#Pix to asa migration tool 8.4 upgrade
#Pix to asa migration tool 8.4 code

Don't put large amounts of configuration on a single firewall. WHY?!?!ДЄn absolute nightmare if you have 6000 Nat rules to go through, also access lists do not convert properly, or are the put into the correct order.ДЄnyway, the lesson I have learned. The client I'm working on has 74 sub interfaces, and over 40 rules that are like this. static NAT's are mixed amongst PAT's and no Nat.ДЄnything that would cover multiple interfaces is now expanded to a per interface rule meaning if you have 50 sub interfaces and a SINGLE nat rule that covers all interfaces, after conversion you will have the same rule duplicated but per interface.Д®nd result 1 rule is now 50. NAT ordering - all over the place and causes packets not to be translated properly.Д®.g. Real IP access list migration - anything that went to the NAT address now needs to go to the real IP - example.ДЄny4 -> 80.1.2.3 - tcp/80 - will not work, this now needs to go to the post NAT addressДЄny4 -> 192.168.1.1 - tcp/80 - will work, it obviously looks at the NAT table before policy.Дў. Basically it doesn't work, and it needs to be re-wrote.ДЎ.

#Pix to asa migration tool 8.4 code

Anyway, had a talk to them earlier today, TAC have recommended the converted code using the automated scrip to be checked and proof read. This doesn't work, ended up getting into a cycle of continuous reboots and crashes. Release Notes for the Cisco ASA Series, 9.1(x) - Cisco

#Pix to asa migration tool 8.4 upgrade

Just to let you know, if anyone is planning to do this upgrade its far from straight forward.Д¬isco recommends going from 8.2X to 8.4.6 (where the migration occurs) and then up to 9.1.3 or later. I'm not scared to re-write the statements, the odd few.

So these all have to be re-wrote manually too.Д«etween 8.25 and 8.31 the automated conversion occurs, however I've seen other people say its less error prone to go to version 8.4(x). Now this needs to be to the Post NAT address so something like any4 to 192.168.1.1 - port 80. Another thing, it doesn't take into account Static NAT access lists, before you would have a rule to the Public Address for clients in ->. Is there a better path to getting to 9.1, that will be less error prone possibly and save me a lot of time? Its going to take ages, and I'm not happy. There are a lot of errors in the NAT config which means I basically need to re-write and re order about 6000 NAT statements. However this time, there a lot of NAT config on this firewall and I've already made the jump from 8.2.5 to 8.3.1. I've done this many times, but have always re-wrote the NAT statements as Cisco utilised the NGN at 8.3 and real IP access list migration too. I'm upgrading a pair of Firewalls (A/S) from asa825 -> asa915. I'm after some advice based on any experiences you may have had on this one. Please disable your ad-block, or become a premium member to hide all advertisements and this notice. Blocking our ads means your killing our stats! and it needs advertisements in order to keep running. This website is run by the community, for the community.