SecureMigrate

Cisco firewall migration toolkit — ASA and FMC sources into a target FMC.

Overview

SecureMigrate is built to make firewall migrations faster and more reliable than clicking through the FMC GUI by hand. It puts two migration sources behind one CLI architecture — ASA show-run files and live FMC-to-FMC — and shares underlying logic for objects, ACP rules, NAT, routes, duplicate cleanup and naming. In firepower mode the source FMC is never written to — all changes land on target.

Two migration sources

ASA mode

Reads an ASA running-config and rebuilds it in FMC: objects, object groups, ACLs, NAT rules and interface-to-zone mapping. Can run as incremental partial syncs (objects only, ACP only, NAT only) or as a single full migration.

Firepower mode

Moves configuration between two FMC instances — a single ACP category, a selection of categories, or the full configuration of one FTD. Live against both FMCs, or via an encrypted export bundle when source and target cannot talk to each other (air-gap, separate networks, vendor handover).

Capabilities

Migrates objects, network groups, ACP rules, NAT rules and static routes between firewall systems
ASA mode: converts ASA show run into structured text files that are human-readable and editable before push
Firepower mode: per-category migration with multi-category support and bundle export/import for air-gap scenarios
Interactive interface and zone remapping from source to target — decisions are cached and reusable
Identifies and removes duplicates and unused objects scoped per ACP category
Renames objects to standardised naming conventions — with optional reverse-DNS lookup
Every command has --dryrun preview, and renaming is rollback-able

Typical workflow

ASA mode

# Setup (interactive — points at FMC + ACP)
securemigrate setup

# Convert ASA config to text files
securemigrate asa --convertasa --acp

# Preview what the migration would do
securemigrate asa --migrate --dryrun

# Run the full migration
securemigrate asa --migrate

# Clean up (duplicate cleanup + rename to convention)
securemigrate dublets --acp
securemigrate rename --acp

Firepower mode

# Setup (points at source FMC + target FMC + source/target ACP)
securemigrate setup

# Preview what the migration would do for one category
securemigrate firepower --migrate --category 'CustomerA' --dryrun

# Run the full migration for the category
securemigrate firepower --migrate --category 'CustomerA'

# (Air-gap) Export source data to a bundle
securemigrate firepower --export migration.tar --category 'CustomerA'
# ... move bundle to target network ...
securemigrate firepower --import migration.tar

Full command reference and install instructions ship with v1.