Migrating from the Cisco ASA 5500 to the Cisco Adaptive Security Virtual Appliance

1.

To upgrade an ASA 5500 configuration to Version 9.2(1), you can leverage a built-in ASAv migration tool. This tool activates when you reboot if the startup configuration matches older ASA versions. Version 9.2(1) then migrates feature-related commands that have changed from the version that was originally stored in the startup configuration.

See the ASA release notes for more information about configuration migration and for upgrade guidelines.

2.

Retrieve the ASA 5500 firewall configuration file from the source device, and store it on your local file system.

See the “Managing Software and Configurations” chapter in the General Operations CLI Configuration Guide.

3.

Choose one of the following two options:

Using the CLI

Export the following VPN configuration files:

• Any clientless secure socket layer (SSL) customizations or plugins.
• Any AnyConnect, Cisco Secure Desktop, and host scan images from the ASA 5500.
• The PKCS12 file for the identity certificate from the ASA 5500.

Note Make sure that you place the files in the same path that is specified in the configuration.

See the “Clientless SSL VPN Overview” chapter in the VPN CLI Configuration Guide.

See the “Configuring AnyConnect VPN Client Connections” chapter in the VPN CLI Configuration Guide.

See the “Installing and Enabling CSD” chapter in the Cisco Secure Desktop Configuration Guide for Cisco ASA 5500 Series Administrators.

See the “Configuring AnyConnect Host Scan” chapter in the VPN CLI Configuration Guide.

See the “Configuring Digital Certificates” chapter in the General Operations CLI Configuration Guide.

See the “Configuring Policy Groups” chapter in the VPN CLI Configuration Guide.

Using ASDM

We encourage you to use the ASDM Backup Utility to facilitate this process and save the source files. These VPN-specific files may include the following: all security images, identity certificates, VPN pre-shared keys, and all SSL VPN configurations.

Note Make sure that you uncheck the running and startup configuration check boxes to exclude them from the backup process.

See the “Managing Software and Configurations” chapter in the General Operations ASDM Configuration Guide.

4.

Change the ASA 5500 configuration to an ASAv configuration:

—

a.

Change any interface configuration to match the available interfaces on the ASAv: Management 0/0 and GigabitEthernet 0/0 - 0/8 (for a ten-interface deployment).

Remove EtherChannel interfaces.

See the “Starting Interface Configuration (ASA 5510 and Higher)” chapter in the General Operations CLI Configuration Guide.

b.

Remove the Content Security and Control Security Services Module configuration (if one is installed).

See the “Configuring the ASA CSC Module” chapter in the Firewall CLI Configuration Guide.

c.

Remove the Advanced Inspection and Prevention Security Services Module configuration (if one is installed).

See the “Configuring the ASA IPS Module” chapter in the Firewall CLI Configuration Guide.

d.

Remove the CX module configuration (if one is installed).

See the “Configuring the ASA CX Module” chapter in the Firewall CLI Configuration Guide.

e.

Remove the following unsupported features:

• Multiple context mode
• Clustering—Remove the cluster-pool and mgmt-pool keywords and arguments from the ip address command.
• Active/Active Failover

See the “Configuring Multiple Context Mode” chapter in the General Operations CLI Configuration Guide.

See the “Configuring a Cluster of ASAs” chapter in the General Operations CLI Configuration Guide.

See the “Configuring Failover” chapter in the General Operations CLI Configuration Guide.

5.

Deploy the ASAv. To enable ASDM connectivity, you need to set appropriate properties, including the mapping of interfaces, in the OVF template.

Install the ASAv onto a VM using the VMware vSphere client.

See the “Deploying the Cisco Adaptive Security Virtual Appliance” chapter in the Cisco Adaptive Security Virtual Appliance (ASAv) Quick Start Guide.

6.

Connect to the ASAv and configure SSH or Telnet for basic connectivity.

From the CLI, use the telnet, ssh, or http command.

In ASDM, choose Configuration > Device Management > Management Access > ASDM/HTTPS/Telnet/SSH.

See the “Deploying the Cisco Adaptive Security Virtual Appliance” chapter in the Cisco Adaptive Security Virtual Appliance (ASAv) Quick Start Guide.

7.

Find your ASAv serial number, then you can obtain a new license that is required to run the ASAv in standard mode.

From the CLI, enter the show version or show inventory command.

In ASDM, choose Help > About the Cisco ASA.

You must also request additional feature licenses that match to what is configured on your ASA hardware.

See the “Deploying the Cisco Adaptive Security Virtual Appliance” chapter in the Cisco Adaptive Security Virtual Appliance (ASAv) Quick Start Guide.

8.

Import the VPN-specific files that you obtained from performing Step 3. If you obtained an ASDM backup zip file, you can then restore it onto the ASAv.

In ASDM, choose Tools > Restore Configurations.

Note If you issue the anyconnect-essentials command or the no anyconnect-essentials command, the following message appears:

“ERROR: Command required AnyConnect Essentials license”

See the “Clientless SSL VPN Overview” chapter in the VPN CLI Configuration Guide.

See the “Configuring AnyConnect VPN Client Connections” chapter in the VPN CLI Configuration Guide.

See the “Installing and Enabling CSD” chapter in the Cisco Secure Desktop Configuration Guide for Cisco ASA 5500 Series Administrators.

9.

Copy the modified ASA 5500 configuration into the ASAv startup configuration. Then enter the reload noconfirm command to reload the ASAv and preserve the copied startup configuration.

You can only use copy-and-paste or read-from-file methods on files that have been saved with Version 9.2(1) and modified in previous steps. These methods may leave interfaces in a shut-down state, may conflict with running configurations, and will not trigger the ASA migration tool.

The VMware vSphere client console window does not allow you to copy and paste information. You must use a TFTP, HTTP, or FTP server to transfer the modified configuration file by entering either the configure net or copy running-config command from the CLI.

See the “Configuring Management Access” chapter in the General Operations CLI Configuration Guide.

See the reload noconfirm command in the Command Reference.

See the “Configuring Digital Certificates” chapter in the General Operations CLI Configuration Guide.

See the configure net or copy running-config command in the Command Reference.

10.

Verify the modified configuration on the ASAv:

—

a.

From the CLI, use the show startup-config errors command to view any errors that the ASAv detected as it booted.

In ASDM, choose Tools > Command Line Interface.

See the show startup-config errors command in the Command Reference.

See the “Managing Software and Configurations” chapter in the General Operations ASDM Configuration Guide.

b.

Review the configuration for interfaces that may be disabled, but should not be.

From the CLI, enter the no shutdown command.

In ASDM, choose Configuration > Device Management > Interfaces.

See the no shutdown command in the Command Reference.

See the “Completing Interface Configuration (Routed Mode)” chapter in the General Operations ASDM Configuration Guide.

c.

Verify that the access lists, interfaces, and inspections are correct.

In the CLI, use the show running-config command to confirm that the ASAv configuration is correct.

In ASDM, choose Tools > Command Line Interface.

See the “Using the ACL Manager” chapter in the General Operations ASDM Configuration Guide.

See the “Starting Interface Configuration (ASA 5510 and Higher)” chapter in the General Operations ASDM Configuration Guide.

See the “Getting Started with Application Layer Protocol Inspection” chapter in the Firewall ASDM Configuration Guide.

See the show running-config command in the Command Reference.

d.

Test the modified configuration on the ASAv for the desired behavior before deploying it in production.

From the CLI, use the packet-tracer command.

In ASDM, choose Tools > Packet Tracer.

See the packet tracer command in the Command Reference.

See the “Troubleshooting” chapter in the General Operations ASDM Configuration Guide.