Firepower 6.5 - How to migrate to a new Hardware Appliance - Tesrex

Written by Tesrex | May 1, 2022 11:00:00 PM

This article will explain how to migrate to a new hardware appliance in Firepower 6.5. As with all its product lines, Cisco periodically refreshes its Firepower Hardware Appliances to ensure customers are getting the latest and greatest in performance and reliability.

Back in July 2019, Cisco issued an end-of-life notice for its last-generation Firepower Management Centre x500 appliance range. The x600 appliance range was announced as the replacement, based on its UCS C220 M5 server platforms.

The issue

However, performing a migration from one FMC to another, in the case of a hardware refresh or virtual to physical conversion, has always required manual un-registration of Firepower Threat Defense devices from the old FMC and reregistration to the new FMC platform

This can be a time and resource-consuming process, often requiring hands on-site at every location to complete the migration. The risk introduced by wiping an FTD configuration by un-registering it from the original FMC has also caused operational concerns to be raised regarding the migration process.

The solution in Firepower 6.5

To resolve these issues, Cisco has introduced a new migration process in Firepower 6.5, allowing a live migration from one FMC to another without requiring manual reconfiguration of remote FTD devices.

At a high level the process has the following steps for a standalone FMC deployment:

Deploy the new FMC with its own IP address live on the network

Patch and update the new FMC to the same level as the old FMC, including running software version, VDB and SRU

Create a full backup on the old FMC (including configuration, events and Threat Intelligence Director if in use)

Copy the backup file from the old FMC to the new FMC

Disconnect the new FMC from the network

Run the Cisco migration script from the CLI on the new FMC on the newly uploaded backup file. Once the migration process has completed the new FMC will automatically be reconfigured to use the IP address of the old FMC

Unregister the old FMC from the Cisco Smart Software Manager to free up its Smart Licenses

Disconnect the old FMC from the network and reconnect the new FMC to the network

Managed FTD devices should begin to register a heartbeat with the new FMC in a few minutes

Verify policy editing, deployment and scheduled jobs are configured on the new FMC as intended

Please note that only Cisco Certified migration paths are supported.

If you would like to see more information or further detail on the migration process including a procedure for High Availability pairs, click here.

View full post