Home
Support
Product Support
Security
Firewall Migration Manager
Install and Upgrade Guides

Migrating Cisco Secure Firewall ASA to Cisco Secure Firewall Threat Defense Using Firewall Migration Manager

View all Saved Content

PDF

Is this content helpful?

Helpful Unhelpful

Suggestions for Improvement

Thank you for your feedback. Your response has been recorded.

Ask about this content

Migrating Cisco Secure Firewall ASA to Cisco Secure Firewall Threat Defense Using Firewall Migration Manager

Expand all sections

About this content

About Firewall Migration Manager

About Firewall Migration Manager
Features in Firewall Migration Manager
Default home page
How ASA to threat defense migration works

Migration Requirements

Licensing requirements for Firewall Migration Manager
Platform requirements for Firewall Migration Manager
Threat Defense device prerequisites for ASA migration
Supported ASA and Threat Defense platforms
Supported target Management Center for migration
Supported software versions
Supported, partially supported and unsupported configurations
Migration guidelines and limitations

Pre-migration Tasks

Download the Firewall Migration Manager
Obtain ASA configuration files
Export PKI certificates from ASA and import into Management Center
Retrieve AnyConnect packages and profiles

ASA to Threat Defense Migration Workflow

Run the migration
Upload ASA source configuration
Specify destination parameters
Map ASA configurations with Firewall Threat Defense interfaces
Map ASA interfaces to security zones, interface groups, and VRFs
Review and validate the migration configuration
Review the post-migration report

Migrating Cisco Secure Firewall ASA to Cisco Secure Firewall Threat Defense Using Firewall Migration Manager

Pre-migration Tasks

Updated: July 22, 2026

Guides users through essential preparatory steps including downloading Firewall Migration Manager application, gathering configuration files, and collecting certificates and packages needed before beginning the firewall migration process.

Download the Firewall Migration Manager

This section describes how to download the Firewall Migration Manager application.

Obtain ASA configuration files

Lists the supported methods for acquiring ASA configuration files from your device.

Export PKI certificates from ASA and import into Management Center

Configure the migration of certificate-based VPN from ASA to Management Center by exporting PKI certificates and importing them as PKI objects.

Retrieve AnyConnect packages and profiles

Configure AnyConnect packages and profiles retrieval from ASA devices to prepare for Remote Access VPN migration.

Need help?

Open a support case

(Requires a Cisco Service Contract)

Bias-free language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.