{"id":1389,"date":"2015-03-03T13:04:54","date_gmt":"2015-03-03T13:04:54","guid":{"rendered":"http:\/\/emtunc.org\/blog\/?p=1389"},"modified":"2015-03-24T19:11:21","modified_gmt":"2015-03-24T19:11:21","slug":"migrating-from-a-physical-ironport-esa-to-a-virtual-ironport-appliance","status":"publish","type":"post","link":"https:\/\/emtunc.org\/blog\/03\/2015\/migrating-from-a-physical-ironport-esa-to-a-virtual-ironport-appliance\/","title":{"rendered":"Migrating from a Physical IronPort ESA to a Virtual IronPort Appliance"},"content":{"rendered":"

This post will be a collection of thoughts and my own experiences when migrating from a physical C160 to a virtual C100V appliance. Other IronPort ESA P2V appliances may be similar so it’s worth reading on!<\/p>\n

<\/p>\n

Firstly let’s talk about the Configuration Migration Tool<\/em> that Cisco developed. Unfortunately it has not been maintained or developed over the years so it probably won’t be very helpful for you… it certainly wasn’t for me. The latest version (last updated in 2013) can only support the following models:<\/p>\n

“For ESA migration from hardware to virtual, version must be 7.6.x* <\/em>
\n (for instance, 7.6.1 or 7.6.0.444).<\/em><\/p>\n

For ESA migration from virtual to hardware, version must be 8.0.0* <\/em>
\n (for instance, 8.0.0 or 8.0.0.671).”<\/em><\/p>\n

Also, don’t even bother trying to migrate from a physical appliance running AsyncOS 8.x to a virtual appliance running 9.X unless you want to know how it feels to go insane.<\/p>\n

The best way to perform the migration is to have both physical and virtual appliances on the same version.<\/p>\n

As of this post, you can download two versions of the virtual appliance. 8.5.6 and 9.0. The aim is to get the physical and virtual appliances on the same version so that the configuration backup and restore can be as pain free as possible (and maintain our sanity).<\/p>\n

Note that in my case, AsyncOS 9.X will not be supported on the C160 hardware so I made sure my physical appliance was on the most up to date 8.5.6 release and downloaded the 8.5.6 virtual appliance.<\/p>\n

Matching up the physical and virtual interfaces<\/h2>\n

Now, on the virtual appliance, you’ll have three interfaces. Management, Data 1 and Data 2. On the C160 you only have Data 1 and Data 2 so you won’t\u00a0be able to just import your config without making some (really easy) modifications.<\/p>\n

What I did was:<\/p>\n

    \n
  1. export the configuration from the virtual appliance and find the sections labelled\u00a0<interface_name>Management<\/interface_name><\/strong>\u00a0and
    \n<ethernet_interface>Management<\/ethernet_interface><\/strong><\/li>\n
  2. Export the physical appliance config<\/li>\n
  3. Replace the sections listed above in the physical config from the ones in the virtual config<\/li>\n<\/ol>\n

    Note that if you are bringing up the virtual appliance in the same network as the currently live physical appliance then you will want to change the hostname and IP addresses (in the config file or after the restore but before the commit) or you’re going to have a bad time. In my case, I changed the management address but kept the other interfaces the same but disconnected in VMWare.<\/p>\n

    Correcting the update server<\/h2>\n

    Before continuing, you will also need to make a change to the update server on the virtual appliance as it will not be correct.<\/p>\n

    You will know if your update server needs fixing if you cannot download the latest anti-spam definitions, feature keys or get any of the following errors:<\/p>\n

    Web UI:\u00a0Failure downloading upgrade list<\/em><\/p>\n

    CLI:\u00a0Failure downloading upgrade list: Received invalid update manifest response<\/em><\/p>\n

    To fix the issue:<\/p>\n

      \n
    1. Log in to CLI<\/li>\n
    2. Run the command updateconfig<\/strong> then subcommand\u00a0dynamichost<\/strong><\/li>\n
    3. Make sure the server is\u00a0update\u2212manifests.sco.cisco.com:443<\/strong><\/li>\n
    4. Commit<\/strong><\/li>\n<\/ol>\n

      See this URL for more information @\u00a0http:\/\/www.cisco.com\/c\/en\/us\/support\/docs\/security\/email-security-appliance\/118065-maintainandoperate-esa-00.pdf<\/a><\/p>\n

      License\/Feature Keys<\/h2>\n

      I generated and imported the license keys after<\/em> the config restore so it probably doesn’t matter which way you do this.<\/p>\n

      Note that you need to import the licence file via the CLI using the command loadlicence<\/strong><\/p>\n

      Dormant Feature Keys<\/h2>\n

      If you see ‘Dormant’ in the ‘Status’ column in the feature keys section then you will need to click in to those sections in the web interface and accept the EULA otherwise those features will remain disabled – annoying but that’s the way it’s done.<\/p>\n

      For example, if Sophos Anti-Virus is dormant then you need to go to:<\/p>\n

        \n
      • Security Services<\/li>\n
      • Sophos<\/li>\n
      • Edit Global Settings…<\/li>\n
      • Accept EULA<\/li>\n
      • Done<\/li>\n<\/ul>\n

        That’s it as far as my notes go – I will update this post if I come across anything else that could be useful.<\/p>\n

        Feel free to comment using the comment section below.<\/p>\n","protected":false},"excerpt":{"rendered":"

        This post will be a collection of thoughts and my own experiences when migrating from a physical C160 to a virtual C100V appliance. Other IronPort ESA P2V appliances may be similar so it’s worth reading on!<\/p>\n","protected":false},"author":32,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"jetpack_post_was_ever_published":false,"footnotes":""},"categories":[1],"tags":[135,136,97,162],"class_list":["post-1389","post","type-post","status-publish","format-standard","hentry","category-tech","tag-cisco-ironport","tag-esa","tag-migration","tag-p2v"],"jetpack_featured_media_url":"","jetpack_shortlink":"https:\/\/wp.me\/p1trTO-mp","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/emtunc.org\/blog\/wp-json\/wp\/v2\/posts\/1389","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/emtunc.org\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/emtunc.org\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/emtunc.org\/blog\/wp-json\/wp\/v2\/users\/32"}],"replies":[{"embeddable":true,"href":"https:\/\/emtunc.org\/blog\/wp-json\/wp\/v2\/comments?post=1389"}],"version-history":[{"count":10,"href":"https:\/\/emtunc.org\/blog\/wp-json\/wp\/v2\/posts\/1389\/revisions"}],"predecessor-version":[{"id":1418,"href":"https:\/\/emtunc.org\/blog\/wp-json\/wp\/v2\/posts\/1389\/revisions\/1418"}],"wp:attachment":[{"href":"https:\/\/emtunc.org\/blog\/wp-json\/wp\/v2\/media?parent=1389"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/emtunc.org\/blog\/wp-json\/wp\/v2\/categories?post=1389"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/emtunc.org\/blog\/wp-json\/wp\/v2\/tags?post=1389"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}