Advice on upgrading ASA 5510 from version 8.4(4)1

Hello all,
Due to an issue we need to upgrade our ASA. Cisco Support team recommended upgrading to version 8.4.7, but, as we'll upgrade, we'd like to upgrade to version 9.
We still use Cisco VPN Client for Remote Access VPNs so I'd like your advice on which version to install on ASA.
Would you recommend version 9.0.3? 9.1.X?
Thanks in advance,
Igor

We have a pretty huge ASA and ASASM complex, and we are just about finished upgrading from an assortment of 8.4.x, 8.5.x, and 8.6.x installs to 9.1.3 on everything. There is one gotcha on some systems in that there is a file system change or some sort of bug that is fixed in 8.4.5 I think. So you _may_ have to first upgrade to a newer version (8.4.7 would work) before going to 9.1.3.
Our Cisco team has recommended going to version 9.x, and this is supported by recent tickets I've had on our stuff still running on 8.x, as the TAC engineer often says we need to upgrade to version 9.
Four our setup, we had some fatal bugs in 8.4.6 and 8.4.7 that kept us running 8.4.5 for a very long time on some equipment.
Anyway, I would recommend going to 9.1.3, which is one removed from the recently recleased 9.1.4. Our AnyConnect VPN complex has been on 9.1.3 for a few months now with no issues. Be sure to read the release notes thoroughly as 9.x changes some command contexts, new features, etc.
Graham

Similar Messages

  • Upgrading ASA 5510 from 8.0.4 to 8.2.5

    We want to implement Netflow so want to upgrade our 5510 to 8.2.5. But have a few questions.
    This device has 64MB of flash and 256MB of DRAM. Would I need to upgrade RAM? Right now we have about 25 site to site VPNs running through this thing as well as a few remote clients. Is this enough to constitute a memory upgrade?
    Right now we are running ASDM 6.4.7. Should we upgrade to a higher version?
    And lastly, would the upgrade to 8.2.5 require the use of AnyConnect for our VPN client users? Our 5505 is on version 8.2.5 and doesn't require AnyConnect, but wanted to make sure.
    Thank you for your time.

    Hi Michael,
    The RAM upgrade is needed if you want to go to 8.3+ code. Although you might find that you are running low on RAM and that will impact your ability to run packet captures, so an upgrade doesn't hurt...
    ASDM can be upgraded seperately and does not require a reboot + new ASDM versions are backwards compatible with older ASA codes...
    http://www.cisco.com/en/US/docs/security/asa/compatibility/asamatrx.html#wp42231
    ASA 8.0(4)
    ASDM 6.1(3) and later.Recommended: 7.1(4).
    ASA 8.2(5)
    ASDM 6.4(3) and later.Recommended: 7.1(4).
    Although the Cisco VPN Client is eol and the replacement is AnyConnect, you are not forced to go that direction in any code...
    Patrick

  • I have upgraded Apple Aperture from version 2 to version 3 and I'm having a problem with the "Highlights and Shadows" adjustment. According to the user's manual, I should have access to an advanced disclosure triangle which would allow me to adjust mid co

    I have upgraded Apple Aperture from version 2 to version 3 and I'm having a problem with the "Highlights and Shadows" adjustment. According to the user's manual, I should have access to an advanced disclosure triangle which would allow me to adjust mid contrast, colour, radius, high tonal width and low tonal width.
    If anyone has any suggestions as to how to access this advanced section, I'd be most grateful.

    Hi David-
    The advanced adjustments in the Highlights & Shadows tool were combined into the "Mid Contrast" slider in Aperture 3.3 and later. If you have any images in your library that were processed in a version of Aperture before 3.3, there will be an Upgrade button in the Highlights & Shadows tool in the upper right, and the controls you asked about under the Advanced section. Clicking the Upgrade button will re-render the photo using the new version of Highlights & Shadows, and the Advanced section will be replaced with the new Mid Contrast slider. With the new version from 3.3 you probably don't need the Advanced slider, but if you want to use the older version you can download it from this page:
    http://www.apertureexpert.com/tips/2012/6/12/reclaim-the-legacy-highlights-shado ws-adjustment-in-aperture.html

  • I have upgraded Acrobat Standard from version 8 through time until I am currently using version X, which doesn't work with Office 2013.  Can I upgrade to version Standard XI?

    Over the years I have upgraded Acrobat Standard from version 8 to currently working with version X.
    However, since getting a new laptop it doesn't work with Office 2013.
    Can I upgrade to Standard XI?

    Upgrade pricing now only applies to version 9 and X. So if you have a retail serial number for X, you should be able to upgrade. (Or consider subscription).

  • Does anybody know benefices of upgrading SAP ERP from version ECC 6.0 EHP 7 to ECC 6.06 EHP 10?

    An upgrade of ERP SAP from version  ECC 6.0 EHP 7 to ECC 6.06 EHP 10 is being planned in the company I work for. However, I don´t know what the benefices are to   implement this upgrade so I wonder if someone knows benefices of upgrading SAP ERP from version ECC 6.0 EHP 7 to ECC 6.06 EHP 10?
    Regards, Alejandro

    Hi _Miguel
    I am going from ECC 6.0 to ECC 6.06. However, I don´t know what the benefices are to   implement this upgrade so I wonder if someone knows benefices of upgrading SAP ERP from version 6.0 to 6.06
    regards, Alejandro

  • Upgrading ASA 5510 IOS

    I have recently come upon a ticket that requires functionality from a later version of the ASA 5510 IOS Firmware, upon researching how to do this upgrade I got caught in a catch 22 where I am unable to dowload ASDM or the ASA software, apparantly I need a service account? I'm looking at Ciscos software download page and searching ASDM which then brings up links to two pages which are ASA and ASDM. Can anyone verify that I do need a service account or point me in the right direction to get these software components?

    Hello,
    You need Smartnet contract for the ASA. With that, you can regester on cisco website and can download necessary software. Reachout to Cisco auth reseller or your account rep for more details.
    hth
    MS

  • Upgrading ASA (5520) from 8.2(5) to 8.4(6)

    Hi All,
    I'm planing to upgrade my failover firewalls active/standby from 8.2.5 to 8.4.6. I read about the NAT and I think I'm ready for it cross fingers
    My plane is
    Upload the 8.4.6 and ASDM 7.1.3 for both firewalls then assgin the boot and ASDM image to the new files. After thaton the active firewall reload the standby and wait until its up and running (cross finger again) then force the active to be standby and reload the standby to get the new 8.4.6.
    am I right about that? or should I upgrade to 8.3.1 or 8.3.1 first ?? please if it is, can you give me the full upgarde path?
    Thanks in advance!!!

    I don't know if I'm going to answer your question.  But here is my latest experience, about year ago.  I just preformed an upgrade from 8.0.x to 8.4.4.1 on a pair of ASA 5510's in failover using CLI.  The upgrade seem to go smooth from our end,  but all connection did drop.  We followed these steps here.  NAT wasn't an issue for us. 
    Point is, there really isn't an upgrade path.  Just reload stand-by unit, make it the active unit and watch the connections.  Ours dropped don't know why.
    Don't know if that helps,
    Nick

  • Upgrading SAP BW from version 7.0 to 7.4

    Hello Everyone,
    We are going to upgrade the BW system from version 7.0 to 7.4. My question is that, we have 3.5 flow as well in our system, so would it cause any issue while upgrading or we should do the migration of 3.5 flow to 7.0 first and then we should go for upgrade. Does 7.4 supports 3.5 flow? Please suggest.

    SAP BW 7.4 supports 3.5 flows and i guess upcoming version will also supports 3.5 flow.
    The 3.5 flow will not create any issues during SAP BW upgrade.The migration of 3.5 to 7.0 is also not mandatory.The Application upgrade is taken care by SUM tool.It will not differentiate any flows (3.5/7.0). It will upgrade all BW objects to 7.4 versions.

  • Upgrade ASA Software from 8.3.2 to 8.4.3

    Hi,
    does anybody did an Upgrade from an 8.3 version to the new version 8.4.3 and can give some hints or links to read?
    I only have a production system and nothing to test and I don' want to get a nasty surprise...
    Thanks a lot in advance

    If you're already on 8.3(2) you've already gotten past the tricky bit - the new NAT syntax and access-list object use. There are some minor changes with identity NAT in going up to 8.4(3) as described here but that's about it as far as things to watch out for.
    The TAC is quite helpful and it is a good idea to open a case proactively just to have them on hand to take a quick look at any issues that come up. The TAC security team deals with these upgrades every day and is very adept at zeroing in on the root cause of  any issues you are having and setting things straight within in few minutes.

  • I can't upgrade my Iphoto from version 9.1.1 (527)

    Hi.
    I am trying to upgrade my Iphoto. I currently have version 9.1.1 (527).
    When i open Iphoto i get a promt, that there is a new version, and would i like to download it. Sure! But when the appstore opens, where the upgrade should be there is nothing there.
    Ive tried other solutions, such as searching for Iphoto in Spotlight, opening Iphoto, and manually clicking the "search for updates" or what it is called in the drop-down menu.
    Then i found differnt upgradefiles here on the apple-site. I downloaded upgrades 9.1, 9.3.1, 9.3.2. But when i tried to apply them, a error message says that i have to have Iphoto 9.1 installed on my mac to upgrade..  But, i have that already don't I, as i have Iphoto version 9.1.1 (527) ??
    Ive read that you could delete it, and download it again from the appstore, but im not gonna pay to download something i already own !
    Can anybody help me ?
    Thanks,
    Simen

    How old is your Mac? If it's very recent you need to update via the App Store
    If you purchased at the App Store you need to update via the App Store
    Otherwise you update via Softare Update
    -->  If you have moved iPhoto from the default location (i.e. into a Folder) then the updater won't find it. Move it back.
    -- > If you have renamed iPhoto, the updater won't find it. Change it back.
    Regards
    TD

  • Upgrading call manager from version 8 to 9

    Hi All
    Can anyone please tell me the summary steps on what I need to do to go from call manager version 8 to version 9?
    many thanks
    Carl

    The answer to your question, is that they entirely depend on you exact CUCM versions, asking here and just saying "8 "does not work. You will need to do your due diligence, and read:
    A) Upgrade guide for your target version
    B) Release Notes
    C) New and changed doc, if not included in the RNs already
    They will provide you with ALL you need to perform the upgrade, pre-reqs, procedure, and post-upgrade changes to the VM. All the information is available on cisco.com under the CUCM main documentation site.
    Once you've been thru those, you can come back with any further questions.

  • Advice for upgrading to iCloud from MobileMe

    I am about to ugrade my 20" Intel iMac (2 GB RAM).  I will also enable iCloud on our iPhone 4S (2 devices in the house) to iCloud and I am seeking advice.  BTW, we are running iOS 5.1.1 on both iPhones.
    First off, I have backed-up and cleaned up my iDisk, so that's done.  I have also deleted my MobileMe Photo Albums and Movies (all are backed-up) from my MobileMe Gallery.
    Next, I have updated my iWeb site and published it to a folder on my hard drive.  I may/may not have a third party host it ... that is a future decision, but for now, it is "preserved". 
    Now my question - What advice do you have for me before I embark upon this "upgrade".  Am I missing anything?  Any tips, tricks or pointers you have to offer would be greatly appreciated.
    Thanks in advance.

    My first observation is that your profile states that you are using OSX 10.6.8, iCloud is only included with OSX10.7.2 or better. Perhaps you should consider updating your operating system before moving to iCloud.
    Secondly, although you would have had to do them eventually, migrating to iCloud will not stop you using your iDisk, gallery or iWeb hosting space. You can continue to use the services until June 30, 2012.
    Finally before making the migration to iCloud from MobileMe, you may wish to back up your MobileMe mail, your contacts and your calendars.

  • I want to upgrade to Lion from version 10.4.11 how do I do this?

    Hi
    I want to upgrade my Macbook to the latest Lion software but do I have to upgrade to Snow Leopard first then go to Lion?
    Can I do this online or do I need to go in store?
    current version 10.4.11
    thanks

    You can upgrade from 10.4 to 10.6 with no problems. Any program that runs under 10.4 should run under10.6. See this list for compatibility with 10.6: http://snowleopard.wikidot.com/  You might have to upgrade some drivers for printers, etc.... And you will have to install Rosetta if you have any third party Power PC applications http://www.macobserver.com/tmo/article/snow_leopard_installing_rosetta/   I recently upgraded an older MacBook (model 1,1) straight from 10.4 to 10.6.
    To upgrade your iLife and iWork. If you only want iPhoto or other single apps from iLife '11 you can get them from the App Store after you've upgraded to 10.6.6. iPhoto, iMovie or Garage Band for $15 each and Pages, Keynote or Numbers from iWork '09 for $20 each.
    Once you are at 10.6.8 you can buy Lion for $29 from the App Store if you have at least a model 2,1 MacBook. Lion will require at least 2gb of RAM but really needs 4gb to run smoothly. As for third party programs see this list for compatibility with 10.7 http://roaringapps.com/apps:table Also Lion doesn't run any Power PC programs. To see if you have any Power PC programs go to the Apple in the upper left corner and select About This Mac, then click on More Info. When System Profiler comes up select Applications under Software. Then look under Kind to see if any of your applications are listed as Power PC. Universal and Intel will run under Lion.
    Before Mac switched to Intel processors they used Power PC processors from 1994 to 2005. Power PC 601 through 604, G3, G4 and G5. Applications written for the Power PC processors need the application called Rosetta to run on Intel processors. This was part of the Operating System in 10.4 and 10.5 but was an optional install in 10.6. With 10.7 Lion Apple dropped all support for Power PC applications.

  • Unable to upgrade Flash Player from version 15 to 16

    Hello Chris.  The process is still not right.  I've posted elsewhere but am unable to update Flashplayer from 15.xxx to 16.xxx.  I can get the installer but the actual download stalls at 35% or so using Firefox, sometimes as high as 44% with Chrome.  I don't play games but several sites have started initially denying me due to out-of-date FP.  Otherwise I really would have quit trying.  Using Window 7 Pro  64x, though several other programs are 32x----no idea what this means.  I have deleted FP  15.xxx  and the world has not ended--tho my patience has.  There's gotta be a fix!

    Sorry you're having problems with the update.  Here's what I'd try:
    1. Uninstall Flash Player using the stand alone installer here (do this even if you've uninstalled from the control panel): http://download.macromedia.com/get/flashplayer/current/support/uninstall_flash_player.exe
    2. If the online installer is failing, go to our Flash Player Install Help page and scroll to the bottom of the page: Installation problems | Flash Player | Windows
    3. At the bottom of the help page you'll find links to the ActiveX (IE) and NPAPI (Firefox) "standalone" installers.  Download these and give them a try.
    Ps. I broke this out into a new thread as the one you had replied to was over a year old and unrelated to installation.

  • ASA 5510 - Version 8.2(1) - SSH, ICMP and NAT not working

    I have an ASA 5510 using version 8.2(1) and I have enabled ssh, icmp and they work from the inside network but not from the outside network. 
    Further to this, I exposed one site from the inside interface on the ASA (192.168.1.100) to outside (1.1.1.7) using NAT and it is not pingable nor accessible from the outside. I also allowed SSH from the outside network to the external IP addresses of the ASA and it is not working either.  Any ideas what I could be missing in my configuration?  I bolded the configurations involved in the ASA running configuration I copied below (please note I have replaced the real IP addresses with 1.1.1.x and 2.2.2.x):
    ASA Version 8.2(1)
    hostname fw
    domain-name net.com
    enable password eYKAfQL1.ZSbcTXZ encrypted
    passwd 2KFQnbNIdI.2KYOU encrypted
    names
    dns-guard
    interface Ethernet0/0
    description Primary Outside (Internet)
    speed 10
    duplex full
    nameif outside
    security-level 0
    ip address 1.1.1.5 255.255.255.240
    ospf cost 10
    interface Ethernet0/1
    description inside
    speed 100
    duplex full
    nameif inside
    security-level 100
    ip address 192.168.1.254 255.255.255.0
    ospf cost 10
    interface Ethernet0/2
    description WLAN
    nameif WLAN
    security-level 100
    ip address 192.168.108.240 255.255.255.0
    ospf cost 10
    interface Ethernet0/3
    description Secondary Outside (Internet)
    speed 100
    duplex full
    nameif WAN2
    security-level 0
    ip address 2.2.2.133 255.255.255.192
    interface Management0/0
    description LAN/STATE Failover Interface
    time-range after_hours
    periodic weekdays 7:00 to 23:00
    boot system disk0:/asa821-k8.bin
    no ftp mode passive
    clock timezone EST -5
    clock summer-time EDT recurring
    dns domain-lookup WLAN
    dns server-group DefaultDNS
    retries 3
    timeout 5
    name-server 8.8.8.8
    name-server 206.191.0.210
    name-server 4.2.2.1
    name-server 4.2.2.2
    domain-name net.com
    access-list WAN2_access_in extended permit icmp any any echo-reply
    access-list WAN2_access_in extended permit icmp any any time-exceeded
    access-list WAN2_access_in extended permit icmp any any source-quench
    access-list WAN2_access_in extended permit icmp any any unreachable
    access-list WLAN_access_in extended permit icmp any any echo-reply
    access-list WLAN_access_in extended permit icmp any any time-exceeded
    access-list WLAN_access_in extended permit icmp any any source-quench
    access-list WLAN_access_in extended permit icmp any any unreachable
    access-list WLAN_access_in extended permit tcp host 192.168.1.100 eq ssh any
    access-list WLAN_access_in extended permit tcp 192.168.1.0 255.255.255.0 host 192.168.1.100 eq ssh
    access-list WLAN_access_in extended permit ip any any
    access-list time_based extended permit ip any any time-range after_hours
    access-list split_tunnel standard permit host 206.191.0.210
    access-list split_tunnel standard permit host 206.191.0.140
    access-list split_tunnel standard permit host 207.181.101.4
    access-list split_tunnel standard permit host 207.181.101.5
    access-list split_tunnel standard permit 192.168.1.0 255.255.255.0
    access-list outside_access_in extended permit icmp any any echo-reply
    access-list outside_access_in extended permit icmp any any time-exceeded
    access-list outside_access_in extended permit icmp any any
    access-list outside_access_in extended permit tcp any host 1.1.1.7 eq ssh
    access-list inside_access_in extended permit ip any any
    access-list inside_access_in extended permit tcp any host 192.168.1.100 eq ssh
    access-list inside_access_in extended permit icmp any any
    access-list inside_access_in extended permit icmp 192.168.1.0 255.255.255.0 any
    access-list inside_access_in extended permit ip 192.168.1.0 255.255.255.0 any
    access-list inside_access_in extended permit tcp 192.168.1.0 255.255.255.0 host 192.168.1.100 eq ssh
    pager lines 20
    logging enable
    logging asdm informational
    mtu outside 1500
    mtu inside 1500
    mtu WLAN 1500
    mtu WAN2 1500
    ip local pool DHCP 192.168.1.245-192.168.1.252 mask 255.255.255.0
    ip verify reverse-path interface outside
    ip verify reverse-path interface WAN2
    failover
    failover lan unit secondary
    failover lan interface FO Management0/0
    failover key *****
    failover link FO Management0/0
    failover interface ip FO 192.168.255.171 255.255.255.0 standby 192.168.255.172
    icmp unreachable rate-limit 1 burst-size 1
    icmp permit any outside
    icmp permit any inside
    icmp permit any WLAN
    icmp permit any WAN2
    asdm image disk0:/asdm-621.bin
    asdm history enable
    arp timeout 14400
    global (outside) 1 interface
    global (WAN2) 1 interface
    nat (inside) 1 192.168.1.0 255.255.255.0
    nat (WLAN) 1 192.168.108.0 255.255.255.0
    static (inside,outside) 1.1.1.7 192.168.1.100 netmask 255.255.255.255
    access-group outside_access_in in interface outside
    access-group inside_access_in in interface inside
    access-group WLAN_access_in in interface WLAN
    access-group WAN2_access_in in interface WAN2
    route outside 0.0.0.0 0.0.0.0 1.1.1.1 1
    route WAN2 0.0.0.0 0.0.0.0 2.2.2.129 254
    route inside 192.168.1.100 255.255.255.255 192.168.1.0 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    dynamic-access-policy-record DfltAccessPolicy
    aaa authentication ssh console LOCAL
    http server enable
    http 192.168.108.0 255.255.255.0 WLAN
    http 192.168.1.0 255.255.255.0 inside
    http 192.168.1.101 255.255.255.255 inside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    sla monitor 123
    type echo protocol ipIcmpEcho 4.2.2.2 interface outside
    num-packets 3
    timeout 1000
    frequency 3
    service resetoutside
    crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
    crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
    crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
    crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
    crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
    crypto ipsec security-association lifetime seconds 28800
    crypto ipsec security-association lifetime kilobytes 4608000
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs group1
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
    crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
    crypto map outside_map interface outside
    crypto isakmp enable outside
    crypto isakmp policy 10
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    track 1 rtr 123 reachability
    no vpn-addr-assign aaa
    no vpn-addr-assign dhcp
    telnet timeout 5
    ssh scopy enable
    ssh 2.2.2.132 255.255.255.255 outside
    ssh 69.17.141.134 255.255.255.255 outside
    ssh 192.168.1.0 255.255.255.0 inside
    ssh 192.168.1.100 255.255.255.255 inside
    ssh 192.168.108.0 255.255.255.0 WLAN
    ssh timeout 60
    console timeout 0
    management-access inside
    dhcpd address 192.168.108.11-192.168.108.239 WLAN
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    ntp authenticate
    ntp server 128.100.100.128
    ntp server 132.246.168.148
    ntp server 128.100.56.135
    tftp-server inside 192.168.1.100 /
    webvpn
    group-policy Wifi internal
    group-policy Wifi attributes
    wins-server none
    dns-server value 206.191.0.210 206.191.0.140
    vpn-tunnel-protocol IPSec l2tp-ipsec svc webvpn
    split-tunnel-policy tunnelspecified
    split-tunnel-network-list value split_tunnel
    tunnel-group Wifi type remote-access
    tunnel-group Wifi general-attributes
    address-pool DHCP
    default-group-policy Wifi
    tunnel-group Wifi ipsec-attributes
    pre-shared-key *
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum 512
    policy-map global_policy
    class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect netbios
      inspect rsh
      inspect rtsp
      inspect skinny 
      inspect esmtp
      inspect sqlnet
      inspect sunrpc
      inspect tftp
      inspect sip 
      inspect xdmcp
      inspect icmp
      inspect icmp error
    policy-map type inspect dns migrated_dns_map_1
    parameters
      message-length maximum 512
    service-policy global_policy global
    prompt hostname context
    Cryptochecksum:ac25ef0642e0ecb8f0ef63219833f3ae
    : end
    asdm image disk0:/asdm-621.bin
    asdm location 192.168.1.245 255.255.255.255 inside
    asdm location 192.168.1.252 255.255.255.255 inside
    asdm history enable

    Hi,
    I can't see any problems right away in the configuration.
    I guess we could start by using the "packet-tracer" to simulate the SSH and ICMP through the firewall
    packet-tracer input outside tcp 1.1.1.1 12345 22
    packet-tracer input outside icmp 1.1.1.1 8 0
    Don'd mind the source address of 1.1.1.1. Its just an address that is located behind "outside" interface according to the ASA routing table. (As the configurations 1.1.1.0/28 is not actually configured on the ASA)
    Share the exact "packet-tracer" command used (wihtout the public IP, notice that the output contains the public IP also) and the output of the command with us here.
    Also, have you made sure that there is no old translations active on the ASA?
    You can use this command to view those
    show xlate local 192.168.1.100
    You can clear the xlates with
    clear xlate local 192.168.1.100
    - Jouni

Maybe you are looking for