Resilent Configuration on Cisco (Part-1: Securing IOS and Configuration Files)

ဒီ featureကေတာ့ Flash ေပၚမွ boot image file ကိုေသာ္လည္းေကာင္း… NVRAM ေပၚမွ startup-config file ကိုေသာ္လည္းေကာင္း… အမွတ္မထင္ ဖ်က္မိတဲ့အခါ recoverလုပ္ဖို႔ ၄င္း file ေတြကို hidden လုပ္ေပးျခင္းျဖစ္ပါတယ္။ Boot image file ႏွင့္ startup-config file မ်ားကို resilent feature enable မလုပ္ထားတဲ့ devices ေတြမွာ dir command နဲ႔ၾကည့္ႏုိင္ပါတယ္။

Router# dir flash:
Directory of flash:/

1 -rw- 23587052 Jan 9 2010 17:16:58 +00:00 c181x-advipservicesk9-mz.124-24.T.bin
2 -rw- 600 Sep 26 2010 07:28:12 +00:00 vlan.dat

128237568 bytes total (104644608 bytes free)
Router# dir nvram:
Directory of nvram:/

189 -rw- 1396 startup-config
190 ---- 24 private-config
191 -rw- 1396 underlying-config
1 -rw- 0 ifIndex-table
2 -rw- 593 IOS-Self-Sig#3401.cer
3 ---- 32 persistent-data
4 -rw- 2945 cwmp_inventory
21 -rw- 581 IOS-Self-Sig#1.cer

196600 bytes total (130616 bytes free)

ကဲ… ေအာက္ပါ command နဲ႔ resilent feature ကို enableလုပ္ပါမယ္…

Router(config)# secure boot-image // for IOS

Router(config)#

%IOS_RESILIENCE-5-IMAGE_RESIL_ACTIVE: Successfully secured running image
Router(config)# secure boot-config // for configuration file

Router(config)#

%IOS_RESILIENCE-5-CONFIG_RESIL_ACTIVE: Successfully secured config archive [flash:.runcfg-20101017-020040.ar]

Command effectiveness ကို show secure bootset command သံုးၿပီးၾကည့္လို႔ရပါတယ္။ (bootsetဆိုတာ boot image ႏွင့္ configuration file ႏွစ္ခုကို ေပါင္းၿပီးေခၚတာျဖစ္ပါတယ္။)
Router# show secure bootset
IOS resilience router id FHK110913UQ

IOS image resilience version 12.4 activated at 02:00:30 UTC Sun Oct 17 2010
Secure archive flash:c181x-advipservicesk9-mz.124-24.T.bin type is image (elf) []
file size is 23587052 bytes, run size is 23752654 bytes
Runnable image, entry point 0x80012000, run from ram

IOS configuration resilience version 12.4 activated at 02:00:41 UTC Sun Oct 17 2010
Secure archive flash:.runcfg-20101017-020040.ar type is config
configuration archive size 1544 bytes

ေနာက္… dir command ႏွင့္ ၾကည့္ရင္လည္း မေတြ႔ရေတာ့မွာ ျဖစ္ပါတယ္…
Router# dir flash:
Directory of flash:/

2 -rw- 600 Sep 26 2010 07:28:12 +00:00 vlan.dat

128237568 bytes total (104636416 bytes free)

ref: http://packetlife.net
9/12/2011