ASA 8.0 configuration migration to 8.6 new ASA

[Ali Koussan]

Hi
I have old ASA with 8.0 configuration that includes huge number of ACL, NAT , VPNs , we got a new ASA with 8.6 , and we are planning to move the configuration to the new box , I'm wondering what is the best approach to do this , I'm thinking of one of the following scenarios

1- downgrade the new ASA to 8.3 , the apply the config , remove the identity nat commands and names then upgrade to 8.6 and after that reconfigure the NAT rules and object groups .

2- convert the old config manually to 8.6 code including NAT , object-group ,ACL and apply it to the new ASA ( this is going to be huge task)

Any suggestion for better way of doing it ? What are the commands that I have to look at when I convert to 8.6 and will the VPN configuration be affected ?

Any idea will be helpful...

Thanks
Ali

Sent from Cisco Technical Support iPad App

[Jouni Forss · Accepted solution]

Hi,

I guess you are getting a new ASA 5500-X series firewall since you mention the 8.6 software.

To my understanding 8.6 is the lowest software level for the new ASA5500-X series and cannot be downgraded to 8.3 or even lower.

Even though the conversion of the configurations manually might be a chore at the start I would still always recomend anyone to do the conversion by hand. You will get used to the new NAT and ACL configurations better and probably make less mistakes when the actual ASA is in production.

The amount of work you have to do is mostly upto the amount of NAT/ACL configurations and ALSO how well you have done them so far. If you for example have done alot of complicated NAT configurations you will naturally have more to take into consideration when writing the new configurations.

The main things for the new software when rewriting old configurations are

• NAT configurations
  • Obviously the largest change
• ACLs (most changes related to "outside" interface ACL)
  • You open traffic always towards the Real IP instead of the NAT IP like in the 8.2 and below softwares
• Some minor changes to VPN configuration format (some parameters added or parameters have different names
  • "ikev1" in Crypto Policys, Transform Sets, Pre-shared-keys

Here is link to a document on these forums that compares the Old and New NAT configuration formats

https://supportforums.cisco.com/docs/DOC-9129

- Jouni

[Ali Koussan]

Hi Jouni

Thanks for the advice ,

I have lots of ACL configured with names , shall I remove the names from old asa , then take the ACLs to the new ASA , then configure the object groups , I think this will make the ACLs config easier on the new ASA,

For the NAT , most of it are static , so I will convert it manually , but I'm worried about the NAT 0 used for VPN , the interesting traffic ACL includes many lines and as per the new code I have to make separate object group for each line , is there any better way of dealing with NAT 0 conversion ?

Appreciating your advice .

Sent from Cisco Technical Support iPad App

[Jouni Forss]

Hi,

You should be able to disable the use of "name" configurations on the ASA (while leaving the actual name/IP pairing configurations on the ASA) After that the ACL should show up only with object-groups and actual IP addresses/network addresses.

If you want to keep using the "name" configurations in the new software notice that atleast in the "outside" ACL your destination IP addresses (your local servers) will be with their private IP address. So there is bound to be changes to the "name" configurations if you have previously used the "name" configuration for a public IP address.

A question regarding the NAT0 configurations

• Do you only have NAT0 configurations for VPN Client or L2L VPN Connections? Or is there some NAT0 configurations between your local ASA interfaces? Or is it just between "inside" -> "outside"?

I guess if you want you could copy/paste your NAT0 configurations (nat commands and ACLs) here and could take a look at them for you and help if I can.

- Jouni

[Ali Koussan]

Hi Jouni,

I have only the follwoing Nat configuration , in addition to many  static NAT

global (outside) 1 interface

nat (inside) 1 172.16.1.80 255.255.255.255

nat (inside) 0 access-list no_nat_vpntraffic

nat (DMZ) 0 Ironmail 255.255.255.255

access-list no_nat_vpntraffic extended permit ip host Citrix object-group Citrix_India

.

.

.

(no_nat_vpntraffic  ACL has around 25 lines)

any suggestion will help  ..

Thanks ..

[Jouni Forss]

Hi,

I dont know what the setup is when you have only one "global" rule and only one host address defined in the "nat" statement

NAT/PAT Configuration

object network PAT-SOURCE

host 172.16.1.80

nat (inside,outside) after-auto source dynamic PAT-SOURCE interface

DMZ NAT Configuration

• It seems that you are not NATing the host "Ironmail"
• Therefore if there truly is no NAT rule on your firewall at the moment that would match the source IP address of the "Ironmail" host then you simply dont need ANY nat configuration. It will pass the ASA without any translation.

NAT0 / NAT Exempt Configuration

• As you dont provide a full ACL with IPs/Networks I cant give you a specific answer.
• At this point I will only give you a simple example of how a single NAT0 configuration could look like.
• If you can combine the the existing NAT0 ACL to fewer NAT statements I guess depends on the whole setup currently on the ASA
• Object names below could be simpler/shorter. They are there just to illustrate the purpose of the "object" in question.

object network -SINGLE-SOURCE-FOR-NAT0

subnet

OR

host

object network SINGLE-DESTINATION-FOR-NAT0

subnet

OR

host

nat (source-interface,destination-interface) source static SINGLE-SOURCE-FOR-NAT0 SINGLE-SOURCE-FOR-NAT0 destination static SINGLE-DESTINATION-FOR-NAT0 SINGLE-DESTINATION-FOR-NAT0

Basic 1:1 Static NAT Configuration

object network STATIC

host

nat (source-interface,destination-interface) static dns

- Jouni