I am replacing some old ASA 5515 with some new ASA 5516. We are going from a set up whereby we managed the boxes to one where a 3rd party is now managing them. I am currently going through the implementation and rollback plan with them, in the meantime I am also preparing a testing plan for when the swap takes place.
The current method for the swap is that 3rd party has already configured the new firewalls and hooked them up to a switch and that the swap will take place by disabling the ports where the old firewall is connected and enabling the ports where the new firewall is connected.
So the way I understand this is that the configuration is being ported to the new firewall. Configuration is exactly the same as what is in the old one. When the swap happens I expect the arp tables to update down the chain of switches and for the servers to reroute their services accordingly to the new gateway ( even though it will have the same IP as the old gateway).
We currently have 6 site-to-site VPN connections and they are worried that just swapping over could cause split-tunneling. To avoid this they have advised that they will add the site-to-site configuration one by one after the rest of the configuration has been added and the internal networking/routing is verfied.
On top of this I am worried about our database servers and how they would be affected by a change like this (mongo,redis,mariadb).
My question is am I missing any pitfalls here? How is a database cluster affected by an internal routing change?
Any lessons from experience would be much appreciated.