Cisco ASA 5525 Migration to FPR-1140

[uadmin]

Hello,

We have a pair of Cisco ASA 5525-X and would like to migrate them to Cisco FPR-1140's.

I started the migration and ended up at this screen:

My intention was to set up a virtual FMC but I am not sure what version would satisfy my ASA units.

Furthermore, do I need a Cisco Firepower license to actually migrate these or not?

[Torbjørn]

Hello @uadmin,

You need to refer to the following doc to find which versions are compatible: https://www.cisco.com/c/en/us/td/docs/security/secure-firewall/compatibility/management-center-compatibility.html 

I don't believe firepower/threatdefence licenses for your old firewalls is required for the purpose of migrating to the new firewalls(it would be odd to have to renew licenses for hardware you are replacing). I would however check this with your account manager. Good luck! 

[uadmin]

Thank you.  That was helpful.

It seems we need entitlement to download the FCM, so we are working on that.  If I have further questions, I will post.

[Marvin Rhoads]

The FMC which is required for use of the Migration Tool on-prem is a licensed product which should be installed (and ideally have onboarded the new 1140s) prior to running the tool. The version should be the latest suggested release that's compatible with your managed FTDs. (At the time of this writing that would be version 7.4.2.2, so you would install FMC 7.4.2 and then patch it to 7.4.2.2.)

[uadmin]

Marvin,

Thank you, very helpful.   I did check the Interop guide and was under the impression I would need version 7.0.7

[Marvin Rhoads]

That table indicates than an FMC 1000 (hardware appliances) maxes out at version 7.0.x.

Virtual FMCs can run any release, subject only to compatibility with the managed devices. i.e., this table: https://www.cisco.com/c/en/us/td/docs/security/secure-firewall/compatibility/management-center-compatibility.html#device-management-onprem