Network Engineering Stack Exchange is a question and answer site for network engineers. It only takes a minute to sign up.
Sign up to join this community
What are best practices migrating ASA config to 8.3 and forward?
I have manually created a new config file with the following changes:
My next steps would be to upgrade from 8.2 to 8.3 keeping note of any errors. Instead of cleaning up the config would it be easier to re-do it line by line?
Give a short enough config set, reconfiguring by hand should be an acceptable option. You could even take your existing config and try to implement it again via the ASDM to see what the new GUI returns.
If your config is multiple pages or has a large number of objects, it might be best to implement it on a test box to see what comes back as an error message before putting it into production.
Unlike the PIX-to-ASA migration, Cisco never released a sanity check tool.
I would definitely recommend rebuilding the configuration to clean it up. Often rules get put in and either go stale or are never used. This is a perfect opportunity to start it over with a clean slate.
The last upgrade I did took about a week to re-write the rules, but they were much cleaner and labeled.
We just recently went through this and I rebuilt the config from scratch. My config was only about 6 pages so it wasn't terrible. This also allowed for some consolidation into object groups and auditing of rules that existed on the ASA.
If your config is too large you could try setting up 8.2 in GNS3, applying your configuration then updating. Never tried an ASA upgrade in GNS3, but have had 8.2, 8.3, and 8.4 working properly in GNS3.
Another option, if you have an Active/Standby pair, would be to break the pair during maintenance and upgrade the Standby. Once everything validates, then make it the primary and bring the other unit back into the pair as standby after upgrading it. If testing fails, downgrade the standby unit and bring it back into the old pair.
