Verify that the ASA device meets the requirements for configuration migration; see ASA Device Requirements.

Identify the access control lists (ACLs) and NAT policies you want to export.

Prune as many inessential rules from the configuration as possible. Cisco recommends that you reduce the complexity and size of your ASA configuration as much as possible prior to conversion. To determine how many entries are present in the ACL:

show access-list acl_name | i elements

Download one of the following images from Support:

• Firepower Management Center Virtual for VMware
• Firepower Management Center Virtual for KVM

Use the image file to install a dedicated Firepower Management Center Virtual, as described in the appropriate guide:

Connect to the Firepower Management Center via ssh, using the admin username.

Log in to the root shell:

sudo su -

Run the following command:

enableMigrationTool.pl

Save the configuration.

Transfer the saved configuration file to a location accessible from the migration tool (for example, your local computer or a shared drive on your network).

Direct your browser to https://hostname/. The hostname element corresponds to the host name of the dedicated Firepower Management Center Virtual where you installed the migration tool.

Log in as the admin user.

Choose System > Tools > Import/Export

Click Upload Package.

Click Browse, and choose the configuration file you exported from the ASA.

Click Next.

Choose the policy you want the system to use when converting access rules:

• Prefilter Policy—Converts the access rules to prefilter rules.
• Access Control Policy—Converts the access rules to access control rules.

If you chose Prefilter Policy, choose the action you want the system to assign for access rules with a Permit action:

• Fastpath—Exempts matching traffic from all further inspection and control, including access control, identity requirements, and rate limiting. Fastpathing a tunnel fastpaths all encapsulated connections.
• Analyze—Allows traffic to continue to be analyzed by the rest of access control. If passed by access control and any related deep inspection, this traffic may also be rate limited.

If you chose Access Control Policy, choose the action you want the system to assign rules with a Permit action:

• Trust—Allows traffic to pass without deep inspection or network discovery. Trusted traffic is still subject to authentication requirements imposed by an identity policy, and to rate limiting.
• Allow—Allows matching traffic to pass. Allowed traffic is still subject to authentication requirements imposed by an identity policy, to rate limiting, and to deep inspection (if configured).

Choose Next.

Click on the System Status icon to display the Message Center.

Click on the Tasks tab.

If the migration fails, review error messages in the appropriate logs; for more information, see Troubleshoot Conversion Failure.

If the migration is successful:

• Click Download .sfo to copy the converted file to your local computer.
• Click Migration Report to view the Migration Report.

Review the Migration Report.

On your production Firepower Management Center, choose System > Tools > Import/Export

Click Upload Package.

Click Choose File, and use browse to choose the appropriate .sfo file on your local computer.

Click Upload.

Choose which policies you want to import. Policies may include access control policies, prefilter policies, or NAT policies, depending on your earlier migration choices.

Click Import.

On the Import Conflict page:

• Resolve conflicts in the configuration; see Import Conflict Resolution in Firepower Management Center Configuration Guide.
• Replicate how rules were grouped by interface in the original ASA configuration, or replace that group association with a new one. To do so, you must assign access control rules to security zones, and prefilter or NAT rules to interface groups, as follows:

  Type	Source	Choose This Zone or Group If:
  System-generated security zones/interface group	The migration tool automatically creates this security zone/interface group during conversion.	You want to replicate how the rules were grouped by interface in the original ASA configuration.
  Security zones/interface group created prior to importing converted ASA configuration	You create this security zone/interface group prior to importing the converted ASA configuration.	You want to associate the rules with a security zone/interface group that already exists on the Firepower Management Center.
  Security zone/interface group created on-the-fly during the import process	You create this security zone/interface group by choosing New... from the drop-down list next to the rule set.	You want to associate the rules with a new security zone/interface group on the Firepower Management Center.

  Tip	Use the arrow next to a rule set to expand additional information about the set.

  Note

  The migration tool does not convert interface configurations; you must manually add devices and configure the interfaces on those devices after importing the converted ASA configuration. However, this import step allows you to retain the association between the ACL or NAT policy and a single entity (a security zone or interface group) that you can quickly associate with an interface on the new Firepower Threat Defense device. For more information on associating security zones/interface groups with interfaces, see Configure the Migrated Policies.

Click Import.

Click the System Status icon to display the Message Center.

Click the Tasks tab.

Click the link in the import task to download the import report.

Install Firepower Threat Defense using the appropriate Quick Start Guide, listed in the table below.

Assign the interfaces on the Firepower Threat Defense device to the security zones or interface groups created during the conversion process.

If you migrated the ASA access rules to an access control policy:

• Optionally, tune the rules in the policy by enabling or editing disabled rules, adding rules, removing rules, and changing rule order. For example, you might want to edit any rules that specify either different source and destination protocols or multiple protocols; see Access Rules that Specify Multiple Protocols.
• Optionally, configure the Firepower equivalents for ASA parameters that tool does not convert:

  Access Rule Parameter	Access Control Rule Parameter
  User	Selected Users condition
  Security Group (Source)	custom SGT condition

• Assign the access control policy to the Firepower Threat Defense device.

If you migrated the ASA access rules to a prefilter policy:

• Optionally, tune the rules in the policy by enabling or editing disabled rules, adding rules, removing rules, and changing rule order. For example, you might want to edit any rules that specify either different source and destination protocols or multiple protocols; see Access Rules that Specify Multiple Protocols.
• Optionally, configure the Firepower equivalents for ASA parameters that the tool does not convert:

  Access Rule Parameter	Prefilter Rule Parameter
  User	Selected Users condition
  Security Group (Source)	custom SGT condition

• Configure the new access control policy that the system created during conversion, or associate the prefilter policy with a different access control policy.

  Warning

  The migration tool sets the default action for the migrated access control policy to Block All Traffic, which is the equivalent of an implicit deny in an ACL. If you use a different access control policy with your migrated prefilter policy, consider setting its default action to Block All Traffic. Otherwise, you may create a security hole.

• Assign the associated access control policy to the Firepower Threat Defense device.

If you migrated a NAT policy:

• Optionally, tune the rules in the policy by enabling or editing disabled rules, adding rules, removing rules, and changing rule order.
• Assign the NAT policy to the Firepower Threat Defense device.

Optionally, configure next-generation firewall features, including application visibility and control, intrusion protection, URL filtering, and Advanced Malware Protection (AMP).

Deploy configuration changes; see Deploy Configuration Changes.