ASA migration from 5520 8.2 to ASA 5545 9.x

[jyoti_prakash85@yahoo.com]

Hi All,

I would like to migrate one old ASA cluster from 5520 version 8.2 to ASA 5545 9.x.

I would appreciate if you anyone please help me with the steps to follow. 

Many thanks

JP

[balaji.bandi · Accepted solution]

8.2 to 9.X  is big change.

How many Rules you have in the FW, if they are Few Hundreds.

i will redo the work by creating new ACL rules in the new ASA (install along with Old FW)

in the maintenance window  do the  Cut over to new ASA ( leave the old one still on, in case any issue you can role over back to OLD ASA)

Make sense ?

[jyoti_prakash85@yahoo.com · Accepted solution]

Thank you, BB for your quick response on this. What about NAT rules and object groups. As I have more than 200 object groups and 200 NAT/ACLs. So do I need to create all of the manually on new ASA?

my old ASA has too many ACLs and NATs. So I am a bit worried about creating them all manually. Does Cisco have a tool for the conversion to 8.3 or later version?

[balaji.bandi · Accepted solution]

Once of the document attached may help you.

Also this reference :

https://www.cisco.com/c/en/us/td/docs/security/asa/upgrade/asa-upgrade/planning.html

https://www.cisco.com/c/en/us/td/docs/security/asa/asa83/upgrading/migrating.html

https://community.cisco.com/t5/security-documents/asa-pre-8-3-to-8-3-nat-configuration-examples/ta-p/3116375

https://learningnetwork.cisco.com/blogs/vip-perspectives/2012/10/11/meet-the-new-nat-on-the-asa-83-or-higher

[jyoti_prakash85@yahoo.com]

Thank you so much, BB. I appreciate your help.

[balaji.bandi]

no worries and you welcome.

[Marvin Rhoads · Accepted solution]

Cisco does have a tool but I don't believe it's accessible to end users. Your partner should be able to assist you in creating an conversion. Refer them to https://fwm.cisco.com

If you cannot get access to that, consider the free tools at tunnelsup.com. That can help with pre-migration cleanup and NAT rule conversion.

[jyoti_prakash85@yahoo.com]

Thank you so much for letting me know about this hidden tool :). I appreciate your time and help.

I will contact Cisco in case they can help me.