Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to migrate a large and complex ip extended access list from a Cisco 3725 router to a Cisco ASA5325-X firewall and I don't want to rewrite it so that it will work on the ASA.

My question is does anyone know of any tools that will convert part or all of a router config to a ASA config?

share|improve this question
There aren't any automated tools out there that I know of. It's really pretty easy. – smithian Oct 26 '12 at 18:50
@smithian, I agree it's easy but extremely time consuming with over 300 entry's. – Sane Oct 26 '12 at 19:55

Nothing that I can think of that would automate it - and if it's as complex as you may think it is, I don't think I'd trust something automated.

Also, this would probably be a good time to take a look at everything going on and strip out what may not be needed and/or optimize the ruleset a bit.

share|improve this answer
I would agree if it was something I had control over. The access list regulates a connection between my network and the state's network and the access list is provided by the state and they seem to think we need every entry. I guess if I don't comes up with an answer I'll just have to put a tack in with Cisco, but I hate doing that. – Sane Oct 26 '12 at 19:50

i don't know a tool too. but if you just want migrate the acl then why you just use a normal text editor. your acl on the router looks like that:

ip access-list extendet test
 permit icmp any any
 permit tcp any any eq telnet

so i would copy this to a editor and use search/replace. search for "permit" and replace it with "access-list ACL-NAME permit" and search for "deny" and replace it with "access-list ACL-NAME deny"

share|improve this answer
That is what it looks like I'm going to have to do. I was hoping that someone had some script that they had created to make it quick and easy. On top of doing what you noted I'm also going to have to convert all the wildcard mask to a subnet mask. – Sane Oct 26 '12 at 21:50
yes that's bad. i quickly wrote down my answer without thinking about the netmask. sorry – user1008764 Oct 26 '12 at 22:06

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.