Copy ASA 5520 Configuration to Another 5515

[murilo.coutinho]

Hi All,

It's been a long time since I worked worked with the ASAs but having to replace a 5520 with a 5515.

The customer current ASA is running version 9.1.(7)23 and the ASA 5515 doesn't support 9.1.7. and asdm 7.1.5

From what I can see there is not a "same image" that both ASA support so how is the best way to do it?

The existing config has certificates so according to other threads I read it is best to use the backup command. However the backup/restore is only available from version 9.3. The config also seems to have Anyconnect and apparently I can use the export command for it.  How can I import it?

Thanks All.

So it doesn't look like I have an option but to copy and paste. Does anyone know if it works fine?

What I am thinking at this stage is to go with version 9.4.4 or 9.6.4 on the 5515. Hopefully no major differences.

[Marvin Rhoads · Accepted solution]

You can generally copy from the old one, edit in a text editor to account for interface numbering changes, hostname, boot and asdm variables and paste into the new firewall.I recommend using something like examdiff to check your editing work before and after.

If you're using an identity certificate for VPN it's generally better to get it reissued from the CA. If you export it intending to import to the new ASA, you need to have the private key as well as the certificate itself.

For the 5515-X I would recommend going with a more recent Cisco-recommended release. ASA 9.8(4)20 or 9.12(3)12 and ASDM 7.14(1)46.

The old config should be syntax-compatible with the few caveats I mentioned earlier.

[Sheraz.Salim · Accepted solution]

As @Marvin Rhoads explained I just want to point out you said you have certificate on your old unit firewall Here this document help you to export the identity certificate your your old firewall and this cert can be import in new firewall. 
one last thing in order to take the config of old unit give command 

more system: running config

this command will show you the password if there is site to site vpn configured.

[murilo.coutinho]

Thanks a lot.