topic Thanks for the reply Alex. in Network Security

Transfer firewall config from ASA 8.0 to 9.2.

kferguson1 — Tue, 12 Mar 2019 08:17:25 GMT

Hi,

We currently have a Cisco ASA 5520 running ASA Version 8.0(3) and ASDM Version 6.1(5).

We have purchased new 5515-X firewalls for an upgrade and I need to know how to export all the config from the 5520 and import it into the 5515-X. I know this is not possible simply by exporting the running config, due to the ASA versions being so far apart. I tried it and got a lot of errors.

Can someone please advise how I would do this? Which versions do I need to downgrade the new firewall to so I can successfully import the config? I have tried to downgrade ASA to version 8.0 on the 5515-X but I get an error saying it is not valid for this platform (as it is a PIX platform).

Thanks

Hello,

Alex D. Silva Gutierrez — Mon, 19 Sep 2016 23:02:42 GMT

Hello,

Major change was done on and after 8.3,

You need to cautions with any nat configuration that you have.

If you can post the entire firewall configuration, that would help to determine the risk.

Alex Gutierrez.

Hi,

Pulkit Saxena — Tue, 20 Sep 2016 03:47:00 GMT

Hi,

The migration that you are going to perform is a major migration as there were lot of syntax change in old and new version.

Ideally during a maintenance window, you should first upgrade you ASA 5520 to 8.2.5, then 8.3.1, then 8.4.6 and then some version in 9.x.

Here is a link for the same :

http://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/116685-problemsolution-product-00.html

Once your ASA 5520 is on version 9.x series, the same configuration can be used on the ASA 5515-X with few changes at interface level.

ASA 5515-X will have gigabitethernet interfaces while ASA 5520 has mostly Ethernet interfaces.

Also, you cannot downgrade ASA 5515-X to 8.0 code as it runs on a different platform and it comes with a minimum version of 8.6.x.

Let me know if you have any further doubt.

Regards,

Pulkit

Hi Pulkit,

kferguson1 — Tue, 20 Sep 2016 14:18:27 GMT

Hi Pulkit,

Thanks very much for your advice. Just one more thing...would upgrading from 8.3.1 to 8.4.5 be sufficient, rather than 8.4.6? I don't have an image for 8.4.6 unfortunately.

Many Thanks,

Keith

Thanks for the reply Alex.

kferguson1 — Tue, 20 Sep 2016 14:22:34 GMT

Thanks for the reply Alex.

Pulkit has given me some advice on an upgrade path for the 5520 which will hopefully prevent me from having to manually amend any configuration i.e NAT rules. I will test this and see if the transition goes smoothly.

Keith

Keith,

Pulkit Saxena — Wed, 21 Sep 2016 00:21:09 GMT

Keith,

Yes that should help, as a best practice one should follow the versions mentioned on the link.

Else, we can go with the one that we have since the syntax will happen on 8.3.1 itself.

Regards,

Pulkit

Great. I will give it a try.

kferguson1 — Wed, 21 Sep 2016 20:40:10 GMT

Great. I will give it a try.

Thanks for your help.

Keith