Home
Support
Product Support
Security
Firewall Migration Manager
Install and Upgrade Guides

Migrating Cisco Secure Firewall ASA to Cisco Secure Firewall Threat Defense Using Firewall Migration Manager

View all Saved Content

PDF

Is this content helpful?

Helpful Unhelpful

Suggestions for Improvement

Thank you for your feedback. Your response has been recorded.

Ask about this content

Migrating Cisco Secure Firewall ASA to Cisco Secure Firewall Threat Defense Using Firewall Migration Manager

Expand all sections

About this content

About Firewall Migration Manager

Firewall Migration Manager overview
Features in Firewall Migration Manager
Default home page
How ASA to threat defense migration works

Migration Requirements

Licensing requirements
Platform requirements
Threat Defense device prerequisites for ASA migration
Supported ASA and Firewall Threat Defense platforms
Target Management Center requirements
Supported software versions for firewall migration
Supported, partially supported and unsupported configurations
Migration guidelines and limitations

Pre-migration Tasks

Download the Firewall Migration Manager
Obtain ASA configuration files
Export PKI certificates from ASA and import into Management Center
Retrieve AnyConnect packages and profiles

ASA to Threat Defense Migration Workflow

Run the migration
Upload ASA source configuration
Specify destination parameters
Map ASA configurations with Firewall Threat Defense interfaces
Map ASA interfaces to security zones, interface groups, and VRFs
Review and validate the migration configuration
Review the post-migration report

Migrating Cisco Secure Firewall ASA to Cisco Secure Firewall Threat Defense Using Firewall Migration Manager

Pre-migration Tasks

Updated: July 22, 2026

Guides users through essential preparatory steps including downloading Firewall Migration Manager application, gathering configuration files, and collecting certificates and packages needed before beginning the firewall migration process.

Download the Firewall Migration Manager

Learn how to download the Firewall Migration Manager for installation on your local Windows or macOS system. This topic also explains how to access the cloud-hosted version of the application through your Security Cloud Control tenant to begin migrating your firewall configurations.

Obtain ASA configuration files

Learn how to acquire ASA configuration files for migration to Secure Firewall by manually exporting the configuration or using the live connection method in the Firewall Migration Manager.

Export PKI certificates from ASA and import into Management Center

Configure the migration of certificate-based VPN from ASA to Management Center by exporting PKI certificates and importing them as PKI objects.

Retrieve AnyConnect packages and profiles

Configure AnyConnect packages and profiles retrieval from ASA devices to prepare for Remote Access VPN migration.

Need help?

Open a support case

(Requires a Cisco Service Contract)

Bias-free language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.