topic Upgrading ASA5550 from 8.2(2) to 8.4(2) in Network Security

Upgrading ASA5550 from 8.2(2) to 8.4(2)

Tim Hamblin — Mon, 11 Mar 2019 21:28:04 GMT

Hi all,

First post so be gentle!!!

I are currently implementing a new patching schedule (when I say new i mean a company first!!!) and I have identified that the firewalls are all running 8.2(2). I would like to bring these up to the latest version but am a little worried about impact!!! I have setup a test firewall with the config from our live asa's and run the upgrade but have received multiple lines like the following:

.....................................................................................................WARNING:

MIGRATION: NAT Exempt command is encountered in config.

Static NATs which overlap with NAT Exempt source are not migrated.

Please check migrated ACLs for accuracy.

*** Output from config line 4167, "access-group outside_acc..."

....and......

NAT migration logs:

The following 'nat' command didn't have a matching 'global' rule on interface 'dmzs' and was not migrated.

nat (newcompany) 1 0.0.0.0 0.0.0.0

Not being able to test the upgraded firewall in a live environment I am worried that the upgrade has left out some critical stuff and won't work properly when migrated. Is there anything I can do to stop these errors (i.e. change the configs before upgrade) or are they informational and everyhting should work fine?? (unlikely I know)

Any Help most appreciated!

Tim

Upgrading ASA5550 from 8.2(2) to 8.4(2)

varrao — Wed, 21 Sep 2011 13:39:47 GMT

Hi Tim,

Can you post me the config fom both the versions, which is config before the upgarde and after the upgarde, i'll compare them and let you know if you are missing anything.

Moreover you can refer this doc for the ASA 8.3 or later upgrade:

https://supportforums.cisco.com/docs/DOC-12690

Thanks,

Varun

Upgrading ASA5550 from 8.2(2) to 8.4(2)

varrao — Wed, 21 Sep 2011 13:48:08 GMT

You can refer to the migration guide as well, it woudl be great help:

http://www.cisco.com/en/US/docs/security/asa/asa83/upgrading/migrating.html

Thanks,

Varun

Upgrading ASA5550 from 8.2(2) to 8.4(2)

Tim Hamblin — Wed, 21 Sep 2011 14:01:40 GMT

Thanks Varun,

I will get a copy of the configs, before and after, and send them over.

Looks like your first post has already answered some of my problems:

The folowing errors.....

NAT migration logs:

The following 'nat' command didn't have a matching 'global' rule on interface 'dmzs' and was not migrated.

nat (newcompany) 1 0.0.0.0 0.0.0.0

........are easily removed by issuing "no nat-control" prior to upgrade.

Tim

Upgrading ASA5550 from 8.2(2) to 8.4(2)

varrao — Wed, 21 Sep 2011 14:13:24 GMT

Yup. Do let me know once you have the config, we can compare them and see if any changes needed be done.

-Varun

Upgrading ASA5550 from 8.2(2) to 8.4(2)

Tim Hamblin — Wed, 21 Sep 2011 14:16:51 GMT

Varun,

I have the configs but, for obvious reasons do not want to post them on here, can I send them to you???

Tim

Upgrading ASA5550 from 8.2(2) to 8.4(2)

varrao — Wed, 21 Sep 2011 14:20:28 GMT

Yes sure, you can send attach the files and send Private message to me.

Varun

Upgrading ASA5550 from 8.2(2) to 8.4(2)

NSG Manager — Mon, 07 Nov 2011 06:42:16 GMT

Can I upgrade directly to 8.4(2) from 8.2(2)? Or I have to go via 8.3?

Upgrading ASA5550 from 8.2(2) to 8.4(2)

varrao — Mon, 07 Nov 2011 06:55:43 GMT

Hi,

You can very well go from 8.2.2 to 8.4.2, that would not be a problem. Just make sure about the memory requirements and upgrade procedures as mentioned in the links above in the post.

Thanks,

Varun

Upgrading ASA5550 from 8.2(2) to 8.4(2)

ranemilind — Fri, 13 Jan 2012 06:10:07 GMT

Hi Team,

i am also facing some problem in 8.4.2, i upgraded both primary and secondary ASA from TFTP from 8.3 to 8.4.2.

After this primary is stable but secondary ASA continiously rebooting,

need help on this.

Regards