Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Our customer wants to upgrade his ASA5520 from 7.2 to 8.x. He has quite a big config and uses lot of features. eg.

a/s failover, subinterfaces, ~70 VPN tunnels (ssl and ipsec), bunch of grouped object's, some policy-maps, lot of ACL's, NAT exemptions etc.....

Does anyone have some best practice Experiences?

Are there a lot differences in the config Syntax to the 8.x ?


share|improve this question
up vote 4 down vote accepted

You should not have problem from 7.2 to 8.x, as the Cisco documentation says: "Therefore, to upgrade from Version 7.0 to Version 8.2, first upgrade from 7.0 to 7.1, then from 7.1 to 7.2, and finally from Version 7.2 to Version 8.2 (8.1 was only available on the ASA 5580)." When booting the first time, configuration adjustement will be done if needed.

So if you're already in 7.2 it's ok. Just take care that when both device run different OS version at the same time you will lost the failover link. (So you can't upgrade without interrupt)

share|improve this answer
Also i would add write your config to a machine (AKA back it up first!) and keep the 7.2 image around so you can fail back if something goes reaaally wrong. You should be able to keep both images on the device. And don't forget to update your ASDM image. – Zypher Jun 15 '09 at 17:52

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.