Unattended backups for Cisco appliances using scp

It's a good practice to keep your Cisco running configuration backed up to a remote backup repository on a regular basis, most convenient way I have found is using 'archive' function in the IOS and transferring the configuration over 'scp':
 
router01#conf t
router01(config)#archive
router01(config-archive)#path scp://bkpadmin:passw0rd@10.10.1.10//backup/bkp-$h-$trouter01(config-archive)#time-period 720
router01(config-archive)#do wr

Where:

• 10.10.1.10 - is my backup server
• bkpadmin/passw0rd - my remote user credentials.
  
• $h - is the hostname of the appliance
• $t - is the backup time stamp
• Backup time interval is specified in minutes so in my case the backup occurs twice a day (1440 minutes=24h).

Your running-config will be saved in file such as:

#ls /backup
bkp-router01-Jun-30-11-27-15.585-0

Perl SSH Log-in

Hi Folks, 

In the following post I will demonstrate a password-less login into Cisco appliance via the SSH protocol using a Perl script.

When combined with cron, it can be a great solution for saving your appliance configuration (show run) or checking status without the need to log-in into the appliance each time.

Pre requirements:

• Perl
• SSH client (duh!)
• Net-SSH-Perl module

On Red-Hat (and friends) the module can be obtained via:

#yum install perl-Net-SSH-Perl -y 

Be sure to have a proper repository installed such as rpmforge 

 

Our simple script connects to the Cisco appliance via SSH and runs "show run" command (this account has enabled privilege).
The script itself should look like this:

#!/usr/bin/perl -w
use strict;
use warnings;
use Net::SSH::Perl;
my $ssh = Net::SSH::Perl->new('hostname');
$ssh->login('username', 'password');
my($out) = $ssh->cmd("show run");
print $out;

Since the script contains your appliance username & password don't forget to remove permissions for others:

#chmod o-rwx script.pl

Now, let's run the script:

#./script.pl

Output:

Building configuration...

Current configuration : 8011 bytes
...more output ommited...

Works like charm!

Now, the only thing is left is to synchronize it with cron :)

Enjoy.

Enable SNMP on Cisco Devices (part 1)

In this short tutorial I'll demonstrate how to quickly configure SNMP on your Cisco appliance and test it's working.


There will be another tutorial dealing with how to configure the SNMP manager side.


1) Let's start by logging in to your Cisco appliance (In my case I used 851 series Cisco router with IOS version 12.3).

2) Enter configuration mode:

cisco851#configure terminal

3) Set your community string and the mode (read only, read write):

cisco851(config)#snmp-server community myComunity1 RW

4) Point the appliance to the SNMP manager (in our case 192.168.2.4) , with the same community string you've set before: 

 cisco851(config)#snmp-server host 192.168.2.4 version 2c myComunity1


5) Enable the trap types you wish to monitor, for example:

cisco851(config)#snmp-server enable traps snmp linkdown linkup coldstart warmstart

6) Save the configuration:

cisco851(config)#do wr

At this point the basic configuration on the Cisco appliance is done, let's see if we able to querry the appliance from our server.

I have used Ubuntu 11.04 x64 box with "snmp" package installed.

Check it's indeed installed with:

root@ubuntu:~#dpkg --list |grep snmp

If not get it with:

root@ubuntu:~#apt-get install snmp

After snmp package has been succefully installed it's time test the configuration.

Issue the following command and see if you're able to retrieve the SNMPv1 agent  or our Cisco appliance (192.168.2.1) MIB tree list :

root@ubuntu:~#snmpwalk -v 1 -c myComunity1 192.168.2.1

At this point you should be able to list the entire tree (output was ommited), means Cisco side is configured successfully.

You can now get the desired info for monitoring purposes, like the system uptime:

root@ubuntu:~#snmpget -v 1 -c myComunity1 192.168.2.1 iso.org.dod.internet.mgmt.mib-2.system.sysUpTime.0


DISMAN-EVENT-MIB::sysUpTimeInstance = Timeticks: (490514418) 56 days, 18:32:24.18
 
Or our appiance hostname:

root@ubuntu:~#snmpget -v 1 -c myComunity1 192.168.2.1 iso.org.dod.internet.mgmt.mib-2.system.sysName.0


SNMPv2-MIB::sysName.0 = STRING: gw1.slsphr.net.il
 
Mission accomplished.
 
In the next SNMP article I will touch the server side configuration.
 
Cheers.

Howto remove old NAT configuration from Cisco router

Recently I came upon a situation where my ISP has assigned me a static IP - instead of L2TP dialer (Virtual PPP Interface in Cisco) I was using before ...
Anyway, I started to remove old and irrelevant NAT settings that were associated with my old dialer ,but when I've tried to configure the new NAT settings I got an error:
%Dynamic mapping in use, cannot change

After scratching my head for awhile I found the solution.

To remove old NAT settings on Cisco router you need to 

1)Clear all old NAT translations
router#clear ip nat translatiom *

2)Disable old NAT pool settings

router(config)#no ip nat pool public_access 200.100.10.33 netmask 255.255.255.252

3)And finally, disable the translation:

router(config)#no ip nat inside source list 1 pool public_access overload

From this point you can safely configure the new NAT settings.

Cheers.