16

I'd like to make my Cisco router automatically do a copy run TFTP (and populate the fields automatically) every 1 minute. I'd also like it to be run in the background. Anyone know if this is possible/how to do it? I'd like to do this for the sake of viewing the running config of my routers in notepad++ (which updates realtime) instead of having to do a show run and hit spacebar 4 or 5 times before I get to what I need to see. I think this would be extraordinarily useful for complex labs. Also, macros don't work because of the TFTP server commands requiring input.

  • 3
    Is once a minute really necessary? Have you also considered using built in filtering on the CLI with regex to filter the parts of the running config that you want to see? Ie | include or | exclude? I'm struggling to see the usefulness of being able to view your running configs "in real time". – John Jensen Dec 14 '13 at 0:18
  • I like to have one monitor with my topology and CLI windows (tabbed and labeled). My second monitor with all the running configs of my devices real-time. Being able to see all my running-configs real-time makes troubleshooting, comparing and copying/pasting command blocks considerably easier. Especially when getting deep into route-map statements and ACLs, it's a huge benefit not having to type show run | s route-map several times to see and compare this part of the configuration with different devices. I'm sorry you struggle to find this useful but I guess to each their own. – Michael May Dec 14 '13 at 0:30
  • @JohnJensen good point, I didn't catch the part about every minute. Christian, have you considered just having a second separate ssh session open to your devices on the second monitor, rather than having the running configs open in a text document? Monitor A's CLI sessions for changes and Monitor B's CLI sessions for viewing configs. Not saying one way is better than the other, just throwing ideas out there. :) – Brett Lykins Dec 14 '13 at 0:33
  • Brett, 'show running-config' does not produce real-time output. I'd have to type show run again every single time I make a change and I'd have to hit the space bar several times to get it to show me all of the config. The goal is having full running configs that get updated almost as soon as you make a change to them without user intervention. – Michael May Dec 14 '13 at 0:37
  • @ChristiandelaPeña I follow you, I'm just saying that different people work different ways. I guess I personally don't see the need for having live updating configs in the fashion you're describing. That doesn't make it wrong, just not the way I work. :) I want to give you the tools to do what you want, the way that you want. As long as you're labing and learning, that's all that matters to me. – Brett Lykins Dec 14 '13 at 0:46
19

You have several options to get this type of functionality on a Cisco device. (Which one you use depends on your needs and sometimes on the device and IOS load. Some older devices/IOS loads will have different capabilities.)

EDIT: You are asking about doing this every one minute, which as you found out in our chat about this question, will bog down your router. (Especially in GNS3.) The below options are available to you for automating confirguation backup, however I would not recommend doing so every 1 minute.

You could either:

  1. Use Cisco's Kron functionality for command scheduling. This will allow you to execute predefined commands on a scheduled basis. As you pointed out, copy run tftp requires file prompt confirmation. (Unless you've turned off file prompt confirmation, however I don't recommend it as a normal setting.) Redirecting does not require confirmation. So the command used in the scheduler is show run | redirect tftp://$SERVERIP/$PATH/$FILE

  2. Use Cisco's Archive functionality for configuration management. Archive is a way to store multiple copies of the config in a sequential fashion and roll back configs if needed to a previous version. Copying out with Kron overwrites the previous config, while Archive allows you to keep up to 14 different config versions in the specified location. See this link on the Cisco Learning network for more useful info on Archive. Specifically how to dynamically set the filename with the $h and $t tags.

In either of the below samples, you can adjust the times to your needs, these are just what I quickly pulled out of some production gear.


Sample config to have Kron write config and back it up to a tftp server once a week:

kron occurrence SaveConfig at 23:50 Mon recurring
policy-list SaveConfig
!
kron occurrence BackupRunningConfig at 23:55 Mon recurring
policy-list BackupRunningConfig
!
kron policy-list SaveConfig
cli write
!
kron policy-list BackupRunningConfig
cli show running-config | redirect tftp://10.10.10.10/configs/testswitch.txt

Sample config to have Archive back up your config to a tftp server daily:

archive
 path tftp://10.10.10.10/configs/$h-$t
 time-period 1440
 maximum 14
12

There is actually another way.

You can trigger a TFTP copy using SNMP. It's not terribly straight forward, but is incredibly useful.

Firstly, you'll need a TFTP server (unsurprisingly). You'll also need something that can send snmp requests. I've done it effectively with Linux's snmp tools.

You'll want to set up a new community for SNMP that has limited write access, and probably lock it down even further with an IP ACL. Actually you only need to be able to write to the ccCopyTable OID.

On the Linux side, you'll need the following MIBs (for readability, rather than functionality)

CISCO-CONFIG-COPY-MIB
CISCO-SMI
CISCO-ST-TC

With the MIBs installed in the relevant location for your SNMP configuration on Linux, you should be able to test connectivity with snmptable thusly:

snmptable -v2c -c writeCommunity 192.168.1.1 ccCopyTable
CISCO-CONFIG-COPY-MIB::ccCopyTable: No entries

You usually need to pre-create the file on the TFTP server for the router to copy into.

In order to trigger a TFTP copy, you need to insert a row into the ccCopyTable.

snmpset allows you to do this.

# snmpset -v2c -c writeCommunity 192.168.1.1 \
> ccCopyProtocol.23 i tftp \
> ccCopySourceFileType.23 i runningConfig \
> ccCopyDestFileType.23 i networkFile \
> ccCopyServerAddress.23 a 192.168.1.100 \
> ccCopyFileName.23 s router.conf

CISCO-CONFIG-COPY-MIB::ccCopyProtocol.23 = INTEGER: tftp(1)
CISCO-CONFIG-COPY-MIB::ccCopySourceFileType.23 = INTEGER: runningConfig(4)
CISCO-CONFIG-COPY-MIB::ccCopyDestFileType.23 = INTEGER: networkFile(1)
CISCO-CONFIG-COPY-MIB::ccCopyServerAddress.23 = IpAddress: 192.168.1.100
CISCO-CONFIG-COPY-MIB::ccCopyFileName.23 = STRING: router.conf

Once you've done that, you should be able to re-run the first command, and see the copy command in the ccCopyTable.

snmptable -v 2c -c writeCommunity 192.168.1.1 ccCopyTable

SNMP table: CISCO-CONFIG-COPY-MIB::ccCopyTable

 index Protocol SourceFileType DestFileType ServerAddress    FileName UserName
    23     tftp  runningConfig  networkFile     192.168.1.100 router.conf        ?

SNMP table CISCO-CONFIG-COPY-MIB::ccCopyTable, part 2

 index UserPassword NotificationOnCompletion State TimeStarted TimeCompleted
    23            ?                    false     ?           ?             ?

SNMP table CISCO-CONFIG-COPY-MIB::ccCopyTable, part 3

 index FailCause EntryRowStatus ServerAddressType ServerAddressRev1
    23         ?              ?              ipv4       "192.168.1.100"

Nothing will happen until you set another column on ccCopyTable to activate the row.

 snmpset  -v2c -c writeCommunity 192.168.1.1 \
> ccCopyEntryRowStatus.23 i active

If you check ccCopyTable again, you should see that State and TimeStarted have been updated to reflect that the file has been copied.

There's more details in the source links below, including how to empty ccCopyTable (if you'd like).

I've used the same method in a script from a Linux server to trigger a TFTP copy, then commit the file to git, and push it back to the repository, all in one swift process.

Sources: http://www.ciscozine.com/2013/08/22/how-to-save-configurations-using-snmp/

and http://bodgitandscarper.co.uk/networks/using-snmp-to-trigger-cisco-tftp-backups/

  • 2
    This is the way I have done it for years, using Pancho, until I recently switched to RANCID to get more device support. RANCID is highly recommended, purely because you get version control too - use 'svn blame' to find out when that interface changed from full duplex to auto, or prove that nothing has changed for x months. – AnotherHowie Dec 17 '13 at 9:21
  • Can RANCID check into Git rather than SVN? – Tom O'Connor Dec 18 '13 at 14:02
  • I don't think so. CVS is the default. SVN is an option. Since it's a write-only, single-branch, single-user (RANCID) version-control situation, there's no particular benefit to using something else. RANCID 3 is in the works right now though, so it's possible they've updated that part. It's a relatively old-fashioned piece of software though - perl, expect and shell. – AnotherHowie Dec 18 '13 at 17:44
  • Just checked and RANCID 3 doesn't mention new VC options, in here: gossamer-threads.com/lists/rancid/users/6555#6555 – AnotherHowie Dec 18 '13 at 17:48
2

You can use EEM

Example:

event manager applet dumpconfig
 event timer {absolute time time-value | countdown time time-value | cron cron-entry cron-entry | watchdog time time-value} [name timer-name]
 action 1.0 cli command "enable"
 action 2.0 cli show running-config | redirect tftp://10.10.10.10/configs/testswitch.txt
 action 998.0 cli command "end"
 action 999.0 cli command "exit"
  • Only on NX-OS, I suspect... – Tom O'Connor Dec 18 '13 at 14:02
  • 1
    @Tom, I dont have nexus(unfortunately ;-)), in IOS it is supported... I guess EEM supported by all routers and most of all switches: for example, I have only one model, which is not support EEM - 2950, but in 2960s, 3560, 3750(E and not E), 4500, 4948, 6500 it is supported. – pyatka Dec 19 '13 at 5:35
2

You could use RANCID to do this.

You get a few other nice things such as version control of the configs, email diffs and other nice things (by default it takes a hardware inventory so if the hardware changes you get an alert with that).

It works with every switch and router I have thrown at it so far (Cisco/Juniper/Dell) which is another plus.

1

You can use a perl script, such as this one. Usage: perl cisco_backup.pl "my-enable-password"

  • 1
    Link-only posts are limited in their usefulness. Can you add the relevant portions of this solution to your answer? – Ryan Foley Jan 9 '15 at 9:55
  • Never put password to command line if possible. Use environment instead. – Cougar Mar 3 '15 at 13:59
0

fetchconfig is another tool for this:

fetchconfig is a Perl script for retrieving configuration of multiple devices. It has been tested under Linux and Windows, and currently supports a variety of devices, including Cisco IOS, Cisco Catalyst, Cisco ASA, Cisco PIX, FortiGate Firewalls, ProCurve, Alcatel Ethernet Routers (aka Riverstone), Dell PowerConnect Switches, Terayon 3200/3500 CMTS, Datacom DmSwitch Switches, HP MSR Routers, Mikrotik Routers, Tellabs MSR Routers, Juniper EX Switch JunOS, Oracle Acme Packet, Audiocodes Mediant, Cisco IOS XR, NEC Univerge IX.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.