migration from FMC (2500) FMCv (VMware)

[J. H.]

Hi!

FMC2500 is going to be EoL soon so we've decided to migrate to FMCv instead, since we already have all the hardware we need in
our VMware datacenters.

Current setup:
2 x FMC2500 (in HA mode) v7.0.4(55).

New setup, migration to virtual machines in VMware:
FMCv v7.0.4(55).

Steps taken:
1. Installed the same version on FMCv in VMware as our older FMC2500. Version 7.0.4(55).
2. Made backup from FMC2500.
3. Uploaded the backup from FMC2500 to the FMCv.
4. Started RESTORE from the FMCv using the uploaded backup-file.
This gives the following error message: “Error: Product model mismatch”.
We also get the same error message when using the larger FMCv300 image instead (which is overpowered for our use case).

Have anyone else migrated from FMC to FMCv? Any tips on what to do?

Regards,
J.

[Marvin Rhoads · Accepted solution]

Yes. Please see my advice on doing a very similar migration here:

https://community.cisco.com/t5/network-security/can-fmc-running-in-vsphere-be-migrated-to-aws/td-p/4569305

[Fmoo]

Thanks Mavin, 

Is any further steps require after fooling the fmc and  restore the backup on target device ?
do we need migration tools ?

[Marvin Rhoads]

@Fmoo 

Use the model migration tool (in conjunction with the work around I already linked).

The tool is documented here:

https://www.cisco.com/c/en/us/td/docs/security/firepower/fmc_model_migration/b_FMC_Model_Migration_Guide/m_fmc_migration_workflow.html

[Fmoo]

@Marvin Rhoads 

After fooling the fmc I am still getting error message this error ''Restore will not be available: Product model mismatch'' while  i try to restore.

[Marvin Rhoads]

You should be using the model migration tool - not a straight restore. The script in the migration tool will allow restore onto a different model.

[Fmoo]

Thanks Marvin 

I just ran the script but i got an error message on standby with an error message '' Error restoring health metrics'' 
hardware is 2500 but i chose 2600 on vm   just to fool the migration tools 

[J. H.]

I changed the model to 2600 in our case and now the migration tool started to do its job.
Highly appreciated advice, thank you!

[Martin Ostberg]

We're trying to migrate a single FMC 2500 to FMCv-300. We have configured the new FMCv thinking it is a 2500. But when we try to run the migration script we get this.

> expert
admin@SVASFMC01:~$ sudo /var/sf/bin/sf-migration.pl /var/sf/backup/EUME01-FMC02-2024-09-23T11-28-38.tar
Password:
Untaring /var/sf/backup/EUME01-FMC02-2024-09-23T11-28-38.tar to read ims.conf
Source Model = Cisco Firepower Management Center 2500 Target Model = Cisco Firepower Management Center 2500
No migration path exists from the Cisco Firepower Management Center 2500 -> Cisco Firepower Management Center 2500

******************WARNING: Running this script will modify Management IP Address of this Firepower Management Center using configurations from backup file. Make sure that Firepower Management Center from where backup was taken, is disconnected from network to avoid IP conflict.*********************

Are you sure you want to continue (Y/N)Y
Migrating device . . . . . . . . . . . . . . . . . . . . . . . . . . . Aborting model migration since identified no valid migration path exists or the original TARGET modelid is missing for recovery. Please re-image the management center
admin@SVASFMC01:~$

Any ideas?

[Marvin Rhoads]

@Martin Ostberg the migration from FMC 2500 to FMCv300 (on VMware) is supported as-is. So there's no need to change the model of the FMCv300 to fool the tool. You only need that hack when migrating to an "unsupported" model.

See the following for directly supported migration paths:

https://www.cisco.com/c/en/us/td/docs/security/firepower/fmc_model_migration/b_FMC_Model_Migration_Guide/about_fmc_model_migration.html#id_111597