Copy Config from router to asa

We are remotely configuring new ASAs and need an easier way to get the old config onto the new ASA (from router). Or Best Practice ideas/suggestions/help would be GREAT Appreciated.
Spt_UsAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

arnoldCommented:
I beleive cisco offers a "converter" since not all IOS versions are the same nor do all work in the same way.

One way is to use TFTP
copy tftp running
this way you can make sure the data on the TFTP server for the config the ASA will be loading is correct in terms of which interfaces/vlans/ips/etc.

There are also scripting tools that you could use to script the configuration using perl/tcl/tk, etc. i.e. it will connect to the ASA and will perform the actions you preconfigure.


When dealing with configuring remotely an error will lock you out until the device is rebooted back to its former self unless you have a dial-in console connection.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Mohammed KhawajaManager - Infrastructure:  Information TechnologyCommented:
Please note that the ASA is a firewall and not a router.  You cannot transfer router configuration to a firewall.  If you happen to have a PIX firewall which you are replacing with ASA then it is possible.  Refer to link below for migrating from PIX 500 series to new ASA:

http://www.cisco.com/c/en/us/support/docs/security/pix-500-series-security-appliances/91976-migrate-pix-to-asa.html
0
AkinsdNetwork AdministratorCommented:
ASAs have routing functionalities.

You can try copying the contents of the config then paste it in the ASA from the priviledge exec mode
ASA9config)#

This way, acceptable or compatible configuration will be applied to the ASA and incompatible functions will be discarded.

Better still, I'm assuming you're probably only interested in the routing statements. If so, just copy the routing section of the running-config and apply that to your ASA
0
Managing Security & Risk at the Speed of Business

Gartner Research VP, Neil McDonald & AlgoSec CTO, Prof. Avishai Wool, discuss the business-driven approach to automated security policy management, its benefits and how to align security policy management with business processes to address today's security challenges.

Spt_UsAuthor Commented:
Thanks for all the help; I took the current config "show running-config" from the live router and put into text file.  I guess I am going to have to manually do the work; my concern 'is' I want to be able to do this remotely and get as much on as I can before sending to site w/ onsite IT guy
0
arnoldCommented:
if you have a tftp server, you could copy running tftp
this way you see the content on how it is stored, and this is the same way once you make changes you can load it in.

Scripting changes/management is also frequently done, the sound of your issue is that the device was sent unconfigured and you want to configure it now remotely.
This type of situation is always ...... a slight error could render the device and whatever is connecting through it locked out.
0
Spt_UsAuthor Commented:
I apprciate all the suggestions; this ASA isn't going to work in this solution as there is not a T1 port connection.
0
arnoldCommented:
I do not understand how the connection method has anything to do with preconfiguring it.
To automate you would first, export the current config to a TFTP server (local) lan connection. You can export the config to a far distant server, to the locally available TFTP server.

I guess I do not understand the T1 port connection reference.
0
Spt_UsAuthor Commented:
I have to have a serial port connection for a T ljne
0
arnoldCommented:
I understand what a serial Port is and a T1, I am not understanding the reason you are mentioning it.  i.e. if you do not these types of connection in the lab, you can not test the device after the configuration.

if you would provide a detailed context to what you have what you are working with and what it is you are looking to achieve, it might make the picture clearer and other avenues for solutions arise.
0
Spt_UsAuthor Commented:
Thanks for all the suggestions.
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Network Security

From novice to tech pro — start learning today.