There are two way of doing it.
First-one
setting up a HA pair of FTD appliance to a new FMC without breaking the HA can be done by following step/guileless are below.
make your your new FMC is configured properly, means take the back up from old FMC and restore it into new FMC. I believe you using the same version of FMC for old one and new FMC.
Configure HA on the new FMC using the same settings from the old FMC (For Example, HA mode, HA interface, failover link configuration) as the old FMC. This will establish HA communication between the FMC and the FTD devices.
Configure the HA interfaces setting on the FTD devices to match the settings on the new FMC. This include the assigning the same IP address/es, configuring the HA mode, and establishing communication with the new FMC. (setting IP address for FTD must be same as it was in old FMC).
Disconnect the FTD devices from the old FMC, this can be acheived by unregistering the FTD appliances from the old FMC. This will sever the HA connection between the old FMC and the FTD devices.
Last step connect the FTD appliances to the new FMC (by registering it) the FTD with the new FMC using the MGMT IP address of the new FMC appliance. This will establish a new HA connection between the FTD appliance and the new FMC.
Either from GUI or From the CLI of the FTD you can verify HA status. Go to Monitor the HA status on the FTD devices to see that the new HA connection is established successfully. Check the synchronization status, failover capabilities.
Second one
Note: This one a similar and tested case I did in past.
You need to Break the HA-Pair,
-
Prior to breaking the HA, ensure that the FTD Primary is active and the FTD Secondary is in standby mode. This will ensure uninterrupted service during the migration process.
-
Break the HA configuration in the old FMC. After breaking the HA, the Primary FTD will continue operating in the production network, serving traffic, while the secondary FTD will be out of service. You can delete this standby FTD, which will become a standalone device, from the old FMC.
-
Take the secondary FTD that was deleted from the old FMC and register it with the new FMC.
-
Before pushing the policy from the new FMC to the FTD, it is essential to shut down all data-plane interfaces. Please remember that static routes are not automatically pushed from the restore backup, so you will need to define them manually. Keep the management interface active, as it is used to push FMC policies to the FTD. This step ensures that the FTD on the old FMC remains in production and avoids having two units with the same configuration without HA.
-
Once the policy, NAT rules, and ACE entries are pushed from the new FMC to the FTD, perform a switchover. This can be done by shutting down the interfaces of the FTD from the old FMC. Alternatively, you can quickly shut down the interfaces from the switch side. However, please do not shut down the management interface.
-
Once the interfaces of the FTD are shut down from the old FMC (note: do not unregister the FTD yet on the old FMC), go to the new FMC-FTD and un-shut down the interfaces. At this point, both the new FMC and FTD are in production. It is crucial to check the monitoring and verify if the traffic is flowing as expected. In case of any issues, you can roll back by shutting down the interfaces again and bringing the old FMC-FTD back into production.
-
Check the monitoring and health alerts to ensure everything looks good. If all is well, you can proceed to create a new HA pair with the FTDs from the new FMC. Please remember to unregister the FTD from the old FMC before initiating this step.
Last Note. if this is a production network have a change control in place for this work.
please do not forget to rate.
