topic Re: Create CLI FTW template from running config in Firewall and Security Management

Create CLI FTW template from running config

dj0Nz — Mon, 04 Dec 2017 09:36:49 GMT

Hi,

is there already a way (some kind of script or undocumented command line parameter) to create a populated config_system template file from a working configuration?

Would be fine in case of desaster recovery...

Cheers,

Michael

Re: Create CLI FTW template from running config

PhoneBoy — Tue, 05 Dec 2017 05:49:21 GMT

I am not aware of a way to do this today.

However, we are looking at ways to improve the speed at which new installations take place.

This might be a nice addition to that.

Re: Create CLI FTW template from running config

Norbert_Bohusch — Tue, 05 Dec 2017 09:27:33 GMT

Don't know if it is a feasible way for you, but ISOmorpic can create USB sticks which already have FTW configuration included and also clish-config can be supplied. This configurations can be supplied for multiple different systems which are distinguished using their management interface mac address.

In addition to that the latest CPUSE version and JUMBO can also be included and installed automatically!

Re: Create CLI FTW template from running config

dj0Nz — Tue, 05 Dec 2017 11:58:45 GMT

Thanks for your answers. I was aware of the Isomorphic solution but the needs were somewhat different here. In the meantime I solved it with a quick-and-dirty shell script which I integrated into the regularly running backup script. Pretty easy. Have a look at cptools/crftwtpl.sh at master · dj0nz/cptools · GitHub if interested...

Re: Create CLI FTW template from running config

Hugo_vd_Kooij — Tue, 05 Dec 2017 13:02:16 GMT

clish -c "show configuration" > myconfig.txt

Then just backup myconfig.txt

Re: Create CLI FTW template from running config

Hugo_vd_Kooij — Tue, 05 Dec 2017 13:13:35 GMT

And then grep a bit to know what the prime interface is and you just configure that in the first time wizard or through the isomorphic tool.

Given that most firewalls don't change interfaces that much you can update you recovery USB stick everytime you make a change.

It would mean you might automate it and just send a cab driver with a USB stick and a unit to remote location and get it up and running in no time in case of a hardware failure.

Or you might use SRAFAP. (Google won't help you here 😉 ((Students Running As Fast As Possible.))

Re: Create CLI FTW template from running config

dj0Nz — Tue, 05 Dec 2017 13:23:01 GMT

Thanks a lot. 😉 Unfortunately, recovery via USB is not an option in this case, but I already found a kind of solution (see link in my previous posting).

Re: Create CLI FTW template from running config

PhoneBoy — Tue, 05 Dec 2017 14:20:28 GMT

It turns out config_system is not the best mechanism to do what you're asking as it's not guaranteed to be compatible across versions.

That said we are working on some enhancements to CDT in the near term that should address the underlying requirement.

Watch this space: Central Deployment Tool (CDT)

Re: Create CLI FTW template from running config

dj0Nz — Tue, 05 Dec 2017 14:36:05 GMT

Thank you for that. Yes, I know CDT a bit, had a POC one or two years ago with it's predecessor (Avalon?). Great to hear it will improve. xD

Currently (with R77.30 only) config_system is perfect. We will rethink the solution if we schedule R80.x updates for that specific customer. I will keep an eye on CDT...

Re: Create CLI FTW template from running config

Vincent_Bacher — Tue, 19 Dec 2017 16:45:11 GMT

In CDT a function for backups is being integrated. As in am working with EA release I don't know if it's integrated in the current GA as well. And I did not test it yet.

Re: Create CLI FTW template from running config

PhoneBoy — Tue, 19 Dec 2017 20:30:49 GMT

It's not in the GA release, but it is expected in the near future.

Along these lines, we are developing a more rapid appliance deployment system called Blink that will image an appliance with hotfixes in 5-7 minutes time.

This will ultimately be integrated into CDT as well, but not in the coming release.

Re: Create CLI FTW template from running config

Vincent_Bacher — Tue, 19 Dec 2017 20:38:40 GMT

5-7 minutes. Really? I'm curious how that's realized and maybe I'll get the opportunity to test it someday.

Re: Create CLI FTW template from running config

PhoneBoy — Tue, 19 Dec 2017 20:46:30 GMT

Check with the same source you're getting the EA version of CDT from

Re: Create CLI FTW template from running config

Vincent_Bacher — Tue, 19 Dec 2017 21:06:57 GMT

Sure, I'll do so. Thanks a lot.

Re: Create CLI FTW template from running config

davbu — Sat, 29 Jul 2023 10:51:33 GMT

I tried this link but it's no longer available. Do you have it somewhere else? I have a similar need where I am trying to create a config from a working backup config and deploy it to a device that I need to factory reset.