Chris, I will try and add a section that addresses this. For now: - You could create a Certificate Signing Request from Windows 7: https://technet.microsoft.com/en-us/library/cc730689.aspx [Make sure this is in base64 format] - Now take this CSR to the IOS CA: crypto pki server <name> request pkcs10 terminal base64 https://supportforums.cisco.com/document/57441/ios-ca-basic-deployment-certificate-enrollment-and-signing-process#Grant_the_certificate_on_CA: - The certificate you get here should be importable on your Windows 7 PC i will test this out just in case ... View more

Starting ASA 9.3(2), we support all IKEv2 standards based clients connecting to the ASA: http://www.cisco.com/c/en/us/td/docs/security/asa/roadmap/asa_new_features.html Look for: Interoperability with standards-based, third-party, IKEv2 remote access clients   ... View more

Starting ASA 9.3(2), we support all IKEv2 standards based clients connecting to the ASA: http://www.cisco.com/c/en/us/td/docs/security/asa/roadmap/asa_new_features.html Look for: Interoperability with standards-based, third-party, IKEv2 remote access clients   ... View more

Roberto, I am not sure if you have heard, but ASA 9.3(2) now supports Windows 7 Built-in IKEv2 client: http://goo.gl/UZllWZ Feature name: Interoperability with standards-based, third-party, IKEv2 remote access clients   ... View more

I see a problem with the statement: nat (inside,outside) dynamic OBJ_GENERIC_ALL an ip-address/network-based object should follow the 'dynamic' keyword. In your case, i see the statement should have been: object network OBJ_GENERIC_ALL   nat (inside,outside) dynamic interface ... View more

This is a bi-directional nat statement. So yes, outside user can initiate a connection request to 192.168.100.100 which will then get untranslated to 10.1.1.6 on the inside interface. PS: We need to allow access to real ip address in the access-list on the outside interface i.e. "permit <protocol> any host 10.1.1.6") ... View more

The statement says that there is a Web-Server at 10.1.1.6 on the "inside" and it is statically being translated to 192.168.100.100 on the "outside" ... View more

Well with HA in picture, what you have in mind should work just fine. You could also do this: 1. As far as 5520 is concerned, just get one ASA (that will be converted to HA), and migrate it to 8.4 2. Edit this config in order to get interfaces and boot variable (pointing to 8.6) right (and remove the checksum part (i know i keep repeating this part, but this is absolutely necessary )). And also, for each interfaces append a standby ip address. 3. Load it on 5525-x and reload 4. Make this 5525-x the primary in the HA Pair 5. Add the secondary 5525-x enable failover on this one 6. The second 5525-x should now sync up the config This way you need to worry about HA config only once (on 5525-x). If the interface mapping stay the same, i guess you can follow your method, but as you can see above, since the secondary box does not need to be *built* (config sync up happens when you build HA), forming 5520 HA is not necessary -- Praveen ... View more

Hey Robin, All 55xx-X series ASAs can load OS beyond 8.6 only, but they are almost similer to 8.4 when it comes to configuration. So since you have ASAs as opposed to PIXs, you have two options: Option#1: 0. backup your ASA config. 1. Upgrade these ASAs to 8.4 when you are about decommission them. And it does not matter if they don't have enough RAM (since they are not going to be operational) 2. Now Back this config and make changes to the interfaces (i.e.only if 5525-x interface mapping changes  compared to 5520)    - Remove the old 'boot system ..' statement and add thew new 'boot system ..' statement    - remove the 'Crypto Checksum' part from the end. 2. Load it on ASA5525-x's Flash (asdm/tftp/ftp) 3. on ASA5525-x, replace the startup-config with the PIX's config:    copy flash:/pix-config.txt start 4. Do NOT execute 'write mem' 5. Reload Option#2: Same as option #1, if you choose to skip step #1 in the last option. (i.e. identical with the last PIX to 5525-x migration steps) Let me know if you have any queries. -- Praveen ... View more

Hey Fahad, I haven't used that tool myself, but yeah sure please go ahead and ask, if i know, i will for sure answer or at least give some pointers. -- Praveen ... View more

Hi Shine, Sure, you can migrate from any older version directly to 8.4, provided the system meets the memory requirements. The major changes that stand out are NAT and Real-IP Usage in Filter ACL (rather than using Translated IP), however these are taken care of i.e. the ASA OS  post-8.3 have built-in config migrator that does a good job. Please read these: https://supportforums.cisco.com/docs/DOC-12690 http://www.cisco.com/en/US/docs/security/asa/asa83/upgrading/migrating.html HTH -- Praveen ... View more

Hey Jouni, Ah well, i will be honest with you here i haven't gotten a chance to work on Smart Call home feature, but for one i do know that this is supported on multi-context. You can add any command to the list, having said that, you can add "more flash:\ .cfg" and that should get you the specific context config. Also, any command added in the snapshot should run in system context AND the regular contexts: From the config guide: In multiple context mode, the snapshots  command is divided into two commands: one to obtain information from  the system context and one to obtain information from the regular  context. HTH -- Praveen ... View more

Hi Jouni, Have you checked out our Smart-Call home feature, which you can customize to backup the ASA config periodically: https://supportforums.cisco.com/docs/DOC-14958 More on Smart Call Home: https://supportforums.cisco.com/docs/DOC-12801 I know you are looking for  builtin tool, but it seems this is it for now. Then there is a Cisco Works Tool called, Cisco Security Manager (CSM): http://www.cisco.com/en/US/prod/collateral/vpndevc/ps5739/ps6498/data_sheet_c78-584863.html Also, you can use a perl script to do this (ah yes, not a built in feature ), as mentioned at: http://www.cisco.com/en/US/docs/security/asa/asa82/configuration/guide/admin_swconfig.html#wp1063700 That is it from us. I would also point out 'rancid', if you are interested: http://www.openmaniak.com/rancid_tutorial.php This not only backs up the config, it also diff's the config, which is what the name stands for (apparently it is, 'Really Awesome New CIsco Diff' tool ) -- Praveen ... View more

Well Rafael, you might not like my answer, but i have a workaround for you apart from doing this manually: 0. 1. Get the PIX config. 2. Edit it using an editor like notepad++:    - replace interface types (ethernet) manually with the correcponding interface types on the New ASAs (gigabit)    - Remove the old 'boot system ..' statement and add thew new 'boot system ..' statement    - remove the 'Crypto Checksum' part from the end. 2. Load it on ASA5525-x's Flash (asdm/tftp/ftp) 3. on ASA5525-x, replace the startup-config with the PIX's config:    copy flash:/pix-config.txt start 4. Do NOT execute 'write mem' 5. Reload Now the ASa boxes should come back up with the migrated config. -- Praveen ... View more

Well, you can copy over tftp/ftp/http(asdm). You can also add additional flash cards, but sorry, no USB -- Praveen ... View more