Load or Migrate ESA Configuration on a Replacement ESA

Introduction

This document describes how to load or migrate a Secure Email Gateway (SEG) configuration onto a replacement appliance.

Prerequisites

Requirements

Cisco recommends that the AsyncOS version and build on both the original and replacement SEG be the same.

To verify the version from the CLI, execute the version command. 

Components Used

There are no specific hardware and software versions required for this document.

The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, ensure that you understand the potential impact of any command.

Background Information

Use the load procedure for a like-for-like replacement, and use the migrate guidance when moving between different appliance types or from hardware to a virtual appliance.

Load a Configuration on a Replacement SEG

Tip: See the Managing the Configuration File section of the SEG User Guide for complete details on how to save, load, and manage the configuration file.

Note: If you do not need to change the IP address(es) or hostname of the SEG, and it replaces your current unit. You do not need to complete the network-edit steps. Once you load the configuration and commit the changes, the replacement SEG becomes live on your network with the existing IP address(es) and hostname.

Save the Configuration

1. Choose System Administration > Configuration File
2.  Within the Current Configuration section, select a passphrase option before you download:
• Select Encrypt passphrases in the Configuration File (recommended) or Plain passphrases in the Configuration File.

3.  Select the Download file to local computer to view or save radio button.

4.  Click Submit. This downloads the appliance configuration in XML format to your local computer. Ensure that you save the file to a known location.

5.  With a local editor, edit the XML file. In the Network Configuration section, remove the ethernet, port, and routing-table entries:

• The ethernet entry starts with <ethernet_settings> and ends with </ethernet_settings>.
• The port entry starts with <ports> and ends with </ports>.
• The  routing_tables entry starts with <routing_tables> and ends with </routing_tables>.

6. Save the XML file locally before you load the configuration.

Load the Configuration

1. On the replacement SEG, choose System Administration > Configuration File.
2. In the Load Configuration section, select the Load a configuration file from local computer radio button, then click Browse.
3. Locate the file you saved and click Open.
4. Click Load.
5. A pop-up notification states: Loading a configuration permanently removes all of your current configuration settings. Click Continue to proceed.
6. A confirmation appears: Success — Configuration file was loaded. Changes do not take effect until you Commit. Please review network settings before committing the changes.
7. Complete the Before You Commit checklist.
8. From the upper-right corner, click Commit Changes, enter a comment, and click Commit Changes.

If you receive errors on the Configuration File screen after you click Continue, see the Load Errors That Might Require Manual XML Edits section — you can make manual edits to the XML.

Migrate a Configuration to a Replacement SEG

You can migrate a configuration from one SEG to another, or from a hardware appliance to a virtual appliance.

Because configuration values vary across models and many scenarios are possible, this document cannot cover every case. The two most common migration adjustments are:

•  Quarantine sizes — when migrating to a smaller-capacity appliance, quarantine sizes need to be reduced.
•  Number of network interfaces — when the source and target appliances have a different number of interfaces, the interface entries must be corrected manually in the XML.
•  Quarantine-size alerts at load time — if a loadconfig alert references quarantine size, edit the XML and adjust the relevant quarantine section.

Load Errors That Might Require Manual XML Edits

A failed load usually names the offending XML element. Common examples include:

•  An interface referenced in the file does not exist on the target appliance (for example, a Data 3 reference on a model with fewer interfaces).
•  A reporting or tracking database-size element that must not be modified (for example, db_environment_actual_size or tracking_global_max_db_size).

Use the element name in the error message to locate and correct the relevant section of the XML, then reload. 

Before You Commit — Validation Checklist

Before you click Commit Changes on the replacement SEG, confirm:

• Network interfaces are correct for the target model.
• Routing is correct after the network-section edits.
• Hostname and IP address(es) match the intended configuration.
• Quarantine sizes are valid for the target appliance capacity.
• The original SEG is removed from the network or powered off (to prevent an IP/hostname conflict).

Related Information

• Cisco Secure Email Gateway End-User Guides
• Cisco Secure Email Gateway Release Notes and General Information
• Cisco Secure Email Gateway Data Sheet
• Cisco Secure Email Virtual Gateway Virtual Appliance Installation Guide

Revision History

Revision	Publish Date	Comments
2.0	30-Jun-2026	Updated Tech Content, Title, Machine Translation, Style Requirements, and Formatting.
1.0	21-Feb-2019	Initial Release