Automate configuration backup (every minute) in Cisco IOS

Question

I'd like to make my Cisco router automatically do a copy run TFTP (and populate the fields automatically) every 1 minute. I'd also like it to be run in the background. Anyone know if this is possible/how to do it? I'd like to do this for the sake of viewing the running config of my routers in notepad++ (which updates realtime) instead of having to do a show run and hit spacebar 4 or 5 times before I get to what I need to see. I think this would be extraordinarily useful for complex labs. Also, macros don't work because of the TFTP server commands requiring input.

Answer 1

You have several options to get this type of functionality on a Cisco device. (Which one you use depends on your needs and sometimes on the device and IOS load. Some older devices/IOS loads will have different capabilities.)

EDIT: You are asking about doing this every one minute, which as you found out in our chat about this question, will bog down your router. (Especially in GNS3.) The below options are available to you for automating confirguation backup, however I would not recommend doing so every 1 minute.

You could either:

1. Use Cisco's Kron functionality for command scheduling. This will allow you to execute predefined commands on a scheduled basis. As you pointed out, copy run tftp requires file prompt confirmation. (Unless you've turned off file prompt confirmation, however I don't recommend it as a normal setting.) Redirecting does not require confirmation. So the command used in the scheduler is show run | redirect tftp://$SERVERIP/$PATH/$FILE

2. Use Cisco's Archive functionality for configuration management. Archive is a way to store multiple copies of the config in a sequential fashion and roll back configs if needed to a previous version. Copying out with Kron overwrites the previous config, while Archive allows you to keep up to 14 different config versions in the specified location. See this link on the Cisco Learning network for more useful info on Archive. Specifically how to dynamically set the filename with the $h and $t tags.

In either of the below samples, you can adjust the times to your needs, these are just what I quickly pulled out of some production gear.

---

Sample config to have Kron write config and back it up to a tftp server once a week:

kron occurrence SaveConfig at 23:50 Mon recurring
policy-list SaveConfig
!
kron occurrence BackupRunningConfig at 23:55 Mon recurring
policy-list BackupRunningConfig
!
kron policy-list SaveConfig
cli write
!
kron policy-list BackupRunningConfig
cli show running-config | redirect tftp://10.10.10.10/configs/testswitch.txt

Sample config to have Archive back up your config to a tftp server daily:

archive
 path tftp://10.10.10.10/configs/$h-$t
 time-period 1440
 maximum 14

Answer 2

There is actually another way.

You can trigger a TFTP copy using SNMP. It's not terribly straight forward, but is incredibly useful.

Firstly, you'll need a TFTP server (unsurprisingly). You'll also need something that can send snmp requests. I've done it effectively with Linux's snmp tools.

You'll want to set up a new community for SNMP that has limited write access, and probably lock it down even further with an IP ACL. Actually you only need to be able to write to the ccCopyTable OID.

On the Linux side, you'll need the following MIBs (for readability, rather than functionality)

CISCO-CONFIG-COPY-MIB
CISCO-SMI
CISCO-ST-TC

With the MIBs installed in the relevant location for your SNMP configuration on Linux, you should be able to test connectivity with snmptable thusly:

snmptable -v2c -c writeCommunity 192.168.1.1 ccCopyTable
CISCO-CONFIG-COPY-MIB::ccCopyTable: No entries

You usually need to pre-create the file on the TFTP server for the router to copy into.

In order to trigger a TFTP copy, you need to insert a row into the ccCopyTable.

snmpset allows you to do this.

# snmpset -v2c -c writeCommunity 192.168.1.1 \
> ccCopyProtocol.23 i tftp \
> ccCopySourceFileType.23 i runningConfig \
> ccCopyDestFileType.23 i networkFile \
> ccCopyServerAddress.23 a 192.168.1.100 \
> ccCopyFileName.23 s router.conf

CISCO-CONFIG-COPY-MIB::ccCopyProtocol.23 = INTEGER: tftp(1)
CISCO-CONFIG-COPY-MIB::ccCopySourceFileType.23 = INTEGER: runningConfig(4)
CISCO-CONFIG-COPY-MIB::ccCopyDestFileType.23 = INTEGER: networkFile(1)
CISCO-CONFIG-COPY-MIB::ccCopyServerAddress.23 = IpAddress: 192.168.1.100
CISCO-CONFIG-COPY-MIB::ccCopyFileName.23 = STRING: router.conf

Once you've done that, you should be able to re-run the first command, and see the copy command in the ccCopyTable.

snmptable -v 2c -c writeCommunity 192.168.1.1 ccCopyTable

SNMP table: CISCO-CONFIG-COPY-MIB::ccCopyTable

 index Protocol SourceFileType DestFileType ServerAddress    FileName UserName
    23     tftp  runningConfig  networkFile     192.168.1.100 router.conf        ?

SNMP table CISCO-CONFIG-COPY-MIB::ccCopyTable, part 2

 index UserPassword NotificationOnCompletion State TimeStarted TimeCompleted
    23            ?                    false     ?           ?             ?

SNMP table CISCO-CONFIG-COPY-MIB::ccCopyTable, part 3

 index FailCause EntryRowStatus ServerAddressType ServerAddressRev1
    23         ?              ?              ipv4       "192.168.1.100"

Nothing will happen until you set another column on ccCopyTable to activate the row.

 snmpset  -v2c -c writeCommunity 192.168.1.1 \
> ccCopyEntryRowStatus.23 i active

If you check ccCopyTable again, you should see that State and TimeStarted have been updated to reflect that the file has been copied.

There's more details in the source links below, including how to empty ccCopyTable (if you'd like).

I've used the same method in a script from a Linux server to trigger a TFTP copy, then commit the file to git, and push it back to the repository, all in one swift process.

Sources: http://www.ciscozine.com/2013/08/22/how-to-save-configurations-using-snmp/

and http://bodgitandscarper.co.uk/networks/using-snmp-to-trigger-cisco-tftp-backups/

Answer 3

You can use EEM

Example:

event manager applet dumpconfig
 event timer {absolute time time-value | countdown time time-value | cron cron-entry cron-entry | watchdog time time-value} [name timer-name]
 action 1.0 cli command "enable"
 action 2.0 cli show running-config | redirect tftp://10.10.10.10/configs/testswitch.txt
 action 998.0 cli command "end"
 action 999.0 cli command "exit"

Answer 4

You could use RANCID to do this.

You get a few other nice things such as version control of the configs, email diffs and other nice things (by default it takes a hardware inventory so if the hardware changes you get an alert with that).

It works with every switch and router I have thrown at it so far (Cisco/Juniper/Dell) which is another plus.

Answer 5

You can use a perl script, such as this one. Usage: perl cisco_backup.pl "my-enable-password"

Answer 6

if you are allowed connect to device using python libraries such as netmiko, paramiko, you can simply send the command required and use schedule library to trigger the commands set every minute. Please hit me for further information if it helps.

example of how to use schedule library:

# schedule.every(10).minutes.do(function)
# schedule.every().hour.do(function)
schedule.every().day.at("07:15").do(function)
# schedule.every().monday.do(job)
# schedule.every().wednesday.at("13:15").do(function)
#schedule.every().minute.at(":15").do(function)

while True:
    schedule.run_pending()
    time.sleep(1)

Answer 7

fetchconfig is another tool for this:

fetchconfig is a Perl script for retrieving configuration of multiple devices. It has been tested under Linux and Windows, and currently supports a variety of devices, including Cisco IOS, Cisco Catalyst, Cisco ASA, Cisco PIX, FortiGate Firewalls, ProCurve, Alcatel Ethernet Routers (aka Riverstone), Dell PowerConnect Switches, Terayon 3200/3500 CMTS, Datacom DmSwitch Switches, HP MSR Routers, Mikrotik Routers, Tellabs MSR Routers, Juniper EX Switch JunOS, Oracle Acme Packet, Audiocodes Mediant, Cisco IOS XR, NEC Univerge IX.