I have a Cisco ASA 5505 as a BOVPN endpoint using certificates. The config is complete and I now need to back it up and restore to a cold standby Cisco ASA 5505 that will sit on the shelf until something goes wrong.
Problem is I cannot restore my certifcates to the standby.
I have tried the backup and restore wizard in ASDM and to be honest it didn't work.
I need to backup my ASA 5505 configuration and restore it to default, then I'll configure manually the new config, but if something doesn't work I want to restore the backup made before.
I tried the "copy run tftp" command, and it always answers the same: Result of the command: "copy run tftp" [code] I read everywhere its supossed to prompt asking me tftp server address and file name.
We have cisco works LMS 3.1 and the server have very problems, we need format the server and reinstall the Cisco Works, when I doin backup and restore of data LMS We lost the licenses? or when we restore the data in the server we have the same licenses? or get the new licenses to cisco?
View 5 Replies View RelatedI am facing a failed issue when restoring the WCS Database. Below is the error i get, does any one out there facing it before?
#######################################
[root@egwgwcs WCS7.0.220.0]# ./Restore
Please enter the full path of the backup file name: /opt/WCS7.0.220.0/Backup_File/WCS_Aug2012.nmsbackup
Untaring the backup file...
Failed to untar backup file. Exception: invalid stored block lengths
Restore database failed.
#######################################
I want to restore a backup from c2960 to other one.Why is recommended to remove any security commands, like AAA?
View 2 Replies View RelatedI've been setting up building and testing our new ACS 5.x boxes and I've been running into a spot of bother with the backup restore feature. This most likely due to my unfamiliarity with the tool.
As part of my testing for Backup/Restore, I first backup the data using the Removal and backup tool in Secure ACS View (found under data management. I then confirm that the new FULL backup has been populated my test repository and is available in the restore feature. (also under Data Management) My next step is to create a few test Network Device Groups, Identity groups, and users Then I go back to the restore feature select the Back up file I just created, I also check the box Skip View Database backup before Restore and hit the restore button.
The box goes through the expected steps including a reload. When it comes back up I would expect the test users, groups etc I created after the last backup to be gone as they did not exist at that time. Although I find the opposite is true. Any settings I made after the last backup are still present. I do not have incremental backups enabled.
I essentially want to test a backup of the database of users and groups/rules etc make changes and then restore that database to the previous backed up configuration.
We want to take the current configuration backup of the LMS 4.0 (Installed on Win 2003 Enterprise) and restore the same to a new windows machine (Win2003 standard edition).
View 1 Replies View RelatedI recently tested the process for a customer of defaulting a Cisco WLC to factory configuration and then restoring the configuration from Cisco NCS. It was not seamless to say the least and I wonder if I have just gone about it the wrong way.
Have have set the NCS platform to configuration sync with the 5508 controllers at 04:00 every day and prior to the controller defaulting I ensured that NCS also reported that the config was in sync. I have also set NCS to complete a tftp backup of the controller every night 23:00 - interestingly though I have no idea where this is stored on the NCS platform ( a VM appliance ) or what it's file name is.
Anyway my experiences where as follows:-
1. defaulted WLC and via serial CLI ended up at the configuration wizard.
2. Set the correct LAG, management IP, host name that NCS knew this controller by.
3. To test things just created a dummy WLAN ( SSID ) as I assumed this would be overwritten ( big mistake ! ).
At this point I connected the controller to the network and tried to restore the configuration from the config sync version.
First problem - you have to remember to set up the SNMP community string you were using as it is needed by the configuration sync process. After adding this to the controller I could push the configuration to the controller.
Second problem - failed to add the first WLAN from the backup as I have added the temporary dummy W LAN via the wizard and NCS reported a conflict. So had to delete WLAN ID 1 from the WLC GUI directly and then the config push no longer reported this error.
Third problem - for some reason did not add the TACACS server details - reported the error that it could not added them. I manually added these via a template via NCS and all was well.
Fourth problem - all but the first WLAN was in the disabled state - had to re-enable all of the WLANs.
Fifth problem - any default items I had disabled or removed have not been saved - therefore I have removed the public and private SNMP communities - but these were still on the WLC after the restore. I have disabled unused ports not in the LAG as they show an error in NCS - these where not disabled after the restore.
So all in all not a very satisfactory restore process from NCS to an defaulted WLC ( meant to simulate to the customer what would be needed if they had to replace a controller due to hardware failure ).
If the hostnames are the same - can I restore the backup file from a wcs 5.2.148.0 instance on a different wcs instance running wcs 6.0.196.0?
View 1 Replies View RelatedIs there anyway to backup and restore the spams quarantine to another ironport c170?
View 1 Replies View RelatedI have a WAG160N and its seems to have reset to factory defaults, no idea why, but when trying to restore the Configuration Backup all I get is "Restore Failure <Unmatched pid>"
View 2 Replies View RelatedI'm replacing an older (& failing) RVS4000 v1 with a new V2. I need to minimize downtime. Will a config backup from the old v1 restore properly to a new v2 (all have newest firmware)? There are a lot of tweaks including several VPNs and to do it all manually is not desirable.
View 2 Replies View RelatedWe are trying to make a restore from the backup done on ACS version 5.1 to a new appliance running ACS5.2 Before doing it I found this note in Cisco ACS user guide:
Note: You cannot back up data from an earlier version of ACS and restore it to a later version. Backup and restore must be performed on the same version of ACS. If you need the data on a different version of the ACS, you can perform an upgrade after you restore the data. Refer to the Installation and Setup Guide for Cisco Secure Access Control System 5.1 for more information on upgrading ACS to later versions.
How should I understand it? This note has conflicting statements. We can't restore to a later version but if you need data on a different version of ACS you can perform an upgrade AFTER YOU RESTORE the data. Doesn't it mean that the restore will still work? How would I do the upgrade to version 5.2 or even version 5.3 that was announced to be released very soon? I didn't find anything on the software upgrade in ACS5.1 guide.
I'm trying to move from a faulty SRP527 to SRP 547 - I tried a Restore from Backup, but it doesn't work.So start from fresh, and I'm having an issue trying to add a 2nd SSID to a VLAN...
I keep getting the error:
"FAILED! SSID 2 has joined another VLAN"
Except it hasn't... its not assigned to any VLAN...
How can we restore ACS config from an existing backup file, in an ACS cluster deployment? is it through CLI? with"restore"or"acs restore" command? and should I restore only the ACS config or both ACS and ADE-OS config?
View 4 Replies View Relatedhave some problems with setting up jobs for the backup running config on my switches. Have RW and RO contact with everyone and can change the config in editor, but do not get config.txt
View 1 Replies View RelatedI need to know the command to take the Backup and Restore of IOS Image of 6513 through tftp server.
View 6 Replies View RelatedHas anyone tried to get two factor authentication working with the asa 5505. I have a CA setup and the enrollment emails are being sent out. But when I go to login to the enrollment site at [URL]. I get a page not found.
I would like to have one factor be a username and password and the second factor being a certificate on the device.
I'm working on task to update the SSL certificate for an application. steps to upgrade the SSL, stuffs need to be checked before and after the installation and how to verify the new certificates.
View 1 Replies View RelatedI have a problem with the router Linksys RV042, I made a backup of it that contains a file with the extention .exp Now we have buy a new Rv042 made by cisco and the backup file is .config the question is how I convert the .exp file to a .config file so I can Restore the backup in to the new router?
View 1 Replies View RelatedI have the configuration file of the ASA 5505 I have another exactly model that asa is new but this my first time working with an ASA.
I going to configure it an ip address in the 0/0 interface and then use TFTP to upload the config to the start-up config and the save it and reload the ASA.
is that enough? or the ASA has extra steps??
while configuring my ASA 5505 I changed the IP address range of the internal network. Obviously I made an error because I cannot reach the box neither at the old nor the new address. How can I restore the interface and firewall definitions or reset the box to its initial state ? I found a doc how to reset the password, but not explaining how to restore the complete initial config.
View 10 Replies View RelatedI am trying to create a backup tunnel from an ASA 5505 to a pix 501 in the case of the Main ISP failing. The Pix external side will stay the same, but not quite sure how I can create a new crypto map and have it use the Backup ISP interface without bringing down the main tunnel.
My first thought was to add the following crypto map to the configuration below: [code]
I am working with a client that currently has an ASA 5505 with two ISPs for failover using a tracked interface. I would like to configure logging so that the ASA will email us when the Primary ISP goes down and fails over to the backup. Here is what I have so far...
interface Ethernet0/0
switchport access vlan 2
!
interface Ethernet0/1
switchport access vlan 12
[code]....
The primary interface is Outside and the backup is obviously Backup
I'm having problems configuring an asa 8.2(1) with a backup isp. I followed the asdm instructions in this document: [URL]
I have my backup interface configured as DHCP and the static routes set. Pinging the gateway and other external IP address from the backup interfaces works normally. I have also tried configuring the backup interface as a static address but got the same results.
When removing the primary wan link, all traffic stops. When I ping a external DNS, I get these errors in the log: portmap translation creation failed for udp src inside: 192.168.13.23 dst backup:208.67.222.222_type 8, code0)
I though this type of error is related to a NAT problem, not sure where to look though.
I have setup ASA 5505 with 2 ISP, named outside (primary) and backup, the scenario is if outside down, then backup will take over, it works now. But it is not working when the primary connection cannot reach the gateway with the interface still up.
Is it possible when the primary connection cannot reach the gateway then backup automatically take over?
My configuration is:
ASA Version 8.2(1)
!
hostname cisco
[Code].....
I have a production ASA 5505 that is working perfectly. I wanted to take a spare ASA 5505 and copy the running config to it so that I would have a backup unit that could be swapped out if the production unit went down.
Both units have security plus and running 8.2(1). The only difference is that the production ASA has 512MB of RAM while the backup ASA has 256MB. Also the backup has anyconnect and the production unit does not.
I copied the running-config to my tftp server and then copied the running config from my tftp server to the backup ASA as startup-config. After reload the device booted with an identical configuration to my production ASA, but after swapping out the units to test it, I have no access to the WAN or DMZ from my LAN. Swapping back to the production unit and all works as it should.
I printed out the running config from both devices and compared them line by line. They are identical except for the anyconnect line on the backup ASAs config file.
Is there a way to backup the configuration file to a tftp server? I've tried "copy start tftp" and copy run tftp". No luck, I get an error message.
View 1 Replies View RelatedI'm working on setting up a backup link for our ASA 5505 and I've followed these directions: [URL]
The backup ISP gives us a dynamic address, however, when I enable the backup ISP's interface on the ASA, my vpn tunnels drop. As soon as I disable the backup interface, the tunnels come back up. I'm attempting to configure this across one of these tunnels, so obviously this is an issue, as is the fact that other people need the tunnels as well. I'm not sure what I did to make this happen, but I've been over the config many times and can't see anything different from the instructions in the link above.
I thought it might be trying to route traffic across the backup interface, but my primary interface is tracked and has SLA running on it, so I would assume it wouldn't roll over onto the backup interface.
I have 5505 license with default 10 user license, want to increment the remote vpn user to 50 user license;will it be on yearly basis.Another question, can we purchase security plus license for configuring the failover config ,as well support the 50 user license on the same..
View 3 Replies View Relatedhow can I setup that the backup connection will start but after 30s of icmp timeout the default gateway (tracket object - 192.168.1.1)
My configuration:
sla monitor 123
type echo protocol ipIcmpEcho 192.168.1.1 interface outside
num-packets 3
frequency 10
sla monitor schedule 123 life forever start-time now
route outside 0.0.0.0 0.0.0.0 192.168.1.1 1 track 1
route backup 0.0.0.0 0.0.0.0 192.168.2.1 254
track 1 rtr 123 reachability
I have 2 ASA 5505 Firewall, I Configured Site 2 Site VPN no both the fitrewall, as i have a dual ISP, i am able to create the tunnel with primary but once my primary is down i am not able to create the tunnel with back up ISP. During the troobleshoothing by typing Show isakmp sa and Show ipsec sa, i can see my tunnel is up, but not able to decap the packets.
As it will look like
#pkts encaps: 15, #pkts encrypt: 15, #pkts digest: 15 #pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0 #pkts compressed: 0, #pkts decompressed: 0 #pkts not compressed: 15, #pkts comp failed: 0, #pkts decomp failed: 0 #pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0 #PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0 #send errors: 0, #recv errors: 0
I have access to an ASA running 8.4 and I need to copy the config to another one, to have it has as a spare.All configuration has coppied fine except for this part in the config;
crypto ca trustpoint ASDM_TrustPoint0
enrollment self
subject-name CN=GS2-NT-FIR-01
proxy-ldc-issuer
crl configure
[code]....
So firstly, I assume this certificate is for the SSL vpn that is configured on the ASA? Secondly, this wouldn't copy across (the HEX part). But I believe this ASA is using a self signed cert so instead I probably ned to generate a new one on this spare ASA, so how do I do that?