Firepower Migration Tool Frequently Asked Questions
Q. |
What are the new features supported on the Firepower Migration Tool for Release 2.5? |
A. |
The following features are supported with release 2.5:
|
Q. |
What are the new features supported on the Firepower Migration Tool for Release 2.4? | ||||
A. |
The following ASA VPN configuration migration to Firepower Threat Defense (FTD):
|
||||
Q. |
What are the new features supported on the Firepower Migration Tool for Release 2.3.5? | ||||
A. |
The following features are supported with release 2.3.5:
|
||||
Q. |
What are the new features supported on the Firepower Migration Tool for Release 2.3.4? | ||||
A. |
The following features are supported with release 2.3.4:
|
||||
Q. |
What are the source and target platforms that the Firepower Migration Tool can migrate policy? | ||||
A. |
The Firepower Migration Tool can migrate policies from supported ASA platform to FTD platform. For more information, see Supported Source ASA Platforms. |
||||
Q. |
What are the tasks that you must perform in the Pre-Migration and Post-Migration Reports? | ||||
A. |
To perform the tasks as part of your plan for migrating from ASA to Firepower Threat Defense, see Migrating ASA to Firepower Threat Defense 2100 - An Example. |
||||
Q. |
What are the supported destination platforms versions? | ||||
A. |
You can use the Firepower Migration Tool to migrate an ASA configuration to the standalone or container instance of the Firepower Threat Defense platforms for FMC 6.2.3 or later. For more information on the list of supported devices, see Supported Target Firepower Threat Defense Platforms. |
||||
Q. |
What are the features the Firepower Migration Tool supports for migration? | ||||
A. |
The Firepower Migration Tool supports migration of L3/L4 ASA configuration to FTD. It also allows enabling L7 features like IPS, file policy, and so on, during the migration process. The Firepower Migration Tool can fully migrate the following ASA configurations:
|
||||
Q. |
What are the new features supported on the Firepower Migration Tool for Release 2.2? | ||||
A. |
The following features are supported with release 2.2:
|
||||
Q. |
What are the new features supported on the Firepower Migration Tool for Release 2.0? | ||||
A. |
The following features are supported with release 2.0:
|
||||
Q. |
Is there any dependency on FMC to use the new features introduced in the Firepower Migration Tool? | ||||
A. |
Yes. The following features are supported with target FMC 6.5 and later:
The following features are supported with target FMC 6.6 and later:
The following features are supported with target FMC 6.7 and later:
|
||||
Q. |
Can we migrate all the access rules in the source configuration to the Prefilter policy? | ||||
A. |
No. For migrations that are opted with Migrate Tunnel rules as Prefilter, the Firepower Migration Tool identifies tunneling protocol-based access rules and migrates them as tunnel rules. |
||||
Q. |
What are the features the Firepower Migration Tool does not migrate today? | ||||
A. |
The Firepower Migration Tool does not support the following ASA configurations for migration. If these configurations are supported in Firepower Management Center, you can configure them manually after the migration is complete.
For more information, see Guidelines and Limitations for ASA Configurations. |
||||
Q. |
What are the supported source devices and code version? | ||||
A. |
You can use the Firepower Migration Tool to migrate the configuration from single or multi-context ASA platforms (software version 8.4 or later). For more information on the list of devices, see Supported Source ASA Platforms. |
||||
Q. |
Does the Firepower Migration Tool support migration of multi-context ASA? | ||||
A. |
Yes. The Firepower Migration Tool can handle migration of multi-context ASA. At any given point in time, one can migrate one context of the ASA (except for System context) to either FTD container or native instances on the target FMC. |
||||
Q. |
What is the support mechanism if there are migration errors? | ||||
A. |
The Firepower Migration Tool is integrated with Cisco Success Network. If there are errors or issues, contact Cisco TAC. For troubleshooting, see Troubleshooting Migration Issues. |
||||
Q. |
How much time does the Firepower Migration Tool take to successfully migrate a configuration? | ||||
A. |
The time that is taken during migration depends on numerous factors like latency on network, load on FMC, config size, number of objects, ACL, and so on. In internal testing, it was observed that a config file of 2.0 MB with 7000+ Access Control List, 7000+ NAT Translations, and 3000+ Network Objects takes around 6 minutes to successfully complete the migration. |