0

Cisco newb question here. My company currently has one PIX and one VPN concentrator at our colo site. We purchased duplicate devices for redundancy. I need to copy the configs from the running devices and slap them on to the new duplicate devices. How do I do this?

2 Answers 2

0

If you do "copy running-config ?" you'll see a list of different options for copying the config. Easiest one to use depends on your situation, but I'd recommend setting up a tftp server on the same network. Then you can do copy running-config tftp: and follow the prompts.

One thing that often trips people up when using tftp: Create a file of the same name as the one you want to copy over beforehand. It can be empty, it just has to exist and be writable.

Edit: forgot to mention that on the destination device, you just do the reverse:

copy tftp: running-config

:)

2
  • The copy running-config command is not working. We have a PIX 515E btw. When I issue the copy running-config, it comes back with: PIX# copy running-config tftp: Usage: copy capture:<capture-name> tftp://<location>/<pathname> [pcap] copy http[s]://[<user>:<password>@]<location>[:<port>]/<pathname> flash[:[image | pdm]] copy tftp[:[[//location][/pathname]]] flash[:[image | pdm]] Oct 1, 2009 at 15:39
  • Actually I have a 515E as well. What happens if you just type "copy " and then add a question mark? Does it give you "running-config" as an option? Oct 1, 2009 at 17:40
2

You will actually want to setup stateful fail over (at least for the PIX/ASA) instead of just copying the config, that way if one device goes down at most you have a blink of non-stateful protocols.

here is example of my fail over config:

failover
failover lan unit primary
failover lan interface FAILOVER GigabitEthernet0/2
failover key *****
failover link FAILOVER GigabitEthernet0/2
failover interface ip FAILOVER 192.168.1.9 255.255.255.0 standby 192.168.1.10

Cisco Documentation for PIX/ASA failover

This will keep the configs in sync as you make updates as well.

Sorry I can't speak to how to how to setup failover on the VPN Concentrator although the quick google search seems to indicate the use of VRRP for the Cicso VPN 3000 concentrator.

2
  • Bear in mind that failover requires the primary PIX to have an unrestricted license, and the secondary to have either an unrestricted or failover-only license. It is also only supported on PIX 515 and up. VPN concentrator failover depends on the model, but you are correct that VRRP would be the preferred method with the VPN 3000 series. If you are using PIX for VPN termination, failover works, but it is not seamless and sessions will be dropped during the transition. Sep 30, 2009 at 22:08
  • @James: Thanks for the reminder about licensing, we buy everything UR so I always forget about that.
    – Zypher
    Sep 30, 2009 at 22:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .