ASA 5505 upgrade query

[ROHIT SHARMA]

I have this ASA:

Cisco Adaptive Security Appliance Software Version 8.4(4)
Device Manager Version 7.3(1)101

Compiled on Mon 21-May-12 10:48 by builders
System image file is "disk0:/asa844-k8.bin"
Config file at boot was "startup-config"

Hardware:   ASA5505, 512 MB RAM, CPU Geode 500 MHz
Internal ATA Compact Flash, 128MB
BIOS Flash M50FW016 @ 0xfff00000, 2048KB

Please advise if I'll face any problem while upgrading it to 9.1 ?

[Vibhor Amrodia · Accepted solution]

Hi,

I would request you to upgrade first to ASA 8.4.6 and then upgrade to the ASA 9.1.

Rest all should be good. Keep note of the memory utilization.

Thanks and Regards,

Vibhor Amrodia

[ROHIT SHARMA]

Current Memory Utilization is 48% but free flash is only 17 MB.

Don't you think it could be  a problem?

[Vibhor Amrodia]

Hi,

Yes , so I think you would have to remove some if the files and make space for the new IOS image.

Thanks and Regards,

Vibhor Amrodia

[ROHIT SHARMA]

Thanks,

Is there any change in terms of configuration that I have to take care while upgrading 8.4 > 8.4.6 > 9.1

e.g from 8.2 > 8.3  NAT change.....anything like that....

Will it be a smooth upgrade....?

[Vibhor Amrodia]

Hi,

There are some changes between the ASA 9.x and 8.4.x.

They should be minor and seamless.

You can check these release notes for more information:-

http://www.cisco.com/c/en/us/td/docs/security/asa/asa90/release/notes/asarn90.html

Thanks and Regards,

Vibhor Amrodia

[ROHIT SHARMA]

Hi,

What about RAM requirement for 9.1.5 ?

I have 512 MB of RAM.

now 47% free.with 8.4.4

[Vibhor Amrodia]

Hi,

I think that should be okay.

Thanks and Regards,

Vibhor Amrodia

[ROHIT SHARMA]

Hi Vibhor,

One last thing. Does 9.1 supports al the features of 8.4?

Specifically I want old vpn client that runs on IPSec.

It should not happen that some of the configuration becomes useless or something stops working.

[Vibhor Amrodia]

Hi,

Yes , the ASA 9.1.x will still support all the features on the ASA device and specifically the VPN client. Although , VPN client is now EOS:-

http://www.cisco.com/c/en/us/products/collateral/security/vpn-client/end_of_life_c51-680819.html

Thanks and Regards,

Vibhor Amrodia

[ROHIT SHARMA]

Hello Vibhor,

Can you suggest a stable release of 9.1

which version should i upgrade to?

[Vibhor Amrodia]

Hi,

I think upgrading to ASA 9.1.5 should be recommended as it is available on Cisco CCO.

Thanks and Regards,

Vibhor Amrodia

[James Leinweber]

Since you are already on the new NAT style, it should be smooth.

Note that as of 9.0 IPv6 and IPv4 access lists are unified, so the "any" keyword is now dual-protocol.  Use "any4" or "any6" if you want just one protocol.  The upgrade should preserve the intent of your current rules, but you may want to review the results with more care than usual.

IPsec tunnels can use IKEv2, but this is not required.

-- Jim Leinweber, WI State Lab of Hygiene