News & Events

Firepower 6.5 – How to migrate to a new Hardware Appliance

  • 31 January, 2020

Article, Cisco, Security

This article will explain how to migrate to a new hardware appliance in Firepower 6.5. As with all its product lines, Cisco periodically refreshes its Firepower Hardware Appliances to ensure customers are getting the latest and greatest in performance and reliability.

Back in July 2019, Cisco issued an end-of-life notice for its last-generation Firepower Management Centre x500 appliance range. The x600 appliance range was announced as the replacement, based on its UCS C220 M5 server platforms.

firepower 6.5 migration x600

The issue

However, performing a migration from one FMC to another, in the case of a hardware refresh or virtual to physical conversion, has always required manual un-registration of Firepower Threat Defense devices from the old FMC and reregistration to the new FMC platform

This can be a time and resource-consuming process, often requiring hands on-site at every location to complete the migration. The risk introduced by wiping an FTD configuration by un-registering it from the original FMC has also caused operational concerns to be raised regarding the migration process.

The solution in Firepower 6.5

To resolve these issues, Cisco has introduced a new migration process in Firepower 6.5, allowing a live migration from one FMC to another without requiring manual reconfiguration of remote FTD devices.

At a high level the process has the following steps for a standalone FMC deployment:

1

Deploy the new FMC with its own IP address live on the network 

2

Patch and update the new FMC to the same level as the old FMC, including running software version, VDB and SRU

3

Create a full backup on the old FMC (including configuration, events and Threat Intelligence Director if in use)

4

Copy the backup file from the old FMC to the new FMC 

Cheat sheet mid article ad5
5

Disconnect the new FMC from the network 

6

Run the Cisco migration script from the CLI on the new FMC on the newly uploaded backup file. Once the migration process has completed the new FMC will automatically be reconfigured to use the IP address of the old FMC 

firepower 6.5 migration x600
7

Unregister the old FMC from the Cisco Smart Software Manager to free up its Smart Licenses 

8

Disconnect the old FMC from the network and reconnect the new FMC to the network 

9

Register the new FMC with the Cisco Smart Software Manager

10

Managed FTD devices should begin to register a heartbeat with the new FMC in a few minutes 

11

Verify policy editing, deployment and scheduled jobs are configured on the new FMC as intended

Please note that only Cisco Certified migration paths are supported.

If you would like to see more information or further detail on the migration process including a procedure for High Availability pairs, click here.

Need some assistance?

Contact us today! Our security experts are more than happy to help with any of your issues!

Tweet
Share
Share