The migration tool places ASA rules into a Prefilter Policy because ASA rules are L3/4 inspection only. Prefilter policies provide L2/L4 inspection of access rules. You can also put all of your source ASA ACL entries into a destination Access Control Policy. https://www.cisco.com/c/en/us/td/docs/security/firepower/660/configuration/guide/fpmc-config- guide-v66/prefiltering_and_prefilter_policies.html