

[Marvin Rhoads · Accepted solution]

Bootstrap both ASAs with FTD image using the initial cli-based setup. Then add both to FMC using "configure manager add..." command.

Once both appliances are successfully registered and licensed, add them as an HA pair in FMC. See Devices > Device Management > Add > High Availability.

Then proceed to do the normal configuration of objects, policies, platform settings, etc. deploy to the HA pair and everything will sync from FMC to the Active member of the pair (and then on from there to the Standby member).

You don't need to do anything from FDM. Indeed you shouldn't as it will be all wiped out by FMC.

[yong khang NG]

good one, thanks!