•
PPTP VPN is not supported on software versions 7.x. PPTP commands in the source configuration are marked as comments in the converted configuration with a note that they are not supported.
•Exporting certificates is not supported in PIX 6.3. If you have certificates in your PIX configuration, you must either upgrade to PIX version 8.0 and export the certificates first, or you must obtain a new certificate after the conversion process.
•Serial cable failover is not supported in the ASA platform. Therefore, you must add LAN failover on the ASA after the migration process.
•Physical interface exhaustion—A physical interface must always be mapped one-to-one to a destination physical interface. If interfaces in the source platform exceed the number of available intehttps://supportforums.cisco.com/post!reply.jspa?message=3193112rfaces available in the destination platform, such as migrating from a fully equipped Cisco PIX 535 to an Cisco ASA 5540, those interfaces will be converted to the 7.x syntax but will keep their original interface names.
•Multiple Context Mode—You must manually convert multiple context mode configurations.
•VLANS on the Cisco ASA 5505—On an Cisco ASA 5505, the migration tool assigns VLAN 2 to Ethernet 0/0 and VLAN 1 to all other physical interfaces. Typically, VLAN 1 and VLAN 2 provide access to inside and outside interfaces. If you do not assign source interfaces to these VLANs, then the ASA will not have access to the inside and the outside interfaces.
Once you have converted configuration from 6.3.4 to 7.2, you can make sure if its fine or not. Once it is done, you can either upload the configuration directly to ASA having 7.2 code and upgrade the ASA. or you can also use the conversion tool to convert it to 8.x.
During conversion, you can see some of the warning messages, for e.g.:-
INFO: PIX to ASA conversion tool $Revision: 1.9 $
INFO: PIX Version 6.3(4) Removed from config
INFO: fixup protocol sip udp 5060 Removed from config
WARNING: The configuration is NOT supported - floodguard enable
WARNING: Your password is set to all STARS(*) Please Correct before deploying to the new
device! 'vpdn username cisco password ********* '
INFO: Cryptochecksum:e136533e23231c5bbbbf4088cee75a5a Removed from config
INFO: : end Removed from config
INFO: The destination platform is: asa-5540
which will tell you what changes has been done and what changes you need to do. For e.g all the passwords will be converted to"*'
So you need to put the passwords again.
You can try this method and let me know if you need any help.
Hello,
The adaptive security appliance runs in a combination of the following modes:
•
Transparent firewall or routed firewall mode
The firewall mode determines if the security appliance runs as a Layer 2 or Layer 3 firewall.
•Multiple context or single context mode
The security context mode determines if the adaptive security appliance runs as a single device or as multiple security contexts, which act like virtual devices.
You can partition a single security appliance into multiple virtual devices, known as security contexts. Each context is an independent device, with its own security policy, interfaces, and administrators. Multiple contexts are similar to having multiple standalone devices.
You can read more about it in the following links:-
http://www1.cisco.com/en/US/docs/security/asa/asa83/command/reference/cli.html
http://www.cisco.com/en/US/docs/security/asa/asa70/configuration/guide/contexts.html
Thanks,
Shilpa
