Cisco PIX and VPN: Copy config to backup devices

Question

Cisco newb question here. My company currently has one PIX and one VPN concentrator at our colo site. We purchased duplicate devices for redundancy. I need to copy the configs from the running devices and slap them on to the new duplicate devices. How do I do this?

Answer 1

If you do "copy running-config ?" you'll see a list of different options for copying the config. Easiest one to use depends on your situation, but I'd recommend setting up a tftp server on the same network. Then you can do copy running-config tftp: and follow the prompts.

One thing that often trips people up when using tftp: Create a file of the same name as the one you want to copy over beforehand. It can be empty, it just has to exist and be writable.

Edit: forgot to mention that on the destination device, you just do the reverse:

copy tftp: running-config

:)

Answer 2

You will actually want to setup stateful fail over (at least for the PIX/ASA) instead of just copying the config, that way if one device goes down at most you have a blink of non-stateful protocols.

here is example of my fail over config:

failover
failover lan unit primary
failover lan interface FAILOVER GigabitEthernet0/2
failover key *****
failover link FAILOVER GigabitEthernet0/2
failover interface ip FAILOVER 192.168.1.9 255.255.255.0 standby 192.168.1.10

Cisco Documentation for PIX/ASA failover

This will keep the configs in sync as you make updates as well.

Sorry I can't speak to how to how to setup failover on the VPN Concentrator although the quick google search seems to indicate the use of VRRP for the Cicso VPN 3000 concentrator.