Firewall Migration Tool ignores ASA interface out ACL

[Network Diver]

Hi,

I'm trying migrate ASA 9.16 access-lists and objects using Firewall Migration Tool 7.0.1 to a FTD. So far only the access-lists defined by "access-group in interface" are migrated. All the ACLs "access-group out interface" are ignored.

access-group <ifname>_access_in in interface <ifname>
access-group <ifname>_access_out out interface <ifname>

Am I missing something? I haven't found an option in the migration tool to select also the interface out ACLs. Am I the only one who ever used ACLs matching interface outbound or is it yet another bug with ASA in multicontext mode? I would expect that the migration tools generates FTD rules with the interface as destination zone.

Regards,

Bernd

[Karsten Iwen · Accepted solution]

It works as intended (although not as expected). Only incoming and global ACLs are supported:

https://www.cisco.com/c/en/us/td/docs/security/firepower/migration-tool/migration-guide/ASA2FTD-with-FP-Migration-Tool/m-getting-started-with-the-secure-firewall-migration-tool.html#Cisco_Concept.dita_bae18839-883e-45ca-a86f-a30e271b0aeb

[Network Diver]

Create image: Cisco logo with a facepalm emoticon

CheatGPT won't win any of US spelling bee contests ...