Step 1

On your computer, create a folder for the Secure Firewall migration tool.

Step 2

Browse to https://software.cisco.com/download/home/286306503/type and click Firewall Migration Tool.

Step 3

Download the most recent version of the Secure Firewall migration tool into the folder that you created.

Step 1

From the configuration bundle, copy the certificate payload (Value between -----BEGIN CERTIFICATE----- and -----END CERTIFICATE-----) and key (Value between -----BEGIN RSA PRIVATE KEY----- and -----END RSA PRIVATE KEY-----).

   "type":"identitywrapper",
   "action":"CREATE",
   "data":{
      "version":"girr7veykdjvx",
      "name":"RA_VPN_Cert",
      "cert":"-----BEGIN CERTIFICATE-----MIIF2zCCBMOgAwIBAgICHCUwDQYJKoZIhvcNAQEFBQAwfTELMAkGA1UEBhMCVVMxDjAMBgNVBAoTBUNpc2NvMS4wLAYDVQQDEyVtb2phdmUtcnNhLXJvb3QtMjA0OC1zaGEzODQuY2lzY28uY29tMS4wLAYDVQQDEyVtb2phdmUtcnNhLXJvb3QtMjA0OC1zaGEzODQuY2lzY28uY29tMB4XDTEyMDEwMTEyMDAwMFoXDTM0MDkwMTEyMDAwMFowWDELMAkGA1UEBhMCVVMxDjAMBgNVBAoTBUNpc2NvMSIwIAYDVQQDExlmZG0tcmEtdnBuLWNlcnQuY2lzY28uY29tMRUwEwYDVQQDEwwxNzIuMTYuMTAuNTAwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC6eJRuxth4wBmQxJAx+BxYWMaPp+ZXHlKve7FkUs1pxadqjr//PkFR8UecdtF7wwhktDnlVEAa5FHIf6MbuY44s6+vGBYwyYFy8i1XmfsZKJ6cvAIJ2JfXGaUYiOGTb5yMmqvnTLtcWqT3WHcoukCF+3AasWFm8o6KOzwBNtlQTCPrlivIuGdlEeH/SV3UBcKtxBV29X9t5uhA/GRkhtU1b1iZTNoY7RnHoifBWsOX8iqF50+fOo9M2BGB3N2a9SVU1/wJyjubAw6ssOw/pUs3DmNvV2BvEvwv6P47OMc9Mci3WcJJN65a7UxklpROdtVd8xrFxujFClgvX6bU7+atAgMBAAGjggKIMIIChDCBqQYDVR0jBIGhMIGegBQQO252P8pzlyZ1jzKLmz4OApQSu6GBgaR/MH0xCzAJBgNVBAYTAlVTMQ4wDAYDVQQKEwVDaXNjbzEuMCwGA1UEAxMlbW9qYXZlLXJzYS1yb290LTIwNDgtc2hhMzg0LmNpc2NvLmNvbTEuMCwGA1UEAxMlbW9qYXZlLXJzYS1yb290LTIwNDgtc2hhMzg0LmNpc2NvLmNvbYICBh0wTQYJYIZIAYb4QgEEBEAWPmh0dHA6Ly9tb2phdmUuY2lzY28uY29tL2NhL2NybC9tb2phdmUtcnNhLXJvb3QtMjA0OC1zaGEzODQuY3JsME8GA1UdHwRIMEYwRKBCoECGPmh0dHA6Ly9tb2phdmUuY2lzY28uY29tL2NhL2NybC9tb2phdmUtcnNhLXJvb3QtMjA0OC1zaGEzODQuY3JsMG4GCCsGAQUFBwEBBGIwYDBeBggrBgEFBQcwAoZSaHR0cDovL21vamF2ZS1yc2Etcm9vdC0yMDQ4LXNoYTM4NC5jaXNjby5jb20vY2EvY2EvbW9qYXZlLXJzYS1yb290LTIwNDgtc2hhMzg0LmNydDAwBgNVHRIEKTAngiVtb2phdmUtcnNhLXJvb3QtMjA0OC1zaGEzODQuY2lzY28uY29tMCQGA1UdEQQdMBuCGWZkbS1yYS12cG4tY2VydC5jaXNjby5jb20wDgYDVR0PAQH/BAQDAgOoMDEGA1UdJQQqMCgGCCsGAQUFBwMCBggrBgEFBQcDBQYIKwYBBQUHAwYGCCsGAQUFBwMBMAwGA1UdEwEB/wQCMAAwHQYDVR0OBBYEFEGzwcC8UpnjJsUqrTY/u9uAVS5iMA0GCSqGSIb3DQEBBQUAA4IBAQAN2lC4+jidtSI3pswUvW3X7hXn8WREaBgPWmAxSEXvJ7Wzz1btG3WgaBAAzl7GRcJpNvO1dbW2gnncdD0vyT/TqATdeRhZsLj/37w/asv2NhnNASEXE/4du1wp1fjbDZ4iFmm4tiEgjE5OsrCZUSgEWuVulY2YEvfBhx6kHcW2Y5IWRDwBUBi4+/TwmyNxphFIUpzXBCIJTfInuGz7SYpGitFUmn0fqAqrpRKRjlJCem6xGGFQkBPnVZhpUG3Lr+CGjiS8fXlxizFEuG6lorz1Cfw5n3q/wnNKIQAZYl8fZEHIP+Zpv18B60iY/qURM6CpWz+kz+D5KOl3hnx2fbIP-----END CERTIFICATE-----",
      "privateKey":"-----BEGIN RSA PRIVATE KEY-----MIIEpQIBAAKCAQEAuniUbsbYeMAZkMSQMfgcWFjGj6fmVx5Sr3uxZFLNacWnao6//z5BUfFHnHbRe8MIZLQ55VRAGuRRyH+jG7mOOLOvrxgWMMmBcvItV5n7GSienLwCCdiX1xmlGIjhk2+cjJqr50y7XFqk91h3KLpAhftwGrFhZvKOijs8ATbZUEwj65YryLhnZRHh/0ld1AXCrcQVdvV/beboQPxkZIbVNW9YmUzaGO0Zx6InwVrDl/IqhedPnzqPTNgRgdzdmvUlVNf8Cco7mwMOrLDsP6VLNw5jb1dgbxL8L+j+OzjHPTHIt1nCSTeuWu1MZJaUTnbVXfMaxcboxQpYL1+m1O/mrQIDAQABAoIBAQCPyftrkJnMQxVztJ8caR4yYgJ7NBVCiHdqKg+YNOGA9pEqcflLcU4dSdjWpijTLomCXhdm55inI/iMix/TeTpaLvUCJ6i05i2T3XtpWatuswvcAH3x6brsezH7wVFwx1gIdByqt1ii1qLuuKDqHvUyW7kOXEmngNK5dQPIS+s3JqzKkdEgLLl+/KZ+51tX3gARhNaLku5Ha7vgv6CKSDMwnBCAdUn7L3swjoBuHMqgcP4nzWGqoro1iu2Cl/LYm5emoezZ/K6MnJl/T8mMgfNi5weFzvI378XEeo+WpFL72yQTU4jAt0S4qxNJO/xExZMgPYmzkiMOelK1iPcmasBhAoGBAPFei+VkDZOW/RtewqF9z/B6acyJhYUfwDut+hGg5TobMwNTSzje+OOjEPcpjHlEbarCbVbLLJMSjoRhLDX2QSux3FFNcNs5xcNdVqjx8ZWcp23LnbYhZJiPrq+BIgGes4LZ8O3KS30b1qIKE5Sh737Z1tmLgGrf0oj6kSGOcWIbAoGBAMXGJdBKqShIMa7xLt1o2F6VZlIVjNzz7lOt0boDfu3FQeElEf1hDcA2l6s9kcgsEV+ATsOooSZKtvRwno2KxkqYcD3If8Bg29b7VipbyYM+7HqetTURkltrDnqRyWaBM+ip8aoLQza3u/L+e1ofh+fkb6/luDal+IsAobdT26bXAoGBAJIv7lEP6T0jrMa//OeseJ2wtpWAEVNQqLA8rgGxTkSEJsBz2VJnkZzlrafVDVSBQl6zBWAVDDlDevfolstUC6K4RbUkTx8n/YRW6t7GMsinqaxRL4MY9IGGPInlj0Al65lsAIU1CcWLb9KSgct6zMAqlfsKh8uzJiN6hx4o1LlTAoGAczk8Mpws7WESQSAW87vvwzs7f7s6dEhRo8LzG3KJ8rEn7qoQTxTKVB/6QTP/ySWTgZZZTTjjmlGRQdyTI1ekqzUgv34en9BOhHOuAcO0JZj1YYMxg5eXM1et+c8SDXxc58KLH0ysfiaRg8KrzxfrsDiwsUQfDQepRCK8FPjwUcUCgYEA1Kubk1Xb9/eXmXO9o1AN9w+1TeFn1p0Qqo2HRaCpYeZWBH8B9R+7przk4WW+uYxKNxxyD/riG6gLZ7j086jkYS5kpQIxJIq/grfs8mshwEEujLf1gyqAGWSawzh0DjPa7IPZQb2C/H5VJOh/X3ge+PUP3rEwKiCmHg6EyFzjbeE=-----END RSA PRIVATE KEY-----",
      "issuerCommonName":"mojave-rsa-root-2048-sha384.cisco.com, CN = mojave-rsa-root-2048-sha384.cisco.com",
      "issuerCountry":"US",
      "issuerOrganization":"Cisco",
      "subjectCommonName":"fdm-ra-vpn-cert.cisco.com, CN = 172.16.10.50",
      "subjectCountry":"US",
      "subjectDistinguishedName":" C = US, O = Cisco, CN = fdm-ra-vpn-cert.cisco.com, CN = 172.16.10.50",
      "subjectOrganization":"Cisco",
      "validityStartDate":"Jan  1 12:00:00 2012 GMT",
      "validityEndDate":"Sep  1 12:00:00 2034 GMT",
      "isSystemDefined":false,
      "keyType":"RSA",
      "keySize":2048,
      "allowWeakCert":false,
      "signatureHashType":"SHA1",
      "weakCertificate":true,
      "id":"9d0a8efb-01fa-11ed-8d7b-1f4809c453ac",
      "type":"internalcertificate"
   }
}

Step 2

Import the PKI certificate into the management center (ObjectManagement > PKIObjects).

Step 1

Check the packages available on the device manager to download.

curl -X GET --header 'Accept: application/json' '
 https://10.89.5.38/api/fdm/v6/object/anyconnectpackagefiles'

{
  "items": [
    {
      "version": "gx5yk7xkdsosu",
      "name": "anyconnect-win-4.10.02086-webdeploy-k9.pkg",
      "md5Checksum": "63e4a86fc7c68d7769b6a1b2976ffa73",
      "description": null,
      "diskFileName": "12f0988e-01fb-11ed-8d7b-07ecdd54c7bf.pkg",
      "platformType": "WINDOWS",
      "id": "133f2dbf-01fb-11ed-8d7b-89d64ab04e18",
      "type": "anyconnectpackagefile",
      "links": {
        "self": " https://10.89.5.38/api/fdm/v6/object/anyconnectpackagefiles/133f2dbf-01fb-11ed-8d7b-89d64ab04e18"
      }
    }
  ],
}

Step 2

Download the AnyConnect package.

curl -X GET --header 'Accept: application/octet-stream' 
' https://10.89.5.38/api/fdm/v6/action/downloaddiskfile/12f0988e-01fb-11ed-8d7b-07ecdd54c7bf.pkg'

Step 3

Check for available AnyConnect profiles on the device manager.

curl -X GET --header 'Accept: application/json' 
'https://10.196.155.3:12272/api/fdm/v6/object/anyconnectclientprofiles'

  "items": [
    
    {
      "version": "jqtwzirf36qke",
      "name": "AnyConnect_VPN_Profile",
      "md5Checksum": "e4ba581f84daec6f24c209f9f7f9e1fb",
      "description": null,
      "diskFileName": "1629395a-0384-11ed-8d7b-ab1a2a5ad583.xml",
      "anyConnectModuleType": "ANY_CONNECT_CLIENT_PROFILE",
      "id": "1754c10b-0384-11ed-8d7b-6b8e36ae1285",
      "type": "anyconnectclientprofile",
    }
  ]
}

Step 4

Download the AnyConnect profile.

curl -X GET --header 'Accept: application/octet-stream' 
'https://10.196.155.3:12272/api/fdm/v6/action/downloaddiskfile/1629395a-0384-11ed-8d7b-ab1a2a5ad583.xml'

Step 5

Import the downloaded packages to management center (ObjectManagement >) > VPN > AnyConnect File.

Step 1

On your computer, navigate to the folder where you downloaded the Secure Firewall migration tool.

Step 2

Do one of the following:

• On your Windows machine, double-click the Secure Firewall migration tool executable to launch it in a Google Chrome browser.

  If prompted, click Yes to allow the Secure Firewall migration tool to make changes to your system.

  The Secure Firewall migration tool creates and stores all related files in the folder where it resides, including the log and resources folders.

• On your Mac move, the Secure Firewall migration tool *.command file to the desired folder, launch the Terminal application, browse to the folder where the Secure Firewall migration tool is installed and run the following commands:

  # chmod 750 Firewall_Migration_Tool-version_number.command

  # ./Firewall_Migration_Tool-version_number.command

  The Secure Firewall migration tool creates and stores all related files in the folder where it resides, including the log and resources folders.

  Tip

  When you try to open the Secure Firewall migration tool, you get a warning dialog because the Secure Firewall migration tool is not registered with Apple by an identified developer. For information on opening an application from an unidentified developer, see Open an app from an unidentified developer.

  Note	Use MAC terminal zip method.

Step 3

On the End User License Agreement page, click I agree to share data with Cisco Success Network if you want to share telemetry information with Cisco, else click I'll do later.

Step 4

On the Secure Firewall migration tool's login page, do one of the following:

• To share statistics with Cisco Success Network, click the Login with CCO link to log in to your Cisco.com account using your single sign-on credentials. If you do not have a Cisco.com account, create it on the Cisco.com login page.

  Proceed to step 8, if you have used your Cisco.com account to log in.

• If you have deployed your firewall in an air-gapped network that does not have internet access, contact Cisco TAC to receive a build that works with administrator credentials. Note that this build does not send usage statistics to Cisco, and TAC can provide you the credentials.

Step 5

On the Reset Password page, enter the old password, your new password, and confirm the new password.

Step 6

Click Reset.

Step 7

Log in with the new password.

Step 8

Review the pre-migration checklist and make sure you have completed all the items listed.

Step 9

Click New Migration.

Step 10

On the Software Update Check screen, if you are not sure you are running the most recent version of the Secure Firewall migration tool, click the link to verify the version on Cisco.com.

Step 11

Click Proceed.

Step 1

Select the Source Firewall Vendor from the drop-down list and click Start Migration.

Step 2

Select the migration option by which you wish to migrate the FDM-managed device.

Step 1

On the Extract FDM Information screen, in the Manual Upload section, click Upload, to upload an FDM-managed configuration bundle. If the configuration bundle is encrypted, provide with the key on the text box for the Secure Firewall migration tool to decrypt the bundle.

Step 2

Browse to where the FDM-managed device configuration file is located and click Open.

Step 3

Click Start Parsing.

Step 4

Review the summary of the elements in the uploaded configuration file that the Secure Firewall migration tool detected and parsed.

Step 5

Click Next to select the target parameters.

Step 1

On the ExtractFDM Information screen, in the Connect to FDM section, click Connect to connect to the FDM-managed device that you want to migrate

Step 2

On the FDM Login screen, enter the following information:

Step 3

Review the summary of the elements that the Secure Firewall migration tool detected and parsed, from the FDM-managed device.

Step 4

Click Next, to select the target parameters.

Step 1

On the Select Target screen, in the Firewall Management section, do the following:

1. Click the On-Prem FMC radio button.

2. Enter the IP address or Fully-Qualified Domain Name (FQDN) for the management center.

3. In the Domain drop-down list, select the domain to which you are migrating.

   If you have selected Migrate Firepower Device Manager (Includes Device & Shared Configurations) to FTD Device (New Hardware), you can only migrate to the threat defense devices available in the selected domain.

4. Click Connect and proceed to Step 2.

1. Click the Cloud-delivered FMC radio button.

2. Choose the region and paste the Security Cloud Control API token. For generating the API token. from Security Cloud Control, follow the below steps:

   1. Log in to Security Cloud Control.

   2. From the top-right corner, navigate to Preferences > General Preferences and copy the API Token from My Tokens section.

3. Click Connect and proceed to Step 2.

Step 2

In the Firewall Management Center Login dialog box, enter the username and password of the dedicated account for the Secure Firewall migration tool, and click Login.

Step 3

Click Proceed.

Step 4

In the Choose FTD section, do one of the following:

• Click the Select FTD Device drop-down list and check the device where you want to migrate the FDM-managed device configuration.

  The devices in the selected management center domain are listed by IP Address, Name, Device Model, and Mode (routed or transparent).

  Note

  Only when the supported target threat defense platform is Firewall 1010 with management center version 6.5 or later.6.5, FDM 5505 migration support is applicable for shared policies and not for device specific policies. When you proceed without threat defense, the Secure Firewall migration tool will not push any configurations or the policies to the threat defense. Thus, interfaces and routes, and site-to-site VPN which are threat defense device-specific configurations will not be migrated. However, all the other supported configurations (shared policies and objects) such as NAT, ACLs, and port objects will be migrated. Remote Access VPN is a shared policy and can be migrated even without threat defense.

• Click Proceed without FTD to migrate the configuration to the management center.

  When you proceed without threat defense, the Secure Firewall migration tool will not push any configurations or the policies to threat defense. Thus, interfaces and routes, and site-to-site VPN which are threat defense device-specific configurations will not be migrated and need to be manually configured on management center. However, all the other supported configurations (shared policies and objects) such as NAT, ACLs, and port objects will be migrated. Remote Access VPN is a shared policy and can be migrated even without threat defense.

Step 5

Click Proceed.

Step 6

Click the Select Features section to review and select the features that you want to migrate to the destination.

• If you are migrating to a destination threat defense device, the Secure Firewall migration tool automatically selects the features available for migration from the FDM-managed device configuration in the Device Configuration and Shared Configuration sections. You can further modify the default selection, according to your requirements.
• If you are migrating to a management center, the Secure Firewall migration tool automatically selects the features available for migration from the FDM-managed device configuration in the Device Configuration, Shared Configuration, and Optimization sections. You can further modify the default selection, according to your requirements.

  Note	The Device Configuration section is not available if you have selected Migrate Firepower Device Manager (Shared Configurations Only).

• The Secure Firewall migration tool supports the following for access control during migration:

  • Populate Destination Security Zones—Enables mapping of destination zones for the ACL during migration.

    Route-lookup logic is limited to Static Routes and Connected Routes, whereas PBR, Dynamic Routes, and NAT are not considered. Interface network configuration is used to derive the connected route information.

    Based on the nature of Source and Destination network object-groups, this operation may result in rule explosion.

  • • Tailor Deep Inspection—For encapsulated traffic and to improve performance with fastpathing.

    • Improve Performance—You can fastpath or block any other connections that benefit from early handling.

    The Secure Firewall migration tool identifies the encapsulated tunnel traffic rules in source configuration and migrates them as Prefilter tunnel rules. You can verify the migrated tunnel rule under the Prefilter policy. The Prefilter policy is associated with the migrated access control policy on management center.

    The protocols which are migrated as Prefilter tunnel rules are following:

    • GRE (47)

    • IPv4 encapsulation (4)

    • IPv6 encapsulation (41)

    • Teredo Tunneling (UDP:3544)

    Note	If you do not opt to select the prefilter option, all the tunneled traffic rules will be migrated as unsupported rules.

    The ACL tunnel rules (GRE and IPnIP) in the FDM-managed device configuration are currently migrated as bidirectional by default. You can now specify the Rule direction for the destination as bidirectional or unidirectional in the access control state option.

• The Secure Firewall migration tool supports the following interfaces and objects for VPN Tunnel migration:

  • Policy-based (Crypto Map)—If the target management center and threat defense is version 6.6 or later.

  • Route-based (VTI)—If the target management center and threat defense is version 6.7 or later.

• The Secure Firewall migration tool supports migration of Remote Access VPN if the target management center is 7.2 or later. Remote Access VPN is a shared policy that can be migrated without threat defense. If migration is selected with threat defense, the threat defense version should be 7.0 or later.

• (Optional) In the Optimization section, select Migrate only referenced objects to migrate only those objects that are referenced in an access control policy and a NAT policy.

  Note	When you select this option, unreferenced objects in the FDM-managed device configuration will not be migrated. This optimizes migration time and cleans out unused objects from the configuration.

• (Optional) In the Optimization section, select Object group search for optimal memory utilization by access policy on threat defense.
• If you have platform settings, file, and malware policies on your source FDM-managed device, the migration tool displays them on the Select Features page as Platform Settings under Shared Configuration and File and Malware Policy under Device Configuration. Note that these checkboxes are selected by default.

Step 7

Click Proceed.

Step 8

In the Rule Conversion/ Process Config section, click Start Conversion to initiate the conversion.

Step 9

Review the summary of the elements that the Secure Firewall migration tool converted.

Step 10

Click Download Report and save the Pre-Migration Report.

Step 1

Navigate to where you downloaded the Pre-Migration Report.

Step 2

Open the Pre-Migration Report and carefully review its contents to identify any issues that can cause the migration to fail.

Step 3

If the Pre-Migration Report recommends corrective actions, complete those corrections on the interface, export the FDM-managed device configuration file again and upload the updated configuration file before proceeding.

Step 4

After your FDM-managed device configuration file is successfully uploaded and parsed, return to the Secure Firewall migration tool, and click Next to continue the migration.

Step 1

If you want to change an interface mapping, click the drop-down list in the FTD Interface Name and choose the interface that you want to map to that interface.

Step 2

When you have mapped each FDM-managed device interface to a threat defense interface, click Next.

Step 1

On the Map Security Zones and Interface Groups screen, review the available interfaces, security zones, and interface groups.

Step 2

To map interfaces to security zones and interface groups that exist in management center, or that is available in FDM-managed device configuration files as Security Zone type objects and is available in the drop-down list, do the following:

1. In the Security Zones column, choose the security zone for the interface.

2. In the Interface Groups column, choose the interface group for the interface.

Step 3

You can manually map or auto-create the security zones and interface groups.

Step 4

1. Click Add SZ & IG.

2. In the Add SZ & IG dialog box, click Add to add a new security zone or Interface Group.

3. Enter the security zone name in the Security Zone column. The maximum characters allowed is 48. Similarly, you can add an interface group.

4. Click Close.

1. Click Auto-Create.

2. In the Auto-Create dialog box, check one or both of Interface Groups and Zone Mapping.

3. Click Auto-Create.

Step 5

When you have mapped all interfaces to the appropriate security zones and interface groups, click Next.

Step 1

In the Validation Status dialog box, review the validation summary.

Step 2

Click Push Configuration to send the migrated FDM-managed device configuration to management center.

Step 3

After the migration is complete, click Download Report to download and save the post-migration report.

Step 4

If your migration failed, review the post-migration report, log file, and unparsed file carefully to understand what caused the failure.

Step 1

Navigate to where you downloaded the Post-Migration Report.

Step 2

Open the post-migration report and carefully review its contents to understand how your FDM-managed device configuration was migrated:

Step 3

Open the Pre-Migration Report and make a note of any FDM-managed device configuration items that you must migrate manually on the threat defense device.

Step 4

In management center, do the following:

1. Review the migrated configuration for the threat defense device to confirm that all expected rules and other configuration items, including the following, were migrated:

   • Access control lists (ACL)

   • Network Address Translation rules

   • Port and network objects

   • Routes

   • Interfaces

   • IP SLA objects

   • Object Group Search

   • Time-based objects

   • Site-to-Site VPN Tunnels

   • Dynamic Route objects

2. Configure all partially supported, unsupported, ignored, and disabled configuration items and rules that were not migrated.

   For information on how to configure these items and rules, see the Management Center Configuration Guide. The following are examples of configuration items that require manual configuration:

   • Platform settings, including SSH and HTTPS access, as described in Platform Settings for Threat Defense

   • Syslog settings, as described in Configure Syslog

   • Dynamic routing, as described in Routing Overview for Threat Defense

   • Service policies, as described in FlexConfig Policies

   • VPN configuration, as described in Threat Defense VPN

   • Connection log settings, as described in Connection Logging

   If you have changed the encryption of AD realm before migration, follow the below steps to revert the encryption type to LDAPS or STARTTLS:

   1. Navigate to Integration section and click Other Integrations.

   2. Select Realms and click Edit () next to the specific realm to change the encryption type.

   3. Click Directory and change the encryption type to LDAPS or STARTTLS.

   4. Save and deploy the changes.

Step 5

After you have completed your review, deploy the migrated configuration from management center to the threat defense device.

Step 1

Obtain the FDM-managed configuration or connect to FDM-managed device to fetch the configuration.

Step 2

Review the FDM-managed device configuration file.

Step 3

Deploy the Firepower 2100 series device in your network, connect the interfaces and power on the appliance.

Step 4

Register the Firepower 2100 series device to be managed by the management center.

Step 5

(Optional) If your source FDM-managed device configuration has port channels, create port channels (EtherChannels) on the target Firepower 2100 series device.

Step 6

Download and run the most recent version of the Secure Firewall migration tool from https://software.cisco.com/download/home/286306503/type.

Step 7

When you launch the Secure Firewall migration tool, and specify destination parameters, make sure that you select the Firepower 2100 series device that you registered to the management center.

Step 8

Map the FDM-managed device interfaces with the threat defense interfaces.

Step 9

While mapping logical interfaces to security zones, click Auto-Create to allow the Secure Firewall migration tool to create new security zones. To use existing security zones, manually map the FDM-managed device logical interfaces to the security zones.

Step 10

Follow the instructions of this guide to sequentially review and validate the configuration to be migrated, and then push the configuration to the management center.

Step 11

Review the Post Migration report, manually setup and deploy other configurations to the threat defense and complete the migration.

Step 12

Test the Firepower 2100 series device using the test plan that you would have created while planning for migration.

Step 1

Connect to the FDM-managed device through the SSH console and switch to the interface configuration mode.

Step 2

Shutdown the FDM-managed device interfaces using the shutdown command.

Step 3

(Optional) Access the management center and configure dynamic routing for the Firepower 2100 series device.

Step 4

Clear the Address Resolution Protocol (ARP) cache on the surrounding switching infrastructure.

Step 5

Perform basic ping tests from surrounding switching infrastructure to the Firepower 2100 series device interface IP addresses, to make sure that they are accessible.

Step 6

Perform basic ping tests from devices which require layer 3 routing to Firepower 2100 series device interface IP addresses.

Step 7

If you are assigning a new IP address to the Firepower 2100 series device and not reusing the IP address assigned to the FDM-managed device perform the following steps:

Step 8

Run a comprehensive test plan and monitor logs within the managing management center for your Firepower 2100 device.