Let me start with short background for better understanding.
We have LAB at work (Cisco devices mostly), and we would like to allow other employers connect remotely from their homes, build own labs during free time (something like CCIE rack from physical devices). For that reason we are going to build "Jump Host", basically Linux server used for connection to routers, switches, etc. There will be also few scripts for backup of configuration via SNMP, aliases for connection, so when user types R1, it will automatically trigger telnet to R1. And so on.
Due to that, devices has to be always configured with management IP address and SNMP community string.
The first question is. Is somehow possible to load startup-configuration from TFTP server and override startup-configuration from NVRAM?
I have tried used:
boot network tftp filename x.x.x.x
But it is not very helpful to be honest, because it is not override configuration stored in NVRAM.
So I was thinking about EEM applet to deny user perform copy run start and write memory. But users can easily remove EEM applet if they have access to configuration mode, aren't they? :-) Let me put the second question. Can I somehow use privileged in order to deny using of few configuration commands? But if user has access to configuration mode there is no way how to do that probably.
I know, my question is not straightforward at all. I am just wondering whether I am able ensure that startup configuration (including management IP address and SNMP string) is always loaded after reload of router and overrides configuration created by user.
I can not trust to users and be sure they will use only Linux script to save their configuration to their home folders and not copy running-config to startup-config. I need to be sure it will be foolproof.
Thanks a lot for any idea, much appreciated.