Normally the upgrade is very smooth and easy, but this upgrade is tricky, because changes the NAT grammar completly ande some other stuff. The new grammar is much easier.
- 32768 Dec 22 2011 08:48:16 coredumpinfo - 43 Dec 22 2011 08:48:16 coredumpinfo/coredump.cfg - 17786880 Dec 22 2011 08:49:16 asa825-smp-k8.bin - 16280544 Dec 22 2011 08:49:42 _asdm-645.bin - 31057920 Jan 06 2012 06:37:51 _asa842-8-smp-k8.bin - 32768 Dec 22 2011 08:53:30 log - 32768 Dec 22 2011 08:53:50 crypto_archive - 17232256 Jan 06 2012 06:38:16 asdm-645-206.bin - 12998641 Dec 22 2011 08:54:02 csd_3.5.2008-k9.pkg - 32768 Dec 22 2011 08:54:04 sdesktop - 1462 Dec 22 2011 08:54:04 sdesktop/data.xml - 6487517 Dec 22 2011 08:54:04 anyconnect-macosx-i386-2.5.2014-k9.pkg - 6689498 Dec 22 2011 08:54:06 anyconnect-linux-2.5.2014-k9.pkg - 4678691 Dec 22 2011 08:54:06 anyconnect-win-2.5.2014-k9.pkg
--#-- --length-- -----date/time------ path - 32768 Dec 22 2011 08:48:16 coredumpinfo - 59 Jan 06 2012 06:51:51 coredumpinfo/coredump.cfg - 16280544 Dec 22 2011 08:49:42 _asdm-645.bin - 0 Jan 06 2012 06:51:51 nat_ident_migrate - 31057920 Jan 06 2012 06:37:50 asa842-8-smp-k8.bin - 32768 Dec 22 2011 08:53:30 log - 32768 Dec 22 2011 08:53:50 crypto_archive - 17232256 Jan 06 2012 06:38:16 asdm-645-206.bin - 12998641 Dec 22 2011 08:54:02 csd_3.5.2008-k9.pkg - 32768 Dec 22 2011 08:54:04 sdesktop - 1462 Dec 22 2011 08:54:04 sdesktop/data.xml - 6487517 Dec 22 2011 08:54:04 anyconnect-macosx-i386-2.5.2014-k9.pkg - 6689498 Dec 22 2011 08:54:06 anyconnect-linux-2.5.2014-k9.pkg - 4678691 Dec 22 2011 08:54:06 anyconnect-win-2.5.2014-k9.pkg - 17786880 Dec 22 2011 08:49:16 _asa825-smp-k8.bin - 3063 Jan 06 2012 06:51:51 8_2_5_0_startup_cfg.sav - 1138 Jan 06 2012 06:51:51 upgrade_startup_errors_201201060651.log
The ASA shows this log also while upgrading the config during boot.
ciscoasa# more flash:/upgrade_startup_errors_201201060651.log
INFO: MIGRATION - Saving the startup errors to file 'flash:upgrade_startup_errors_201201060651.log'
Reading from flash...
!
REAL IP MIGRATION: WARNING
In this version access-lists used in 'access-group', 'class-map',
'dynamic-filter classify-list', 'aaa match' will be migrated from
using IP address/ports as seen on interface, to their real values.
If an access-list used by these features is shared with per-user ACL
then the original access-list has to be recreated.
INFO: Note that identical IP addresses or overlapping IP ranges on
different interfaces are not detectable by automated Real IP migration.
If your deployment contains such scenarios, please verify your migrated
configuration is appropriate for those overlapping addresses/ranges.
Please also refer to the ASA 8.3 migration guide for a complete
explanation of the automated migration process.
INFO: MIGRATION - Saving the startup configuration to file
INFO: MIGRATION - Startup configuration saved to file 'flash:8_2_5_0_startup_cfg.sav'
*** Output from config line 4, "ASA Version 8.2(5) "
Real IP migration logs:
No ACL was changed as part of Real-ip migration
enable copy /noconfirm tftp://192.168.1.10/asa842-8-smp-k8.bin flash:/asa842-8-smp-k8.bin copy /noconfirm tftp://192.168.1.10/asdm-645-206.bin flash:/asdm-645-206.bin rename /noconfirm flash:/asa825-smp-k8.bin flash:/_asa825-smp-k8.bin rename /noconfirm flash:/asdm-645.bin flash:/_asdm-645.bin reload noconfirm
Have alook into the upgrade log and if the machine boots fine → delete unneccessary files
delete /noconfirm flash:/upgrade_startup_errors_201201060720.log delete /noconfirm flash:/8_2_5_0_startup_cfg.sav delete /noconfirm flash:/_asa825-smp-k8.bin delete /noconfirm flash:/_asdm-645.bin