Manage multiple Cisco ASA's

[Jon Are Endrerud]

Hei Everyone

Im managing multiple Cisco ASAs, ranging from 5555X to 5505, and all in between. Currently I am using the GIthub project Oxidized for configuration backup and pushing to Gitlab for changelog and storing of configuration. (https://github.com/ytti/oxidized) This project also takes care of my other units.

I am still struggling with management of the configuration changing when accesslists, nat rules and cryptomaps changes. What are people using for this ?, Are there anyway for example to easily deploy a new access rule to several devices at the same time ?

ASDM is ok for one device, but there must be something easier.

Thanx in advance

Jon

[mattjones03]

Hi Jon,

I find that Device Expert by Manage Engine is great for this type of thing.

Should tick all the boxes for the criteria you have mentioned.

[Dennis Mink]

Solarwinds Network configuration manager can do this.

you basically create a file with all the configuration changes and aplply that to devices x.y.z on time T.

its very easy to use costs around AU$1300 / year for 200 node licenses

[Oliver Kaiser · Accepted solution]

Cisco CSM could be used to do this. In the future it will be firepower management center when all ASAs run FTD.

If you are into oss and automation you could take a look at the ansible modules for asa. Since asa provides a rest api that has crud operations for acl&nat it can be used to automate changes

[nspasov]

All very good suggestions here. I would also suggest adding Cisco's Defense Orchestrator (CDO) to the list. It is pretty new and lacks many features but it seems like with the latest udpate/version Cisco has added a lot of new features:

http://www.cisco.com/c/en/us/products/security/defense-orchestrator/index.html

Thank you for rating helpful posts!