Then I defined the “real” address ranges to which this rule will apply, namely all addresses. I gave this object a hopefully meaningful name of PAT-0_0_0_0. Here’s the equivalent in the new syntax: object network PAT-0_0_0_0 In the newer ASA software versions, address translation is configured using objects. The old syntax looked something like this: global (outside) 1 interface The new syntax looks completely different, but it’s actually quite simple and flexible once you see how it works.įirst, let’s look at the example of Port Address Translation (PAT) because PAT is something that appears in almost every Internet-facing firewall. The most obvious syntax change involves NAT. Here are some of the most important things I tripped over during the ASA migration. But the conversion involved a painful process of going through all the Network Address Translation (NAT) rules and access lists (ACLs) line by line. Updating gave them access to the really good SourceFire features that have recently been integrated into the ASA platform. One of my clients was recently migrating from an old ASA firewall to a new model running the new software. Sooner or later, though, you’ll have to do it. I’ve noticed a lot of people are desperately trying to cling to the old software to avoid the massive task of converting the configuration. The Cisco website has extensive documentation on both the old and new syntax, which is great if you really want to read through all of it.īut I’ve never seen a nice, concise description of how to migrate an existing ASA firewall.

Cisco made huge changes to the configuration syntax on ASA firewalls starting in version 8.3.

Cisco asa 5505 configuration example