topic Thank you for the quick in Network Security

ASA copy tftp run question

Robin Swan — Tue, 12 Mar 2019 04:02:59 GMT

Hello,

I have 2 ASA 5520's. I had to split them up to migrate over to a new ISP while keeping the old ISP in service temporarily. I want to join them back together now with the new ISP because we are going to be ending our contract with the old ISP. However, I also want to upgrade the IOS from 8.2 to the newest IOS. I know I should copy the new ISP configuration over first. My question is; Can I copy a configuration using: "copy tftp run" (w/out quotes), on a ASA 5520 just the same as doing it on a switch? Then make it the boot configuration? Or is there a different way to copy a configuration over than how it's done on a switch?

Thank you in advance.

It's pretty similar. If you

Marvin Rhoads — Tue, 08 Apr 2014 15:40:57 GMT

It's pretty similar. If you copy to running-config, you'll have to save (write memory) to commit that as the startup-config. You can also copy directly to startup-config.

The detailed syntax is laid out here: link.

You didn't say, but if your ASAs are to be setup as an HA pair, the primary unit will automatically replicate the configuration to the mate when it detects the mate returning to the link.

Note if you were moving physical units and have any certificates, VPN Profiles, AnyConnect images, Clientless SSL VPN portal customization etc. that those are separate from the configuration file and need to be handled separately when migrating an ASA.

One final note - "ASA software" is just that - it's not IOS.

Thank you for the quick

Robin Swan — Tue, 08 Apr 2014 16:19:57 GMT

Thank you for the quick response Marvin.

I do understand that I have to export all of the additonal files from the production ASA so I can import them to the old one once I copy the running-config over.

However, do you have a link that will give me the commands to take out the old configuration? Because I have read that simply copying a configuration to the old one will merge them together.

You're welcome.If you want to

Marvin Rhoads — Tue, 08 Apr 2014 16:54:24 GMT

You're welcome.

If you want to blow away the old configuration, you could always "configure factory-default". What that leaves you with is described elsewhere in the configuration guide (here).

Please mark your post when answered and rate helpful replies. Thanks!

One more question on this

Robin Swan — Tue, 08 Apr 2014 21:53:48 GMT

One more question on this subject.

do I export each of the files listed under the "sh import webvpn plug-in?"

If you're using the plug-ins

Marvin Rhoads — Tue, 08 Apr 2014 23:06:46 GMT

If you're using the plug-ins for Clientless SSL VPN (with AnyConnect Premium) then, yes, they are required.

If you aren't then they don't make any difference.