Unable to change the FTDv model using configure-model.sh

[chandrasekarp]

I am in the process of migrating FTD 4110 configuration (version 7.0.4) to FTD 3120 (version 7.2.8) that is managed by FMC 2500 (this manages multiple FTD instances). New FMC is 2700 (version 7.4.0). FTD 3120 will be soon managed by FMC 2700 once migration is complete.

This is not a normal migration process, as only one FTD instance (FTD 4110 configuration (version 7.0.4)) will be migrated to FTD 3120 (version 7.2.8) and will be managed with the new FMC 2700.

I am trying to backup the config of the FTD 4110 and upload to a temporary FTDv (version 7.0.4), and upgrade the version to 7.2.8. Now I can backup the config from the upgraded version of FTDv and move it to FTD 3120 (version 7.2.8) through FMC 2700.

While setting up the FTDv, I had to change the model using the script /var/sf/etc/model-info/configure-model.sh. Post model change, the FTDv reboots in a loop with "Switching to runlevel: 6" error after the memory check. I don't see any workaround to fix the VM part for me to upload the backup and upgrade the software.

Any help would be appreciated.

[Marvin Rhoads]

I'm not sure what's going on with your FMC, but 4100 series to 3100 series is not currently a supported migration path, no matter what you manage to do with the FMC. This will change in the next major release of FMC (post-7.7), but that won't be out until late this year (2025).

[chandrasekarp]

Is there any other means or a workaround for migration to work on the above scenario?

Like...

Run the below on the source device:

system support diagnostic-cli

enable(press enter)

show running-config

and copy the running-config on the destination device?

[Marvin Rhoads]

No. You cannot migrate a running-config directly.

You can use it as a guide to recreate parts of a new config manually, but it will normally have references to objects which are database entries and not plain text. That's why a migration tool / wizard is needed.

[chandrasekarp]

Can I use the model migration wizard for migrating 4100 to 3100?

https://www.cisco.com/c/en/us/td/docs/security/secure-firewall/migration/threat-defense/b_secure-firewall-threat-defense-model-migration.html

[chandrasekarp]

Is there any means or a workaround for migration to work on the above scenario?

Like...

Run the below on the source device:

system support diagnostic-cli

enable(press enter)

show running-config

and copy the running-config on the destination device?

[Marius Gunnerud]

If you feel comfortable with Python, you could create a script that fetches the configuration from the 4110 using API and then use the extracted information to configure the 3120, also using API.

[chandrasekarp]

Thank you for directing me in the right way.

Before I explore the API way, is it possible to use the model migration wizard to migrate 4100 to 3100?

Ref:    https://www.cisco.com/c/en/us/td/docs/security/secure-firewall/migration/threat-defense/b_secure-firewall-threat-defense-model-migration.html

[Marvin Rhoads · Accepted solution]

4100 to 3100 series is not currently a supported path in the wizard. I had mentioned this already in my 5 May reply. If your interface, routing etc. is a basic setup, it is easy enough to manually recreate on the new device and then just re-target the Access Control, NAT and VPN configurations directly from FMC.