In short: An ASA to FTD migration moves your Cisco ASA configuration to Secure Firewall Threat Defense. Cisco's free Secure Firewall Migration Tool converts objects, access rules, NAT, routes, interfaces and site-to-site and remote access VPN into Management Center. You then fix unsupported items manually, add IPS and other policies, test, and cut over in a planned window.
Why migrate from ASA to Threat Defense?
Older ASA appliances have reached the end of Cisco support (see our Cisco ASA page), so most ASA estates face a hardware refresh anyway. Moving to Secure Firewall Threat Defense at the same time adds Snort 3 IPS, SnortML, application control, URL filtering, malware defence and universal ZTNA, and brings the firewalls under Management Center or Security Cloud Control.
The two images work differently: Threat Defense uses security zones, an access control policy with layered inspection, and separate NAT, VPN and platform settings policies. A good migration converts the configuration and also takes the chance to tidy up years of rule sprawl.
The Secure Firewall Migration Tool
Cisco's Secure Firewall Migration Tool (FMT) is free and needs no licence of its own. It runs on a Windows or macOS workstation, reads the ASA configuration (from an uploaded running configuration or by connecting to the live ASA), and pushes the converted policy to an on-premises or cloud-delivered Management Center. It produces a pre-migration report showing what will be fully migrated, partly migrated, unsupported or ignored, and a post-migration report that compares the results after the push.
| Converts (fully or partly) | Needs manual work |
|---|---|
| Network and service objects and groups, including FQDN objects | User-based and tunnelling-protocol access rules, and access list remarks |
| Inbound and global access rules | Outbound ACLs |
| Auto, manual and object NAT | NAT rules with block allocation or SCTP |
| Static, ECMP and policy-based routes; BGP and EIGRP (route maps partly) | Static routes with tracking (migrated without it) and SLA-tracked default routes learned by DHCP or PPPoE |
| Physical interfaces, subinterfaces, port channels, static and dynamic VTIs | Certificates and trustpoints, which you add to Management Center before migrating |
| Site-to-site VPN (crypto map and route-based), with pre-shared key automation | Transport-mode IPsec transform sets and SLA monitor schedules |
| Remote access VPN (SSL and IKEv2) with AnyConnect/Secure Client profiles | Advanced logging options on access rules, which are dropped |
The tool can also optimise access rules by flagging redundant and shadowed entries you can disable or delete. For a multi-context ASA it can migrate each context to its own Threat Defense device, or merge contexts into one device, adding the context name to interfaces and zones that would otherwise clash. The target can be a standalone device or a high-availability pair, but not a cluster.
Migration steps
- Inventory: list every ASA, its hardware, software version, mode (routed or transparent, single or multi-context), interfaces, VPN tunnels, remote access users and integrations such as RADIUS, LDAP and syslog.
- Choose the target and size it: pick Secure Firewall hardware or Threat Defense Virtual sized for throughput with IPS switched on, and decide on Management Center, cloud-delivered management or Device Manager.
- Map the licences: Essentials plus the IPS, Malware Defense and URL Filtering subscriptions you need (see Secure Firewall licensing), and Secure Client licences for remote access.
- Prepare Management Center: register the new device, create its interfaces, and pre-load certificates, Secure Client packages and any intrusion and file policies.
- Run the migration tool: load the configuration, review the pre-migration report, map ASA interfaces to Threat Defense interfaces and security zones, optimise rules, validate and push.
- Finish by hand: rebuild anything the reports flag as unsupported or partly migrated, then add the next-generation policy the ASA never had (IPS, application and URL rules, decryption where appropriate).
- Test in parallel: stage the new firewall alongside the ASA, test key applications, VPN tunnels and remote access profiles, and run IPS in a detection-first stance where needed.
- Cut over: move traffic in a planned change window with a tested rollback, re-establish site-to-site tunnels with partners, and monitor closely for the first days.
The Secure Client VPN cut-over
Remote access VPN is usually the most visible part of the migration. Plan it carefully:
- Move users to Cisco Secure Client 5 if they still run AnyConnect 4.x, whose application support ends on 31 March 2027 (see AnyConnect end of life)
- Keep the same headend name and certificate where possible, so clients connect without reconfiguration
- Check authentication (RADIUS, SAML or certificates) and any posture rules, for example with ISE
- Consider replacing some remote access with zero trust access: universal ZTNA on Threat Defense with Cisco Secure Access
How we run migrations
We follow the steps above with a written plan you sign off before any change: a discovery workshop, a configuration review with clean-up recommendations, a staged build using the migration tool, testing with your application owners, and a cut-over in an agreed out-of-hours window with rollback ready. Afterwards we tune IPS and access policy and hand over documentation. Contact us to scope your migration; ask us for a quote.
How Forever Systems supplies and supports Cisco Secure
We supply and support the whole Cisco security portfolio for UK organisations, alongside Cisco Meraki networking and Cisco voice.
- Architecture and sizing: the right mix of firewall, secure access, identity, endpoint, email, detection and response and OT security for your estate, whether as individual products or a Cisco security suite
- Licensing: Smart Accounts, subscription tiers, Enterprise Agreements and renewals, explained in plain English
- Deployment and migration, including ASA to Secure Firewall Threat Defense, AnyConnect to Secure Client, and Umbrella to Secure Access
- Integration across Cisco XDR, Splunk, Duo, ISE and Secure Access so products share telemetry and response actions
- Ongoing support: upgrades, policy reviews, end-of-life planning, licence management and renewals
Forever Systems Ltd is an independent IT and cyber security provider. We will always recommend what fits, Cisco or otherwise.
Want help choosing, licensing or migrating Cisco security products?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
Is the Cisco Secure Firewall Migration Tool free?
Yes. The tool is free and needs no licence. You still need a Management Center to push the configuration to, with the Threat Defense feature licences for whatever you migrate.
Can I migrate ASA remote access VPN to FTD?
Yes. The migration tool converts SSL and IKEv2 remote access VPN, including AnyConnect/Secure Client profiles. Review the result and test with real users before cut-over.
Can a multi-context ASA be migrated to Threat Defense?
Yes. The tool can migrate individual contexts to separate Threat Defense devices or merge several contexts into one device. Design this carefully, as interfaces and zones that share a name are renamed with the context name to keep them apart.
How long does an ASA to FTD migration take?
It depends on the number of firewalls, the size of the rule base and the VPN estate. A single site with a clean configuration is quicker than a multi-context data centre pair. We give you a timeline after the discovery stage.
Can I keep ASA software on new hardware instead?
Yes. Current Secure Firewall hardware still runs ASA software, which can be a sensible first step if you need a like-for-like refresh before redesigning policy.