Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

Copy config from ASA5550 (8.2) to ASA5520 (8.4)

Has anyone tried this or done something similar?  This is to test the upgrade of our ASA5550 from 8.2 to 8.4. 

I have a test ASA5520 with 8.4.  I copied the 5550 config to the 5520 then rebooted it.

After the upgrade, I couldn't test connectivity of course, but the upgrade seem to be a success as the errors in the logs are minimal.

However, after looking at the new config ,I see new entries (i.e access-lists, object-groups) that do not exist in the old config.

I'm familiar with the new NAT and object scheme.  But in looking at the flow for our outside ACL (from object, to NAT, to access-list), it does not seem to make sense.

I'm also opening a TAC case to see if they can evaluate the configs. 

I also wanted to ask those who have gone though the upgrade what they're experience had been.

Any comments is appreciated.

Everyone's tags (4)
6 REPLIES

Copy config from ASA5550 (8.2) to ASA5520 (8.4)

Hello Richard,

8.3 and higher versions is based on object-networks so your entire nat will be based on that ( as an example if you have names enabled before the upgrade, all of the names will be translated to objects automatically)

Also if you have nat-control enabled extra nat statements will be added to your configuration as Nat control is disabled on this higher versions so it's a must to disable it before the upgrade.

Please keep this links with you

https://supportforums.cisco.com/docs/DOC-12690

http://www.cisco.com/en/US/docs/security/asa/asa83/configuration/guide/nat_objects.html

Rate all the helpful posts

Regards,

Julio

Looking for some Networking Assistance? Contact me directly at jcarvaja@laguiadelnetworking.com I will fix your problem ASAP. Cheers, Julio Carvajal Segura http://laguiadelnetworking.com
New Member

Copy config from ASA5550 (8.2) to ASA5520 (8.4)

Hi Julio,

Thanks for the reply.  Names and nat-control are disabled on our 5550.

Copy config from ASA5550 (8.2) to ASA5520 (8.4)

Hello Richard,

The nat control disabled is great

Please read the first link I sent you so you can learn about how the ASA on 8.3 and higher versions works, then you will be able to read your configuration and figure out if there is something wrong.

Rate all the helpful posts

Looking for some Networking Assistance? Contact me directly at jcarvaja@laguiadelnetworking.com I will fix your problem ASAP. Cheers, Julio Carvajal Segura http://laguiadelnetworking.com
New Member

Copy config from ASA5550 (8.2) to ASA5520 (8.4)

I also discovered that the outside ACLs are still showing the NATted IP addresses instead of Real addresses.

Looks like there's going to be a LOT of cleaning up after the upgrade. 

Has anyone encountered this issue?

Copy config from ASA5550 (8.2) to ASA5520 (8.4)

Hello Richard,

That usually happens because of an upgrade error but I have seen the behavior before, let's see if someone else has seen this issue.

Regards,

Julio

Looking for some Networking Assistance? Contact me directly at jcarvaja@laguiadelnetworking.com I will fix your problem ASAP. Cheers, Julio Carvajal Segura http://laguiadelnetworking.com
New Member

Copy config from ASA5550 (8.2) to ASA5520 (8.4)

Thanks Julio.  I will go through it again and see if I get a different result.

403
Views
0
Helpful
6
Replies