Transfer Config from a Cisco 3030 VPN Concentrator to ASA 5520

[muzzia321]

Hello,

I have a Cisco 3030 VPN concentrator, and I need to transfer to config to a new ASA 5520.  My boss said that I should be able to port the config directly to the ASA, but I have TFTP'd the config to my TFTP server to look at it, and it is nothing like the ASA config setup. So I believe that copy and paste is out of the question.

My boss also told me he wasn't sure but I may need some sort of tool or software to make this transfer. Though, I have searched the internet for the past 2.5 hours, but couldn't find an answer on how I could go about doing this.  I have never really worked with the 3030 Concentrator before, so I'm not really sure what most of the config means, since it is so different.

Does anyone have any info on how I could do this transfer easily? Any help would be appreciated.

Thanks in advance

[Karsten Iwen]

There is no easy transfer of the config. Migrating a complex VPN3000 config is defenitely hard work. You find some help in the VPN3000 to ASA migration-guide:
http://www.cisco.com/en/US/docs/security/asa/asa72/vpn3000_upgrade/upgrade/guide/migrate.html

It's only for ASA v7.2 and I'm not aware of any newer version. But still it's a starting-point for the migration.


Sent from Cisco Technical Support iPad App

[Richard Burts · Accepted solution]

The opinion of the boss of the original poster that he should be able to port the config directly from 3030 to ASA is logical but incorrect. You certainly can not copy the config directly from 3030 to ASA.

There used to be a utility that would take a 3000 config as input and suggest a config for ASA. I remember working with a Cisco SE to have the utility help me with a conversion. The result was very seriously flawed. :(
I am not sure the utility still exists - and if it did my experience was so bad I would not try it again.

The 3000 concentrator was certainly oriented to its GUI interface. Trying to look at the text config file to understand what is going on is an exercise in futility. The original poster needs to understand and document the current functionality and then figure how to configure the ASA to do this.

HTH

Rick

Sent from Cisco Technical Support iPad App

[Marvin Rhoads]

That's my experience as well, Rick.

[muzzia321]

Thank you all for your help.  My boss thought there might have been a way to do this, but wasn't sure and that's why he has me looking this up.

I figured I would just have to go through the GUI and find out how to duplicate the config on the ASA. I have found that the ASDM software for the ASA is very helpful in doing this. It makes the duplication much less strenuous, and matches a little better than trying to figure it out in the CLI.

It is also nice that ASDM has wizards to help you set up many options on the ASA.  (***Note this for anyone else asking this question****)

Again, Thanks to all

[Marvin Rhoads]

Glad to hear the answers helped.

I would only suggest aht you start out with ASA software version 8.4 (or 9.1) if your device has the memory to support it. You'll be better off using the newer NAT setup and will have the broadest feature set going forward on that path.