ASA5520-K8 7.0 (6) asdm 5.0 missing Interface configuration commands

Similar Questions

• manual installation of ASDM

  I need to pass a pair of ASA5520 to 8.0.4 (ASDM 6.1), while the rest of the firewall on the network are 7.2. (4)-(ASDM 5.2.2) it is possible to install two shortcuts ASDM on the same PC of management? We have no intention to upgrade 7.2.4 on most of the ASA

  NO - you can have 1 the AMPS on the PC version, what you can do is to keep one version of ASDM on the PC - and then connect to the ASA via the web browser and run the ASDM as a Java session.

  HTH >

• Cannot start device - ASDM question Manager

  Hello

  I have recently updated our router to spare ASA 5510 to version 9.1 (3) with image ASDM Version 7.1 (5) 100.

  The customer I try to run the ASDM launcher on Windows 7 x 64 is the latest version of Java (updated 7-5).

  I am able to do at the hand of the screen when I have https to the device.  I can install the ASDM launcher, but as soon as I get the host name and the password I have the following error "could not launch 192.168.X.XXX Device Manager."

  I went through a checklist and I can confirm the following:

  -3des-sha1 license is activated

  -Http server is enabled for my customer subnet

  -ssl encryption is enabled

  -Tried Firefox and IE10

  When I try to run the ASDM via the browser I go as far as to ask for the password, and although the initial prompt seems to accept it, an another authentication box will appear asking you to do this over and over again in an infinite loop.

  I have lived through many forum posts and checklists, but I can't seem to identify this problem.

  If it helps, the box was already flashed back to factory default before I then applied the configuration from scratch (depending on the configuration of our live cam ASA 5510).

  Can anyone help please?

  Thank you

  Hi Anthony,.

  Since then, you must have more control on ASA:

  AAA authentication http LOCAL console

  Alongside this, there should be a user name and password in the local data base of the SAA. Then try to configure command, then check:

  username cisco password cisco

  After this attempt to access two cisco ASDM with username and password and check if it works or not.

  -Prateek Verma

• I do not have "Firepower of ASA Configuration" menu in ASDM

  Hello

  I do not have "Firepower of ASA Configuration" menu in ASDM.

  I already configured IP to the management port 0/0 10.226.24.181 also to the 10.226.24.130 of the SFP Manager.

  I can ping 10.226.24.130 ASA CLI and have tab in ASDM (with https://No DC configured the button).

  You can see in attachment

  Help, please

  You have an ASA 5525 - X and the module of firepower is 5.3.1 - 152. To manage the power light module on that platform via ASDM requires the runtime current software 6.0 or later version (and your ASDM must be 7.5 (1.112) or later version).

  Reference: http://www.cisco.com/c/en/us/td/docs/security/asdm/7_5/release/notes/rn7...

  If you want to upgrade the module of 5.3 to 6.0 and you do not have fire power manager, then the way ahead is to reimage using the 6.0 system images and boot. This procedure is illustrated below:

  http://www.Cisco.com/c/en/us/support/docs/security/ASA-firepower-service...

  You need the images available here:

  https://software.Cisco.com/download/release.html?mdfid=286271172&flowid=...

  Expand the tree on the left and look under all versions 6.0 > 6.0.0. Use the files asasfr-5500 x-boot - 6.0.0 - 1005.img and asasfr-sys - 6.0.0 - 1005.pkg.

  After getting it to work, you should also update further the the latest version (currently 6.0.1).)

• How to disable the asdm sessions.

  Hello to all the experts,

  For some reason I can't go to the session of the asdm.

  You sh asdm sessions, it shows that I have 0-4 sessions in progress, but I don't have any session going at it, it was my previous access. He did not clear when I left the game.

  Try to erase with 'asdm disconnect 0', he takes the command, but do when an asdm session show. He is also always connected; so I can't start another session of asdm to the pix. PIX work os version 7.01. Any help on this will be highly appreciated. Thank you in advance for any input from the forum. Joseph

  To the best of my knowledge, there is a bug in version 7.01, I suggest to update for the maintenance release 7.0 (4) or above release.

• Dashboard ASA ASDM Cisco ACS

  Hi all

  We use CiscoSecure ACS 4.2 for AAA.

  In our ASA 8.2.5 ASDM 7.3 (1) 101, if connect us with user group privilege 5, we would be unable to see the dashboard of firewall for Top 10 Services / Sources / Destinations.

  Someone knows how to have the privilege of established, essentially the Group of users that we have only in read-only, but can see the Top 10 services/sources/destinations edge ASDM

  Thank you very much

  Hi David,

  Yes you are right with privilege 5 you would be able to make these changes.

  You can use one of two methods of authorization in order to work around this limitation:

  Local database: configure command on the security privilege levels
  device. When a local user authenticates with the enable command (or logs
  with the command login), the security apparatus put this user in the
  level of privilege that is defined in the local database. The user can then
  access controls at and below the user privilege level.

  Note You can use the authorization of local control without all the users in local
  without CLI and database or enable authentication. Instead, when you enter
  enable command, you enter the enable password and security
  device puts you in level 15. You can then create enable passwords for
  all levels, so that when you enter enable n (2 to 15), security
  device puts you in the level n. These levels is not used, unless you put
  local command authorization (see "setting up order Local
  Authorization ".
  http://www.Cisco.com/c/en/us/TD/docs/security/ASA/asa80/configuration/gu...

  GANYMEDE + server: GANYMEDE Server + (ACS), to configure the controls that can be used by a user or a group after they authenticate to access CLI. All the commands that a user enters in the CLI are verified with the GANYMEDE server +:

  http://www.Cisco.com/c/en/us/support/docs/security/secure-access-control...

  It will be useful.

  Kind regards

  Aditya

  Please evaluate the useful messages.

• Location of image/asdm FWSM

  Hello

  Can someone please advise how we can see the image copied/AMPS on FWSM... ?. as per the below document we copied the software application (image or asdm) to current partiton with the command

  copy tftp://server[/path]/filename flash:

  http://www.Cisco.com/en/us/docs/security/FWSM/fwsm31/configuration/guide/swcnfg_f.html#wp1047472

  I just want to know where this current partition, is this what partition out of six on the flash (cf:x.?), when we give the command to see the current boot partition, we cannot see any number of partition here.

  wr01-cc4 #show boot device Module 9

  [mod:9]:

  but below document which clearly shows the number of partition as cf:4

  http://www.Cisco.com/en/us/docs/security/FWSM/fwsm31/configuration/guide/switch_f.html#wpxref43058

  has my copy (image/asdm) went somewhere else, which is the recommended method to copy into the correct partition. ?

  Thanks in advance.

  Hello

  Yes, that means that the FWSM will start automatically to cf:4 since nothing is specified. If you want to cf:4 appears in this output, you can run the command "boot device module 9 cf:4" and it will set it for you.

  The FWSM, you can ' dir flash: "to see the FWSM and ASDM images in flash, but keep in mind that there is no file name or version information here. This is because the FWSM can only contain one of each image at a time. Instead, you simply tick 'Show version' to see the FWSM and ASDM versions.

  -Mike

• ASDM 6.4; ASA 5510 version 8.4 (1) - cannot access ASDM

  Hello Experts,

  I want access to ASDM since my PC of management. I can ping to MANAGEMENT PC as well as do SSH connection but I can't go ASDM browser.

  Please guide me.

  Here are the usful details:

  ASDM - setup.jpg

  

  Running configuration

  See the ciscoasa # running
  : Saved
  :
  ASA Version 8.4 (1)
  !
  ciscoasa hostname
  activate 9jNfZuG3TC5tCVH0 encrypted password
  2KFQnbNIdI.2KYOU encrypted passwd
  names of
  !
  interface Ethernet0/0
  nameif inside
  security-level 90
  IP 192.168.1.1 255.255.255.0
  !
  interface Ethernet0/1
  Shutdown
  No nameif
  no level of security
  no ip address
  !
  interface Ethernet0/2
  Shutdown
  No nameif
  no level of security
  no ip address
  !
  interface Ethernet0/3
  Shutdown
  No nameif
  no level of security
  no ip address
  !
  interface Management0/0
  Shutdown
  No nameif
  no level of security
  no ip address
  !
  passive FTP mode
  pager lines 24
  MTU 1500 inside
  ICMP unreachable rate-limit 1 burst-size 1
  ASDM image disk0: / asdm - 641.bin
  don't allow no asdm history
  ARP timeout 14400
  Timeout xlate 03:00
  Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
  Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
  Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
  Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
  timeout tcp-proxy-reassembly 0:01:00
  dynamic-access-policy-registration DfltAccessPolicy
  the ssh LOCAL console AAA authentication
  Enable http server
  http 192.168.1.5 255.255.255.255 inside
  No snmp server location
  No snmp Server contact
  Server enable SNMP traps snmp authentication linkup, linkdown warmstart of cold start
  Telnet timeout 5
  SSH 192.168.1.0 255.255.255.0 inside
  SSH timeout 5
  Console timeout 0
  a basic threat threat detection
  Statistics-list of access threat detection
  no statistical threat detection tcp-interception
  WebVPN
  username admin privilege 15 encrypted password e1z89R3cZe9Kt6Ib
  !
  class-map inspection_default
  match default-inspection-traffic
  !
  !
  type of policy-card inspect dns preset_dns_map
  parameters
  maximum message length automatic of customer
  message-length maximum 512
  Policy-map global_policy
  class inspection_default
  inspect the preset_dns_map dns
  inspect the ftp
  inspect h323 h225
  inspect the h323 ras
  Review the ip options
  inspect the netbios
  inspect the rsh
  inspect the rtsp
  inspect the skinny
  inspect esmtp
  inspect sqlnet
  inspect sunrpc
  inspect the tftp
  inspect the sip
  inspect xdmcp
  !
  global service-policy global_policy
  context of prompt hostname
  call-home
  Profile of CiscoTAC-1
  no active account
  http https://tools.cisco.com/its/service/oddce/services/DDCEService destination address
  email address of destination [email protected] / * /
  destination-mode http transport
  Subscribe to alert-group diagnosis
  Subscribe to alert-group environment
  Subscribe to alert-group monthly periodic inventory
  monthly periodicals to subscribe to alert-group configuration
  daily periodic subscribe to alert-group telemetry
  Cryptochecksum:afe73d128f7510e1bf9463fd698fa7fb
  : end
   
   
  Successful PING Bothways
   
  ciscoasa (config) # ping 192.168.1.1

  Type to abort escape sequence.

  Send 5, echoes ICMP 100 bytes to 192.168.1.1, time-out is 2 seconds:

  !!!!!

  Success rate is 100 per cent (5/5), round-trip min/avg/max = 1/1/1 ms

  ciscoasa (config) # ping 192.168.1.5

  Type to abort escape sequence.

  Send 5, echoes ICMP 100 bytes to 192.168.1.5, time-out is 2 seconds:

  !!!!!

  Success rate is 100 per cent (5/5), round-trip min/avg/max = 1/1/1 ms

  output ciscoasa (config) #.

  Thank you :-)

  Please let us know the output of:

  view worm | I have 3DES

  Show ssl

  The bits of this production key would ensure that your license 3DES / AES is active and your ASA supports strong cryptographic algorithms (encryption).

• Form improved ASDM 5.0 to 5.12, ASDM now does not work

  Hello

  I upgraded from ASDM ver 5.0 to 5.12 and now cannot connect through the client (error message incorrect worm) or via HTTPS only needed to upgrade the PIX at the same time?

  Verify that the version of your config runnning ASDM new version...... It must be said

  ASDM image disk0: / asdm - XXX.bin

  If it does not then you neeed to specify manually

  First, check the file loaded in Flash ASDM is specified by the asdm image flash: / / order. Then, verify that the enable http server command is in the configuration. Finally, check the host trying to load the ASDM is permitted through the http command.

  I hope that helps... Rate if he does!

• Dynamic to static IPSec with certificate-based authentication

  I'm trying to implement a dynamic to static LAN2LAN vpn from an ASA 5505 (with a dynamic IP address) to an ASA5520 (with a static IP address)
  I wish I had a small (/ 30) network on the side dynamics which I can connect to a larger (/ 24) network on the static side.
  I also try to use the identity for authentication certificates.

  I produced a root and intermediate CA signed of the intermediate CA with the certificate authority root and then created identity cases for
  the ASAs, signed with the intermediate CA using OpenSSL and imported to a trustpoint

  I tried to use the instructions on:
  http://www.Cisco.com/en/us/products/ps6120/products_configuration_example09186a0080930f21.shtml
  to configure certificates (replacing MS with OpenSSL) and following the instructions to:

  I tried the ASDM to set up the cert to identity appropriate on the external interface
  [Configuration-> Device Management-> advanced-> SSL settings]

  and establish a connection profile [Configuration-> Device Management-> connection profiles] on both devices,
  setting the part that gets its IP via DHCP static and the side that has the IP permanently to accept dynamic.

  I apply the settings, and nothing happens.

  See the crypto isakmp just returns "there is none its isakmp.

  I don't know where to start debugging it. How can I force the side DHCP to initiate a connection?

  We are sure that both peers are using the same isakmp settings? It seems the policy that uses rsa - sig on one end uses a different Diffie-Hellman group.

• upgrade of firepower that run in asa integrated

  I have a x-5506 running 9.5.1 asa and 5.4.1 sfr.

  I have had't used for a while and ran the Manager of the sfr cmd line configuration command. I read that the DB variable for sfr consecutive in a 5506 may be damaged. It seems there because it will not register with my asa now.

  If I go to configure > local > register he is stuck on waiting to record. Even on the sfr cmd line.

  It is a device that I got through a course less than a year yet. Is that mean that one is not allowed forever to update or download the installation images? can I register to my account?

  Hello

  When you use Configuration manager to SFR, it expects to sign up to a power of fire aka Defense center management center.

  See this article.

  http://www.Cisco.com/c/en/us/support/docs/security/firesight-management-...

  So once you configure the manager address at sfr, you must complete the registration process in separate Manager as well.

  If you are not running a separate management centre, then I believe that you want to manage the ASA and SFR module using ASDM.

  You can do this, but for this you don't need configuration manager. So if you do this, remove the handler by using the command "configure Manager delete" and make sure that the computer running ASDM can reach sfr module and vice versa.

  See this article to make sure that you are running scenarios.

  http://www.Cisco.com/c/en/us/support/docs/security/IPS-sensor-software-v...

  See this article for more information on how you can use ASDM to fire module /SFR Power Manager

  http://www.Cisco.com/c/en/us/TD/docs/security/firesight/541/firepower-mo...

  Rate if this can help.

  Yogesh

• ASA 5505 cannot configure FTP and I tried almost everything

  Not sure if my device is faulty or not, but I'm running on a base license and cannot establish an FTP connection for the life of me. Here is my config;

  Thanks in advance...

  ASA Version 7.2 (2)
  !
  ciscoasa hostname
  domain default.domain.invalid
  activate the encrypted password of TGFUt.AsMHJOyury
  names of
  !
  interface Vlan1
  nameif inside
  security-level 100
  IP 192.168.1.1 255.255.255.0
  !
  interface Vlan2
  nameif outside
  security-level 0
  IP address dhcp setroute
  !
  interface Ethernet0/0
  switchport access vlan 2
  !
  interface Ethernet0/1
  !
  interface Ethernet0/2
  !
  interface Ethernet0/3
  !
  interface Ethernet0/4
  !
  interface Ethernet0/5
  !
  interface Ethernet0/6
  !
  interface Ethernet0/7
  !
  2KFQnbNIdI.2KYOU encrypted passwd
  passive FTP mode
  DNS server-group DefaultDNS
  domain default.domain.invalid
  access-list extended 100 permit tcp any host 192.168.1.110 eq ftp
  access-list extended 100 permit tcp any host 192.168.1.110 eq ftp - data
  pager lines 24
  asdm of logging of information
  Outside 1500 MTU
  Within 1500 MTU
  ICMP unreachable rate-limit 1 burst-size 1
  ASDM image disk0: / asdm - 522.bin
  don't allow no asdm history
  ARP timeout 14400
  Global 1 interface (outside)
  NAT (inside) 1 0.0.0.0 0.0.0.0
  Timeout xlate 03:00
  Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
  Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat
  Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect
  Timeout, uauth 0:05:00 absolute
  Enable http server
  http 192.168.1.0 255.255.255.0 inside
  No snmp server location
  No snmp Server contact
  Server enable SNMP traps snmp authentication linkup, linkdown cold start
  Telnet 192.168.1.0 255.255.255.0 inside
  Telnet timeout 5
  SSH timeout 5
  Console timeout 0
  dhcpd outside auto_config
  !
  dhcpd address 192.168.1.2 - 192.168.1.33 inside
  dhcpd allow inside
  !

  !
  class-map inspection_default
  match default-inspection-traffic
  !
  !
  type of policy-card inspect dns preset_dns_map
  parameters
  message-length maximum 512
  Policy-map global_policy
  class inspection_default
  inspect the preset_dns_map dns
  inspect the ftp
  inspect h323 h225
  inspect the h323 ras
  inspect the rsh
  inspect the rtsp
  inspect esmtp
  inspect sqlnet
  inspect the skinny
  inspect sunrpc
  inspect xdmcp
  inspect the sip
  inspect the netbios
  inspect the tftp
  !
  global service-policy global_policy
  context of prompt hostname
  Cryptochecksum:641863a581e04222e46e2ab17a880147
  : end

  Where is the static nat translation, or configuration of port forwarding?

  you have bellows acl lines, these access lists is not yet applied to the external interface of the firewall.

  access-list extended 100 permit tcp any host 192.168.1.110 eq ftp
  access-list extended 100 permit tcp any host 192.168.1.110 eq ftp - data

  How the outside internet hosts are able to connect to a non-public such as the 192.168.1.110 IP address?

  you need little things to fix in your configuration, your external interface is first attributed to dynamic ip for ISPS to provide the public IP seen in your config like:

  interface Vlan2
  nameif outside
  security-level 0
  IP address dhcp setroute
  

  Number 1- because we don't know what address IP of the ISP dynamically given the firewall, you must know what address is provided by the show on the asa show ip interface brief command line and take notes on the IP Vlan2... that Ip address will be the use of a single for hosts on the internet so you can connect to your FTP 192.168.1.110 server.

  Number 2 - because you do not spared a public IP address to use a one-to-one translation NAT for your server ftp within a public IP to the outside address, you must use the keyword interface on your translation of static port and the real access list 100 for the firewall to allow this connection and sends the request to the server ftp inside.

  public static tcp (indoor, outdoor) interface 192.168.1.110 ftp ftp netmask 255.255.255.255
  public static tcp (indoor, outdoor) interface ftp - data 192.168.1.110 ftp - data netmask 255.255.255.255

  Then re - configure acl 100 as below and apply it to the external interface

  access-list extended 100 permit tcp any which interface outside eq ftp
  access-list extended 100 permit tcp any which interface outside eq ftp_data

  Access-group 100 in external interface

  Finally, make sure you have your FTP server is running, don't forget not that from outside you will be using the public IP address you got output show ip interface brief , which will be the IP address that will be used to FTP from the outside to the inside.

• Access through RSA SecurID w / RADIUS ASA

  Hello

  I'm trying to configure AAA to access our ASA box. I have an RSA SecurID appliance with the operation of Steel Belted Radius. I have implemented access SSH and telnet without any problem.

  However, when I try to access it via HTTP or with the ASDM, it will not authenticate. I enabled http server and added the appropriate commands, but what actually happens is when I try to log on by HTTP, it sends 2 RADIUS, 1 queries immediately after the other. So one gets accepted, 2nd gets rejected. I think it's because you cannot authenticate twice with the same token on the RSA code, so why the 2nd request is rejected. But he should not be sent 2 requests in the first place.

  This does not happen through SSH.

  I have attached a log from the flow of connection through the FW...

  Any help is greatly appreciated!

  Hello

  ASDM will not work with Server Token RSA generated passwords. Generated by the Token RSA server past are one time only use. They expire after the first use. ASDM uses Java that caches of authentication once connected at the start. For all transactions http subsequent of the ASDM, uses Java caching of authentication information when communicating with the device. Each action of ASDM to the device is a transaction independent http involving any SSL handshake, but that Java uses cached authentication information users do not have to re-enter it.

  ASDM works only if the configured authentication mechanism uses persistent passwords. Unique PASSWORD mechanisms do not work with the ASSISTANT Deputy Ministers.

  Try to test http authentication with a user account local on the Radius Server and verify the results.

  I hope this helps.

  Soumya

• Assign the virtual sensor in the MODE SINGLE ASA5510-AIP10SP-K9

  Hello

  I install asa 2 ASA5510-AIP10SP-K9 in standby mode active failover. I know how to assign virtual devices to the contexts of the ASA in multiple mode (active/active failover). But I want it to be done in simple mode (active/standby failover). Any idea will be welcomed.

  OK, now I understand what you need.

  Most users need only the single default «vs0» virtual sensor

  To get traffic from the ASA to send to the SSM for follow-up here are the basic steps:

  (The assumption is that you have already previously connected and changed the password and went through the steps in "setup" to set the IP address, network and other settings on your sensor mask.)

  (1) in the AIP - SSM (telnet or ssh) session as the default user "cisco".

  (2) adding interface backplane of the AIP - SSM GigabitEthernet0/1 in the virtual sensor default "vs0" using these commands:

  Configure the terminal

  service-analysis engine

  vs0 virtual sensor

  phyiscal-interface GigabitEthernet0/1

  output

  output

  Answer Yes when prompted

  output

  NOTE: The above could also be done through the advanced configuration command, or could be done through ASDM or IDM. To put it simply I just give you the CLI commands.

  3) connect to the ASA CLI. If you're "ridden" on the SSM, then an exit from your session will respond to the ASA CLI. If connect you via the console through a ssh or telnet or ASA ASA.

  (4) set the ASA to send traffic to the AIP - SSM.

  To do this, you would create an ACL for the traffic you want to monitor. This ACL is then used to create a class map. The plan of the class is then added in a political map. The political map is applied.

  Here's an example of how you can get any traffic to monitor histocompatibility of the AIP - SSM:

  conf t

  IPS ip access list allow a whole

  my class-map-ips-class

  corresponds to the IP access list

  Policy-map global_policy

  My ips-category

  IPS overcrowding relief

  global service-policy global_policy

  NOTE: The foregoing will send all IP packets to the SSM for surveillance of promiscuity. To change monitoring online simply substitute "inline" instead of promiscuity in the line of configuration of IP addresses.

  Note 2: The service-policy command is a reptition of the command that should already be in your configuration of ASA by default. So, it will probably generate an error/warning letting you know that the policy is already applied.

  IF you do not use the default configuration on the SAA and instead create your own policy, then you can use the steps above, but add the class to your own policy rather than the value default 'global_policy '.

  (4) repeat steps 1 and 2 on the MSS of your Eve ASA.

  The configuration of the AIP - SSM does NOT automatically copied between the AIP-SSMs. If you need to do the configuration manually on the two AIP-SSMs.

  (5) connection to standby you ASA and check tha the configuration in step 3 is automatically copied to your Eve ASA.

  The steps above are in force at step 4/5 in your original list.

  Your AIP - SSM should now be followed by traffic.

  You can now proceed to step 6 of your original list.

• Anyconnect VPN migration issues

  Hi, I do Anyconnect VPN from an ASA ASA migration another. I need your suggestion. Migration must transfer customization and anyconnect vpn configuration. After that I reviewed some documents, looks like the configuration and customization are not the only thing that needs to be transferred. Everything can give some suggestion exactly what needs to be transferred in addition to customization and configuration vpn? Thank you

  Hello

  Although the copy of the configuration of one firewall to another will get all the anyconnect rules and the installation program completed, but the flash content (IE anyconnect programs, profiles anyconnect, customizations anyconnect, bookmarks, and dap profiles) is not transferred to the other ASA. They must be downloaded manually to the ASA again.

  Another way to do this is through ASDM,

  Go to tools > configuration backup:

  Select the components of the VPN you want to create a backup for.

  

  NOTE *.
  This backup will be restored as a whole via ASDM and substitute another configuration.
  So, you might want to restore the backup to a fresh firewall and then import the configuration and the images of the SAA.

  Otherwise, you can go the ususal path, the anyconnect first configuration copy and then manually transfer components anyconnect flash of one ASA to another.

  **********

  Kind regards
  Dinesh Moudgil

  PS Please rate helpful messages.