ASA to FTD migration

[rushispace]

hey there i am trying to migrate my old ASA Cluster firewall to a new FTD via FMC using FTM tool so i tried a demo for the same with same configuration on FTM however FTM gives me error for interface

there is total 113 Logical Interfaces like 'interface Port-channel10.197' this

error:

Blocked

FTD 3110 has only 16 physical interfaces available but the source configuration has 84 interfaces. Please choose a different FTD device to proceed.

[MHM Cisco World · Accepted solution]

https://www.cisco.com/c/en/us/td/docs/security/firepower/migration-tool/migration-guide/ASA2FTD-with-FP-Migration-Tool.html

this migration tool 

MHM

[rushispace]

so as per the documentation we need to create interface, port-channel manually right ?

/

• During migration, the Secure Firewall migration tool resets the interface configuration. If you use these interfaces in policies, the Secure Firewall migration tool cannot reset them and hence the migration fails.

• The Secure Firewall migration tool can create subinterfaces on the native instance of the threat defense device based on the ASA configuration. Manually create interfaces and port channel interfaces on the target threat defense device before starting migration. For example, if your ASA configuration is assigned with the following interfaces and port channels, you must create them on the target threat defense device before the migration:

  • Five physical interfaces

  • Five port channels

  • Two management-only interfaces

[Ruben Cocheno · Accepted solution]

@rushispace 

You will need to create the Port-Channels and Subinterfaces on the FTD, and use the tool again to perform the mapping.

[Marvin Rhoads · Accepted solution]

It depends on how you onboarded the 3110 into FMC. If you are managing the chassis from FMC (vs. just the native FTD instance) then you will need to first create portchannels. The subinterfaces should auto-create. I just did a migration that's similar but I had onboarded the native FTD (and not the 3110 chassis). The target interface portchannel and associated subinterfaces auto-created in that case (based on the physical interface mapping I did in the migration tool)

[rushispace]

Thanks every one !! actually we need to create a basic port-channel interface eg. po-ch10 and then migration tool will create sub interface on the bases of vlan taging