I'd like to make my Cisco router automatically do a copy run TFTP (and populate the fields automatically) every 1 minute. I'd also like it to be run in the background. Anyone know if this is possible/how to do it? I'd like to do this for the sake of viewing the running config of my routers in notepad++ (which updates realtime) instead of having to do a show run and hit spacebar 4 or 5 times before I get to what I need to see. I think this would be extraordinarily useful for complex labs. Also, macros don't work because of the TFTP server commands requiring input.
7 Answers
You have several options to get this type of functionality on a Cisco device. (Which one you use depends on your needs and sometimes on the device and IOS load. Some older devices/IOS loads will have different capabilities.)
EDIT: You are asking about doing this every one minute, which as you found out in our chat about this question, will bog down your router. (Especially in GNS3.) The below options are available to you for automating confirguation backup, however I would not recommend doing so every 1 minute.
You could either:
Use Cisco's Kron functionality for command scheduling. This will allow you to execute predefined commands on a scheduled basis. As you pointed out,
copy run tftp
requires file prompt confirmation. (Unless you've turned off file prompt confirmation, however I don't recommend it as a normal setting.) Redirecting does not require confirmation. So the command used in the scheduler isshow run | redirect tftp://$SERVERIP/$PATH/$FILE
Use Cisco's Archive functionality for configuration management. Archive is a way to store multiple copies of the config in a sequential fashion and roll back configs if needed to a previous version. Copying out with Kron overwrites the previous config, while Archive allows you to keep up to 14 different config versions in the specified location. See this link on the Cisco Learning network for more useful info on Archive. Specifically how to dynamically set the filename with the $h and $t tags.
In either of the below samples, you can adjust the times to your needs, these are just what I quickly pulled out of some production gear.
Sample config to have Kron write config and back it up to a tftp server once a week:
kron occurrence SaveConfig at 23:50 Mon recurring
policy-list SaveConfig
!
kron occurrence BackupRunningConfig at 23:55 Mon recurring
policy-list BackupRunningConfig
!
kron policy-list SaveConfig
cli write
!
kron policy-list BackupRunningConfig
cli show running-config | redirect tftp://10.10.10.10/configs/testswitch.txt
Sample config to have Archive back up your config to a tftp server daily:
archive
path tftp://10.10.10.10/configs/$h-$t
time-period 1440
maximum 14
There is actually another way.
You can trigger a TFTP copy using SNMP. It's not terribly straight forward, but is incredibly useful.
Firstly, you'll need a TFTP server (unsurprisingly). You'll also need something that can send snmp requests. I've done it effectively with Linux's snmp tools.
You'll want to set up a new community for SNMP that has limited write access, and probably lock it down even further with an IP ACL. Actually you only need to be able to write to the ccCopyTable
OID.
On the Linux side, you'll need the following MIBs (for readability, rather than functionality)
CISCO-CONFIG-COPY-MIB
CISCO-SMI
CISCO-ST-TC
With the MIBs installed in the relevant location for your SNMP configuration on Linux, you should be able to test connectivity with snmptable thusly:
snmptable -v2c -c writeCommunity 192.168.1.1 ccCopyTable
CISCO-CONFIG-COPY-MIB::ccCopyTable: No entries
You usually need to pre-create the file on the TFTP server for the router to copy into.
In order to trigger a TFTP copy, you need to insert a row into the ccCopyTable
.
snmpset
allows you to do this.
# snmpset -v2c -c writeCommunity 192.168.1.1 \
> ccCopyProtocol.23 i tftp \
> ccCopySourceFileType.23 i runningConfig \
> ccCopyDestFileType.23 i networkFile \
> ccCopyServerAddress.23 a 192.168.1.100 \
> ccCopyFileName.23 s router.conf
CISCO-CONFIG-COPY-MIB::ccCopyProtocol.23 = INTEGER: tftp(1)
CISCO-CONFIG-COPY-MIB::ccCopySourceFileType.23 = INTEGER: runningConfig(4)
CISCO-CONFIG-COPY-MIB::ccCopyDestFileType.23 = INTEGER: networkFile(1)
CISCO-CONFIG-COPY-MIB::ccCopyServerAddress.23 = IpAddress: 192.168.1.100
CISCO-CONFIG-COPY-MIB::ccCopyFileName.23 = STRING: router.conf
Once you've done that, you should be able to re-run the first command, and see the copy command in the ccCopyTable.
snmptable -v 2c -c writeCommunity 192.168.1.1 ccCopyTable
SNMP table: CISCO-CONFIG-COPY-MIB::ccCopyTable
index Protocol SourceFileType DestFileType ServerAddress FileName UserName
23 tftp runningConfig networkFile 192.168.1.100 router.conf ?
SNMP table CISCO-CONFIG-COPY-MIB::ccCopyTable, part 2
index UserPassword NotificationOnCompletion State TimeStarted TimeCompleted
23 ? false ? ? ?
SNMP table CISCO-CONFIG-COPY-MIB::ccCopyTable, part 3
index FailCause EntryRowStatus ServerAddressType ServerAddressRev1
23 ? ? ipv4 "192.168.1.100"
Nothing will happen until you set another column on ccCopyTable to activate the row.
snmpset -v2c -c writeCommunity 192.168.1.1 \
> ccCopyEntryRowStatus.23 i active
If you check ccCopyTable again, you should see that State and TimeStarted have been updated to reflect that the file has been copied.
There's more details in the source links below, including how to empty ccCopyTable (if you'd like).
I've used the same method in a script from a Linux server to trigger a TFTP copy, then commit the file to git, and push it back to the repository, all in one swift process.
Sources: http://www.ciscozine.com/2013/08/22/how-to-save-configurations-using-snmp/
and http://bodgitandscarper.co.uk/networks/using-snmp-to-trigger-cisco-tftp-backups/
-
2This is the way I have done it for years, using Pancho, until I recently switched to RANCID to get more device support. RANCID is highly recommended, purely because you get version control too - use 'svn blame' to find out when that interface changed from full duplex to auto, or prove that nothing has changed for x months. Dec 17, 2013 at 9:21
-
-
I don't think so. CVS is the default. SVN is an option. Since it's a write-only, single-branch, single-user (RANCID) version-control situation, there's no particular benefit to using something else. RANCID 3 is in the works right now though, so it's possible they've updated that part. It's a relatively old-fashioned piece of software though - perl, expect and shell. Dec 18, 2013 at 17:44
-
Just checked and RANCID 3 doesn't mention new VC options, in here: gossamer-threads.com/lists/rancid/users/6555#6555 Dec 18, 2013 at 17:48
You can use EEM
Example:
event manager applet dumpconfig
event timer {absolute time time-value | countdown time time-value | cron cron-entry cron-entry | watchdog time time-value} [name timer-name]
action 1.0 cli command "enable"
action 2.0 cli show running-config | redirect tftp://10.10.10.10/configs/testswitch.txt
action 998.0 cli command "end"
action 999.0 cli command "exit"
-
-
1@Tom, I dont have nexus(unfortunately ;-)), in IOS it is supported... I guess EEM supported by all routers and most of all switches: for example, I have only one model, which is not support EEM - 2950, but in 2960s, 3560, 3750(E and not E), 4500, 4948, 6500 it is supported.– pyatkaDec 19, 2013 at 5:35
You could use RANCID to do this.
You get a few other nice things such as version control of the configs, email diffs and other nice things (by default it takes a hardware inventory so if the hardware changes you get an alert with that).
It works with every switch and router I have thrown at it so far (Cisco/Juniper/Dell) which is another plus.
You can use a perl script, such as this one. Usage: perl cisco_backup.pl "my-enable-password"
-
1Link-only posts are limited in their usefulness. Can you add the relevant portions of this solution to your answer? Jan 9, 2015 at 9:55
-
Never put password to command line if possible. Use environment instead.– CougarMar 3, 2015 at 13:59
if you are allowed connect to device using python libraries such as netmiko, paramiko, you can simply send the command required and use schedule library to trigger the commands set every minute. Please hit me for further information if it helps.
example of how to use schedule library:
# schedule.every(10).minutes.do(function)
# schedule.every().hour.do(function)
schedule.every().day.at("07:15").do(function)
# schedule.every().monday.do(job)
# schedule.every().wednesday.at("13:15").do(function)
#schedule.every().minute.at(":15").do(function)
while True:
schedule.run_pending()
time.sleep(1)
fetchconfig is another tool for this:
fetchconfig is a Perl script for retrieving configuration of multiple devices. It has been tested under Linux and Windows, and currently supports a variety of devices, including Cisco IOS, Cisco Catalyst, Cisco ASA, Cisco PIX, FortiGate Firewalls, ProCurve, Alcatel Ethernet Routers (aka Riverstone), Dell PowerConnect Switches, Terayon 3200/3500 CMTS, Datacom DmSwitch Switches, HP MSR Routers, Mikrotik Routers, Tellabs MSR Routers, Juniper EX Switch JunOS, Oracle Acme Packet, Audiocodes Mediant, Cisco IOS XR, NEC Univerge IX.
| include
or| exclude
? I'm struggling to see the usefulness of being able to view your running configs "in real time".