Timeline for Swapping to new ASA hardware - same configuration - what are the pitfalls?
Current License: CC BY-SA 4.0
10 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Feb 11, 2020 at 10:58 | vote | accept | CrazyHorse019 | ||
| Feb 11, 2020 at 10:58 | answer | added | CrazyHorse019 | timeline score: 1 | |
| Jan 30, 2020 at 14:43 | comment | added | Jesse P. | @CrazyHorse019 Correct. Changing vendors would be a different story altogether. You have to account for all sorts of things like DH-group support, encryption and hash algorithm support, special character support for PSKs, IKEv1/IKEv2 support, etc. Since you're staying with ASAs (and I assume staying with ASA OS rather than Firepower), there should be no differences other than maybe interface numberings and other negligible things like that. | |
| Jan 30, 2020 at 14:20 | comment | added | CrazyHorse019 | @JesseP. Sorry, I have put forward your suggestions for clarifications with the third party and I am unfortunately still awaiting answers ( they should be sending me the information at end of play today, so I may have an update in a few hours). In the meantime I did have conversations with other members of the group we are in and who have performed similar operations, they had issues with firewalls because they changed vendor and configuration had to be converted but for us they believe not too much of an issue between a 5515 and a 5516 so I feel reassured there. | |
| Jan 30, 2020 at 14:12 | comment | added | Jesse P. | @CrazyHorse019 Any update with this, so we can better help? | |
| Jan 28, 2020 at 14:41 | comment | added | Ron Maupin♦ | The ARP tables are in the layer-3 devices (your servers) not the switches. The switches maintain MAC address tables, and some people confuse the two, but they are very different. Your servers will eventually time out their ARP tables, but that may be a problem to start with. You can ask questions about your servers on Server Fault (they are off-topic here). | |
| Jan 28, 2020 at 14:09 | comment | added | Jesse P. | Sure. I'm guessing they're maybe using the term incorrectly to say they fear some tunnels will terminate to the old firewall while other tunnels terminate to the new firewall. If you're shutting off the ports to the old firewall before installing the new firewall and enabling its ports, that fear is negated. | |
| Jan 28, 2020 at 14:06 | comment | added | CrazyHorse019 | Thanks for pointing that out, I did wonder about the split tunnelling too, but it was the project manager this morning who mentioned it - not the engineer who is performing the change, so I'll bring that to his attention to clarify what he meant and i'll update you. | |
| Jan 28, 2020 at 13:58 | comment | added | Jesse P. | Please expand on what this concern about split-tunneling is. Split-tunneling is a term used with remote access VPN, not site-to-site VPN. Site-to-site VPN only routes specific traffic to/from the peers, unlike remote access VPN which may only include specific routes (split-tunneling) or have only a default route (tunnel all). So, I'm not sure I understand the fear and reason for adding each site-to-site tunnel separately. | |
| Jan 28, 2020 at 13:49 | history | asked | CrazyHorse019 | CC BY-SA 4.0 |