Question about archived configs

[dionjiles]

We had a Pix Firewall device go down and we are trying to find out where do the configs get archived. Is there anyway to pull down the configs in clear text so we can pull down the encryption keys from the devices?

[Joe Clarke]

Ah, I think I see. When you copy the config from the PIX, the credentials come through. Unfortunately, this would require an architectural change to RME to allow for this.

[Joe Clarke]

What command could be used to get the full config suitable for disaster recovery? As far as I know, show running will always provide a starred out isakmp key as well as things like vpdn passwords. Other passwords will be encrypted.

[dionjiles]

Okay here is the scenario. Let me know can this be done in CiscoWorks.

1) SSH to the PIX

2) wr net 192.168.10.10:Filename

This would tftp the startup configuration to the Ciscoworks server. Of course Ciscoworks would need to have a tftp server active for this to work.

[Joe Clarke]

This is not currently possible. The trick is RME would need to be taught to pre-create the file on the TFTP server, then process the file once the download is complete. The changes would be non-trivial.

I do see a clear value for this, though. It is something you should pursue with your account team as a feature request.

[dionjiles]

No problem. Can a Tac Case be opened to request this feature request to have this done? Can you clarify what do you mean by our account team?

[Joe Clarke · Accepted solution]

A feature request by TAC doesn't hold much weight. A feature request made by the sales organization which can back things up with dollar figures means a whole lot more. Typically, TAC encourages customers to talk to their account team, SE, account manager, etc. to open a PERS ticket requesting a new or enhanced feature.

[dionjiles]

Thanks for clarifying on what needs to be done on our end.