Need help on Cisco ASA and PIX migartion o ASA

[m-abooali]

Hello,

the organization I work for has purchased two Cisco ASA 5500 series and wants to get rid off two PIXs (515E, image 7.1) and use the Cisco ASA to do Firewalling plus VPN. Well this is my frist exposure to Cisco ASA and I have read almost all the available documents on ASA that Cisco has published and have gain understanding of how ASA works, single mode, multimode and security context (vertual Firewall) but I still really don't know if the ASA will infact do what the physical PIXs are doing plus VPN. One of the main points of confusion for me is that, based on Cisco dicuments, if I enable Multimode then, I cannot use the ASA for VPN?? but i don't know if my understanding is correct or if there are ways around it??

We have over 100 VLANs on our switched network with 2 cores switches 6509 and 4006 (Cisco IOS) all fiber and ports on core 6509 are set to trunk and is VLAN server. we have mant Cisco 3560s and 3550 switches all over this campus in various closets. VoIP and eigrp and Spanning -tress are also other services running. well I really don't know how ASA will fit in all that I have explained above and need help undertanding so that I can have a clear picture of ASA relation to all of these equipments, routing, STP plus VLANs.

at this time I really don't know where to start if I wanted to start removing the PIXs and put the ASAs in their place today??

Also, I must note here that the engineer before me had done some configuration on ASAs but they don't work properly and PIXs are still doing the Firewalling. i can see subinterfaces have been created on the ASAs but something is wrong there that I cannot pinpoint.

Any help and assistance you guys can give me is greatly appreciated.

Please forgive me for this long posting but I had to be somewhat clear on what I have in my hands and what I want to do having no idea of where to start??

Thanks.

Mike

[JBDanford2002]

The ASA should be able to do what you want. Especially if you are replacing a PIX. Do you need to run multi mode? As far as the config goes it should be fairly easy to transfer the config from the PIX to the ASA. Yes you cannot run VPNs on Multimode but the ASA will do what you are currently doing and more. If you would like to work through the config problems post the problem you are having and a scrubbed config.

[JORGE RODRIGUEZ]

As Jbdanford indicated, it should be fairly straight forward to migrate if not implementing multi-mode. you have to analyse what you currently have and what additional features gain when deploying the ASA .

If you are simply migrating from PIX 7.x then you should be able cutover almost the same info to the ASA as a single mode

firewall. As far as the migration goes I would recommend start a new config on the ASA having it offline and following the logical information from the PIX.

Gather with your peers and go over the main reasons why you would want to run multiple context and its benefits,as well as the features you will have to give up such as VPN, dynamic routing and multicast

if deployeed as such.

here is some more info on unsuported features and common uses for multiple context.

http://www.cisco.com/en/US/docs/security/asa/asa71/configuration/guide/contexts.html#wp1116132

If you are currently doing VPN in your PIX and decide to use multiplex-context you could always deploy a VPN concentrator solution.

[m-abooali]

Hi Guys,

Ok, I will try to do what Jbdanford and you suggested and will get back here for more assistance if needed. I personaly don't see why they want to get rid off PIXs while they are doing what they are suppose to do unless Cisco announces end of life/end of service for Cisco PIXs in near future which i don't think that is the case. They don't have VPN running on the PIXs and it should be easy to just copy and past the PIX 7.1 config into the ASA in single mode and let them run. I have one question though? how is the failover works in ASA? is it like PIXs?

Thx,

Mike

[JORGE RODRIGUEZ]

The failover is based on the same principle as the pix, however, there are differences in the ASAs an how failover functions based on the firewall mode implemented. There is no serial connections on asa's, only Lan base connections. Go over this link, it will give you overall information regarding failover, licences etc..

ASA Failover config architecture

http://www.cisco.com/en/US/docs/security/asa/asa72/configuration/guide/failover.html

rgds

Jorge