Migrate from FTD 2140 to 3110

[Arun2022]

Hi Experts,

I am looking for some options to migrate and FTD 2140 managed by an existing FMC over to a new FTD 3110 which will be managed by a new FMC.

I've been having a look at the migration tool and I see that all the options are only form FDM managed and not an appliance that is already managed by an FMC.

I am having a look at the CDO as well.

Any suggestions are much appreciated.

[Milos_Jovanovic · Accepted solution]

Hi @Arun2022,

FMT is designed to migrate non-FTD/FMC device to FMC. Migration from FMC to FMC should be much simpler.

What I would do (in high level) would be:

• Do backup/restore or policies export from existing FMC and import it to new FMC. This would give you all necessary policies and objects that are currently in use. Make sure to export all relevant policies which are in use currently on existing FPR2140.
• Do initial device registration of new FPR3100 and recommended SW upgrades/patches.
• Configure manually device configuration on new FPR3100 (e.g. interfaces, zone assignment, routes, etc.), but keep new interfaces in shutdown state (you don't want conflicts on the network).
• Apply relevant policies to new FPR3100 devices and you are ready for migration (interfaces shut on existing FPR2100, and unshut on FPR3100).

Kind regards,

Milos

[Arun2022]

Thanks @Milos_Jovanovic, I appreciate your quick response. In an FMC managed FTD is there any way to login to the appliance directly and take a backup of the config (like any other NGFW vendor). I believe this can be done only via external authentication and not using the local admin account. If I can obtain that config, I can still use FMT, upload the config file manually and push it onto the few FTD/FMC.

[Milos_Jovanovic]

Yes, you can SSH into device, either with local FTD credentials or with AAA account (depending on your setup, but both are possible technically) and issue "show running-config", as you would do it on ASA. You would get ASA-like output. However, I'm not confident that you could re-import that config into FMT again, as concepts are bit different on FTD then on ASA (there is no more interface specific ACL, rather just one, applied globally), so I'm not sure that it would work.

Kind regards,

Milos