How to migrate config to replacement SSM-40 ?

Ronald Nutter · ‎01-27-2010

We had a SSM-40 IPS module fail last week and I am setting up the replacement to go online tonight. I was hoping to get it up quickly by just cutting and pasting the config from the failed IPS module to the replacement. From what I found out, it isnt as simple as that. After fight it for a couple of hours, I finally did everything from IPS ME. I opened a TAC case and after 2 hours, the assigned engineer couldnt provide info on how to do it.

One of the problems I ran into was that things I pasted into the config via CLI werent showing up when I went into IPS ME. It seems that you have to paste in the config in sections, periodically exiting out so that it is saved. Since TAC didnt know how to do this, has anyone else been able to do this ?

I try to be able to manage the devices via CLI when possible but after attending a CCSP bootcamp and the instructor saying that the IPS was the one exception that doing from the GUI was easier than the CLI, I would like to see if others have run into the same problem ?

Thanks,

Ron

Farrukh Haroon · ‎02-03-2010

This is not true. You can just copy all the config in 'configure terminal' mode and then apply the changes in the end.

You might not to create the user account separate tough (AFAIK).

Regards

Farrukh

Ronald Nutter · ‎02-03-2010

Copying the config from one SSM to the other didnt work. I kept getting random errors on pasting the config to the

new SSM that even TAC could explain. From what I was able figure out, it appears that you have to past it in sections and then exit out and save and then go back in and past some more in order for it to work. After spending several hours trying to get CLI cut and past to work, I threw in the towel and recreated the config using GUI.

jan.odzgan · ‎02-03-2010

I agree with you. Sometime (when configuration is big) I can't past full configuration. I need cut config to few section and past it in to 'configure terminal' in a row.

But best way how to copy configuration from one sensor to another is with CSM. You can create your own policy for every Cisco IPS but you can use this policy for more Cisco IPS devices.

rhermes · ‎02-03-2010

You can create a backup config file from the CLI, copy it off the sensor to a server, copy it back onto your replacement sensor and restore it.

Here are the commands:

http://www.cisco.com/en/US/docs/security/ips/6.0/configuration/guide/cli/cliConf.html#wp1030676

- Bob

Farrukh Haroon · ‎02-05-2010

Must be a version or device specific issue, because I recently re-imaged two IDSM-2 modules and pasted the configuration from the backup without any issues

Regards

Farrukh