topic Re: CISCO ASA migration from 5510 to 5525x in Network Security

CISCO ASA migration from 5510 to 5525x

JPMohapatra — Fri, 21 Feb 2020 16:42:42 GMT

Hi,

I would like to migrate ASA-5510 version 8.4 (7) to ASA 5525X- version 9.7.2. If someone could please help me with the steps to follow that would be a great help. Existing config has VPN, HA and NAT as well.

Thanks

Re: CISCO ASA migration from 5510 to 5525x

MajidShirzadeh — Mon, 28 Jan 2019 17:04:26 GMT

Here is what I used few months ago,

http://www.cisco.com/en/US/docs/security/asa/asa91/release/notes/asarn91.html#wp746094

Also please look at this before migration:

https://community.cisco.com/t5/security-documents/asa-nat-8-3-nat-operation-and-configuration-format-cli/ta-p/3143050

1. upgrade the standby ASA

2. update your object groups, NAT and ACLs

3. initiate failover and monitor for connectivity issues.

4. once you are sure that you have minimal connectivity problems, upgrade the second ASA and update the object groups, NAT and ACLs.

Then initiate failover back to the original active ASA...if required.

--
Please remember to rate and select a correct answer

Re: CISCO ASA migration from 5510 to 5525x

MajidShirzadeh — Mon, 28 Jan 2019 17:06:58 GMT

The other option that you can use is run this on GNS3 and upgrade to new code and see what's failing.

Re: CISCO ASA migration from 5510 to 5525x

JPMohapatra — Mon, 28 Jan 2019 19:16:16 GMT

Thanks for your help, but I would like to migrate the old ASA to the new one as per below.

CISCO ASA migration from 5510- version 8.4 to 5525x- Version 9.7

Re: CISCO ASA migration from 5510 to 5525x

JPMohapatra — Mon, 28 Jan 2019 19:17:23 GMT

thanks, that's a good option to try with.

Re: CISCO ASA migration from 5510 to 5525x

Sheraz.Salim — Mon, 28 Jan 2019 20:07:47 GMT

if you doing a change from 8.4 to 9.x in that case no nat rules need to be change. prior to 8.3 the nat order was different. post 8.4 to 9.x the unified nat syntax and function is same so does the VPN and also the HA (Active,Standby) or (ACTIVE/ACTIVE) also know as context firewall. minor changes were added on each ASA code however, no new major updates was/were included.

you should be fine.

Re: CISCO ASA migration from 5510 to 5525x

JPMohapatra — Tue, 29 Jan 2019 06:28:12 GMT

Thank a lot for your help and I appreciate for your time. I’ve few more questions!

Is there any procedure to follow as in best practice for any migration? Or just copy and paste the config and that’s it?

Re: CISCO ASA migration from 5510 to 5525x

Sheraz.Salim — Tue, 29 Jan 2019 09:07:13 GMT

I understand the concern you have. i have attach the matrix for you which will give you more confidence in order for you to upgrade or migration.

https://www.cisco.com/c/en/us/td/docs/security/asa/asa99/release/notes/asarn99.html

according to this cisco link 8.4 to 9.x no big change. however, if you have a change windows which i would recommand you to have to you can look into it what is not working. but you should be fine have read on this link i share ealier and ask any question you have.

Re: CISCO ASA migration from 5510 to 5525x

jyoti_prakash85@yahoo.com — Tue, 29 Jan 2019 12:09:42 GMT

Hello Sheraz,

Thanks for your time and I appreciate. I'll go through the attached document.

If you don't mind I have drafted a migration plan and I would appreciate if you can take a look and recommend your thoughts.

1: Full system backup – Production Firewall (primary and secondary).

2: Upgrade both the new 5525X Firewall to 9.9.X version.

3: Configure Interface (as per the new 5525X Firewall) and HA config on Primary Firewall.

4: Configure Object, ACL, NAT, and VPN.

5: Configure the Secondary Firewall with only Failover syntax.

6: Compare the configuration (old and new) for any missing info with the actual production.

7: Save the ARP details for the troubleshooting.

8: Configure the TACACS access after firewall swap and in the network.

many thanks.

Re: CISCO ASA migration from 5510 to 5525x

Sheraz.Salim — Tue, 29 Jan 2019 12:15:42 GMT

2: Upgrade both the new 5525X Firewall to 9.9.X version

what version they on at the moment?

have a look on this doc will save you

https://www.cisco.com/c/en/us/td/docs/security/asa/upgrade/asa-upgrade/planning.html

Re: CISCO ASA migration from 5510 to 5525x

jyoti_prakash85@yahoo.com — Tue, 29 Jan 2019 12:16:41 GMT

New firewalls are on the 9.7 version and I would like to go with 9.9.2.

thank you for your prompt response.

Re: CISCO ASA migration from 5510 to 5525x

Sheraz.Salim — Tue, 29 Jan 2019 12:21:50 GMT

yes no interim upgrade required you good to go.

Re: CISCO ASA migration from 5510 to 5525x

jyoti_prakash85@yahoo.com — Tue, 29 Jan 2019 12:24:19 GMT

Thank you very much. Is this migration plan looks ok to you?

1: Full system backup – Production Firewall (primary and secondary).
2: Upgrade both the new 5525X Firewall to 9.9.X version.
3: Configure Interface (as per the new 5525X Firewall) and HA on Primary Firewall.
4: Configure Object, ACL, NAT, and VPN.
5: Configure the Secondary Firewall with only Failover syntax.
6: Compare the configuration (old and new) for any missing info with the actual production.
7: Save the ARP details for the troubleshooting.
8: Configure the TACACS access after firewall swap and in the network.

Re: CISCO ASA migration from 5510 to 5525x

Sheraz.Salim — Tue, 29 Jan 2019 12:31:41 GMT

yes looks good to me but make sure you understand the process of the upgrading the software in active/passive

load the image on both units' disk0:
change the boot variable
save the config with that change
from the active unit, "failover reload-standby"
wait for successful reload and verify configuration is synced OK. You should expect a message that mate software version is different.
"no failover active" on active unit
log into newly active unit and "failover reload-standby"
wait for succeful reload and verify configuration is synced OK. Both units are now on 9.9x.

Re: CISCO ASA migration from 5510 to 5525x

jyoti_prakash85@yahoo.com — Tue, 29 Jan 2019 12:37:42 GMT

Thank you so much, Sheraz. I really appreciate your prompt response with this.

I'll follow the upgrade process you have mentioned above. many thanks.

Re: CISCO ASA migration from 5510 to 5525x

jyoti_prakash85@yahoo.com — Wed, 06 Feb 2019 13:23:58 GMT

Hi,

Can I configure the management port of each ASA in HA with unique IP and I don't want them to be part of the failover? So that I can access each ASA for the troubleshooting. is that possible?

Re: CISCO ASA migration from 5510 to 5525x

jyoti_prakash85@yahoo.com — Wed, 06 Feb 2019 14:17:39 GMT

Hi,

Can I add management interface IP for each ASA and can access for the troubleshooting. Also, I hope the config will not overwrite in HA.