topic Can we migrate the configuration of ASA 5510 to ASA 5516-X? in Network Security

Can we migrate the configuration of ASA 5510 to ASA 5516-X?

melvin.koh — Tue, 12 Mar 2019 08:38:22 GMT

Hi all,

Can the configuration of ASA 5510 migrate to ASA 5516-X? I'm doing this because there are tons of policies in ASA 5510 which i do not want to miss anything.

Regards,

Melvin

What's the ASA version on

cofee — Thu, 08 Dec 2016 06:34:59 GMT

Hi Cofee@0400,

melvin.koh — Thu, 08 Dec 2016 06:35:00 GMT

Hi Cofee@0400,

the version is stated below.

ASA version 5510 = 8.2 (1)

ASA version 5516-x = 9.6 (1)

Hi Melvin,

cofee — Thu, 08 Dec 2016 06:54:17 GMT

Hi Melvin,

You are probably aware that there is a huge syntax change when you go from 8.2 to 8.3 and above with the NAT and ACLs. I have done this in the past and you won't like to hear this, but I ended up using a notepad. There is a migration utility built by Cisco, but it does a very messy job and makes the whole process way more complicated than simply making syntax changes using notepad. It takes time when you make changes using a notepad, but from my perspective you will know how it's configured with the new syntax and if something goes wrong you will know exactly where to go and find the problem. If you decide to use the cisco migration utility you will still have to go back and organize it the way you want it because it will set everything to default values. I am not sure if Cisco has made it any better or if there is a better way to do it other than using Notepad.

When I actually implemented this in the production environment we had less than 20 minutes downtime and there were few issues here and there but I was able to fix them very quickly as I was very familiar with the new configuration. I believe we went from 8.2 to 9.1 on a 5550.

Please let me know if you have any questions.

Hi cofee@0400,

melvin.koh — Thu, 08 Dec 2016 07:10:02 GMT

Hi cofee@0400,

Thank you for the advise. Have no choice but to do the policies manually.

Good Luck!

cofee — Thu, 08 Dec 2016 07:21:51 GMT

Good Luck!

I hope there is a better way to do it and if there is I am sure someone will point it out.

Melvin,

Nenad Stojanovic — Thu, 08 Dec 2016 15:38:22 GMT

Melvin,

You need to do a lot manually but there are couple tools that you can use to make things easier. For NAT conversion I use https://www.tunnelsup.com/nat-converter/ and it works seamlessly!

You need to do access lists manually. I use notepad++ which makes things easier.

At the end use https://www.diffchecker.com/ to compare configs.

This is the way I found works the best for me.

Nenad