moving nat rules from asa to fmc?

[baselzind]

i need to move asa 5520 9.1(7)11 config onto fmc , for the natting i have many natting rules on the asa that doesnt change the source or destination ip and im puzzled whether i need to move them or not into fmc?

[Marvin Rhoads]

Those would most likely be identity NAT (also known as NAT exemption) rules. They typically continue to be needed as they exempt traffic from a more general NAT rule later in the config.

[Puneesh Chhabra]

If you do not have any overlapping NATs, you do not need to put the NAT exempts.  For migration process and other caveats, you can go through the documentation for FTD migration tool:

https://www.cisco.com/c/en/us/td/docs/security/firepower/migration-tool/migration-guide/ASA2FTD-with-FP-Migration-Tool/b_Migration_Guide_ASA2FTD_chapter_00.html

Regards,

Puneesh

Please rate helpful posts

[Alessandro Roberto Alves]

Will you migrate from ASA to FTD too?

If so, yes, you will need to move the NATs to the FMC. You can use Cisco's own Firepower Migration Tool to migrate settings.

Hope this helps.