Firewall config move

[Patrick McHenry]

Hi,

I would like to take a config from a ASA5520 version 8.4(7) and convert it to run on a 5545X version 9.1(1) or higher. Is there a tool I can use to convert the config to match up with the 5545X hardware and software?

Any good docs on the procedure for doing the migration?

Thank you

[INGENIERIA Y CONSULTORIAS WEBREDES LTDA · Accepted solution]

i recommend you to create the whole configuration from scratch if you don't know the main differences.

but as i see you had an 8.4 config version, must be compatible... so try it!!!

just took attention with the copy with keys... so the whole config transfers the users and passwords of the VPN users.

[Marius Gunnerud · Accepted solution]

There are no gotchas to look out for in 9.1.  You can copy paste your configuration straight from 8.4(7).  9.1 introduces support for CX-SSP for ASA 5512-X through 5555-X

http://www.cisco.com/c/en/us/td/docs/security/asa/asa91/release/notes/asarn91.html#wp744465

Just copy about 10 lines at a time.  this ensures that there are no copy paste errors, and if you do happen to see an error it is easier to troubleshoot.

Another option is to copy the running-config file using TFTP to the new ASA then copy the running config file to the startup config.  this way is probably the fastest but if you do happen on som errors it is more difficult to troubleshoot...if you ask me that is.

--
Please remember to rate and select a correct answer

[Patrick McHenry]

Thanks Guys - how about copying from usb to running config? Must I still pay attention to lines not being added?

Thank you

[Marius Gunnerud]

I am sure that it is possible, though I have never tried this.  Just keep in mind that not all USB types are supported.

--
Please remember to rate and select a correct answer

[James Leinweber]

I'm too chicken to copy to the running config; I import the old syntax to a separate file, copy it to the startup config, reload, and let Cisco convert it live during boot.  Then there is some cleanup and saving to do.   From 8.4 to 9.x you don't have the NAT changes to worry about, so things would probably go mostly OK.  Aside from IPS, the big firewall innovations in 9.x are the v6 ACL's got integrated, so you have new any4 and any6 keywords for mono-protocol traffic, and any is dual-protocol.  You'll probably want to pay attention to that; it made me unify some of my network object-groups and rewrite a bunch of ACLs.  Also, IPsec tunnels can optionally use IKEv2 instead of IKEv2 for negotiations.

-- Jim Leinweber, WI State Lab of Hygiene