Solved: Cisco ASA OS Upgrade

Adley Francois · ‎02-21-2016

Hello,

What are the challenges while upgrading Cisco OS from 8.2 (5) to 9.1 (7)? I'm planning to go through from 8.2 to 8.4 to 9.1, Is it correct? Is there any chance of losing the configuration or any issue?

Please assist.

Marvin Rhoads · ‎02-21-2016

There are several pitfalls that have been discussed at length in many postings on this forum.

Primarily is the change of NAT and access-list syntax. The upgrade process will automatically convert them for you but in all but the most simple configuration, the results will likely add a lot of unnecessary complexity and in some cases results in broken functionality.

You also need to verify your ASA has enough memory to support the later versions. The requirements increased as of 8.3.

You should read through your configuration and some related threads and decide on whether you are comfortable with the changes.

I recommend starting with Jouni's thorough explanation of post-8.3 NAT:

https://supportforums.cisco.com/document/132066/asa-nat-83-nat-operation-and-configuration-format-cli

View solution in original post

Marvin Rhoads · ‎02-21-2016

There are several pitfalls that have been discussed at length in many postings on this forum.

Primarily is the change of NAT and access-list syntax. The upgrade process will automatically convert them for you but in all but the most simple configuration, the results will likely add a lot of unnecessary complexity and in some cases results in broken functionality.

You also need to verify your ASA has enough memory to support the later versions. The requirements increased as of 8.3.

You should read through your configuration and some related threads and decide on whether you are comfortable with the changes.

I recommend starting with Jouni's thorough explanation of post-8.3 NAT:

https://supportforums.cisco.com/document/132066/asa-nat-83-nat-operation-and-configuration-format-cli

mvsheik123 · ‎02-21-2016

Hi,

In addition to Marvin's suggestion... incase if you are planning to go to 9.1.7 due to recent 'critical' vulnerability, Cisco released 8.2.5.59- which addresses that issue. Your goal to address ikev1/v2 issue, 8.2.5.59 will do with out much hassle. However, recommended long term solution is to move to 9.x code - as 8.2.5 is end of support.

Thx

MS

Adley Francois · ‎02-23-2016

I went ahead and upgraded the OS from 8.2 to 8.4(3) to 8.4(6) to 9.1(7) and I didn't face any issue during the upgrade process except few commands were got it removed of crypto that I added back to the configuration and all is set now.

Thanks.