Resilent Configuration on Cisco (Part-2: Recovering IOS and Configuration Files)

ယခင္အပိုင္းမွာ IOS Image ႏွင့္ Configuration File ေတြကို hidden (secure) လုပ္ၿပီးခဲ့ပါၿပီ…
ယခုအပိုင္းမွာ restoration ကိုေျပာပါမယ္… Configuration File ကေနစပါမယ္…
Configuration File ကို မေတာ္တဆ ဖ်က္မိၿပီဆိုပါစို႔… device က reload ျဖစ္တဲ့အခါ default configuration file ႏွင့္သာ boot တက္လာပါတယ္… resilent feature ကိုလည္း disable အေနနဲ႔ေတြရပါတယ္…
Router# erase startup-config
Erasing the nvram filesystem will remove all configuration files! Continue? [confirm]
[OK]
Erase of nvram: complete
Router# show startup-config
startup-config is not present
Router# reload

System configuration has been modified. Save? [yes/no]: n
Proceed with reload? [confirm]
...
Router> enable
Router# show secure bootset
%IOS image and configuration resilience is not active

Restoration ကိုစလုပ္ပါမယ္… first, secure လုပ္ထားတဲ့ configuration file ကို flash ေပၚကို အရင္ extract လုပ္ရပါတယ္… second, extract လုပ္ၿပီးတဲ့ configuration file ကို running configuration ႏွင့္ အစားထိုးရပါတယ္… third, အားလံုးၿပီးတဲ့အခါ save လုပ္ရန္ အေရးႀကီးပါတယ္။

Router(config)# secure boot-config restore flash:archived-config
ios resilience:configuration successfully restored as flash:archived-config
Router(config)# ^C
Router# configure replace flash:archived-config
This will apply all necessary additions and deletions
to replace the current running configuration with the
contents of the specified configuration file, which is
assumed to be a complete configuration, not a partial
configuration. Enter Y if you are sure you want to proceed. ? [no]: y
Total number of passes: 1
Rollback Done

Router# copy run start

သတိထားရမွာက resilent feature ကို update ျပန္လုပ္ေပးဖို႔လိုပါတယ္… အဲဒီအတြက္ အရင္ resilent configuration file ကိုဖ်က္ၿပီးမွ update လုပ္ရပါတယ္။
Router(config)# no secure boot-config
%IOS_RESILIENCE-5-CONFIG_RESIL_INACTIVE: Disabled secure config archival [removed
 flash:.runcfg-20101017-020040.ar]
Router(config)# secure boot-config
%IOS_RESILIENCE-5-CONFIG_RESIL_ACTIVE: Successfully secured config archive
 [flash:.runcfg-20101017-024745.ar]

IOS ကေတာ့ configuration file restore လုပ္တာနဲ႔မတူတာ ေတြ႔ရပါတယ္… flash ကို format လုပ္ၿပီးသည့္တိုင္ secure-image လုပ္ထားတဲ့အတြက device က normal အတိုင္ reboot တက္လာပါတယ္…
Router# format flash:
Format operation may take a while. Continue? [confirm]
Format operation will destroy all data in "flash:".  Continue? [confirm]
Writing Monlib sectors...
Monlib write complete

Format: All system sectors written. OK...

Format: Total sectors in formatted partition: 250848
Format: Total bytes in formatted partition: 128434176
Format: Operation completed successfully.

Format of flash: complete
Router# dir
Directory of flash:/

No files in directory

128237568 bytes total (104640512 bytes free)
Router# reload
Proceed with reload? [confirm]

*Oct 17 02:37:37.127: %SYS-5-RELOAD: Reload requested  by console. Reload Reason
: Reload Command.
System Bootstrap, Version 12.3(8r)YH8, RELEASE SOFTWARE (fc2)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 2006 by cisco Systems, Inc.
C1800 platform with 131072 Kbytes of main memory with parity disabled

Upgrade ROMMON initialized
program load complete, entry point: 0x80012000, size: 0xc0c0

Initializing ATA monitor library.......
program load complete, entry point: 0x80012000, size: 0xc0c0

Initializing ATA monitor library.......

program load complete, entry point: 0x80012000, size: 0x167e724
Self decompressing the image : #################################################
################################################################################
################################################################ [OK]

Restricted Rights Legend

Use, duplication, or disclosure by the Government is
subject to restrictions as set forth in subparagraph
(c) of the Commercial Computer Software - Restricted
Rights clause at FAR sec. 52.227-19 and subparagraph
(c) (1) (ii) of the Rights in Technical Data and Computer
Software clause at DFARS sec. 252.227-7013.

cisco Systems, Inc.
           170 West Tasman Drive
           San Jose, California 95134-1706

Cisco IOS Software, C181X Software (C181X-ADVIPSERVICESK9-M), Version 12.4(24)T,
 RELEASE SOFTWARE (fc1)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2009 by Cisco Systems, Inc.
Compiled Thu 26-Feb-09 03:22 by prod_rel_team
...
Router> enable
Password:
Router# dir
Directory of flash:/

No files in directory

128237568 bytes total (104640512 bytes free)
Router# show version
Cisco IOS Software, C181X Software (C181X-ADVIPSERVICESK9-M), Version 12.4(24)T,
 RELEASE SOFTWARE (fc1)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2009 by Cisco Systems, Inc.
Compiled Thu 26-Feb-09 03:22 by prod_rel_team
...
ref: http://packetlife.net
9/12/2011

Resilent Configuration on Cisco (Part-1: Securing IOS and Configuration Files)

ဒီ featureကေတာ့ Flash ေပၚမွ boot image file ကိုေသာ္လည္းေကာင္း… NVRAM ေပၚမွ startup-config file ကိုေသာ္လည္းေကာင္း… အမွတ္မထင္ ဖ်က္မိတဲ့အခါ recoverလုပ္ဖို႔ ၄င္း file ေတြကို hidden လုပ္ေပးျခင္းျဖစ္ပါတယ္။ Boot image file ႏွင့္ startup-config file မ်ားကို resilent feature enable မလုပ္ထားတဲ့ devices ေတြမွာ dir command နဲ႔ၾကည့္ႏုိင္ပါတယ္။

Router# dir flash:
Directory of flash:/

1 -rw- 23587052 Jan 9 2010 17:16:58 +00:00 c181x-advipservicesk9-mz.124-24.T.bin
2 -rw- 600 Sep 26 2010 07:28:12 +00:00 vlan.dat

128237568 bytes total (104644608 bytes free)
Router# dir nvram:
Directory of nvram:/

189 -rw- 1396 startup-config
190 ---- 24 private-config
191 -rw- 1396 underlying-config
1 -rw- 0 ifIndex-table
2 -rw- 593 IOS-Self-Sig#3401.cer
3 ---- 32 persistent-data
4 -rw- 2945 cwmp_inventory
21 -rw- 581 IOS-Self-Sig#1.cer

196600 bytes total (130616 bytes free)

ကဲ… ေအာက္ပါ command နဲ႔ resilent feature ကို enableလုပ္ပါမယ္…

Router(config)# secure boot-image // for IOS

Router(config)#

%IOS_RESILIENCE-5-IMAGE_RESIL_ACTIVE: Successfully secured running image
Router(config)# secure boot-config // for configuration file

Router(config)#

%IOS_RESILIENCE-5-CONFIG_RESIL_ACTIVE: Successfully secured config archive [flash:.runcfg-20101017-020040.ar]

Command effectiveness ကို show secure bootset command သံုးၿပီးၾကည့္လို႔ရပါတယ္။ (bootsetဆိုတာ boot image ႏွင့္ configuration file ႏွစ္ခုကို ေပါင္းၿပီးေခၚတာျဖစ္ပါတယ္။)
Router# show secure bootset
IOS resilience router id FHK110913UQ

IOS image resilience version 12.4 activated at 02:00:30 UTC Sun Oct 17 2010
Secure archive flash:c181x-advipservicesk9-mz.124-24.T.bin type is image (elf) []
file size is 23587052 bytes, run size is 23752654 bytes
Runnable image, entry point 0x80012000, run from ram

IOS configuration resilience version 12.4 activated at 02:00:41 UTC Sun Oct 17 2010
Secure archive flash:.runcfg-20101017-020040.ar type is config
configuration archive size 1544 bytes

ေနာက္… dir command ႏွင့္ ၾကည့္ရင္လည္း မေတြ႔ရေတာ့မွာ ျဖစ္ပါတယ္…
Router# dir flash:
Directory of flash:/

2 -rw- 600 Sep 26 2010 07:28:12 +00:00 vlan.dat

128237568 bytes total (104636416 bytes free)

ref: http://packetlife.net
9/12/2011

Upgrading Cisco IOS with TFTP32

ref: searchnetworking.com and Tech Target
2/12/2011