Download Cisco Migration Tool

I've migrated more than one ASA to FTDs managed on the same FMC. I don't think i came across having the same object name with different values. Note you cannot merge the ASA configs onto a single target FTD. That's not supported using the tool.

FMT tool has a resolve conflict option, where it will ask you to rename the object while migrating it, if an object with same name exists on FMC, but your object has different values, check the below screenshot.

Download Zip 🔥 https://urluso.com/2y68ML 🔥

It looks like in migrating the ACL and merging the per-interface ACLs into a single Global ACL the tool adds source and destination zones rather than the ASA just having a source interface. I think the FMT uses the routing table to determine the destination zone?

Interfaces should generally be mapped to interface groups and zones. The FMT suggest the same when migrating. I've followed that method on a half dozen or so that I have done and it has always worked for me. The tool has saved me dozens of hours that I would have otherwise spent doing manual migrations.

The tool has definitely saved me time, however this caused me a major headache as the majority of things worked with the customer testing. I was only a day later when they realised there were some issues and initially they thought it was server related rather than the firewall migration.

Luckily there was a pattern to it and it was only rules where the destination was a summary prefix covering multiple actual destinations - i.e. 10.0.0.0/8. It seems the tool is matching exactly rather than looking a bit deeper as to what traffic is allowed.

Migrating ASA 8.4(7) to FMC 7.2(5) using the Firewall Migration Tool. Tried both version 5.0.0 and 4.0.3. Manually uploading the ASA config file from show running-config. It stays stuck at "Parsing in progress. Please refer to console logs for more details." I let it sit there for about an hour and nothing happens. The logs do not show any errors or anything. Windows 10 x64 with Chrome as default browser. Config file is ".txt" and starts with "ASA Version 8.4(7)" and ends with ": end" just after the checksum. Verified that there are no "" lines. I used Putty to grab the config and set "pager lines 0" before running the "show running-config" command. Copied the configuration to Notepad and saved as a text file. Tried running the tool as Administrator as well. Same result. Cleared browser history, cookies, etc. Screenshot of the error is attached. Also, the log is attached. Any help would be greatly appreciated!

Thank you for the reply Marvin! I did verify the requirements in the link you sent. Everything is good. I also tried to trim the configuration file down to a basic configuration and it behaves the same way. No errors or anything in the console logs. Just hangs. I tried running the tool as Administrator and even tried to disable the Windows Defender firewall. Again, just hangs with no errors. I did remove the version information from the config file just as a test and sure enough, it errors out and complains that the version information is missing. Do you have an idea of how long it could take on average for the parsing process? I tried letting it sit for a couple of hours but nothing. Am I just not waiting long enough? Again, this is only for the parsing of the ASA config after uploading it.

We are planning to migrate our firewall to Cisco meraki from cisco ASA. Could someone help me with the migration planning and also let me know is there any automated configuration migration tool in Meraki

IMO, the most important step is to document which services you use on the ASA and if these services are needed after migration. The MX is far less capable than the ASA in nearly everything up to Layer3/4. It can be sufficient, but I ended up very often to still have an ASA alongside with the MX.

The migration tool is not perfect. After using the migration tool for a couple of ASA migrations. I found the tool is best used for migrating the shared configurations (ACP, NAT and Objects) as those are the most time consuming if you are migrating manually. During the migration, I had issues with L2L VPNs, dynamic routing such as BGP and OSPF and their associated policies that used ACLs. For the VPN, there were some discrepancies with the encryption and integrity algorithms and supported Diffie-Hellman groups. This is due to the FTD/FMC not supporting outdated and low security algorithms and DH groups in IKEv1. The FMT also migrated some VPNs but not others, but the reports did not give a reason why. The migrated VPNs also cause a configuration deployment to error out until the encryption, integrity and DH group issues are resolved. I found that it was just easier to migrate the L2L VPNs over manually. Keep in mind that any changes to the VPN requires changes to the peer configuration or VPN will break. Also, the migration tool did not detect any of the dynamic routing protocols. BGP was used in the ASAs but the FMT did not detect it or allow me to select it for migration. OPSF was not a selectable option for migration.

For installation there is a video created on the expedition forums demonstrating how to perform this function, you can watch the video here ( -migration-tool/ct-p/migration_tool ), also there are guides listed from that link as well.

As for the Cisco FirewPower migration the expedition tool will not migrate over the layer 7 policies but only the layer 3/4 policies so you will need to export the configuration with the asa format for conversion.

I currently have SNS-3515-ACS-K9 running 5.8.1.4. I have to get two appliances for primary/secondary. Currently, I only have one appliance. The second appliance will be 3515-ISE-K9. Does Cisco provide a migration tool for me to upgrade ACS to ISE on the SNS-3515 I currently have? I was told they no longer support that. I find that hard to believe. Can anyone confirm that is correct? My goal was to have the migration tool 2.4 still on so I can see what applications ACS installed in ISE. It would be a bit hard if I am to start ISE from scratch on a second appliance. The migration tool 2.4 would save me a lot of time learning ISE. Anyone? Thank you, Vincent

Hi @Shubhamkumaryadav It is is important to create a new device group and new template in panorama for your ciscoasa migration before you export the whole running config file out, so when you merge the ciscoasa and panorama config, you only merge the ciscoasa migrated config to the new device group and template , that way ,when you load the config on panorama, you can load the new device group and template from the exported expedition config. Hope this clear.

Cisco customers migrating from ASA to Firepower can now enlist Tufin channel partners to deliver migration services. The service delivers a fully optimized rule set that aligns to Firepower Access Control Groups and provides immediate realization of Firepower benefits. Each ASA to Firepower migration is estimated to take four hours per firewall migration (up to 20 times faster than the manual process) and supports nested object groups and offline devices.

COBRAS is a set of object-oriented import/export tools for Unity and Unity Connection. They allow you to selectively export (i.e., backup) specific application objects (e.g., Subscribers, Call Handlers, etc.) and then import them to another version of Unity or Unity Connection. COBRAS is much different than DiRT which provides backup and restore capabilities to the exact same version of Unity. COBRAS is geared more towards migrating data between different versions of Unity or even between applications (Unity to Unity Connection). In total, there are 3 separate tools:

If you're currently using Cisco Umbrella to manage your destination lists and would like to migrate them to Atmos, you can easily do so using a CMD tool created for this purpose. This tool automates the process of importing and configuring your destination lists from Cisco Umbrella into Web Categories in Atmos, saving you time and effort. The tool ensures that the migration is performed accurately, reducing the risk of errors.

Run Brocade SAN Health 4.2.2a on the Cisco MDS Fabric.

Once all the basic information is gathered from the VSAN environment, go to the Broadcom site and download the latest installation file from Install the file and run an audit on the VSAN fabric. This report is useful in generating new Brocade device zoning information, especially in a large environment.

Submit the Brocade SAN Health auditing data to the Brocade SAN Health team to generate a zoning script for the Brocade platform. The MDS VSAN configuration and device information that are gathered are used to create zoning in the Brocade environment, with the help of Brocade SAN Health. The device information and zoning script syntax that are generated from Brocade SAN Health are compared to the original VSAN environment. The zoning script that is generated from Brocade SAN Health is ready to use without modification.

The SAN Health team has a tool that is called Zone Migration that is used to simplify the process of migrating to a new fabric by assisting with the recreation of an existing zone configuration into a new fabric. By using the zone information captured in a SAN Health report, the SAN Health team can create a text file that contains all the CLI commands necessary to build those zones in the new fabric. This can reduce the time that is required to manually enter the zone data, and it can eliminate costly typos and other human errors.

What are the steps to obtain a zone migration text?

Run SAN Health and send in the audit to be processed to use the Zone Migration tool. After the completed report is sent back to you, ask for the zone migration text from Broadcom SANHealth.Admin@broadcom.com.

When contacting SAN Health Admin for the script, they require the name of the report that was generated and not the report itself.