Can FMC running in vsphere be migrated to AWS?

[m1xed0s]

I plan to migrate a FMC running in vsphere to AWS. Initially I plan to: 1. Build the FMC in AWS as brand new; 2. Backup the existing FMC (running v7 already) and then restore the backup in AWS FMC; 3. Login to AWS FMC serial console to change the MGMT IP address.

But after reading the FMC migration guide below, I am not too sure my planned process would work…

https://www.cisco.com/c/en/us/td/docs/security/firepower/fmc_model_migration/b_FMC_Model_Migration_Guide.html 

It shows Azure is not supported but what about AWS? From the guide, the supported migration path doesn’t seem support FMCv as the target no matter what is the source model…

So if I read the guide correctly, will I have to do policy export and import in order have the configuration migrated? Plus I donot know if the AWS ec2 serial console would work for FMC instance…

[balaji.bandi]

I have done deployment in AWS, as per document you get console :

https://www.cisco.com/c/en/us/td/docs/security/firepower/quick_start/fmcv/fpmc-virtual/fpmc-virtual-aws.html#id_71276

Your steps seem to reasonable, you need to the same version, register FTD with the new FMC, before you remove OLD one.

[m1xed0s]

Cool! It is mainly the migration path doc confused me…

so the way to access the AWS FMC serial console would the same as other Linux based EC2 instance?

[balaji.bandi]

I believe you get the ability of the same to do the task.

[Marvin Rhoads · Accepted solution]

You can temporarily "fool" the Firepower Model Migration Tool by configuring the target FMCv in AWS as a hardware model - an FMC 1600- for example. There is a script that you can run to do this. Run it as root: /var/sf/etc/model-info/configure-model.sh, change the model of the AWS FMC to FMC 1600 and import the backup. After that, rerun the script and revert it to the FMCv for AWS.

root@firepower:/var/sf/backup# /var/sf/etc/model-info/configure-model.sh 

To reset this Cisco Firepower Management Center for VMware to a new model the Cisco Firepower Management Center for VMware
will be stopped and rebooted.

Stop the Cisco Firepower Management Center for VMware to configure new model and reboot? [y/n] y
Stopping Cisco Firepower Management Center for VMware......ok
Please select the model to configure to:

 1) Cisco_Firepower_Management_Center_for_VMware
 2) Cisco_Firepower_Management_Center_for_AWS
 3) Cisco_Firepower_Management_Center_for_KVM
 4) Cisco_Firepower_Management_Center_1000
 5) Cisco_Firepower_Management_Center_2500
 6) Cisco_Firepower_Management_Center_4500
 7) Cisco_Firepower_Management_Center_1600
  Cisco_Firepower_Management_Center_2600
 9) Cisco_Firepower_Management_Center_4600
10) Cisco_Firepower_Management_Center_for_Azure
11) Cisco_Firepower_Management_Center_for_GCP
12) Cisco_Firepower_Management_Center_for_VMWare_300
13) Cisco_Firepower_Management_Center_for_OCI
14) Cisco_Firepower_Management_Center_for_OpenStack
Please select model configure to: 7

Configuring for Cisco Firepower Management Center 1600.

Proceeding with reboot of new Cisco Firepower Management Center 1600.


Broadcast message from root@firepower (pts/0) (Wed Mar  9 14:12:08 2022):

The system is going down for reboot NOW!
root@firepower:/var/sf/backup# 

[m1xed0s]

Thanks, will give it a try.

[m1xed0s]

@Marvin Rhoads If I set the FMC model to be something else other than the FMCv for AWS, say I set it to FMCv for VMware. Wouldnt I be able to just simply restore my backup captured from the FMC running in VMware?

[Marvin Rhoads]

Possibly, but I've never tried that.

On the other hand, I have used the method I suggested successfully on two different FMCs in the past month.

[m1xed0s]

Thanks for the confirmation!

[bill.whelan]

Will this method work when migrating from an FMC 1000 to FMCv?

[Marvin Rhoads]

@bill.whelan yes it will.

[Freemen]

which mean i can "fool" a FMCv10 as FMCv300 for achieve my migration from FMC2500 to FMCv? 

Cisco Secure Firewall Management Center Model Migration Guide - About Secure Firewall Management Center Model Migration [Cisco Secure Firewall Management Center] - Cisco

[Marvin Rhoads]

@Freemen yes - that is correct. Once you are able to migrate using that work around, revert the new FMC to its actual model.

[rayumang]

I have tried this approached but after uploading the backup file, I cannot reach the AWS FMC. Sorry but I am just new to this. Read also that you need to access the console of the AWS to replace the management IP. How to do this? 

Appreciate the reply.

Thanks,

Don

[Marvin Rhoads]

You would have to log into the VM console in AWS and use the configure-network script as root user in expert mode to update the FMC management address.

sudo /usr/local/sf/bin/configure-network