Saving a Running Configuration
You can view or save a firewall's running configuration with one of the methods described in the following sections.
Viewing the Running Configuration
You can use the following commands to display the current running configuration:
Firewall# write terminal or
Firewall# show running-config
The running configuration is displayed to the current terminal session. If the configuration is longer than your current session page length (24 lines by default), you have to press the spacebar to page through it.
However, in ASA, FWSM, and PIX 6.3 platforms, you can filter the output by using one of the following keywords at the end of the command:
Code View: Scroll / Show All
Firewall# show running-config | {begin | include | exclude | grep [-v]} reg-exp
You can start the first line of output at the line where the regular expression reg-exp appears in the configuration with the begin keyword.
If you are looking for lines that contain only the regular expression reg-exp, use the include or grep keyword. You can also display only the lines that do not contain the reg-exp with the exclude or grep -v keyword.
The regular expression can be a simple text fragment or a more complex form containing wildcard and pattern-matching characters. For example, include int finds any line that contains "int" (including words such as "interface") located anywhere in the text.
These options are very handy if you have a firewall with a large configuration. Rather than paging through large amounts of configuration output, you can instantly find what you are looking for.
Saving the Running Configuration to Flash Memory
After you make configuration changes to a firewall and they are satisfactory, you should make them permanent by saving the running configuration to flash memory. You can use the following command to accomplish this:
Firewall# write memory
All the current configuration commands are stored in the startup configuration area in flash memory. You should always run this command after making configuration changes. Otherwise, you might forget to save them later when the firewall is reloaded.
In ASA and FWSM, the write memory command is supported for backward compatibility. A new form of the copy command is also provided, using the following syntax:
Firewall# copy running-config startup-config
In multiple context mode, each context's running configuration must be saved individually. This usually means you have to move into each context with the changeto command and then use the write memory or copy running-config startup-config command.
Beginning with ASA 7.2(1) and FWSM 3.1(1), you can save all context configurations with a single command. In the system execution space, use the following command:
Firewall# write memory all
The copy command does not have the same capability.
When the configuration is saved or displayed, the firewall also displays a cryptochecksum, or a message digest 5 (MD5) hash of the configuration file contents. This value serves as a type of fingerprint that can be used to evaluate the configuration file's integrity. The configuration file's size is also shown, as in the following example:
Firewall# copy running-config startup-config Source filename [running-config]?
Cryptochecksum: 71a4cecb 97baf374 10757e38 a320cc43
2909 bytes copied in 0.520 secs
Firewall#
You can use the MD5 cryptochecksum value as a quick check to see if a firewall's configuration has changed since it booted. First, find the MD5 hash that was saved with the startup configuration by looking at the last line of the show startup-config or show config command. Then compare that to the MD5 hash of the current running configuration, shown in the last line of the show running-config command or with the output of the show checksum command. If the two hash values differ, the configuration has changed.
Comparing the two cryptochecksum values in the following example shows that the configuration has been changed:
Firewall# show startup-config | include checksum Cryptochecksum:3750a83d00922b8 0ffef7 8e92 8 65b09a Firewall# show running-config | include checksum Cryptochecksum:a5bdac82 9 0 9dc8 717e4 94cfabc2d3 63d Firewall#
Saving the Running Configuration to a TFTP Server
You can use the following steps to save the current running configuration to an external file server:
1. (Optional) Identify the TFTP server:
Firewall(config)# tftp-server [interface] ip-address path
The TFTP server can be found on the firewall's interface at IP address ip-address. By default, the inside interface is assumed. The running configuration file is stored in the path directory on the TFTP server. This path is relative only to the TFTP process itself. For example, if the file is stored in the topmost TFTP directory (/tftpboot, for example), the path would be /, or the root of the TFTP directory tree.
The tftp-server command is not necessary, because all the TFTP parameters can be given with the write net or copy EXEC command when the configuration is saved. However, the firewall always assumes the inside interface will be used for TFTP. The only way to override this assumption is by specifying a firewall interface (inside or outside, for example) in the tftp-server command. This interface is always used whenever files are copied to and from a TFTP server, even if the server address is different.
2. Save the configuration:
Firewall# write net [[server-ip-address]:[filename]]
The TFTP server can be identified by giving its IP address here as server-ip-address. The configuration is saved in a file named filename in the TFTP root directory on the server.
If the server is not specified here, the values configured by the tftp-server command are used. You can also override the server address configured with the tftp-server command by specifying an address here.
ASA and FWSM platforms also offer the copy command, which can be used to copy the running configuration to a TFTP server. You can use the following command:
Firewall# copy running-config tftp://[user[:password]@]server[:port]/[path/]filename
Here, the running configuration is copied as a file with the filename filename. You can provide a path to specify where the file should be stored on the server. The path is relative to the TFTP server's root directory. If the server requires user authentication, the user ID and password can be given in the form user:password@.
For example, the running configuration is to be saved as the file firewall.confg on the TFTP server at 192.168.208.40, located on the firewall's dmz interface. The following commands can be used to accomplish this:
Firewall(config)# tftp-server dmz 192.168.208.40 / Firewall(config)# exit
Firewall# write net 192.168.208.40:firewall.confg or
Firewall# copy running-config tftp://192.168.2 08.4 0/firewall.confg
Forcing the Running Configuration to Be Copied Across a Failover Pair
During the bootup sequence, the active firewall copies its complete running configuration to the standby firewall. The active unit also copies any configuration commands to the standby unit as they are entered and executed.
Under normal conditions, the standby unit can keep its running configuration up to date and synchronized with the active unit. Sometimes it is possible for the two units to become unsynchronized. This can occur when configuration changes are made while the failover cable is disconnected, while the LAN-based failover connection is broken, or while the two units are running different OS releases. In these cases, you might see some of the logging messages in Table 4-8 generated when stateful failover cannot synchronize the two firewall units.
|
Table 4-8. Logging Messages Resulting from Stateful Failover Synchronization Errors |
|
|
Message ID |
Description |
|
%ASA-1-105020 |
(Primary) Incomplete/slow configuration replication. |
|
%ASA-3-210006 |
Stateful failover is unable to locate a NAT group for the IP address on the standby unit. |
|
%ASA-3-210008 |
Unable to find a translation slot (xlate) record for a stateful failover connection. |
|
%ASA-3-210020 |
Stateful failover is unable to allocate a specific PAT address that is in use. |
|
Message ID |
Description |
|
%ASA-3-210021 |
Stateful failover is unable to create a translation slot (xlate). |
If you make configuration changes on the standby firewall unit, those changes are not replicated back toward the active unit. Instead, you see the following message:
Code View: Scroll / Show All
Configuration Replication is NOT performed from Standby unit to Active unit.
Configurations are no longer synchronized.
If you find that the running configurations are no longer identical and synchronized between the active and standby units, you can use the following command on the active unit to force a complete copy to be sent to the standby unit:
Firewall# write standby
Forcing the Startup (Nonvolatile) Configuration to Be Cleared
Sometimes you might need to begin with an empty configuration on a firewall. This might happen if you reuse an existing firewall in a different scenario or if you inherit a firewall from someone else.
The following command erases all configuration commands from the startup configuration in flash memory:
Firewall# write erase
This command does not disturb or erase the current running configuration. After the startup configuration is erased, you can use the reload EXEC command to reboot the firewall with the new, empty startup configuration.
Continue reading here: Configuring a Firewall as an Auto Update Client
Was this article helpful?