Modify configuration best way !!

yann.boulet · ‎05-09-2006

Hello,

I want to know what's the best way to make a lot of changes in my configuration, i am a new V7 user and i want to know if it's better to do that in the runnig conf or the startup conf, and how can i replace the startup configuration file without overwritting the current after my modifications.

Thx

a.kiprawih · ‎05-09-2006

Hi,

Maybe you can use tftp/ftp/http services to load config meant for startup config.

Copy the existing startup config to tftp server, modify the file, and load it again to your PIX to either the Running Config or Startup Config.

a. To copy from a TFTP server, enter the following command:

hostname# copy tftp://server[/path]/filename {startup-config | running-config}

-> hostname# copy tftp://209.165.200.226/configs/startup.cfg startup-config

b. To copy from an FTP server, enter the following command:

hostname# copy ftp://[user[:password]@]server[/path]/filename[;type=xx] {startup-config | running-config}

-> hostname# copy ftp://admin:letmein@209.165.200.227/configs/startup.cfg;type=an startup-config

c. To copy from an HTTP or HTTPS server, enter the following command:

hostname# copy http[s]://[user[:password]@]server[:port][/path]/filename

{startup-config | running-config}

-> hostname# copy http://209.165.200.228/configs/startup.cfg startup-config

ref:

http://www.cisco.com/en/US/products/ps6120/products_configuration_guide_chapter09186a008054dbea.html

http://www.cisco.com/en/US/products/ps6120/products_configuration_guide_chapter09186a0080450b92.html

Rgds,

AK

yann.boulet · ‎05-09-2006

Many thanks for your reply, can you tell if there is a way to change the offline configuration except by NOTEPAD ?

If i copy my new file on the PIX, how can i use the old one if there were a trouble after ?

Another question is maybe stupid but what's the difference in V7 between running and startup because i don't see ASDM location and groups ?

Thanks

a.kiprawih · ‎05-09-2006

Hi,

Q: Many thanks for your reply, can you tell if there is a way to change the offline configuration except by NOTEPAD ?

A: As far as I am concerned, that's the way you do it in offline mode (can use any word processing apps such as wordpad, MSWord)

Q: If i copy my new file on the PIX, how can i use the old one if there were a trouble after ?

A: Normally, you can always load the old config file using the same tftp/ftp/http method. If you specify your firewall to load startup config automatically from a tftp server, then you probably need to copy your old config, and rename it to a same file name that you load automatically via tftp.

But in worst case scenario, you need to console in and modify the config from there, e.g copy & paste fr old config.

Q: Another question is maybe stupid but what's the difference in V7 between running and startup because i don't see ASDM location and groups ?

A: Startup Config - default loaded config file by firewall everytime you power-on or restart the box.

Normally, whatever changes you've made to the running config and later saved it via "write mem" command, it will be saved to/as startup-config.

Running Config - active config used by firewall after you power-on the unit. Any changes you made will immediately take effect as long as your do not power-off your firewall, but if you don't saved this config (using write mem), all changes will be gone. If you saved it, it will become your startup config.

Hope this help... pls rate if it does.

Rgds,

AK

yann.boulet · ‎05-10-2006

sorry for the delay i will rate your posts but can you just tell me how in the startup config i have names and asdm with the interface they belong and in the running configuration i don't save, my problem is if i make my modification in the runnig the hosts i will move from an interface will be assigned on which interface ? or if you want i can explain what i just want to do ? i want to use vlan's on an interface and at the moment there is a conifugration with no vlan's on this one so i just want to migrate the physical configuration on an virtual (same physical) without changing anything IP's, rules, routes, nat and other.

Can you give me maybe the easy way to do that ??

a.kiprawih · ‎05-10-2006

Hi,

Q. can you just tell me how in the startup config i have names and asdm with the interface they belong and in the running configuration i don't save, my problem is if i make my modification in the runnig the hosts i will move from an interface will be assigned on which interface ?

A: You can maintain the names, but for the asdm location, if they still belongs to the same interface and using the same name, I think you don't have to do anything. Can you share your config so that I can understand better your config?

Q. or if you want i can explain what i just want to do ? i want to use vlan's on an interface and at the moment there is a conifugration with no vlan's on this one so i just want to migrate the physical configuration on an virtual (same physical) without changing anything IP's, rules, routes, nat and other.

Can you give me maybe the easy way to do that ??

A: With v7.x, you can create sub-interface and associate individual sub-interface with Vlan.

So, if you need to move your segment/vlan that currently used Firewall physical interface, you can use Notepad to predefine your config. But in this case, you need to put/migrate the existing segment as new VLAN (same IP, etc) in the switch connected to Firewall, AND configure the switch port connected to Firewall as trunk with Dot1Q encap. Make sure you only allow the new VLAN to pass through, or you can simply allow all at the beginning.

Example:-

*Before:

interface Ethernet0/0

description :: Link to InternetRouter

nameif outside

security-level 0

ip address 192.168.100.1 255.255.255.0

!

interface Ethernet0/1

description :: Secure Inside Segment

nameif inside

security-level 100

ip address 10.10.10.1 255.255.255.0 ---> connect to switch in flat segment or no VLAN.

*After:

interface Ethernet0/0

description :: Link to InternetRouter

nameif outside

security-level 0

ip address 192.168.100.1 255.255.255.0

!

interface gigabitethernet0/1

no ip address

!

interface gigabitethernet0/1.1

description :: Secure Inside Segment

vlan 100

nameif inside

security-level 100

ip address 10.10.10.1 255.255.255.0 ---> segment now defined as VLAN100.

no shutdown

*use 'no' command to remove the sub-interface.

Rgds,

AK

yann.boulet · ‎05-12-2006

i understant what you mean but before creating the subinterface with the same name i will have to make a NO IP ADDRESS and NO NAMEIF (on the physical) to be able to create my subinterface and where i want to be sure is does the pix remove all lines with this NAMEIF (route, static, acl, asdm) when i will do a NO NAMEIF or does it let orphans lines for example my current interface is :

nameif : DMZ_PUB

Ip address : 10.60.0.1 255.255.0.0 standby 10.60.0.2

name 10.60.2.2 INTRANET_SERVER

asdm location INTRANET_SERVER 255.255.255.255 DMZ_PUB

regards,

YB

yann.boulet · ‎05-12-2006

Someone can help me on this ?