2

Let me start with short background for better understanding.

We have LAB at work (Cisco devices mostly), and we would like to allow other employers connect remotely from their homes, build own labs during free time (something like CCIE rack from physical devices). For that reason we are going to build "Jump Host", basically Linux server used for connection to routers, switches, etc. There will be also few scripts for backup of configuration via SNMP, aliases for connection, so when user types R1, it will automatically trigger telnet to R1. And so on.

Due to that, devices has to be always configured with management IP address and SNMP community string.

The first question is. Is somehow possible to load startup-configuration from TFTP server and override startup-configuration from NVRAM?

I have tried used:

boot network tftp filename x.x.x.x

But it is not very helpful to be honest, because it is not override configuration stored in NVRAM.

So I was thinking about EEM applet to deny user perform copy run start and write memory. But users can easily remove EEM applet if they have access to configuration mode, aren't they? :-) Let me put the second question. Can I somehow use privileged in order to deny using of few configuration commands? But if user has access to configuration mode there is no way how to do that probably.

I know, my question is not straightforward at all. I am just wondering whether I am able ensure that startup configuration (including management IP address and SNMP string) is always loaded after reload of router and overrides configuration created by user.

I can not trust to users and be sure they will use only Linux script to save their configuration to their home folders and not copy running-config to startup-config. I need to be sure it will be foolproof.

Thanks a lot for any idea, much appreciated.

Daniel

Improve this question
5
  • 5
    That's not how other CCIE labs work. You may want to reconsider your design. Most use a terminal server to connect people to the console ports, and they have some custom software on a server which will use the terminal server to completely wipe any configurations left by the users. You could do the same sort of thing to wipe the devices, and/or put put them into a known state. Without a terminal server, you are fighting a losing battle.
    – Ron Maupin ♦
    Commented May 14, 2016 at 17:22
  • Thanks for pointing it out. Terminal server seems to be the best option which I didn't consider before. I also found that most of CCIE labs instructs user to use blank.cfg stored on flash, in order to restore their configuration to initial configuration (copy replace running-config flash:blank.cfg). That's really cool. But what about to have some software which will use terminal server to wipe out cfg, as you mentioned? Do you know about software which can do it?
    – Daniel Blazek
    Commented May 14, 2016 at 20:35
  • Unfortunately, product or resource recommendations are explicitly off-topic here. Many of the commercial labs use proprietary software, which was developed in-house.
    – Ron Maupin ♦
    Commented May 14, 2016 at 20:47
  • Okay, I understand. At least I know it's possible, just find right way how to realize it. I can not imagine how such a software works :-) . Thanks for your time.
    – Daniel Blazek
    Commented May 14, 2016 at 20:58
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin ♦
    Commented Aug 14, 2017 at 3:54

2 Answers 2

Reset to default
5

Sorry, no. ROMMON can be told to ignore any NVRAM config, but there's no documented method to override the NVRAM startup-config. (Note: I'm aware of a US DoD contractor that does this, but they have customized hardware.)

In a virtualized environment (GNS3, Cisco's virtual labs, etc.), it's easy to replace NVRAM entirely, or replace NVRAM contents. And this is how many (most?) modern labs are setup -- it's how Cisco's own test labs work.

Improve this answer
1

The lab environment needs to be able to be torn up, torn down, erased, etc. IP connectivity is going to get messed up. That's the whole idea behind a terminal server and console ports.

You might try using something like Docker?

Improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.