Managing the Startup Configuration

In PIX releases 6.3 and earlier, as well as FWSM releases, a firewall has one startup configuration that is stored in flash memory. This configuration file is read upon bootup and is copied into the running configuration.

ASA platforms running 7.0 or later have the capability to maintain one or more startup configuration files in flash, provided that you have sufficient space to store them. Only one of these can be used at boot time.

This section discusses the tasks that can be used to maintain and display the startup configuration file.

Selecting a Startup Configuration File

In ASA platforms, having multiple startup configurations makes configuration rollback easy. The startup configuration contents can be saved in one file during the time that the firewall configuration is stable. If major configuration changes need to be made, the new updated running configuration can be saved to a new startup configuration file. The next time the firewall is booted, it can use this new file.

If you encounter problems with the new configuration, you can make one configuration change to force the firewall to roll back or use a previous version of the startup configuration.

By default, a firewall stores its startup configuration in a hidden partition of flash memory. That file has no usable name and can be viewed only through the show startup-configuration command.

To force the firewall to use a different startup configuration filename, you can use the following command:

Firewall(config)# boot config url url represents the location of the startup configuration file. It can be flash:/path, disk0:/path, or disk1:/path, depending on which flash file systems the firewall platform supports. PIX models have only a flash:/ file system, whereas the ASA platforms can support flash or disk flash file systems.

Be aware that the boot config url command effectively changes an environment variable used only by the running configuration. When you use this command, be sure to save the running configuration with the copy running-config startup-config or write memory command.

At this point, the firewall uses the new url and saves the startup configuration in that file, not in the default location. If the file does not exist, a new file is created; if it does exist, the running configuration is merged with that file's contents. The environment variable is also updated and is used during the next boot cycle to find the new startup configuration file.

You can see the startup configuration environment variable with the show bootvar command. The following example begins with the default location, signified by the empty Current CONFIG FILE variable value. When the boot config command is used, the current value is updated to show the new file location.

However, until the running configuration is saved to the new startup configuration location, the new file is not present in flash. As well, the startup configuration file used at boot time is still the default (shown by an empty CONFIG FILE variable line). After the configuration is saved, the new file is used during the next firewall boot.

Code View: Scroll / Show All

Firewall# show bootvar BOOT variable = flash:/image.bin Current BOOT variable = flash:/image.bin CONFIG_FILE variable = Current CONFIG_FILE variable = Firewall# configure terminal

Firewall(config)# boot config flash:/startup-1.cfg

INFO: Converting myconfig.cfg to flash:/startup-1.cfg

Firewall(config)# exit

Firewall# show bootvar

BOOT variable = flash:/image.bin

Current BOOT variable = flash:/image.bin

CONFIG_FILE variable =

Current CONFIG_FILE variable = flash:/startup-1.cfg Firewall# dir flash:/ Directory of flash:/

6 -rw- 5031936 10:21:11 Dec 21 2006 image.bin

23 -rw- 8596996 10:12:38 Nov 12 2006 asdm.bin

16128000 bytes total (2450944 bytes free) Firewall#

Firewall# copy running-config startup-config Source filename [running-config]?

Cryptochecksum: a8885ca7 9782e279 c6794487 6480e76a

3861 bytes copied in 0.900 secs

Firewall# show bootvar

BOOT variable = flash:/image.bin

Current BOOT variable = flash:/image.bin

CONFIG_FILE variable = flash:/startup-1.cfg

Current CONFIG_FILE variable = flash:/startup-1.cfg

Firewall# dir flash:/

Directory of flash:/

6 -rw- 5031936 10:21:11 Dec 21 2006 image.bin

23 -rw- 8596996 10:12:38 Nov 12 2006 asdm.bin

20 -rw- 3861 23:12:20 Dec 30 2006 startup-1.cfg

Finally, notice that even though a new location and a new filename are used for the startup configuration, you do not have to specify those when you save the running configuration later. The firewall continues to work with the startup-config keyword, but it uses the new url to reference the actual file. In other words, copy running-config startup-config always uses the current and correct location.

Displaying the Startup Configuration

You can display the contents of the startup configuration with either of these commands:

Firewall# show startup-config or

Firewall# show configuration

In PIX 6.3, the latter command is actually show configure.

In the first line of the startup configuration, you can find its time stamp. This shows when the running configuration was saved to flash the last time and who saved it. For example, the generic user enable_15 (someone in privileged EXEC or enable mode) saved this configuration:

Firewall# show startup-config : Saved

: Written by enable_15 at 17:41:51.013 EST Mon Nov 22 2006 PIX Version 8.0(1) names !

interface Ethernet0 shutdown [output omitted]

Continue reading here: Saving a Running Configuration

Was this article helpful?

0 0