Automating Backup of Config

Question

I'm looking to setup a way to backup the configuration of my C370's.  Currently I know how to do so manually through the GUI.  Is there a way to automate this and back it up through the CLI?  I was searching through the CLI yesterday but I couldn't find what the command was to save the config out.  I would assume if I could find the command I could setup a job through our Kiwi CatTools to do so.  Let me know if anyone knows how to do this or if you've found another way to do this effectively.
Thanks,
Mike

Answer 1

Hi Mike,
There are actually a couple of ways to do this.
You can backup the configuration from the CLI using the command saveconfig. You can load a configuration file using the command loadconfig. I would run those commands first just so you can see the process. Basically you can script something around these commands that would get the job done.
We also have a nice knowledgebase article that covers this subject as well. The approach is a little differnet but the results are the same.
How can I schedule or automate the backup of my appliance's XML  configuration file?  Where does it reside?  How do I do a scheduled  backup of the configuration file from a Windows system?
Environment:
- ESA with AsyncOS 6.x or later.
- A designated host for initiating and storing backups.
NOTES:
Some  familiarity with OS scripting and task scheduling is necessary to  understand and safely implement these tasks.  Please understand that  many of these concepts are outside of the scope of IronPort customer  support and these sample scripts are certainly not supported.  While  these steps have been successfully tested, this article is primarily for  demonstration and illustration purposes.
The configuration file  is dynamically generated when using the save or mail configuration tools  from the CLI or GUI.  To have an effective backup, it's best to  "unmask" the passwords, which allows the appliance to place a hashed  form of the passwords for the local administrative accounts in the  configuration file.  For this reason, we can not simply copy a flat  "running configuration" file from the device.  This method allows us to  first access the appliance, issue a command to dynamically build the  current configuration,  and either save or mail a copy of this file  somewhere remotely, without any user intervention.  Once this is  accomplished, we can then repeat or schedule this task to occur on a  regular basis.
To quickly and automatically backup configuration files with passwords unmasked:
1)  Generate an SSH keypair to use.  Verify that you can access your  appliance via SSH without having to manually enter a password.  Details  on this operation can be found in KB article #283.
2) Create  script to login to the appliance, save the config, and copy it (or mail  it).  Two such simple examples written in BASH:
Example #1: Saving the configuration to a specified host
#! /bin/bash
# this saves the config and then copies it locally via SCP to a directory called ironport/config-backups
HOSTNAME=test.com
USERNAME=admin
FILENAME=`ssh $USERNAME@$HOSTNAME "saveconfig yes" | grep xml | cut -f 3 -d " "`
scp $USERNAME@$HOSTNAME:./configuration/$FILENAME./ironport/config-backups/.
Example #2: Emailing the configuration to an email address
#! /bin/bash
# this mails the config to MAILDEST
HOSTNAME=mx.test.com
USERNAME=admin
[email protected]
ssh $USERNAME@$HOSTNAME 'mailconfig $MAILDEST yes'
NOTE: that similar logic can be applied in any OS scripting language  such as VB or batch scripts for Windows.  These scripts are intended as  rudimentary examples only.
3) Use cron or AT or similar scheduling  tool to kick off the job regularly.  Services like cron or Windows task  scheduler are easy tools that can be used to automate simple jobs like  this.  For instance, the *NIX CRON config file typically follows this  format:
minute (0-59), hour (0-23, 0 = midnight), day (1-31), month (1-12), weekday (0-6, 0 = Sunday), command
So a good example entry to run this script every day at 2:00 AM would look like:
00 02 * * * /location/your_script.sh
Alternatively, here is another method of automating a configuration backup.
How do I do a scheduled backup of the configuration file from a Windows system?
With the following procedure, you can backup the configuration file regularly from a Windows system.
1.  Install the terminal emulator "putty" under C:\
2.  Create a text file with following line and name it "send_config.txt" and place it under C:\ (Change the [email protected] to the email address you would like configuration file to be sent to)
mailconfig [email protected]
3.  Create a text file with following lines and name it "send_config_batch.bat" and place it under C:\
(Change  the "hostname" to the resolvable hostname or the IP address of your  appliance and the "password" to your actual password for admin account.)
C:\putty.exe -ssh hostname -l admin -pw password -m C:\send_config.txt
exit
4.  Add the "send_config_batch.bat" to the Windows' scheduled task.
The Configuration file will be sent to the address specified in the "send_config.txt".
Hope this helps!
Christopher C Smith
CSE
Cisco IronPort Customer Support