How to backup ASA 5505 2

[DennisTheMenace]

I have an ASA 5505 that is working great. I also have a brand new one sitting in the box.

The working ASA was config'd by a CISCO guru who knows his stuff... Unfortunately, he comes with a hefty price.

Does anyone know of the best way to copy/backup and restore to the spare so I can have a hot swap in case of any issues (and get it done BEFORE the issues arise) )?

THANKS in advance!
-Dennis

=====================
Remember - YOU ARE UNIQUE!!!... Just like EVERYONE ELSE! ;o)

 

[Supergrrover]

You can use TFTP or just the copy and paste method.

Login, get into exec mode and do a
sho run

Copy that to a text file. There is your backup.

The TFTP method is a little longer -

http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_tech_note09186a008072142a.shtml

Brent
Systems Engineer / Consultant
CCNP, CCSP

 

[DennisTheMenace]

Thank you for the reply! Any chance I could get a little more clarification on a couple of points?

get into exec mode

I typically monitor the ASA from the Cisco ASDM Launcher. I there a way to switch to exec mode from there?

sho run

Sounds easy enough... but then how do I "paste" this config into the backup ASA?

Will sho run also do usernames & passwords?

Thanks!
-Dennis


=====================
Remember - YOU ARE UNIQUE!!!... Just like EVERYONE ELSE! ;o)

 

[gurowar]

All you need to do is go to tools and click on "command line interface" from there just type in show run and that will give you an output of your config. Then all that needs to be done
is open up a notepad and copy/paste it to the notepad now you have a hard copy of your config. To transfer it to the new ASA all you need to do is copy/paste from the notepad to the new ASA......hope that helps

 

[DennisTheMenace]

all you need to do is copy/paste from the notepad to the new ASA

Go into the new ASA at the command line interface as well, and simply paste at the prompt.... or is there a command I must run? Can I screw it up if it is done wrong?

Also, will this do the Usernames and Passwords as well?

THANKS!
-Dennis

=====================
Remember - YOU ARE UNIQUE!!!... Just like EVERYONE ELSE! ;o)

 

[kurthansen]

That won't give you passwords. Only TFTP will give you passwords.

From ASDM you can go to File-->Send running config to TFTP server. Run a TFTP server on your local machine and put the IP address of your TFTP server in the box.

 

[DennisTheMenace]

I set up a free SolarWinds TFTP server on my PC. Was able to save the running config to a file (after turning off windows firewall). Perfect! Thank you.

Now how do I get that running config INTO the backup device. I don't see anywhere a "IMPORT RUNNING CONFIG FROM TFTP"??

-Dennis

=====================
Remember - YOU ARE UNIQUE!!!... Just like EVERYONE ELSE! ;o)

 

[kurthansen]

The best way will be go through the console port and just cut and paste from the file you TFTPed. Make sure you are in config terminal mode first. Or if you have an IP on it already telnet into it and paste onto the ASA. Then write memory and reboot.

 

[DennisTheMenace]

if you have an IP on it already telnet into it and paste onto the ASA

SORRY about my ignorance - but i have never used the command prompt before!

When I telnet and sign in I am at the "asa5505>" prompt. Then what? I have the file in the TFTP directory on my PC which can be opened in notepad... You don't just copy the entire content and paste it at the prompt do you?

-Dennis

=====================
Remember - YOU ARE UNIQUE!!!... Just like EVERYONE ELSE! ;o)

 

[Supergrrover]

type
en
then login with the enable password (same as when you go in via the ASDM)
Then so
sho run

The copy and paste method will get passwords but it will not show them. They are encrypted. The pix will accept the encrypted passwords when they are pasted back in as long as it has the "encrypted" keyword after it.


Brent
Systems Engineer / Consultant
CCNP, CCSP

 

[DennisTheMenace]

At the ASA5505# prompt, the SHO RUN listed configuration lines with a <-- MORE --> at the bottom of each page.

Do I continue to hit return until I get the ASA5505# prompt again and then PASTE the copied info at that prompt? Or is there a command to run first before the paste? Also, the text file contains a first and last line:

: Saved
: Written at 14:57:49.837 EST Wed Nov 7 2007 ! ASA Version x.x(x) !
LINES OF CONFIG
: end

Do I copy those lines as well (ie the ENTIRE contents of the saved running config?)

Again, sorry about my ignorance on the command line! I typically only monitor activity using ASDM. I am not familiar with setting up and programming cisco products. Quite impressed with this groups knowledge!!

THANKS! )
-Dennis

=====================
Remember - YOU ARE UNIQUE!!!... Just like EVERYONE ELSE! ;o)

 

[Supergrrover]

If you don't have the config then yes you do as above and get all the way to the end then you copy it. Then paste that into the new ASA.

To paste it in
en
config t
Then paste the config
wri mem
and away you go.

Be sure to create the self signed cert. (I believe you can do that through the ASDM - I don't use it much except for the pretty graphs.)


Brent
Systems Engineer / Consultant
CCNP, CCSP

 

[kurthansen]

when you do a show run it won't get the passwords to your VPN groups. Those will be shown as '*'.

 

[DennisTheMenace]

Thanks Kurthansen! I don't need to actually see them, only to paste them into the other ASA.

I will be doing this by opening the file from the TFTP saved running config in Notepad and copy/paste to the backup device as supergrrover said using CONFIG T in enable mode.

Sound right?

=====================
Remember - YOU ARE UNIQUE!!!... Just like EVERYONE ELSE! ;o)

 

[kurthansen]

It will paste the passwords as '*' for the groups if you don't do the tftp way.

 

[DennisTheMenace]

So I have to TFTP the config into the backup device? I didn't see that on any of the menus in the ASDM...

-Dennis

=====================
Remember - YOU ARE UNIQUE!!!... Just like EVERYONE ELSE! ;o)

 

[kurthansen]

No once you TFTP the config you have all the passwords in plain text.

 

[Supergrrover]

Ahhh, forgot the VPN info. They should change that. Doesn't really have a point to it.


Brent
Systems Engineer / Consultant
CCNP, CCSP

 

[DennisTheMenace]

The vpn info won't copy???

=====================
Remember - YOU ARE UNIQUE!!!... Just like EVERYONE ELSE! ;o)

 

[Supergrrover]

Just the passwords for site-to site and VPN groups. They are (as kurthansen pointed out) masked by stars in the text version. The TFTP will keep these plain text.


Brent
Systems Engineer / Consultant
CCNP, CCSP