Migration Strategies and Best Practices Firewall Migration Tool

Good morning, everyone, and thank you for joining us today. My name is Neeraj Kumar and I am a customer success specialist here at Cisco within the CX organization.00:10My role focuses on helping customers to maximize the value of the Cisco technology investments. As a part of customer success team, we work closely with our customers to understand their business and technical objectives and drive adoption of Cisco solutions and provide strategic guidance and best practices.00:21Our goal is to ensure that you are able to fully leverage the capabilities of our Cisco platforms and achieve measurable business outcomes. Now before we begin, I would like to introduce my colleagues who has joined the session today. We have Visalachi.00:39She's also customer success specialist and she'll be guiding us through the demo portion later in this session today. We are also joined by Sonu, Suresh and Shikar. They are also customer success specialist and will be serving as our panelists for today's discussion.00:56Thank you again for being here and let's get started.01:13So today's agenda is structured to walk you through the key stages involved in a successful firewall migration. We'll begin with the firewall migration tool overview, where we'll briefly introduce the tool.01:40And explain how it helps to simplify and automate firewall migrations. Next, we will discuss the planning migration tasks. This section focuses on how to properly prepare for a migration covering important considerations such as environment readiness, policy review, and defining the migration appropriate.01:53Approach. From there, we will move on to performing the migration task, where we'll outline the steps involved in executing the migration itself and also highlight any best practices to ensure a smooth transition.02:13After that, we'll cover the post migration tasks which are critical for validating the deployment, confirming policy behavior and ensuring the environment is operational as expected. Finally, we will conclude with a live demonstration where we'll walk you through the migration workflow and show how the.02:27Process works in practice.02:47Let us now take a closer look at the migration strategy overview. In this section, we'll walk you through the key components that form the effective migration strategy. A successful firewall migration typically involves careful preparation, a well defined execution plan, and proper validation.02:53After the transition.03:13We'll focus on the importance of structured planning, which includes understanding the existing environment, reviewing security policies, and identifying any dependencies that could impact the migration. Let us see the different management options 1st that are available for managing the Cisco.03:15Firewall platforms, which are depending on the deployment size, architecture, and operational requirements. Starting on the left, we have the security cloud control. This was previously known as Cisco defense orchestrator.03:35This is a cloud based centralized management platform that can manage both ACs and FTD devices. It is typically used for organizations looking for cloud native management and simplified multi device administration. Next is the FMC itself, which provides centralized on premise.03:49This Management specifically for the FTD devices.04:09It offers advanced capabilities such as policy management, threat intelligence integration, event monitoring, and detailed reporting. Moving to the firewall device manager. This is an on box management interface that is used to directly manage the firewall. It is commonly used for smaller deployments or a single.04:12Device environment where centralized management may not be required. And finally we have the ASDM, which is the local on box manager for the ASA firewall, which is also similar to the FDM. It provides on device on device configuration and monitoring capabilities. So in summary I would say we offer both centralized and.04:32Non box management options that allows the organizations to choose the model that.04:52Best fits their scale, operational model, and the security management requirements. Let's explore the migration parts that are supported by the firewall migration tool. The tool supports several migration scenarios depending upon the existing firewall platform.04:57One common path is migrating from Cisco ASA firewall to the secure firewall threat defense, allowing organizations to transition from our traditional firewall functionality to a next generation firewall platform with advanced threat protection.05:17Another supported scenario is migrating from ASA with firepower services, where the existing ASA device running the firepower modules is converted into a fully integrated threat defense deployment. The tool also supports migration from firepower device manager managed devices to the FMC.05:34Managed devices enabling centralized management and policy control.05:53In addition, the migration tool can assist with migrations from several 3rd party firewall platforms such such as checkpoint, Palo Alto, Fortinet, that can help translate existing policies and objects into a format which is compatible with Cisco secure firewall.05:58Let us look at some of the key capabilities of the firewall migration tool that can help you simplify and streamline the migration process. The 1st is reporting. The tool provides detailed pre migration and post migration reports allowing administrator.06:19To review the configurations before the migration and validate the results afterwards. It also maintains live logs throughout the migration process that can help you better visibility and troubleshooting. In additions.06:39Configurations can be reviewed and adjusted during the migration with built in error handling to help you identify any issues resolve the issues gracefully. The next is automation. The tool automates the migration of the key configuration elements such as access control list, NAT, network objects.06:54FQDN objects etc. It also supports automatic interface mapping and provides options for selective migration, allowing administrators to migrate only the configurations required for their environment.07:14Finally, there is scalability and integration. The tool leverages FMC REST APIs enabling efficient interaction with the firewall management center. It can be accessed through a browser based interface using Chrome on Windows or a Mac system. And it also integrates with CDO for centralized management.07:28And orchestration.07:47In this section, we look at the broader concept of migration from a holistic perspective, focusing on the integration of people, process and technology. Successful migrations are not driven by tools alone. They require the right people, including network and security teams.07:51Who understand the existing environment and the desired security outcomes?08:09Their expertise ensures that the migration is planned and executed correctly. Next are the processes. The structured approach which is used to plan, validate and execute the migration. This includes tasks such as configuration review, policy validation, change management, and.08:13Post migration verification to ensure the environment continues to operate as expected. And finally, we have the programs or the tools such as the firewall migration tool, which will help to automate the configuration translation, reduce manual effort, and improve the migration accuracy.08:33By aligning people, process and technologies, organizations can ensure a smoother transition. So when we talk about the firewall migration, the 1st thing I will always emphasize is the documentation. A successful migration.08:51Rarely starts with tools. It starts with having a clear and a comprehensive migration document. The 1st part of that document is understanding the current environment. That means capturing the existing firewall configuration in detail like access control policies, nats, et cetera.09:11These elements define how traffic is being controlled today. So documenting them accurately is essential before moving to any new platform. 2nd step is defining the target environment. This includes destination firewall platform like the hardware model and the software version that you are planning to deploy.09:31It should also capture the management center architecture. E.g., whether the environment will be centrally managed using the.09:51FMC or you are going to the security cloud control or CDO. Finally, the document should also include both high level and low level design plans. The high level design outlines the overall security architecture and migration strategy, whereas the low level design defines exactly.09:58How the policies interface and network services will be implemented on the new firewall. When you bring these pieces together, the current state, the target platform, and the design architecture.10:18You create a clear roadmap that significantly reduces the risk and enables a smooth and control firewall migration. When we look at executing a successful firewall migration, it is helpful to follow a structured five stage strategy. This framework ensures.10:29Is that the migration is controlled, predictable, and minimizes any kind of operational risk.10:49The 1st stage is discovery. This is where we access the current environment and understand the requirements. It includes reviewing the existing firewall configurations, policies, network topology, and identifying any dependencies that could impact the migration. 2nd stage is the strategy based on the dis.10:55Discovered insights, we finally, we finalized the migration design and the step by step procedure. At this stage, we define the rollback plan also and the contingency options to ensure there's a clear recovery path if needed.11:15The 3rd stage is execution. This is where the actual migration takes place, implementing the planned configuration changes and carefully documenting each step to maintain visibility and control throughout the process.11:30The 4th stage is support. So after the migration is completed, our focus shifts on monitoring the environment and addressing any technical issues or unexpected behavior that may arise. And finally, the 5th stage is completion.11:45This includes a formal handover validation of the new environment and a post migration review to capture lessons, learn and ensure best practices were followed. Let us focus on the key steps involved in planning and preparing for a successful firewall upgrade. The 1st.12:00App is performing thorough compatibility checks. This means validating that the target software version is supported.12:20On the existing hardware platform and confirming compatibility across the entire security ecosystem. The management platform, licenses, integrations, and any kind of dependent services. Next are the pre migration activities. This includes tasks such as backing up the configuration.12:28Verifying system health, reviewing release notes and confirming that the current deployment meets the prerequisites required for the migration. And finally, it is critical to carefully schedule the maintenance window. Selecting the right time and communicating with the stakeholders ensures minimal business disruption.12:48Option.13:08While giving the team enough time to complete the upgrade and perform the validation. Let us now look at the compatibility checks required for a successful firewall migration. These checks are essential because they ensure the migration path is supported and technically feasible.13:09Before any changes are made.13:29The 1st step is identifying the supported source and the target hardware platforms. Many organizations migrate from legacy platforms such as Cisco ASA to modern next generation firewall platforms like Cisco firepower, fire firepower threat defense. Cisco's migration framework support supports a wide range of devices.13:31Including ASA models as well as newer platforms like Firepower 12100 4100 series and others.13:51Next, it is important to verify the supported software versions also. E.g., Cisco migration tool supports the configurations from ASA devices that are running on version eight.four or later while you perform the migration. Similarly, if you have a.14:00FDM, then you need to be on minimum of seven.two version to be able to perform the migration. Another key requirement is ensuring that the system used to run the migration utility meets the desktop environment requirements. The migration tool typically runs on systems such as windows ten, Windows eleven.14:17Mac OS ten.thirteen and later and requires a supported browser.14:38Let us now move on to the pre migration tasks, which are critical steps in preparing the environment before the actual migration begins. The 1st step is to collect the configuration from the existing firewall. Typically, this involves exporting the running configuration from the ASA or the current firewall.14:45The platform which you have. This configuration file contains policies, nat rules, network objects, and other things that will be later analyzed and translated during the migration process.15:05The next step is to review any migration limitations or unsupported features. So every migration tool has certain constraints. E.g., some legacy commands or configurations may not translate directly onto the next generation firewall policies. Identifying these early allows you to plan for.15:17For workarounds and avoid.15:37Surpasses during execution. The final step is preparing the target firewall environment. In many deployments, this means setting up the destination device running on FTD and registering the FMC with it. While the device setup can sometimes be completed later, having the target.15:39Environment ready in advance can significantly streamline the migration workflow. By completing these pre migration tasks, like collecting configuration, validating limitation, and preparing the target environment, you are going to establish a strong foundation.15:59That will help to ensure the migration proceeds smoothly and with the minimal risk. Here we'll take an example of the ASA configuration file. So let us have a look on how to obtain the current firewall configuration from ASA, which is a key input for the migration process. The most common approach.16:14Is using the CLI commands directly on the ASA. Commands such as show run or more system running config will allow you to retrieve the active configuration from the device.16:342nd command is particularly useful because it ensures the default settings are also included, which can be important when preparing the configuration for the migration. One important thing to remember is that sensitive values such as password are usually masked with with asterisks in the configuration output. In some cases.16:45Additional commands maybe required to display certain parameters in a readable format depending upon how the configuration was exported.17:05Once you have the configuration, there are two primary methods to provide it to the migration workflow or the migration tool. The 1st is a manual upload of the configuration where you will export the configuration file and upload it directly to the migration tool. 2nd method is directly, directly connecting to the ASA device, which allows the.17:14Migration tool to automatically retrieve this configuration. Now both approaches are supported.17:34But each requires the configuration to meet specific formatting and connectivity conditions to ensure the migration process runs smoothly. So when obtaining the configuration file for migration, it is important to follow a few key requirements to ensure the file can be properly processed by the.17:40The Migration tool. 1st, the configuration file must include the ASA software version information and it should ex and it should be exported from the ASA operating system either in single context mode or from a specific context if it is within a multi context environment. This will ensure the migration tool can correctly interpret the con.18:00Configuration structure. Second is the file format itself. It must meet certain standards. The configuration should be saved with a.CFG extension or a.txtension extension, and the file must use the UTF.18:20Encoding so that all the characters are interpreted correctly during the migration process. It is also important to make sure the configuration output is clean and complete. E.g., the file should not contain indicator, indicators such as-more prompt which appears during the CLI output. And the configuration.18:37Must be free of any kind of syntax errors.18:57Finally, the configuration file should not be manually edited or hand hand hand coded. Any manual modifications could introduce inconsistencies that may cause errors during the migration. You should follow these guidelines to ensure the configuration file is accurate.19:00Consistent and ready to be processed by the firewall migration tool. Now before starting the migration, it is important to understand the limitation on both source ASA and the target firewall platform. Identifying this constraint early helps avoid any kind of issues during the.19:17Migration process. Starting with the source device, let's say Cisco ASA, it may have certain configurations that are not fully supported during the migration. This can include elements such as dynamic routing protocol, specific VPN configurations, bridge group interface like BVI, and certain complex.19:37NAT rules. In many cases, this configuration may require manual review or adjustment when transitioning to the newer platform. On the target side, the destination firewall.19:57Running on firepowered thread defense must also meet certain requirements. E.g., during the migration process to the target device should typically be deployed as a standalone system, meaning it should not already be configured on high availability or.20:10Clustering. It is also important to ensure that the target device has sufficient interface capacity, including the required number of physical interfaces or port port interfaces that correspond to the interface used on the source firewall. So by understanding these limitations of both source and the target platform, you can proactively.20:26Plan the adjustments and ensure a smooth transition.20:46Now setting up the target firewall is technically optional, but it can also significantly streamline the migration process if it is prepared in advance. The 1st step is to bootstrap the target device running on the FTD. This involves performing the initial setup so that the device is operational.20:52And ready for integration with the FMC. Next, you need to establish the management connectivity.21:11Typically by registering your firewall with the firepower management center, this allows for centralized management of policies, objects, and configurations once the migration is complete. If the existing ASA deployment uses port channel interfaces, it is recommended to replicate those configurations on the time.21:18To get FTD to maintain the interface consistency during the migration.21:38Another important consideration is licensing. Ensure that the target firewall has appropriate licenses enabled for the features that will be migrated or used in the new environment. It's also a best practice to create a dedicated administrative user accounts specifically for the migration.21:45Workflow and to enable the FMC REST API, which will allow the migration tool to interact with the management platform efficiently.22:03As we move on to the migration phase, there are few key steps that help to ensure the process runs smoothly. The 1st step is executing the structured workflow within the firewall migration tool. This tool guides the migration process by importing the configuration.22:15From the ASA, analyzing the policies and translating them into the appropriate format which is understood by the target platform. During this process, the tool also generates a detailed pre migration report. This report is extremely valuable because it highlights how configurations will be translated anytime.22:34And it helps you to identify any elements that may require manual review or adjustments before you deploy it. As the migration process progresses, it is important to closely monitor the workflow as well to validate each step.22:54This includes reviewing any kind of warnings, checking for translation results and ensuring that the policies and network objects are mapped correctly. If any issues arise, engineers should leverage the available support documentation logs and troubleshooting resources to quickly identify and resolve the problems.23:09Let us now look at the initial steps for obtaining and preparing the migration utility. The 1st step is to download the latest build of the firewall migration tool. Using the latest version is important because it includes the most recent recent feature updates capability improvement.23:31Points.23:51And bug fixes which helps to ensure that the smoother migration experience. Once the tool is downloaded, the next step is to create a dedicated folder on your system specifically for the migration tool. This folder will store the application files, configuration inputs, logs, any kind of reports generated during the migration workflow.23:52It is recommended not to store any kind of unrelated files in this directory, keeping the folder clean and dedicated to the migration tool.24:12That can help them maintain the organization and makes it easier for the reviewing the logs and troubleshooting if needed. This simple preparation steps ensures that the tool environment is structured organized, and ready for use, which ultimately helps to streamline the migration process.24:19Another important capability to consider during the migration is the Cisco success telemetry. By enabling the success telemetry, the system can securely share operational insights with Cisco. This allows Cisco to collect relevant diagnostic and usage data as it occurs and helping the engineering team to detect prioritize.24:42And resolve potential problems more quickly. It is important to note that enabling telemetry is completely optional and organizations can decide based on their operational or compliance policies. However, many customers choose to enable it because it significantly improves the overall support and troubleshooting experience doing the complex activity.25:01It is like the migrations. By allowing better visibility into the environment, the Cisco success telemetry helps to ensure the migration process is smoother and faster to troubleshoot.25:21Let us walk through the workflow of this secure firewall migration tool, which provides a structured process to guide the entire migration. The workflow begins with accepting the end user license agreement through the Cisco success network. After which you will log in using your cco ID.25:37You select the source platform.25:56This could be devices like secured adaptive security appliance or it could be any other appliance from the 3rd party as well. Next, you import the source configuration, either by directly connecting to the device or manually uploading the configuration file. After that you define the target environment by connecting to.25:59FMC and selecting the appropriate policy model such as global or zone based access policies which have been coded. From there, the tool guides you through reviewing the translated configuration.26:19Mapping of the logical objects and aligning the interface objects with the physical interfaces on the target firewall. At this stage, the tool generates a pre migration report, highlighting any warnings or conflicts that needs to be addressed.26:31On those issues, once those issues are resolved, the configuration is pushed to the FMC and the migration is finalized. A post migration report is then generated to validate the results and confirm the success of the migration. Following the structured workflow ensures the migration is system.26:47Validated and significantly less error prone.27:07Let us now introduce an important component, which is the pre migration report. Within the firewall migration tool, the pre migration report plays a critical role in evaluating how ready the current environment is for migration. It provides a detailed analysis of the import.27:14Configuration and shows how the existing policies objects, and interface will be translated to the target platform. This report can also highlight unsupported configuration, any kind of warnings and potential conflicts that may need to be performing the manual adjustments before the migration can proceed.27:31So here we see an example of the pre migration report generated by the migration tool. To generate this report, the 1st step is selecting the target firewall device, typically running the firepower threat defense. Now once selected, the tool analyzes the important configuration and it will provide.27:52Give a summary of the key configuration elements. The summary elements will include ACLs, logical interfaces, NAT details, etc. The goal here is to give engineers a clear view of how the existing firewall configuration has been interpreted by the tool.28:10The report can also be downloaded for deeper analysis if needed. This can provide a detailed breakdown of the configuration translation and reviewing this document carefully is critical because it enables proactive troubleshooting and validation before pushing the configuration to the target environment.28:26So here we see an example of the detailed output from the pre migration report. This report provides several important piece of information that will help to validate the readiness of the migration. It begins with general metadata such as the collection method used to obtain the configuration and the details about the source file.28:45Firewall. Typically a Cisco ASA firewall, right? From there, the report presents a summary of supported configuration elements detected on in the imported configuration. This includes metrics such as the network objects, logical interface and other components that will be processed during the migration.29:05Another critical section is the access control policy analysis. Here the engineers can review the number of access control entries and confirm the required rules can be successfully translated to the target platform. So by carefully reviewing this detailed report, your teams can validate configuration readiness and proactively resolve any kind of issue.29:25It's for a smoother transition.29:44As we walk through the migration process, it is equally important to understand the support and troubleshooting resources that are available to you within the firewall migration tool. 1st, Cisco provides detailed documentation and knowledge resources that help explain the supported configuration, migration workflows, and known limitations.29:49These resources are extremely helpful when validating the configuration or resolving migration warnings. Another useful capacity capability is enhanced report storage.30:09Which allows engineers to review the detailed migration outputs and reports generated during the workflow. These reports provide visibility on how the configurations are interpreted and translated by the tool. And one of the most important troubleshooting resource is the support bundle.30:21This bundle allows you to download critical diagnostic data such as the log files, internal databases, and configuration information generated by the tool. These files can be analyzed internally or it can be shared with the tech team, you know, to assist in deeper troubleshooting. So by leveraging these resource.30:38Sources, you know, documentation detail reports as well as the support bundles.30:58Engineers who are doing the migration can quickly diagnose issues and ensure that any migration challenges are resolved efficiently. Finally, we'll go through the post migration steps which in which will include reviewing the post migration report, validating the migration was successful.31:02Full and performing any required maintenance window tasks.31:22So the post migration report is a critical validation step after the migration is completed. So once the configuration has been successfully pushed to the target environment by the migration tool, it generates a post migration report to provide a detailed summary of the migration outcome. This report helps to confirm that.31:29All supported configuration elements such as the access control policies, interface mapping, et cetera, has been successfully transferred to the newer environment.31:48Here we see the layout of the post migration report generated by the tool. This reports provides the visual summary of the migration results. The report typically includes status checks across key configuration categories as we see on the list.32:00If any configuration element encounters issues, this report is going to highlight them and provide a detailed summary explaining the problem. The full report can also be downloaded for deeper analysis and reviewing this report carefully ensures that the newer firewall environment is functioning as expected after the migration.32:17So let's take a deeper look at the sample report which we see on screen, which covers the final validation of the migration outcome. The summary presents a complete overview of all the migrated configurations. Along with the successful items, the report can also highlight any discrepancies.32:41Warnings or configurations that require manual attention or adjustments. These indicators help engineers quickly identify the areas that may need verification or further tweaking. By reviewing this report, your team can gain full visibility into the final migration state.32:59Ensuring that the policies and objects are operating as intended in the newer environment. Now that the migration is complete, the next critical step is validation, which ensures that the new firewall environment is operating as per the expectation. The 1st.33:18Thing is.33:38Verifying the access control policies, reviewing the rules carefully to confirm that the original access control logic from the ASA has been correctly translated and applied to the firewall management center. Next, validation of the NAT rules to ensure that the address mappings and translation logic are functioning correctly.33:39We should also review network objects, service object, and port definition to confirm that all objects were migrated accurately are being referenced by the referred policies. And another important step is verifying the interfaces and static route. Ensuring that the routing path and interface assignments match the.33:59Intended network design.34:18And finally, you can revisit the post migration report generated by the tool to confirm any unsupported or partially supported configurations. Completing these validation steps ensures that the integrity reliability and security posture of the migrated firewall environment.34:20Finally, once the migration and validation are complete, there are a few additional configuration that should also be reviewed to ensure the firewall environment is fully optimized. 1st, review the platform settings on the device running the firepower threat defense. This includes verifying.34:41The administrative access methods such as SSH and HTTPS ensuring that they are configured selectively and securely and aligned with the operational policies. Next, you need to check the syslog configuration. Proper logging is essential for monitoring and compliance. So make sure.34:59That the logs are being sent correctly to your destination logging or SIM system.35:19Another key step is reviewing the dynamic routing configuration. If routing protocols such as OSPF BGP are being used in your environment, they must be validated and configured correctly within the FMC. You should also review service policies ensuring inspection policies and.35:26Traffic handling behavior are aligned with the organization's security requirement.35:45Additionally, you have VPN configurations, which could be both side to side and remote access. They also must be thoroughly verified to ensure secure connectivity is functioning as expected. And finally configuring the connection logging settings to guarantee that the network activity is proper.35:51Fully audited and visible for troubleshooting and for security analysis.36:10Completing this post migration tasks helps to ensure the firewall environment is fully functional and ready for the production environment. Now let's move on to the most exciting part of today's session, which is the demo.36:15Over to you Vissalachi. Yep, thank you Neeraj and let me begin sharing my screen. So in today's demo, I'll be covering five major parts. The 1st part will be getting started with the FMT tool and 2nd part.36:31Is we'll be going through the FMT tool demo mode of migration and 3rd we'll see FMT tool real migration, and then we'll go through the release overview for the ten.O version and ten.O.one version. And at the end, we'll just look at a few best practices.36:51While using the FMT tool. So let's begin with the 1st part of the demo, which is getting started with the FMT tool. Okay, so I hope my screen is visible and let's get started.37:11So 1st, this step, and the 1st step is to download your FMT tool. So for that, let's navigate to Cisco software central. So software.cisco.com, just click on that and.37:31Yeah, here under the download and manage, let's go to access downloads under the download and upgrade section. So here let's type the product name which is firewall migration tool. So let me just type that.37:51So here we can see the latest release and all the release versions are available here. Let's go ahead with the latest version, which is the ten.O.one version for Windows platform that i'm using. I'll go ahead and download that. So it up.38:13Ask me to log in, let me log in.38:30Yeah, so here let me just close this. I'll go ahead again and click on the ten.O.one version, the latest one and download and accept the Cisco general terms, and here I can see it getting downloaded.38:53So I'll go ahead and open this file. Yep, and now I'll go ahead and run this application.39:19Let's just give a few seconds for the FMT tool to run.39:45Yep, so here we have the end user license agreement, we can just go through this and it's up to you if you want to enable Cisco success network or not according to your organization's policies and then let's go ahead and check the I have read the contents of this end user agreement and proceed.40:07So now it requires me to log in with my Cisco credentials.40:27Yeah, so here is the FMT tool. You can see the ten.O.one version and here you can select your source configuration, the your secure firewall vendor.40:48So here in case we see Cisco ASA eight or four plus version and here we see the pre migration instructions. So either you can do from the demo mode or in the real world you can directly implement it.41:06And here you can see the different vendor options that are provided here, which is ASA eight.four version and ASA running FTD six.six plus versions and so on. You can also have the like.41:25Migration from the FDM to FMC as well and other 3rd party firewalls like checkpoint, Fortinet, Microsoft Azure and Palo Alto networks. And here is the pre migration instructions, so here you can see all the required information.41:41You need before you begin the migration such as the stable IP connection, you need to know the FMC version and your FMC account and it's good to have your FTD, but it's optional.42:02So here you can see the rest of the configuration that is necessary before you go ahead with the migration. So let's just see for something like NFTM, so here you can again you can see the pre migration instructions for the FTM as well. So we.42:15You can go through that.42:35Yeah, now let's try for Cisco ASA eight.four plus version to migrate from that to an FTD.42:47So before we go ahead with, you know, migrating from the ASA to the FTD, let's look at the workflow, let's be aware of the workflow before we go ahead with that. So let me just go ahead and type Cisco secure firewall migration tool and yeah.43:03So here you can see, you can learn more about the migration use cases. So here you can learn how you can migrate from ASA to FMC and how you can migrate from ASA with FPS to FTD and also from FDM to FMC and 3rd party like checkpoint, Palo Alto et cetera.43:26And here you can see the key feature capabilities of the new version that is the one version. Here you can see the new features like emerging of configuration from multiple contacts to a single instant and you can also use the demo mode to perform your migration and.43:45The parsing has been enhanced in this version and you can also migrate from the FDM to FMC and other defects have been.44:05Better in this version, and on the right you can see all the key features that will always be migrated, like, the access rules, the static routes and other routes and site to site VPN and other VPNs. And below we can see the extensive support that is like the value added.44:15During migration. So in this new version, we have policy optimization, so you can remove any redundant access control rules that are there and you can selectively migrate only the required access control rules and you can reuse objects and all that. And you also get comprehensive pre migration.44:34And post migration reports from this FMT tool. And here you can see all the supported platforms like.44:54In the FMC and CDO and FDM ASA and ASA 5500 X series and other 3rd party firewalls that are supported. And, next, at the bottom here you can see the resources like Cisco secure firewall migration tool and the support documentation.45:02Got it. So here let's look at our use case migration that is ASA to the FMC, so let's go ahead and check on that. So let's get started with 1st the secure firewall migration tool.45:22So here you can go through these notes and let me let me just scroll through this and here you can see the version and the supported features here.45:42So e.g., here we can see in the ten.O.one version you can migrate from, you can now migrate the DHCP and DNS configurations using the FMT tool and now there is a migration support for the new 6100 series two and in the ten.O.one.45:59One version that's enhanced application mapping from 3rd party firewalls like checkpoint to FTD. And we also support a migration from like any small or medium businesses to the FTD.46:19And now also the tool does not display the attribute count in the past summary giving it a better look. And we also support the migration from the 5500 series to ftds of series thousand 2000 3000 4000 6009 9000 series. So.46:35Here you can see the version and the features of that version.46:55So now we have seen the getting started with the FMT tool. Now let's go ahead and look for our use case that is ASA to FTD migration workflow. So here we can see the end to end procedure. So 1st let we need to download the FMT tool just the same way that I showed you. And next on the.47:01ASA site, you need to obtain the config file from the ASA and you can also export the PKI certificates from the CLI and export any any connect packages and profiles from the CLI.47:21Then you can import the PKI certificates and any connect packages to the FMC. Next on the FMT tool, you need to upload the ASA config, so either you upload the ASA config or you have to connect to the live ASA from the FM.47:39Empty tool, then you need to specify the destination and the destination parameters and select the features that you want to migrate on the tool to the target FTD. In case you're migrating to the CDO, you need to specify that.47:59After you do that, you will review the pre pre migration report, you can download and review it from your FMT tool. And, next, after the pre migration report has been reviewed, we can go ahead with mapping the ASA configuration to the FTD configuration.48:14So 1st you'll map the interfaces of ASA to your FTD. Next you will go ahead and map your security zones from ASA, your security zones and interface groups to the FTD. After mapping all these, you will optimize and review your configuration.48:34And after your configuration has been validated on the tool, you will push this configuration from your FMT to your FMC.48:54And after it has been pushed successfully, you will be able to get a post migration report. You can go ahead and download that report. You can review the post migration report to see how how much of your configuration has been migrated and how much is partially migrated and a few configurations that.49:03Could not be migrated and you can go ahead and deploy the migrated configurations to your FTD.49:24So that is the workflow, that happens for this use case when you migrate from the ASA to the FTD. So you can like go through this. So here you can see there is two modes, the demo mode and the actual migration mode.49:31So in case you're in the demo mode and if you were in the middle of any migration, then your active migration might be lost if you choose with the demo mode, in case you like leave it and try if you want to go ahead and try the demo mode. And another one in demo mode is it lets you experience the whole.49:51The feature set of our FMT tool except for the last part that is pushing the configuration. So you can have like an end to end experience of how this tool is in the demo mode before you go ahead with your actual migration.50:11Yeah. So that was like getting started. Then we'll go ahead and see the next part which is the working of the FMT in the demo mode, so.50:31Okay, I hope my screen is visible, so this is the demo mode. So one of my migration was there so I'll just say yes that I want to leave it and here I'll click on the demo mode, the interactive demo mode. So it's in process. Here I will go ahead and upload the configuration.50:49File, that I got from my ASA. So I have a sample config ASA file. I'll go ahead and upload that here. You can also live live connect to the ASA device from by entering the management IP address here.51:09So for this case I've uploaded and next is you need to select the target. My target will be in the FMC and I choose the seven.four which is available for me in this demo mode here. I'll go ahead and click on connect.51:24And then we can see the ftds found. It is optional. If you want to go ahead with the FTD, it's good else you can If you want to go ahead with the FTD, you can select it else even proceed without it. And later you can go ahead and deploy your policies to the FTD.51:39Next is selecting the features that you want to migrate from the legacy or the 3rd party firewall to your FTD, so you can go ahead and select all the features like the device configuration or the shared configurations and advanced configurations, so here you have the options which you want to select. You can go ahead with that.51:56Next I'll click on proceed. Yep, so here I click on start conversion. Parsing is in progress. Yep, so it has successfully.52:17Converted to it has successfully created the pre migration report. I can go ahead and download this report before I go ahead with the migration, to check if there are any errors and what what is getting migrated, what is partially migrated and what will be fully migrated, so I can just go ahead and check on that. And here I.52:33Have a past summary of what is migrated. So here we can see the pre migration report and what are the ignored configurations and what are being.52:53Migrated the overall summary et cetera. Now let's go ahead and click on next. And here we need to do the mapping. So let's go ahead and map the ASA interface to the FTD interface. There have been auto mapped for me, so I'll go ahead and click on next now.53:04Next, we need to map the security zones and the interface groups. So in this case if you want, you can add here, you can add more security zones and interface groups if you want from this option and here if you want, we want to, you know, quickly select all these and you know, get it auto created, then I can just.53:25To go ahead and click on this auto create option where this FMT tool automatically maps the security zones and interface groups for me. So I'll go ahead and click on auto create.53:44So here it has been mapped. I go ahead and click on next. Yep, so here we can see my access control rules that I have. You can see the objects, the interfaces and routes. So let's go ahead with access control. So here we have the option to, you know, take any.53:57The Action here, so here I can select anyone and click on edit and.54:17Here I can just make some, something like a log at the end of the connection and confirm and save. So if I want to make any changes, I can make it here and save them. And in case I do not want to migrate or migrate as disabled, I could do that also from this.54:24Actions.54:43So after I've done all the required changes, I'll go ahead and click on optimize ACL. So this will take a few seconds usually, so let's just wait for that to happen. So it is in the optimized state. I'll go ahead and click on validate. So here we can see.54:46It's validated. So I'll go ahead and click on validate. So since this is remember that this is a demo mode, so we'll be able to go until only the validate stage until here. So until the demo demo mode is we can go to this validate stage.55:06And the last stage after this is to just push your configuration and after you push your configuration, you'll get your post migration report.55:26So let me just share that with you so here let's see e.g. a real world migration, so I'll go.55:35With an actual migration here and click on start migration for an eight.four plus version. So I go ahead and upload a sample ASA conflict file that I have.55:55And here, I'll give the FMC management IP that I've configured so it has connected successfully. Here it has found the FTD.56:12If I want I can go ahead and already select the FTD that I want or else I can proceed without the FTD and then go ahead and deploy it on my FMC after, the FTD is configured, so I could do that. And here I can select the features that I want to migrate and then I can click on start conversion.56:32So this complete and here I can download the report.56:52Next part after, getting your pre migration report, after you review it is to map your FTD interface since I didn't select it in this case, and I'll be deploying it later. So here, let's go ahead and map the next phase, which is mapping your security zone and interface groups. So I'll go ahead and do that.56:57So here I'll click on auto create so that gets automatically mapped. So that is done. Successfully done. So I'll go ahead and click on next. And yep, so here we have, few access control rules.57:18And we have similar actions. So if we want we can go ahead and perform some actions like here I'll click on edit.57:38And maybe I'll add like an intrusion policy in this case. It has NO intrusion policy added, so let me just go ahead and add some system provided policy like balanced security and connectivity, intrusion policy, and I'll save it.57:46It has been saved. So now I can go ahead and optimize the ACL or I can also directly validate. So let's just click on optimize. This will take a few seconds and I'll go to work and yep, after that is done, I'll go ahead and validate it.58:04Proceed to validation and this will take a few seconds to successfully validate it. So I'll go ahead and push this configuration, so I'll just proceed to push it to my FMC.58:25So here we can see it is hundred percent complete. The migration is complete to the FMC. So it has pushed to the FMC, and here I have the option to download my post migration report too.58:40So I can go ahead and do that and I can open this up and see the device details, the migration summary, and, the shared configurations and the advanced configurations that were migrated, the few configurations that were ignored. So all of that can be seen here from this post migration report.59:00And after I've reviewed this report, I can go ahead and navigate to my FMC and see the migration has been successfully done. So let me just log in quickly. So yep, here I'll navigate to my policies and I'll go to access control.59:19Yep, so here I can see that I have my like FTD migration policy that was, you know, migrated from the FMT tool to my FMC now.59:41So here I can see the policies, I can see the inclusion policy was also saved and added here. So it has been successfully migrated to my FMC and the last part of it, I can just target it to an FTD and deploy these changes to my FTD.59:56So this is how I perf we perform the migration, using the FMT tool. Yeah, Thankshi. Let me just take over the control. All right, so for the next steps, we would like to invite you to participate in a survey from the CX.01:00:12Our customer experience. Your feedback is crucial in refining our content development and improving the customer offerings. This feedback helps us align our services with your expectations and needs and enhancing the overall customer journey with Cisco.01:00:32Okay thank you for attending today's webinar. Have a great day, and we look forward to engaging with you soon again.01:00:49