Prerequisites for migrating Firewall Threat Defense to Cloud-Delivered Firewall Management Center

DNS and network configuration requirements

Ensure that the following network prerequisites are met before you begin the migration process.

  • DNS Server Configuration: The Firewall Threat Defenses must have the correct DNS server configuration to resolve Cloud-Delivered Firewall Management Center hostnames. For details about checking connectivity with Cloud-Delivered Firewall Management Center, see Check device connectivity with Cloud-Delivered Firewall Management Center.

  • Network Access: The required network access must be enabled for Firewall Threat Defenses to reach Cloud-Delivered Firewall Management Center through the TCP port 8305. Note that outbound connectivity from the Firewall Threat Defenses to Cloud-Delivered Firewall Management Center is sufficient.

  • Firewall Threat Defense Outbound Port 443: The Firewall Threat Defenses must be able to access port 443 and 8305 of Cloud-Delivered Firewall Management Center.

  • On-Premises Firewall Management Center Outbound Port 443: The On-Premises Firewall Management Center must have access to outbound port 443 open to reach "*.cdo.cisco.com" domain.

  • On-Premises Firewall Management Center should allow outbound HTTP/HTTPS to upload configurations to Amazon S3.

On-Premises FMC onboarding and version requirements

Verify that the On-Premises Firewall Management Center is onboarded to Security Cloud Control. Onboarding the On-Premises Firewall Management Center also onboards all the Firewall Threat Defense devices registered to that On-Premises Firewall Management Center. See Onboard an On-Prem FMC.

  • For the On-Premises Firewall Management Center 1000/2500/4500 migration: Run Version 7.4 (available for these models on a temporary basis). We recommend devices be running Version 7.0.5.

  • We recommend that you create a backup of On-Premises Firewall Management Center. For versions On-Premises Firewall Management Center Version 6.5 to 7.1, see the Back up the FMC topic in the Firepower Management Center Configuration Guide. For On-Premises Firewall Management Center Version 7.2 and later, see the Back up the Management Center topic in the Cisco Secure Firewall Management Center Administration Guide.

User account and permission requirements

Create a new user in the On-Premises Firewall Management Center with Administrator role or a custom user role with "Devices" and "System" permissions for onboarding purposes.

If you onboard an On-Premises Firewall Management Center to Security Cloud Control and simultaneously sign in to that On-Premises Firewall Management Center with the same user name, the onboarding fails.

Device synchronization and VPN requirements

Ensure proper device and VPN configuration before initiating migration.

  • The Firewall Threat Defense devices must be synchronized and not have pending changes on them. The migration fails on a device if Security Cloud Control identifies pending changes on that device.

  • All peer devices in a site-to-site VPN topology must be online and have no pending deployment.

Object conflict and FlexConfig considerations

Verify and resolve potential object conflicts and FlexConfig issues before migration.

  • Security Cloud Control imports Syslog alert object used in the access control policy from the On-Premises Firewall Management Center. If Security Cloud Control already contains an alert object with the same name but a different type (SNMP, Email), it is reused during configuration import. The user must check whether the Syslog object name matches the existing SNMP or Email alert object in Security Cloud Control. If the name matches, you must rename the Syslog object in the On-Premises Firewall Management Center before starting the migration process.

  • If you attempt to migrate firewalls with modified system defined FlexConfig text objects from an On-Premises Firewall Management Center to the Cloud-Delivered Firewall Management Center, the values of the modified system defined FlexConfig text objects are not migrated to the Cloud-Delivered Firewall Management Center, and the deployment will fail. To avoid this, copy the modified system defined FlexConfig text object values from the On-Premises Firewall Management Center to Cloud-Delivered Firewall Management Center before migration and initiate migration from On-Premises Firewall Management Center to Cloud-Delivered Firewall Management Center after verifying the predefined FlexConfig text objects.

Policy and object name conflicts

If a policy in Cloud-Delivered Firewall Management Center shares the same name as one in On-Premises Firewall Management Center (excluding network, port, URL, and VLAN objects), the Cloud-Delivered Firewall Management Centerversion will be retained. See Handling Shared Policies and Objects.

After migration, policies and objects aren't auto-synced between On-Premises Firewall Management Center and Cloud-Delivered Firewall Management Center. For phased migrations, you must update them manually.

You can revert to On-Premises Firewall Management Center within 14 days of migration. After that, changes are finalized automatically. See Revert the Threat Defense Management to On-Prem Firewall Management Center.

Requirement: high availability failover link must be up

The high availability failover link should be up for a successful migration. Before initiating the migration process on Security Cloud Control, determine the health status of the failover link on the On-Premises Firewall Management Center.

To identify the failover interfaces of all HA pairs you want to migrate to Cloud-Delivered Firewall Management Center, choose Devices > Device Management, click Edit , click the High Availability tab, and view the Interface field in the High Availability Link area. To check the health status of the failover interfaces, choose Devices > Device Management, click Health Monitor, expand the high availability pair, click the device with the exclamation mark, click the Critical button, and check the Interface Status for errors. If the failover interface is down, the Interface 'failover_interfacename' has no link message is displayed. Rectify the issue and click Sync from onprem FMC now to obtain the latest changes on the device.