I need to do a VPN tunnel migration from 1 Cisco Asa to another one on 20 remote routers.

I wrote a little script that can automaticaly migrate the routers to the new ASA. However, when I run this script, the tunnel breaks ( which is logic, as I need to kill the old tunnel and set up the new tunnel in the script ), which makes me lose my SSH connection, and the last lines of the script do not go trough.

I put a reload command at the start of the script, so when this fails I can retry after the router rebooted.

Is there a clean way to do this ?



Configure SSH to allow connections on the outside interface without VPN from only your IP address or IP range for the duration of the migration, then disable that again. That way you can access the ASAs regardless of the VPN being up, which is definitely a good thing when making VPN changes.

If you can't do that, you can edit each configuration file in a text editor and then copy the new configuration to the startup-config file on each router. Then when you reload the router the startup config will become the running config.

  • Great suggestion. This is what I do (albeit with pfsense) when I'm making dangerous changes. I also limit ssh connections so they can only be made from the central office IP address. – EEAA Jun 16 '15 at 13:07
  • Good suggestion indeed, but this is not practical as most of these routers are behind a firewall, and some of their ip's are not accessible from the outisde ( NAT ). I was more looking for a solution inside the Cisco IOS which could let me enter the whole new config without immediately applying this. – Dylan C Jun 16 '15 at 13:29
  • You might want to add that to the question but I can edit my answer. – Todd Wilcox Jun 16 '15 at 13:30
  • Sorry about that, first time posting here. This would impy running a tftp server where I would put my config files on, right ? – Dylan C Jun 16 '15 at 13:51
  • A TFTP server is how I would get a config file onto a Cisco device. There are probably other ways but I'm not sure what they are off the top of my head. It's a good idea to have a TFTP server around so you can back up configs to it any time you make a change. – Todd Wilcox Jun 16 '15 at 13:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.