topic In addition to the gigantic in Network Security

Cisco ASA 5505 8.2 upgrade

manjeet_s1 — Tue, 12 Mar 2019 07:56:30 GMT

Hello Experts,

Some of the remote location we are having Cisco ASA 5505 with IOS version 8.2(5), We are planning to upgrade those ASA's to the latest IOS.

So we need your suggestion what is the process to upgrade those ASA's and till what version we can upgrade the IOS.

It would be great if you can provide some document for the same.

Hello Manjeet,

Kornelia Gutierrez — Fri, 24 Jun 2016 19:15:12 GMT

Hello Manjeet,

I hope you are fine, regarding query, the latest version available for the 5505 box is 9..2.4(10), you need to take into account the memory requirments and the upgrade path that you must follow before upgrading the ASA.

Upgrade path:

8.2.5 -> 8.4.5 ->9.2.X

Please refer to the following link:

http://www.cisco.com/c/en/us/td/docs/security/asa/asa92/release/notes/asarn92.html#pgfId-769104

Memory requirements:

You must have 512 mb of RAM in order to upgrade to 9.2.4

http://www.cisco.com/c/en/us/td/docs/security/asa/compatibility/asamatrx.html#51927

Also take into account that the configuration will be automatically migrated, since the sintaxys of the nat rules changes, therefore once the ASA is upgraded check the configuration.

Check this documentation:

http://www.cisco.com/c/en/us/td/docs/security/asa/asa83/upgrading/migrating.html

Hope this helps!

Best regards.

Kornelia Gutierrez

Hi

Francesco Molino — Fri, 24 Jun 2016 19:26:13 GMT

the biggest thing when migrating from 8.2 to whatever higher than 8.3, it's NAT configuration (mostly this is unique issues on customer side).

To handle that migration, I'll paste right here a Cisco documentation and a Cisco tool to migrate your config file (don't care about models on the tools, just the IOS version).

http://www.cisco.com/c/en/us/td/docs/security/asa/asa83/upgrading/migrating.html

https://fwm.cisco.com/auth.do

Another thing concerning your asa 5505, don't rely 100% on the Cisco tool, check it before applying the config. Be careful also, ASA 5505 is the only who have switched ports compared to the other models you'll have on the tool (maybe just delete that part if you're getting errors).

Thanks

PS: Please don't forget to rate and mark as correct answer if this solved your issue

In addition to the gigantic

James Leinweber — Mon, 27 Jun 2016 16:52:48 GMT

In addition to the gigantic change in NAT architecture at 8.3 there is also a change in IPv6 support at 9.0 which you will also run into. They unified the IPv4 and IPv6 access lists, abolishing the separate access-group statements for the previous parallel kinds. The "any" keyword goes dual-protocol, and there are new "any4" and "any6" keywords for matching single-protocol addresses.

Many of us preferred to rewrite configurations from scratch for this transition, though the automatically migrated/converted ones can provide a useful guide. To a first approximation, convert your former NAT 0 identity mappings into phase I twice NAT, and everything else into phase II network object NAT.