Devices running Cisco IOS software maintain a running configuration that determines the configuration state of the device. Changes to the running configuration alter the behavior of the device. Because Cisco IOS software allows multiple users to change the running configuration via the device CLI (including the device console and telnet Secure Shell (SSH)), in some operating environments it would be beneficial to prevent multiple users from making concurrent changes to the Cisco IOS running configuration. Temporarily limiting access to the Cisco IOS running configuration prevents inadvertent conflicts or cases where two users attempt to configure the same portion of the running configuration.

The Exclusive Configuration Change Access feature (also called the "Configuration Lock" feature) allows you to have exclusive change access to the Cisco IOS running configuration, preventing multiple users from making concurrent configuration changes.

This feature provides exclusive change access to the Cisco IOS running configuration from the time you enter global configuration mode by using the configureterminal command. This gives the effect of a "configuration lock," preventing other users from changing the Cisco IOS running configuration. The configuration lock is automatically released when the user exits Cisco IOS configuration mode.

The Exclusive Configuration Change Access feature is enabled using the configurationmodeexclusive command in global configuration mode. Exclusive configuration change access can be set to auto, so that the Cisco IOS configuration mode is locked whenever anyone uses the configureterminal command, or it can be set to manual, so that the Cisco IOS configuration mode is locked only when the configureterminallock command is issued.

The Exclusive Configuration Change Access feature is complementary with the locking mechanism for the Configuration Replace and Configuration Rollback feature introduced in Cisco IOS Release 12.2(25)S and 12.3(7)T.

The Access Session Locking feature extends the Exclusive Configuration Change Access feature such that show and debug commands entered by the user holding the configuration lock always have execution priority. This feature prevents concurrent configuration access and also provides an option to prevent simultaneous processes, such as a show command entered by another user, from executing while other configuration commands are being executed. When this feature is enabled, the commands entered by the user with the configuration lock (such as configuration commands) always have priority over commands entered by other users.

In order to overcome the following limitations posed by the Exclusive Configuration Change Access feature, the Parser Concurrency and Locking Improvements feature was introduced in Cisco IOS Release 12.2(33)SRE:

• The Exclusive Configuration Change Access feature locks the configuration to other users. The lock is automatically released when the lock holder exits from the configuration mode. Any other user in the configuration mode will be returned to the EXEC mode when the lock is acquired. Also, any user can execute the clearconfigurationlock command and forcibly remove the lock and allow normal access to all users.
• The router can reload when multiple write processes belonging to the same client simultaneously access the Cisco IOS configurations in a shared mode.
• The router can reload when EXEC commands concurrently access the data structure.

Effective from Cisco IOS Release 12.2(33)SRE, the Concurrency and Locking Improvements feature is the primary locking mechanism used to prevent concurrent configuration of Cisco IOS software by multiple users.

The Parser Concurrency and Locking Improvements feature provides a common interface that ensures that exclusive access is granted to the requested process and prevents others from concurrently accessing the Cisco IOS configuration. It allows access only to the user holding the lock and prevents other clients from accessing the configuration.

Effective from Cisco IOS Release 12.2(33)SRE, the configurationmodeexclusive {auto | manual} command will not be available to enable single-user access functionality for the Cisco IOS CLI. Use the parsercommandserializer command to enable configuration access only to the users holding the lock and prevent other clients from accessing the configuration.

Note

Effective with Cisco IOS Release 12.2(33)SRE, the Exclusive Configuration Change Access and Access Session Locking feature is not available in Cisco IOS software. Use the Parser Concurrency and Locking Improvements feature instead of this feature. See the "Enabling Parser Concurrency and Locking Improvements" section for more information.

Perform this task to enable the Exclusive Configuration Change Access and Access Session Locking feature.

1.    enable

2.    configure terminal

3.    configuration mode exclusive {auto|manual}

4.    end

1.    enable

2.    configure terminal

3.    configure terminal lock

4.    Configure the system by entering your changes to the running configuration.

5.   Do one of the following:

Perform this task to enable configuration access only to the users holding a configuration lock and to prevent other clients from accessing the running configuration.

Note

The Parser Cconcurrency and Locking Improvements feature does not allow two or more processes to exist simultaneously within the critical section of Cisco IOS configurations. This feature flags a command to prevent its serialization if an excessive amount of time is required to generate its output or if its use produces more than 10 kilobytes of output. Examples of commands that would not be serialized are the showterminal and showrunning-config commands.

1.    enable

2.    configure terminal

3.    parser command serializer

4.    exit

1.    show configuration lock

2.    debug configuration lock

Router# show configuration lock
Parser Configure Lock
------------------------------------------------------
Owner PID                         : 3
User                              : unknown
TTY                               : 0
Type                              : EXCLUSIVE
State                             : LOCKED
Class                             : EXPOSED
Count                             : 1
Pending Requests                  : 0
User debug info                   : configure terminal 
Session idle state                : TRUE
No of exec cmds getting executed  : 0
No of exec cmds blocked           : 0
Config wait for show completion   : FALSE
Remote ip address                 : Unknown
Lock active time (in Sec)         : 6
Lock Expiration timer (in Sec)    : 593
Router(config)#

Router# debug configuration lock
 
Session1 from console
==========================
Router# configure terminal lock 
Configuration mode locked exclusively. The lock will be cleared once you exit out of configuration mode using end/exit
Enter configuration commands, one per line. End with CNTL/Z.
Router(config)#
Parser : LOCK REQUEST in EXCLUSIVE mode
Parser: <configure terminal lock> - Config. Lock requested by process <3> client <PARSER Client>
Parser: <configure terminal lock> - Config. Lock acquired successfully !
Router(config)#