The newest Cisco ASA firewall 5500 series came out with software version 7.

0,
following the successful software version 6.x of the older PIX firewall models. The
latest ASA software version is 8.x with intermediary versions of 7.1 and 7.2. In this
post I will show you how to upgrade a Cisco ASA 5505 firewall from version 7.2(3)
to version 8.0(2). The same approach can be used for any 5500 appliance series.
To get the latest ASA software version, you must have a valid SMARTnet
agreement which is basically a maintenance contract for your Cisco product.

Step1:

Connect to the appliance (console or SSH) and verify the current running software
version by using the show ver command:

ASA5505# sh ver

Cisco Adaptive Security Appliance Software Version 7.2(3)

Device Manager Version 5.2(3)

Compiled on Wed 15-Aug-07 16:08 by builders

System image file is disk0:/asa723-k8.bin
Config file at boot was startup-config

ASA5505 up 34 mins 42 secs

Hardware: ASA5505, 256 MB RAM, CPU Geode 500 MHz

Internal ATA Compact Flash, 128MB
BIOS Flash M50FW080 @ 0xffe00000, 1024KB

Encryption hardware device : Cisco ASA-5505 on-board accelerator (revision 00)

Boot microcode : CNlite-MC-Boot-Cisco-1.2
SSL/IKE microcode: CNlite-MC-IPSEC-Admin-3.03
IPSec microcode : CNlite-MC-IPSECm-MAIN-2.04
0: Int: Internal-Data0/0 : address is 001e.7a86.1ea8, irq 11
1: Ext: Ethernet0/0 : address is 001e.7a86.1ea0, irq 255
2: Ext: Ethernet0/1 : address is 001e.7a86.1ea1, irq 255
3: Ext: Ethernet0/2 : address is 001e.7a86.1ea2, irq 255
4: Ext: Ethernet0/3 : address is 001e.7a86.1ea3, irq 255
5: Ext: Ethernet0/4 : address is 001e.7a86.1ea4, irq 255
6: Ext: Ethernet0/5 : address is 001e.7a86.1ea5, irq 255
7: Ext: Ethernet0/6 : address is 001e.7a86.1ea6, irq 255
8: Ext: Ethernet0/7 : address is 001e.7a86.1ea7, irq 255
9: Int: Internal-Data0/1 : address is 0000.0003.0002, irq 255
10: Int: Not used : irq 255
11: Int: Not used : irq 255

Licensed features for this platform:

Maximum Physical Interfaces : 8
VLANs : 3, DMZ Restricted
Inside Hosts : 50
Failover : Disabled
VPN-DES : Enabled
VPN-3DES-AES : Enabled
VPN Peers : 10
WebVPN Peers : 2
Dual ISPs : Disabled
VLAN Trunk Ports : 0

This platform has a Base license.

From the above output you can see that we are running Version 7.2(3) which is
located in disk0 (disk0:/asa723-k8.bin). Also, the GUI device manager version
(ASDM) is 5.2(3). Now, lets upgrade to version 8.0(2).

Step 2:

Assume that our internal network range is 192.168.1.0/24. Configure a TFTP server
(you can use the free tftpd32) on an internal PC (e.g 192.168.1.10) and backup the
current running software image from the firewall to your TFTP PC.

ASA5505# copy disk0 tftp

Source filename []?asa723-k8.bin

Address or name of remote host []? 192.168.1.10

Also, save the current running configuration. Just issue the show run command
and copy all configuration output from your terminal window into a text file.

Step 3:
Now its the time to upload the new software image file to the disk system of the
firewall. Assume that we have already downloaded the software file asa802-k8.bin
and placed that on our TFTP PC.

ASA5505# copy tftp disk0

Address or name of remote host []? 192.168.1.10

Source filename []? asa802-k8.bin
Destination filename [disk0]? disk0:asa802-k8.bin

Accessing tftp://192.168.1.10/asa802-k8.bin!!!!!! (truncated)

Writing file disk0:/asa802-k8.bin !!!!! (truncated)
14524416 bytes copied in 118.210 secs (123088 bytes/sec)

Step 4:

Since now we will have two image files on the firewall disk (old 7.2 and new 8.0
image files), we need to tell the firewall explicitly which image file to use when
booting.

ASA5505# conf t
ASA5505(config)# boot system disk0:/asa802-k8.bin
ASA5505(config)# wr mem

Step 5:

Reboot the firewall in order to load the new software image file. (use the reload
command). If everything works ok with the new image, you can delete the old one
from disk0. (delete disk0:/asa723-k8.bin)

Step6 (Optional):

The new ASA version 8.x uses the newest Device Manager (ASDM) version 6.x.
You can download the new ASDM software from Cisco and upgrade that as well
(using the same steps as above).
Upgrade licenses asa 5505

A very common scenario for a small business is to initially order a 10 user license and
then upgrade to 50 users as the company expands. You need to order via your local
Cisco representative a 10-to-50 user license upgrade. The Cisco reseller will request to
have the ASA 5505 serial number of your firewall which you can find by executing the
show version command. After that, the Cisco reseller will provide you with a license
key which is a long hexadecimal string (e.g e02888da 4ba7bed6 f1c123ae ffd8624e). To
configure the new license key use the following command:

Cisco-ASA(config)# activation-key Hex-activation-key

Cisco-ASA(config)# exit
Cisco-ASA# wr mem
Cisco-ASA# reload

After the firewall reboots, run the show version command to verify that the license
features have been upgraded. The same procedure works also for the other Cisco ASA
models