ASA 5585 IOS upgradation from 8.2(5) to 9.0(2)

sayast001 · ‎11-09-2013

Hi,

I am getting below warning messages when i am doing IOS upgradation of ASA5585.The current version of IOS is 8.2(5) and the converted version is 9.0(2). I would like to know whether i can ignore the warnings and move on with new version or need to do any manual changes in configuration.

This is my internet firewall which has DMZ as well.

WARNING: MIGRATION: ACE converted to real IP/port values based on

dynamic/static Policy NAT. The new ACE(s) need to be checked for enforcing policy NAT ACL

Thanks

Soumya

Jouni Forss · ‎11-09-2013

Hi,

Seems you have done quite a jump with your software.

I have personally done every single migration with manually creating the configurations for the customer firewall. I doubt I will do any such bigger software jump through automatic configuration conversion but the future updates from 8.3 all the way to 9.1 would seem a bit safer.

That being said, I have not really therefore seen the different WARNING messages of the conversion.

Your WARNING message seems to suggest that you had Static/Dynamic Policy NAT configured on the firewall before the upgrade. It also seems to suggest that you should check the ACLs. I presume that this means the ACLs that allow traffic on the interfaces regarding these rules since the new software DOES NOT use any ACLs in the NAT configurations.

So I am not sure if this is anything you should worry about. I guess your main thing to check would be that are your interface ACLs correct. And that is naturally easy in the sense that you always refer to the real/local/actual IP address of the host and NOT the NAT IP address that you still did in software 8.2(5) (or any software below it)

I guess if in doubt you could share the current and new Policy NAT configurations and possible ACLs related to them if you want to have them checked out. You can even use the "packet-tracer" command to naturally test that every NAT and interface ACL are performing the same way as before the upgrade.

I would imagine that your configuration might be large considering the hardware you are using?

Let me know if you need any help with confirming that the converted configurations are correct compared to your old ones.

- Jouni

Marius Gunnerud · ‎11-09-2013

For successful upgrad from a pre 8.3 version to 9.0 or later you need to upgrade to 8.3 or 8.4 before going to 9.0.

http://www.cisco.com/en/US/docs/security/asa/asa91/release/notes/asarn91.html#wp731971

Here is an explanation of the error found in this link

http://www.cisco.com/en/US/docs/security/asa/asa83/upgrading/migrating.html#wp88029 :

Error Message    ACE converted to real IP/port values based on dynamic/static Policy NAT. The new ACE(s) 
need to be checked for enforcing policy NAT ACL.


 
Explanation    When you migrate policy NAT, check that the new access list does not open any security holes. For example,  the following pre-migration configuration translates 10.50.50.50 to 172.23.57.170 only when the destination address is  on 10.0.0.0: 
 

access-list policyacl1 extended permit ip host 10.50.50.50 10.0.0.0 255.0.0.0 


 
 
 

static (inside,outside) 172.23.57.170 access-list policyacl1


 
 
 
 This access rule permits any traffic to the mapped address, but because  this mapping only occurs when the traffic is to or from 10.0.0.0, this  access list essentially only allows 10.0.0.0 to access the inside host: 

 

access-list 1 permit ip any host 172.23.57.170


 

access-group 1 in interface outside


 
 
 
 The migrated configuration permits any traffic to the inside host;  however, because the access list now uses the real IP address, any  traffic can access the inside host, and not just traffic from 10.0.0.0: 

 

access-list 1 extended permit ip any host 10.50.50.50 


 

access-group 1 in interface outside


 
 
 
Recommended Action    You should fix the access list to be: 
 

access-list 1 extended permit ip 10.0.0.0 255.0.0.0 host 10.50.50.50 


 

access-group 1 in interface outside

Basically it is telling you to check and make sure that the configuration is correct and that there are no security holes.

--
Please remember to select a correct answer and rate helpful posts

sayast001 · ‎11-09-2013

Hi ,

Sorry, I forgot to mention that we have upgraded from 8.2->8.4.6>9.02.

We have multiple warning messages like below. A huge number of inbound access rules have been created in new version and we are worried whether this will creat a security loop.

WARNING: MIGRATION: ACE converted to real IP/port values based on

dynamic/static Policy NAT. The new ACE(s) need to be checked for enforcing policy NAT ACL

216.163.252.25

8.2(5)

access-list outside extended permit udp host 216.163.252.25 host 203.99.194.163

access-list outside extended permit esp host 216.163.252.25 host 203.99.194.163

access-list Metlife-VPN extended permit ip 10.239.48.0 255.255.255.0 host 216.163.252.25

access-list Metlife-VPN extended permit ip 10.237.164.0 255.255.254.0 host 216.163.252.25

access-list Metlife-VPN extended permit ip 10.229.32.0 255.255.255.192 host 216.163.252.25

access-list Metlife-VPN extended permit esp 10.229.32.0 255.255.255.192 host 216.163.252.25

access-list Metlife-VPN extended permit ip 10.242.146.0 255.255.255.0 host 216.163.252.25

access-list Metlife-VPN extended permit esp 10.242.146.0 255.255.255.0 host 216.163.252.25

access-list Metlife-VPN extended permit esp 10.239.48.0 255.255.255.0 host 216.163.252.25

access-list Metlife-VPN extended permit ip 10.237.241.0 255.255.255.0 host 216.163.252.25

access-list Metlife-VPN extended permit ip 10.230.107.128 255.255.255.224 host 216.163.252.25

access-list inside1 extended permit udp 10.237.164.0 255.255.254.0 host 216.163.252.25

access-list inside1 extended permit ip 10.229.32.0 255.255.255.192 host 216.163.252.25

access-list inside1 extended permit ip 10.242.146.0 255.255.255.0 host 216.163.252.25

access-list inside1 extended permit esp 10.242.146.0 255.255.255.0 host 216.163.252.25

access-list inside1 extended permit ip 10.239.48.0 255.255.255.0 host 216.163.252.25

access-list inside1 extended permit esp 10.239.48.0 255.255.255.0 host 216.163.252.25

access-list inside1 extended permit ip host 10.239.23.177 host 216.163.252.25

access-list outside extended permit ip any host 203.99.194.163

9.0(2)

object network obj-216.163.252.25

host 216.163.252.25