I need to move from ASA 8.4(1) to 9.0(2).
Reading http://www.cisco.com/en/US/docs/security/asa/asa90/release/notes/asarn90.html#wp582431 it seems to be a quite safe upgrade cause I do not have IPv6 ACL and I have only IKE v1. The following is not very understandable to me,
No Payload Encryption for export—You can purchase some models with No Payload Encryption. For export to some countries, payload encryption cannot be enabled on the Cisco ASA 5500 series. The ASA software senses a No Payload Encryption model, and disables the following features:
–
Unified Communications
–VPN
You can still install the Strong Encryption (3DES/AES) license for use with management connections and encrypted route messages for OSPFv3. For example, you can use ASDM HTTPS/SSL, SSHv2, Telnet and SNMPv3. You can also download the dynamic database for the Botnet Traffic Filer (which uses SSL) and redirect traffic to Cloud Web Security.
Reading http://www.cisco.com/en/US/docs/security/asa/asa84/release/notes/asarn84.html#wp415084 under 'Limitations and Restrictions' I find this point moving to 8.4(2), which I also dont understand,
Currently in 8.4(2) and later, the PAT pool feature is not available as a fallback method for dynamic NAT or PAT. You can only configure the PAT pool as the primary method for dynamic PAT. For example, if you enter the following twice NAT command that configures a PAT pool (object2) for fallback when the addresses in object1 are used up, you see the following error message:
hostname(config)# nat (inside,outside) source dynamic any object1 pat-pool object2
interface round-robin
ERROR: Same mapped parameter cannot be used to do both NAT and PAT.
ERROR: NAT pool allocation failed.
You can alter this command to make it PAT-pool only by removing object1; the PAT pool is used as the primary method, instead of as a fallback method:
hostname(config)# nat (inside,outside) source dynamic any pat-pool object2 interface
round-robin
(CSCtq20634)
Is there any other point I need to consider moving from ASA 8.4(1) to 9.0(2)? any advice or upgrade experience?
Thank you
