Import/Export is supported for the following configurations:

• Access control policies and the policies they invoke: prefilter, network analysis, intrusion, SSL, file, Threat Defense Service Policy

• Intrusion policies, independently of access control

• NAT policies (Firepower Threat Defense only)

• FlexConfig policies. However, the contents of any secret key variables are cleared when you export the policy. You must manually edit the values of all secret keys after importing a FlexConfig policy that uses secret keys.

• Platform settings

• Health policies

• Alert responses

• Application detectors (both user-defined and those provided by Cisco Professional Services)

• Dashboards

• Custom tables

• Custom workflows

• Saved searches

• Custom user roles

• Report templates

• Third-party product and vulnerability mappings

• Users and groups for user control

When you export a configuration, the system also exports other required configurations. For example, exporting an access control policy also exports any subpolicies it invokes, objects and object groups it uses, ancestor policies, and so on. As another example, if you export a platform settings policy with external authentication enabled, the authentication object is exported as well. There are some exceptions, however:

• System-provided databases and feeds—The system does not export URL filtering category and reputation data, Cisco Intelligence Feed data, or the geolocation database (GeoDB). Make sure all the appliances in your deployment obtain up-to-date information from Cisco.

• Global Security Intelligence lists—The system exports Global Security Intelligence Block and Do Not Block lists associated with exported configurations. The import process converts these lists to user-created lists, then uses those new lists in the imported configurations. This ensures that imported lists do not conflict with existing Global Block and Do Not Block lists. To use Global lists on the importing FMC, manually add the lists to your imported configurations.

• Intrusion policy shared layers—The export process breaks intrusion policy shared layers. The previously shared layer is included in the package, and imported intrusion policies do not contain shared layers.

• Intrusion policy default variable set—The export package includes a default variable set with custom variables and system-provided variables with user-defined values. The import process updates the default variable set on the importing FMC with the imported values. However, the import process does not delete custom variables not present in the export package. The import process also does not revert user-defined values on the importing FMC, for values not set in the export package. Therefore, an imported intrusion policy may behave differently than expected if the importing FMC has differently configured default variables.

• Custom user objects—If you have created custom user groups or objects in your FMC and if such a custom user object is a part of any rule in your access control policy, note that the export file (.sfo) does not carry the user object information and therefore while importing such a policy, any reference to such custom user objects will be removed and will not be imported to the destination FMC. To avoid detection issues due to the missing user group, add the customized user objects manually to the new FMC and re-configure the access control policy after import.

When you import objects and object groups:

• Generally, the import process imports objects and groups as new, and you cannot replace existing objects and groups. However, if network and port objects or groups in an imported configuration match existing objects or groups, the imported configuration reuses the existing objects/groups, rather than creating new objects/groups. The system determines a match by comparing the name (minus any autogenerated number) and content of each network and port object/group.

• If the names of imported objects match existing objects on the importing FMC, the system appends autogenerated numbers to the imported object and group names to make them unique.

• You must map any security zones and interface groups used in the imported configurations to matching-type zones and groups managed by the importing FMC.

• If you export a configuration that uses PKI objects containing private keys, the system decrypts the private keys before export. On import, the system encrypts the keys with a randomly generated key.