Saving a Running Configuration

You can view or save a firewall's running configuration with one of the methods described in the following sections.

Viewing the Running Configuration

You can use the following commands to display the current running configuration:

Firewall# write terminal or

Firewall# show running-config

The running configuration is displayed to the current terminal session. If the configuration is longer than your current session page length (24 lines by default), you have to press the spacebar to page through it.

However, in ASA, FWSM, and PIX 6.3 platforms, you can filter the output by using one of the following keywords at the end of the command:

Code View: Scroll / Show All

Firewall# show running-config | {begin | include | exclude | grep [-v]} reg-exp

You can start the first line of output at the line where the regular expression reg-exp appears in the configuration with the begin keyword.

If you are looking for lines that contain only the regular expression reg-exp, use the include or grep keyword. You can also display only the lines that do not contain the reg-exp with the exclude or grep -v keyword.

The regular expression can be a simple text fragment or a more complex form containing wildcard and pattern-matching characters. For example, include int finds any line that contains "int" (including words such as "interface") located anywhere in the text.

These options are very handy if you have a firewall with a large configuration. Rather than paging through large amounts of configuration output, you can instantly find what you are looking for.

Saving the Running Configuration to Flash Memory

After you make configuration changes to a firewall and they are satisfactory, you should make them permanent by saving the running configuration to flash memory. You can use the following command to accomplish this:

Firewall# write memory

All the current configuration commands are stored in the startup configuration area in flash memory. You should always run this command after making configuration changes. Otherwise, you might forget to save them later when the firewall is reloaded.

In ASA and FWSM, the write memory command is supported for backward compatibility. A new form of the copy command is also provided, using the following syntax:

Firewall# copy running-config startup-config

In multiple context mode, each context's running configuration must be saved individually. This usually means you have to move into each context with the changeto command and then use the write memory or copy running-config startup-config command.

Beginning with ASA 7.2(1) and FWSM 3.1(1), you can save all context configurations with a single command. In the system execution space, use the following command:

Firewall# write memory all

The copy command does not have the same capability.

When the configuration is saved or displayed, the firewall also displays a cryptochecksum, or a message digest 5 (MD5) hash of the configuration file contents. This value serves as a type of fingerprint that can be used to evaluate the configuration file's integrity. The configuration file's size is also shown, as in the following example:

Firewall# copy running-config startup-config Source filename [running-config]?

Cryptochecksum: 71a4cecb 97baf374 10757e38 a320cc43

2909 bytes copied in 0.520 secs

Firewall#

You can use the MD5 cryptochecksum value as a quick check to see if a firewall's configuration has changed since it booted. First, find the MD5 hash that was saved with the startup configuration by looking at the last line of the show startup-config or show config command. Then compare that to the MD5 hash of the current running configuration, shown in the last line of the show running-config command or with the output of the show checksum command. If the two hash values differ, the configuration has changed.

Comparing the two cryptochecksum values in the following example shows that the configuration has been changed:

Firewall# show startup-config | include checksum Cryptochecksum:3750a83d00922b8 0ffef7 8e92 8 65b09a Firewall# show running-config | include checksum Cryptochecksum:a5bdac82 9 0 9dc8 717e4 94cfabc2d3 63d Firewall#

Saving the Running Configuration to a TFTP Server

You can use the following steps to save the current running configuration to an external file server:

1. (Optional) Identify the TFTP server:

Firewall(config)# tftp-server [interface] ip-address path

The TFTP server can be found on the firewall's interface at IP address ip-address. By default, the inside interface is assumed. The running configuration file is stored in the path directory on the TFTP server. This path is relative only to the TFTP process itself. For example, if the file is stored in the topmost TFTP directory (/tftpboot, for example), the path would be /, or the root of the TFTP directory tree.

The tftp-server command is not necessary, because all the TFTP parameters can be given with the write net or copy EXEC command when the configuration is saved. However, the firewall always assumes the inside interface will be used for TFTP. The only way to override this assumption is by specifying a firewall interface (inside or outside, for example) in the tftp-server command. This interface is always used whenever files are copied to and from a TFTP server, even if the server address is different.

2. Save the configuration:

Firewall# write net [[server-ip-address]:[filename]]

The TFTP server can be identified by giving its IP address here as server-ip-address. The configuration is saved in a file named filename in the TFTP root directory on the server.

If the server is not specified here, the values configured by the tftp-server command are used. You can also override the server address configured with the tftp-server command by specifying an address here.

ASA and FWSM platforms also offer the copy command, which can be used to copy the running configuration to a TFTP server. You can use the following command:

Firewall# copy running-config tftp://[user[:password]@]server[:port]/[path/]filename

Here, the running configuration is copied as a file with the filename filename. You can provide a path to specify where the file should be stored on the server. The path is relative to the TFTP server's root directory. If the server requires user authentication, the user ID and password can be given in the form user:password@.

For example, the running configuration is to be saved as the file firewall.confg on the TFTP server at 192.168.208.40, located on the firewall's dmz interface. The following commands can be used to accomplish this:

Firewall(config)# tftp-server dmz 192.168.208.40 / Firewall(config)# exit

Firewall# write net 192.168.208.40:firewall.confg or

Firewall# copy running-config tftp://192.168.2 08.4 0/firewall.confg

Forcing the Running Configuration to Be Copied Across a Failover Pair

During the bootup sequence, the active firewall copies its complete running configuration to the standby firewall. The active unit also copies any configuration commands to the standby unit as they are entered and executed.

Under normal conditions, the standby unit can keep its running configuration up to date and synchronized with the active unit. Sometimes it is possible for the two units to become unsynchronized. This can occur when configuration changes are made while the failover cable is disconnected, while the LAN-based failover connection is broken, or while the two units are running different OS releases. In these cases, you might see some of the logging messages in Table 4-8 generated when stateful failover cannot synchronize the two firewall units.

Table 4-8. Logging Messages Resulting from Stateful Failover Synchronization Errors

Message ID

Description

%ASA-1-105020

(Primary) Incomplete/slow configuration replication.

%ASA-3-210006

Stateful failover is unable to locate a NAT group for the IP address on the standby unit.

%ASA-3-210008

Unable to find a translation slot (xlate) record for a stateful failover connection.

%ASA-3-210020

Stateful failover is unable to allocate a specific PAT address that is in use.

Table 4-8. Logging Messages Resulting from Stateful Failover Synchronization Errors

Readers' Questions

  • ronnie robertson
    Where does asa store its running config?
    1 year ago
  • ASA stores the running config in its NVRAM.

    Disclosure: Some of the links above are affiliate links. This means that, at zero cost to you, I will earn an affiliate commission if you click through the link and finalize a purchase.

    Message ID

    Description

    %ASA-3-210021

    Stateful failover is unable to create a translation slot (xlate).

    If you make configuration changes on the standby firewall unit, those changes are not replicated back toward the active unit. Instead, you see the following message:

    Code View: Scroll / Show All

    Configuration Replication is NOT performed from Standby unit to Active unit.

    Configurations are no longer synchronized.

    If you find that the running configurations are no longer identical and synchronized between the active and standby units, you can use the following command on the active unit to force a complete copy to be sent to the standby unit:

    Firewall# write standby

    Forcing the Startup (Nonvolatile) Configuration to Be Cleared

    Sometimes you might need to begin with an empty configuration on a firewall. This might happen if you reuse an existing firewall in a different scenario or if you inherit a firewall from someone else.

    The following command erases all configuration commands from the startup configuration in flash memory:

    Firewall# write erase

    This command does not disturb or erase the current running configuration. After the startup configuration is erased, you can use the reload EXEC command to reboot the firewall with the new, empty startup configuration.

    Continue reading here: Configuring a Firewall as an Auto Update Client

    Was this article helpful?

    +1 -1