Firepower Migration Tool not working, 0 FTDs found

[mhmservice]

Hi

Im tryiong to build a proof of concept for migrating our ASA firewalls to Firepower

I've installed the Firepower Migration Tool, but when I connect to the FMC it says "0 FTDs found", even though I have an FTD added to my FMC

Any help greatly appreciated as I have no idea where to start with troubleshooting this

[Greg Smalley]

I believe the migration tool requires FTD devices to be at least 6.2.3.

Regards,

Greg Smalley

[mhmservice]

I upgraded the firepower module on the FW but no luck, same error. I completely reimaged and reinstalled the FMC and firepower module on the ASA but still no luck :( hours wasted ... do you know how I can further troubleshoot this?

[Greg Smalley · Accepted solution]

6.2.3 is the required version of FTD for the migration tool.  Just to verify you are using the FTD image and not the ASA code with Firepower Sensor?  The new migration tool does not support ASA w/Firepower, only the Firepower Threat Defense images.

[mhmservice]

Yes that was it, thanks, I totally misunderstood the requirements for the firepower migration tool. I flashed the firewall with the FTD image instead of ASA and it worked fine. This whole product line is very confusing with multiple different migration tools, firewall firmwares ... thanks for your help.

[Greg Smalley]

Typically, with ASA w/ Sourcefire sensor, you would keep the rules you have on the ASA, redirect all traffic to the Sourcefire module via a policy, and create a single ACP rule to inspect all traffic. You can later get more granular with the traffic you are inspecting, however that is a good jumping off point. If you decide to go the FTD route, you would migrate all the rules to an ACP policy. Just be aware that certain things are not supported on FTD such as different LDAP group profiles for Remote Access VPN.

[Igor.Dyakonov]

   Hi, 

In case if there is no FTD registered with FMC at all can we still somehow proceed to migrate ACL, NAT, route without apply them to any FTD?

We still have no any FTD because we will reimage first ASA  to FTD  next week.  We just wanted to gain some time and start to migrate and configure some objects, routes and ACL, NAT policies on FMC. 

Is it viable with 0 FTD on FMC? Both, FTD and FMC are 6.3.0.

Thank You.