Solved: Re: Migration from 5515-X to 5516-X

mwood000111 · ‎01-18-2019

CLN,

A few questions that I have not been able to get TAC to give me a straight answer on, are do I need to move over existing AnyConnect SSL certs or do I have to generate new ones? Share or rehost license? Im in the middle of configuring new 5516-X so any assistance/insight/knowledge docs would be greatly appreciated. Thanks.

Marvin Rhoads · ‎01-18-2019

The certificates depend on what type you are using.

If you have an externally generated CSR (e.g. you have a copy of the private key used in the request) and CA-issued certificate, then you can import the certificate and private key on to the new ASA.

If your AnyConnect licenses are 4.x type (Plus or Apex PAKs issued) then the PAKs can be used across multiple ASAs to create activation keys since the licenses are per unique user, not per device.

View solution in original post

Marvin Rhoads · ‎01-18-2019

The certificates depend on what type you are using.

If you have an externally generated CSR (e.g. you have a copy of the private key used in the request) and CA-issued certificate, then you can import the certificate and private key on to the new ASA.

If your AnyConnect licenses are 4.x type (Plus or Apex PAKs issued) then the PAKs can be used across multiple ASAs to create activation keys since the licenses are per unique user, not per device.

mwood000111 · ‎01-22-2019

Thanks Marvin. We do have an externally generated CSR and Ive been able to copy them over.

Ill be deploying these 5516-Xs in HA. Ive been able to get the primary configured and the config pushed over to secondary but am have not be able to get the anyconnect-win-4.x over to it. My steps were to get in to ASDM, take full backup of 5515-X, and restore on 5516-X primary. That worked to get everything over to that node. Did the same for the secondary but the image mentioned above and XML profiles associated with AnyConnect didnt copy over. Is there another way to get that on to the secondary? Do I need to have those files in disk0: on the secondary? Thanks.

Marvin Rhoads · ‎01-22-2019

You're welcome.

The AnyConnect images and xml profile file need to be copied onto the secondary unit manually. You do need them on disk there because the unit will require them if it is ever in the Active role.

HA synchronization won't sync the file systems - only the configuration.

mwood000111 · ‎01-22-2019

Ok that makes sense. Ill get to work on manually adding the images and XML files, thats not an issue. Ill let you know if I run in to any further issues. Appreciate the information.