Re: asa 8.2 to 8.3 config conversion

I'm doing an upgrade for a client from 8.0 to 8.3 soon. Apparently, the
upgrade path must go through 8.2 first. Why the customer insists on using
8.3 is beyond me, but oh well! God be with me hah

On Wed, Aug 28, 2013 at 6:53 AM, Jay McMickle <jay.mcmickle_at_yahoo.com>wrote:

> That's the million dollar question that no-one ever asks. Not every bug is
> "one size fits all".
>
> The bug ID is CSCue11738.
>
> Cheers, and good luck.
>
> Regards,
> Jay McMickle- 2x CCIE #35355 (R/S,Sec)
> Sent from my iPhone 5
>
> On Aug 28, 2013, at 5:40 AM, Tauseef Khan <tasneemjan_at_googlemail.com>
> wrote:
>
> > yes that's fine Jay, We are going to go for this asa846-smp-k8.bin on
> 5585-xssp40s. mine migration is from fwsm 3.2(13) so i need to convert the
> config manually.
> > did you get the bug id for 8.4.5?
> >
> > Kind regards
> >
> > Tauseef
> > mobile: +44 7837209187
> >
> >
> > On 28 August 2013 01:00, Jay McMickle <jay.mcmickle_at_yahoo.com> wrote:
> >> My two cents-
> >> We went through an upgrade failure last weekend and re-attempting this
> weekend.
> >>
> >> We hit a bug in 8.4.5. The correct upgrade path is 8.2.5 to 8.4.6 to
> 9.1.2.
> >>
> >> This pair was a 5585-20-SSP and we didn't have anything on the shelf to
> do
> an offline upgrade. Since the 5585's were the first SMP code, they go down
> to
> 8.2, but all other x series start at 8.6. So, a SMP to non-SMP was needed,
> but
> then the number if interfaces became an issue. We ended up braking the
> failover the morning of the upgrade since we only had a 15minute window,
> but
> hit the bug in 8.4.5 (nat's were converted but ACL's were not). We still
> have
> failover broken and we've upgraded it, waiting for our 15min outage window
> this weekend.
> >>
> >> In the long run, skip 8.3 and 8.4.5. Use 8.4.6 as your interim stop for
> the
> NAT conversion and then to 9.1.
> >>
> >> I hope that helps.
> >>
> >> Regards,
> >> Jay McMickle- 2x CCIE #35355 (R/S,Sec)
> >> Sent from my iPhone 5
> >>
> >> On Aug 27, 2013, at 11:47 AM, Tauseef Khan <tasneemjan_at_googlemail.com>
> wrote:
> >>
> >> > Thanks Rayn, That's what I was looking for.
> >> >
> >> > Kind regards
> >> >
> >> > Tauseef
> >> > mobile: +44 7837209187
> >> >
> >> >
> >> > On 27 August 2013 17:24, JB Poplawski <jb.poplawski_at_gmail.com> wrote:
> >> >
> >> >> Throw the image and let it fly? LOL - Have TAC on the line and
> ready.
> >> >> Get a 5505 a sim it up. Better to be safe than sorry.
> >> >>
> >> >>
> >> >> On Tue, Aug 27, 2013 at 8:55 AM, Ryan West <rwest_at_zyedge.com> wrote:
> >> >>
> >> >>> Might want to try this one -
> >> >>>
> >> >>> http://www.tunnelsup.com/nat-converter
> >> >>>
> >> >>> that should get you into 8.3+, but if you're planning on running
> 9.x,
> you
> >> >>> may want to run 8.4 first and then switch to 9.x and let any other
> >> >>> conversions take place there.
> >> >>>
> >> >>> Also, if you do use the ASA to upgrade from 8.2 to 8.3 and you're
> running
> >> >>> any remote access VPN's, be prepared for them to break. It's
> usually
> an
> >> >>> out of order NAT and a quick fix.
> >> >>>
> >> >>> -ryan
> >> >>>
> >> >>> -----Original Message-----
> >> >>> From: nobody_at_groupstudy.com [mailto:nobody_at_groupstudy.com] On
> Behalf
> Of
> >> >>> Sadiq Yakasai
> >> >>> Sent: Tuesday, August 27, 2013 11:24 AM
> >> >>> To: Tauseef Khan
> >> >>> Cc: Cisco certification
> >> >>> Subject: Re: asa 8.2 to 8.3 config conversion
> >> >>>
> >> >>> Sure np.
> >> >>>
> >> >>> One little observation though - the FWSM does not use 8.x software
> >> >>> release train though .... 8.x is exclusive to ASA. FWSM latest train
> stops
> >> >>> on 4.x.
> >> >>>
> >> >>> Back to your query though; you might want to try converting FWSM->
> ASA
> pre
> >> >>> 8.3 -> ASA 8.3+
> >> >>>
> >> >>> Would that work?
> >> >>>
> >> >>>
> >> >>> On Tue, Aug 27, 2013 at 4:13 PM, Tauseef Khan
> <tasneemjan_at_googlemail.com
> >> >>>> wrote:
> >> >>>
> >> >>>> thanks for the help but its a FWSM to ASA migration.
> >> >>>>
> >> >>>> Kind regards
> >> >>>>
> >> >>>> Tauseef
> >> >>>> mobile: +44 7837209187
> >> >>>>
> >> >>>>
> >> >>>> On 27 August 2013 15:54, Sadiq Yakasai <sadiqtanko_at_gmail.com>
> wrote:
> >> >>>>
> >> >>>>> You do not have to 'convert' the configuration. Just stick the new
> >> >>>>> image on the firewall(s) and boot them up. The configuration
> should
> >> >>>>> pretty much convert itself.
> >> >>>>>
> >> >>>>> PS: Note that NAT exemption is no more available in 8.3+ and is
> >> >>>>> replaced by Identity NAT, so keep an eye out for that! I cant
> think
> >> >>>>> of anything else you should worry about at the moment.
> >> >>>>>
> >> >>>>> Hope that helps abit.
> >> >>>>>
> >> >>>>> Sadiq
> >> >>>>>
> >> >>>>>
> >> >>>>> On Tue, Aug 27, 2013 at 3:46 PM, Tauseef Khan <
> >> >>> tasneemjan_at_googlemail.com>wrote:
> >> >>>>>
> >> >>>>>> Does any one know if there there a script available to convert
> ASA
> >> >>>>>> 8.2 to post 8.3 configs Kind regards
> >> >>>>>>
> >> >>>>>> Tauseef
> >> >>>>>> mobile: +44 7837209187
> >> >>>>>>
> >> >>>>>>
> >> >>>>>> Blogs and organic groups at http://www.ccie.net
> >> >>>>>>
> >> >>>>>>
> ____________________________________________________________________
> >> >>>>>> ___ Subscription information may be found at:
> >> >>>>>> http://www.groupstudy.com/list/CCIELab.html
> >> >>>>>
> >> >>>>>
> >> >>>>> --
> >> >>>>> CCIEx2 (R&S|Sec) #19963
> >> >>>
> >> >>>
> >> >>> --
> >> >>> CCIEx2 (R&S|Sec) #19963
> >> >>>
> >> >>>
> >> >>> Blogs and organic groups at http://www.ccie.net
> >> >>>
> >> >>>
> _______________________________________________________________________
> >> >>> Subscription information may be found at:
> >> >>> http://www.groupstudy.com/list/CCIELab.html
> >> >>>
> >> >>>
> >> >>> Blogs and organic groups at http://www.ccie.net
> >> >>>
> >> >>>
> _______________________________________________________________________
> >> >>> Subscription information may be found at:
> >> >>> http://www.groupstudy.com/list/CCIELab.html
> >> >
> >> >
> >> > Blogs and organic groups at http://www.ccie.net
> >> >
> >> >
> _______________________________________________________________________
> >> > Subscription information may be found at:
> >> > http://www.groupstudy.com/list/CCIELab.html
>
>
> Blogs and organic groups at http://www.ccie.net
>
> _______________________________________________________________________
> Subscription information may be found at:
> http://www.groupstudy.com/list/CCIELab.html
>
>
>
>
>
>
>
>

-- 
Regards,
Joe Astorino
CCIE #24347
http://astorinonetworks.com
"He not busy being born is busy dying" - Dylan
Blogs and organic groups at http://www.ccie.net