Ever since Cisco announced the EoS/EoL of the PIX customers have been migrating to the ASA platform. The configuration migration is very straightforward but to make it even easier Cisco developed a free Migration Tool. I’ll take you through how this very simple tool works.
To back up a second, next summer , specifically july 28th,, is the date that Cisco’s PIXen go “End of Routine Failure Analysis Support” . This means it is the last-possible date a routine failure analysis may be performed to determine the cause of product failure or defect. It is also the date that the PIX software goes “End of SW Maintenance Releases”. This means it is the last date that Cisco Engineering may release any final software maintenance releases or bug fixes. After this date, Cisco Engineering will no longer develop, repair, maintain, or test the product software.
In a nutshell July 28th 2009 is the end of the road for the PIX product line for all practical purposes. That is why I am seeing the last hold outs start to convert their PIX boxes over to ASA. Nobody wants to run a FW in productions that lacks bug fix and PSIRT vulnerability fixes.
So, first things first, if you have a pix running 7.X or higher then you are in great shape. The configuration migration basically consists of matching up your old PIX interfaces with the new interfaces of the ASA. If your old PIX has more interfaces than your new ASA then you will have to create a dot1q trunk and interface VLANs on the new ASA to accommodate. However, if your PIX is running something older than 7.X then the migration gets a bit trickier. Here you have two options, upgrade your current PIX to a 7.X code train and then run the migration tool or use the PIX-to-ASA Migration Tool to start with. One caveat with the upgrade first approach is that if you are still using conduits and outbound statements in your config then you have to use the migration tool. You can’t upgrade to 7.X with these statements in place. Bottom line is that regardless of the method you pick I’d recommend you use the migration tool to help you get there. It eliminates a lot of the user error that typically comes with manual configuration migration.
Now on to how the PIX-to-ASA Migration tool works. First of all the tool works on Windows, MAC, and Linux hosts (I almost fell out of my chair when I saw the MAC version). The screenshots are from the MAC version.
Step 1 is to load in the current config and give a location of where to put the converted config.
Be sure to check the box next to Allow unsupported commands (conduit, outbound, etc.) if you have these in your configuration file still. The tool will then scan the config file.
Step 2 is to select the target device type.
Step 3 is to tell the tool if you have the 4 port Gigabit Ethernet card installed in the ASA. This is important for the interface mapping part.
Step 4 is doing the interface mappings from the PIX to the ASA. For example PIX interface Ethernet0 should be Ethernet0/0 on the ASA.
Step 5 is specifying the preferred ASA boot image if more than one exists.
Step 6 is running the conversion. Just click the Make target configuration button to start. After it is done click the View Target Configuration button to see the results.
You will see the below log message pop-up upon completion. My original config was a PIX 7.2.1 config.
INFO: PIX to ASA conversion tool 1.0 INFO: Time of run: Thu Jan 15 22:26:13 2009 INFO: Input file name : /Users/jheary/Downloads/denlab-pix525a-config INFO: Output file name : /Users/jheary/denlab-pix525a-config-converted.txt INFO: PIX Version 7.2(1) Removed from config INFO: Cryptochecksum:3683f524d21dea142f780223e102c114 Removed from config INFO: The destination platform is: custom WARNING: The source platform has more physical interfaces than the destination platform. WARNING: The interfaces that could not be mapped on the destination platform have been mapped to their own names. INFO: Interface Mapping: ‘ethernet0’ -> ‘Ethernet0/0’ ‘ethernet1’ -> ‘Ethernet0/1’ ‘ethernet2’ -> ‘Ethernet0/2’ ‘ethernet3’ -> ‘ethernet3’ ‘ethernet4’ -> ‘Ethernet0/3’ ‘ethernet5’ -> ‘ethernet5’When you do a conversion for PIX 7.x to ASA 7.x there is very little that needs to change. The image below shows a diff of the changes in the before and after files. The original PIX file was 272 lines long. As you can see it is basically only the interface names that change. In many cases that is all that is needed to convert.
Download the PIX to ASA conversion utility here: http://www.cisco.com/cgi-bin/tablebuild.pl/asa Information on the PIX End-of-Life notices and migration look here: http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/index.html Hopefully this tool will help make your conversion as painless as is possible. If you have any questions just post them. I’d also like to hear your feedback on the tool as well.
The opinions and information presented here are my personal views and not those of my employer.
More from Jamey Heary: Credit Card Skimming: How thieves can steal your card info without you knowing it Cisco enters the crowded AV and DLP client marketCisco’s new ASA code allows you to securely take your Cisco IP Phone with you anywhereCisco targets Symantec, McAfee with its new antivirus client Google’s Chrome raises security concerns and tastes like chicken feet a>Go to Jamey’s Blog for more articles on security.*
*
*
*
*
