Moving HA 4115 FTD to new FMC

[gihernandezn91]

Hi

Im tasked to move an HA 4115 FTD to a new FMC. We are going from Physical to Virtual so sadly this does not comply with the supported fmc model migration path shown here:

https://www.cisco.com/c/en/us/td/docs/security/firepower/fmc_model_migration/b_FMC_Model_Migration_Guide/about_fmc_model_migration.html#id_111597

Instead I would need to break HA and join the secondary FTD to the new FMC and configure manually the interfaces and routes. This is based in the following post:

https://community.cisco.com/t5/security-blogs/firepower-threat-defense-ftd-migrations-from-one-fmc-to-another/ba-p/3956939

Just to be clear im not missing anything. This firewalls contains over 20 site to site vpns and several anyconnect portals. Does this migration include re-configuring these vpns manually in the new FMC?

Thanks

[balaji.bandi]

what is the version of FMC and FTD running ?

[gihernandezn91]

7.0.4 both FMC/FTD

[balaji.bandi]

As per i know that is not support virtual to Azure and other 

My suggestion is to install the new appliance and configure it offline (if you looking to use the same IP address) - if a different IP address is easy for Migration.

Follow the below guides :

https://www.cisco.com/c/en/us/td/docs/security/firepower/fmc_model_migration/b_FMC_Model_Migration_Guide/migrate_your_fmc.html

https://antonioyan.wordpress.com/2021/10/05/how-to-migrate-fmc-to-a-new-hardware-appliance/

[gihernandezn91]

Thanks!

But these guides do not apply to my scenario since im migrating from pyshical to virtual. if it were from virtual to physical or to a higher capacity FMC it would work using the migration script.

[Marvin Rhoads]

There is a script on FMC that allows you to "fool" the system into thinking it is a different model. If you use that, you can then use the FMC model migration tool.

A couple of threads have previously described this method and I have used it personally a couple of times successfully.

https://community.cisco.com/t5/network-security/replace-old-fmc-2000-to-new-fmc-1600/m-p/4621736

https://community.cisco.com/t5/network-security/migration-from-vfmc-to-fmc-appliance/td-p/3680345

[gihernandezn91]

Thanks!

This is the workaround i was looking for.

But my original question still stands. If i were to migrate the FMC withhout using this script. Would I need to migrate all the vpn configuration manually?

[Marvin Rhoads]

You're welcome.

If you don't use the script you would indeed need to rebuild everything manually.

[balaji.bandi]

oh i was thinking other way around, as suggest @Marvin Rhoads  script should do your work.