• Firepower Management Center Virtual for VMware
• Firepower Management Center Virtual for KVM

• Cisco Firepower Management Center Virtual for VMware Deployment Quick Start Guide

• Cisco Firepower Management Center Virtual for KVM Deployment Quick Start Guide

sudo su -

enableMigrationTool.pl

The commands you use to save this configuration may differ depending on the version of your ASA device. For more information, see the version-appropriate ASA configuration guide, as listed in the ASA documentation roadmap at http:/​/​www.cisco.com/​c/​en/​us/​td/​docs/​security/​asa/​roadmap/​asaroadmap.html#pgfId-126642.

• Prefilter Policy—Converts the access rules to prefilter rules.
• Access Control Policy—Converts the access rules to access control rules.

• Fastpath—Exempts matching traffic from all further inspection and control, including access control, identity requirements, and rate limiting. Fastpathing a tunnel fastpaths all encapsulated connections.
• Analyze—Allows traffic to continue to be analyzed by the rest of access control. If passed by access control and any related deep inspection, this traffic may also be rate limited.

• Trust—Allows traffic to pass without deep inspection or network discovery. Trusted traffic is still subject to authentication requirements imposed by an identity policy, and to rate limiting.
• Allow—Allows matching traffic to pass. Allowed traffic is still subject to authentication requirements imposed by an identity policy, to rate limiting, and to deep inspection (if configured).

The migration task is listed as the top message, because only migration tool tasks can be run on the intermediary Firepower Management Center.

• Click Download .sfo to copy the converted file to your local computer.
• Click Migration Report to view the Migration Report.

The Migration Report summarizes which ASA configurations the migration tool could or could not successfully convert to Firepower Threat Defense configurations. Unsuccessfully converted configurations include:

• ASA configurations that are not supported in the Firepower System

• ASA configurations that are supported in the Firepower System (that have Firepower equivalents) but that the migration tool does not convert

For unsuccessfully converted configurations that have Firepower equivalents, you can manually add them after you import the converted policies onto your production Firepower Management Center.

• Resolve conflicts in the configuration; see Import Conflict Resolution in Firepower Management Center Configuration Guide.
• Replicate how rules were grouped by interface in the original ASA configuration, or replace that group association with a new one. To do so, you must assign access control rules to security zones, and prefilter or NAT rules to interface groups, as follows:

  Type	Source	Choose This Zone or Group If:
  System-generated security zones/interface group	The migration tool automatically creates this security zone/interface group during conversion.	You want to replicate how the rules were grouped by interface in the original ASA configuration.
  Security zones/interface group created prior to importing converted ASA configuration	You create this security zone/interface group prior to importing the converted ASA configuration.	You want to associate the rules with a security zone/interface group that already exists on the Firepower Management Center.
  Security zone/interface group created on-the-fly during the import process	You create this security zone/interface group by choosing New... from the drop-down list next to the rule set.	You want to associate the rules with a new security zone/interface group on the Firepower Management Center.

  Tip	Use the arrow next to a rule set to expand additional information about the set.

  Note

  The migration tool does not convert interface configurations; you must manually add devices and configure the interfaces on those devices after importing the converted ASA configuration. However, this import step allows you to retain the association between the ACL or NAT policy and a single entity (a security zone or interface group) that you can quickly associate with an interface on the new Firepower Threat Defense device. For more information on associating security zones/interface groups with interfaces, see Configure the Migrated Policies.

• Optionally, tune the rules in the policy by enabling or editing disabled rules, adding rules, removing rules, and changing rule order. For example, you might want to edit any rules that specify either different source and destination protocols or multiple protocols; see Access Rules that Specify Multiple Protocols.
• Optionally, configure the Firepower equivalents for ASA parameters that tool does not convert:

  Access Rule Parameter	Access Control Rule Parameter
  User	Selected Users condition
  Security Group (Source)	custom SGT condition

• Assign the access control policy to the Firepower Threat Defense device.

• Optionally, tune the rules in the policy by enabling or editing disabled rules, adding rules, removing rules, and changing rule order. For example, you might want to edit any rules that specify either different source and destination protocols or multiple protocols; see Access Rules that Specify Multiple Protocols.
• Optionally, configure the Firepower equivalents for ASA parameters that the tool does not convert:

  Access Rule Parameter	Prefilter Rule Parameter
  User	Selected Users condition
  Security Group (Source)	custom SGT condition

• Configure the new access control policy that the system created during conversion, or associate the prefilter policy with a different access control policy.

  Warning

  The migration tool sets the default action for the migrated access control policy to Block All Traffic, which is the equivalent of an implicit deny in an ACL. If you use a different access control policy with your migrated prefilter policy, consider setting its default action to Block All Traffic. Otherwise, you may create a security hole.

• Assign the associated access control policy to the Firepower Threat Defense device.

• Optionally, tune the rules in the policy by enabling or editing disabled rules, adding rules, removing rules, and changing rule order.
• Assign the NAT policy to the Firepower Threat Defense device.