ASA to FTD Migration

[akash.tiwari]

Dear Team,

Software Version

-ASA 5516X-9.9

-FTD(2140)-6.6

-FMC-6.6

-Migration Tool:2.3.5

Could you please help me out on below queries ?

-is SSL VPN or AnyConnect VPN is supported during Migration from ASA to FTD

-is SSL VPN's Object, NAT, ACL,certificates migrate ?

[Rob Ingram]

@akash.tiwari 

It doesn't appear that you can currently migrate RAVPN settings. A list of supported migrated features is here

https://www.cisco.com/c/en/us/td/docs/security/firepower/migration-tool/migration-guide/ASA2FTD-with-FP-Migration-Tool/ASA2FTD-with-FP-Migration-Tool_chapter_0111.html

From your lsit can migrate objects, NAT, access-lists. You should be able to manually export the certificates from the ASA and import to the FMC. Example.

HTH

[Marvin Rhoads]

You can export CA certificates but not generally identity certificate - that requires the device's private key to be usable.

I get the issuing CA to rekey the certificate based on either new CSR generated from FTD or one I generate from XCA. The latter is preferable so that I can combine the issued certificate with the private key and the certificate chain into FMC.