Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
New Member

Firewall config move

Hi,

I would like to take a config from a ASA5520 version 8.4(7) and convert it to run on a 5545X version 9.1(1) or higher. Is there a tool I can use to convert the config to match up with the 5545X hardware and software?

Any good docs on the procedure for doing the migration?

Thank you

2 ACCEPTED SOLUTIONS

Accepted Solutions

Firewall config move

i recommend you to create the whole configuration from scratch if you don't know the main differences.

but as i see you had an 8.4 config version, must be compatible... so try it!!!

just took attention with the copy with keys... so the whole config transfers the users and passwords of the VPN users.

had a great day . best regards, and rate if you'll find this post useful
VIP Green

Firewall config move

There are no gotchas to look out for in 9.1.  You can copy paste your configuration straight from 8.4(7).  9.1 introduces support for CX-SSP for ASA 5512-X through 5555-X

http://www.cisco.com/c/en/us/td/docs/security/asa/asa91/release/notes/asarn91.html#wp744465

Just copy about 10 lines at a time.  this ensures that there are no copy paste errors, and if you do happen to see an error it is easier to troubleshoot.

Another option is to copy the running-config file using TFTP to the new ASA then copy the running config file to the startup config.  this way is probably the fastest but if you do happen on som errors it is more difficult to troubleshoot...if you ask me that is.

--
Please remember to rate and select a correct answer

--

Please remember to rate and select a correct answer
5 REPLIES

Firewall config move

i recommend you to create the whole configuration from scratch if you don't know the main differences.

but as i see you had an 8.4 config version, must be compatible... so try it!!!

just took attention with the copy with keys... so the whole config transfers the users and passwords of the VPN users.

had a great day . best regards, and rate if you'll find this post useful
VIP Green

Firewall config move

There are no gotchas to look out for in 9.1.  You can copy paste your configuration straight from 8.4(7).  9.1 introduces support for CX-SSP for ASA 5512-X through 5555-X

http://www.cisco.com/c/en/us/td/docs/security/asa/asa91/release/notes/asarn91.html#wp744465

Just copy about 10 lines at a time.  this ensures that there are no copy paste errors, and if you do happen to see an error it is easier to troubleshoot.

Another option is to copy the running-config file using TFTP to the new ASA then copy the running config file to the startup config.  this way is probably the fastest but if you do happen on som errors it is more difficult to troubleshoot...if you ask me that is.

--
Please remember to rate and select a correct answer

--

Please remember to rate and select a correct answer
New Member

Re: Firewall config move

Thanks Guys - how about copying from usb to running config? Must I still pay attention to lines not being added?

Thank you

VIP Green

Re: Firewall config move

I am sure that it is possible, though I have never tried this.  Just keep in mind that not all USB types are supported.

--
Please remember to rate and select a correct answer

--

Please remember to rate and select a correct answer

Re: Firewall config move

I'm too chicken to copy to the running config; I import the old syntax to a separate file, copy it to the startup config, reload, and let Cisco convert it live during boot.  Then there is some cleanup and saving to do.   From 8.4 to 9.x you don't have the NAT changes to worry about, so things would probably go mostly OK.  Aside from IPS, the big firewall innovations in 9.x are the v6 ACL's got integrated, so you have new any4 and any6 keywords for mono-protocol traffic, and any is dual-protocol.  You'll probably want to pay attention to that; it made me unify some of my network object-groups and rewrite a bunch of ACLs.  Also, IPsec tunnels can optionally use IKEv2 instead of IKEv2 for negotiations.

-- Jim Leinweber, WI State Lab of Hygiene

205
Views
10
Helpful
5
Replies
CreatePlease to create content