Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Cisco newb question here. My company currently has one PIX and one VPN concentrator at our colo site. We purchased duplicate devices for redundancy. I need to copy the configs from the running devices and slap them on to the new duplicate devices. How do I do this?

share|improve this question
up vote 0 down vote accepted

If you do "copy running-config ?" you'll see a list of different options for copying the config. Easiest one to use depends on your situation, but I'd recommend setting up a tftp server on the same network. Then you can do copy running-config tftp: and follow the prompts.

One thing that often trips people up when using tftp: Create a file of the same name as the one you want to copy over beforehand. It can be empty, it just has to exist and be writable.

Edit: forgot to mention that on the destination device, you just do the reverse:

copy tftp: running-config


share|improve this answer
The copy running-config command is not working. We have a PIX 515E btw. When I issue the copy running-config, it comes back with: PIX# copy running-config tftp: Usage: copy capture:<capture-name> tftp://<location>/<pathname> [pcap] copy http[s]://[<user>:<password>@]<location>[:<port>]/<pathname> flash[:[image | pdm]] copy tftp[:[[//location][/pathname]]] flash[:[image | pdm]] – Citizen Chin Oct 1 '09 at 15:39
Actually I have a 515E as well. What happens if you just type "copy " and then add a question mark? Does it give you "running-config" as an option? – DictatorBob Oct 1 '09 at 17:40

You will actually want to setup stateful fail over (at least for the PIX/ASA) instead of just copying the config, that way if one device goes down at most you have a blink of non-stateful protocols.

here is example of my fail over config:

failover lan unit primary
failover lan interface FAILOVER GigabitEthernet0/2
failover key *****
failover link FAILOVER GigabitEthernet0/2
failover interface ip FAILOVER standby

Cisco Documentation for PIX/ASA failover

This will keep the configs in sync as you make updates as well.

Sorry I can't speak to how to how to setup failover on the VPN Concentrator although the quick google search seems to indicate the use of VRRP for the Cicso VPN 3000 concentrator.

share|improve this answer
Bear in mind that failover requires the primary PIX to have an unrestricted license, and the secondary to have either an unrestricted or failover-only license. It is also only supported on PIX 515 and up. VPN concentrator failover depends on the model, but you are correct that VRRP would be the preferred method with the VPN 3000 series. If you are using PIX for VPN termination, failover works, but it is not seamless and sessions will be dropped during the transition. – James Sneeringer Sep 30 '09 at 22:08
@James: Thanks for the reminder about licensing, we buy everything UR so I always forget about that. – Zypher Sep 30 '09 at 22:21

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.