copy old_config_url startup-config

It's important that you do not save the running configuration to the startup configuration using write memory ; this command will overwrite your backup configuration.

copy old_config_url startup-config

It's important that you do not save the running configuration to the startup configuration using write memory ; this command will overwrite your backup configuration.

downgrade [/noconfirm] old_image_url old_config_url [activation-key old_key]

The /noconfirm option downgrades without prompting. The image_url is the path to the old image on disk0, disk1, tftp, ftp, or smb. The old_config_url is the path to the saved, pre-migration configuration. If you need to revert to a pre-8.3 activation key, then you can enter the old activation key.

dir [disk0: | disk1:]

Enter disk0: for the internal flash memory. The disk1: keyword represents the external flash memory. The internal flash memory is the default.

show file information [path:/]filename

The file size listed is for example only.

The default path is the root directory of the internal flash memory (disk0:/).

delete disk0: filename

By default, the file is deleted from the current working directory if you do not specify a path. You may use wildcards when deleting files. You are prompted with the filename to delete, and then you must confirm the deletion.

rommon #1> erase [disk0: | disk1: | flash:]

• Copy from a TFTP server:

  copy [/noconfirm] [interface_name] tftp://server[/path]/src_filename {disk0|disk1}:/[path/]dest_filename

  Example:

  
  ciscoasa# copy tftp://10.1.1.67/files/context1.cfg disk0:/context1.cfg
  
  Address or name of remote host [10.1.1.67]?
  
  Source filename [files/context1.cfg]?
  
  Destination filename [context1.cfg]?
  Cryptochecksum: db8ba196 9ad189a8 7f5f501f 1bec469b
  !!!!!!!!!!!
  11143 bytes copied in 5.710 secs (2228 bytes/sec)
  
  

• Copy from an FTP server:

  copy [/noconfirm] [interface_name] ftp://[user[:password]@]server[/path]/src_filename {disk0|disk1}:/[path/]dest_filename

  Example:

  
  ciscoasa# copy ftp://jcrichton:aeryn@10.1.1.67/files/context1.cfg disk0:/contexts/context1.cfg
  
  Address or name of remote host [10.1.1.67]?
  
  Source username [jcrichton]?
  
  Source password [aeryn]?
  
  Source filename [files/context1.cfg]?
  
  Destination filename [contexts/context1.cfg]?
  Cryptochecksum: db8ba196 9ad189a8 7f5f501f 1bec469b
  !!!!!!!!!!!
  11143 bytes copied in 5.710 secs (2228 bytes/sec)
  
  

• Copy from an HTTP(S) server:

  copy [/noconfirm] [interface_name] http[s]://[user[:password]@]server[:port][/path]/src_filename {disk0|disk1}:/[path/]dest_filename

  Example:

  
  ciscoasa# copy https://asun:john@10.1.1.67/files/moya.cfg disk0:/contexts/moya.cfg
  
  Address or name of remote host [10.1.1.67]?
  
  Source username [asun]?
  
  Source password [john]?
  
  Source filename [files/moya.cfg]?
  
  Destination filename [contexts/moya.cfg]?
  Cryptochecksum: db8ba196 9ad189a8 7f5f501f 1bec469b
  !!!!!!!!!!!
  11143 bytes copied in 5.710 secs (2228 bytes/sec)
  
  

• Copy from an SMB server:

  copy [/noconfirm] [interface_name] smb://[user[:password]@]server[/path]/src_filename {disk0|disk1}:/[path/]dest_filename

  Example:

  
  ciscoasa# copy /noconfirm smb://chiana:dargo@10.1.1.67/test.xml disk0:/test.xml
  
  Cryptochecksum: db8ba196 9ad189a8 7f5f501f 1bec469b
  !!!!!!!!!!!
  11143 bytes copied in 5.710 secs (2228 bytes/sec)
  
  

• Copy from a SCP server:

  The ;int=interface option bypasses the route lookup and always uses the specified interface to reach the SCP server.

  copy [/noconfirm] [interface_name] scp://[user[:password]@]server[/path]/src_filename[;int=interface_name] {disk0|disk1}:/[path/]dest_filename

  Example:

  
  ciscoasa# copy scp://pilot@10.86.94.170/test.cfg disk0:/test.cfg
  
  Address or name of remote host [10.86.94.170]?
  
  Source username [pilot]?
  
  Destination filename [test.cfg]?
  
  The authenticity of host '10.86.94.170 (10.86.94.170)' can't be established.
  RSA key fingerprint is <65:d9:9d:fe:1a:bc:61:aa:64:9d:fc:ee:99:87:38:df:a8:8e:d9:e9:ff:42:de:e8:8d:2d:bf:a9:2b:85:2e:19>(SHA256).
  Are you sure you want to continue connecting (yes/no)? yes
  
  Please use the following commands to add the hash key to the configuration:
    ssh pubkey-chain
      server 10.86.94.170
        key-hash sha256 65:d9:9d:fe:1a:bc:61:aa:64:9d:fc:ee:99:87:38:df:a8:8e:d9:e9:ff:42:de:e8:8d:2d:bf:a9:2b:85:2e:19
  
  
  Password: <type in password>
  !!!!!!
  6006 bytes copied in 8.160 secs (750 bytes/sec)
  
  

• Copy from a TFTP server:

  copy [/noconfirm] [interface_name] tftp://server[/path]/src_filename {startup-config | running-config}

  Example:

  
  ciscoasa# copy tftp://10.1.1.67/files/old-running.cfg running-config
  
  

• Copy from an FTP server:

  copy [/noconfirm] [interface_name] ftp://[user[:password]@]server[/path]/src_filename {startup-config | running-config}

  Example:

  
  ciscoasa# copy ftp://jcrichton:aeryn@10.1.1.67/files/old-startup.cfg startup-config
  
  

• Copy from an HTTP(S) server:

  copy [/noconfirm] [interface_name] http[s]://[user[:password]@]server[:port][/path]/src_filename {startup-config | running-config}

  Example:

  
  ciscoasa# copy https://asun:john@10.1.1.67/files/new-running.cfg running-config
  
  

• Copy from an SMB server:

  copy [/noconfirm] [interface_name] smb://[user[:password]@]server[/path]/src_filename {startup-config | running-config}

  Example:

  
  ciscoasa# copy /noconfirm smb://chiana:dargo@10.1.1.67/new-running.cfg running-config
  
  

• Copy from a SCP server:

  copy [/noconfirm] [interface_name] scp://[user[:password]@]server[/path]/src_filename[;int=interface_name] {startup-config | running-config}

  Example:

  
  ciscoasa# copy scp://pilot:moya@10.86.94.170/new-startup.cfg startup-config
  
  

  The ;int=interface option bypasses the route lookup and always uses the specified interface to reach the SCP server.

• Copy to a TFTP server:

  copy [/noconfirm] [interface_name] {startup-config | running-config} tftp://server[/path]/dst_filename

  Example:

  
  ciscoasa# copy running-config tftp://10.1.1.67/files/new-running.cfg
  
  

• Copy to an FTP server:

  copy [/noconfirm] [interface_name] {startup-config | running-config} ftp://[user[:password]@]server[/path]/dst_filename

  Example:

  
  ciscoasa# copy startup-config ftp://jcrichton:aeryn@10.1.1.67/files/new-startup.cfg
  
  

• Copy to an SMB server:

  copy [/noconfirm] [interface_name] {startup-config | running-config} smb://[user[:password]@]server[/path]/dst_filename

  Example:

  
  ciscoasa# copy /noconfirm running-config smb://chiana:dargo@10.1.1.67/new-running.cfg
  
  

• Copy to a SCP server:

  copy [/noconfirm] [interface_name] {startup-config | running-config} scp://[user[:password]@]server[/path]/dst_filename[;int=interface_name]

  Example:

  
  ciscoasa# copy startup-config
  scp://pilot:moya@10.86.94.170/new-startup.cfg
  
  

  The ;int=interface option bypasses the route lookup and always uses the specified interface to reach the SCP server.

• Copy to the local flash memory:

  copy [/noconfirm] {startup-config | running-config} {disk0|disk1}:/[path/]dst_filename

  Example:

  
  ciscoasa# copy /noconfirm running-config disk0:/new-running.cfg
  
  

  Be sure that the destination directory exists. If it does not exist, first create the directory using the mkdir command.

• Copy from flash to a TFTP server:

  copy [/noconfirm] [interface_name] {disk0|disk1}:/[path/]src_filename tftp://server[/path]/dst_filename

  Example:

  
  ciscoasa# copy disk0:/asa-os.bin tftp://10.1.1.67/files/asa-os.bin
  
  

• Copy from flash to an FTP server:

  copy [/noconfirm] [interface_name] {disk0|disk1}:/[path/]src_filename ftp://[user[:password]@]server[/path]/dst_filename

  Example:

  
  ciscoasa# copy disk0:/asa-os.bin ftp://jcrichton:aeryn@10.1.1.67/files/asa-os.bin
  
  

• Copy from flash to an SMB server:

  copy [/noconfirm] [interface_name] {disk0|disk1}:/[path/]src_filename smb://[user[:password]@]server[/path]/dst_filename

  Example:

  
  ciscoasa# copy /noconfirm copy disk0:/asdm.bin
  smb://chiana:dargo@10.1.1.67/asdm.bin
  
  

• Copy from flash to SCP server:

  copy [/noconfirm] [interface_name] {disk0|disk1}:/[path/]src_filename scp://[user[:password]@]server[/path]/dst_filename[;int=interface_name]

  Example:

  
  ciscoasa# copy disk0:/context1.cfg
  scp://pilot:moya@10.86.94.170/context1.cfg
  
  

  The ;int=interface option bypasses the route lookup and always uses the specified interface to reach the SCP server.

• Copy from flash to the local flash memory:

  copy [/noconfirm] {disk0|disk1}:/[path/]src_filename {disk0|disk1}:/[path/]dst_filename

  Example:

  
  ciscoasa# copy /noconfirm disk1:/file1.cfg disk0:/file1.cfgnew-running.cfg
  
  

  Be sure that the destination directory exists. If it does not exist, first create the directory using the mkdir command.

 
ciscoasa/contexta# copy running-config startup-config

ciscoasa/contexta# copy running-config tftp:/server[/path]/filename

more system:running-config

 
ciscoasa # show import webvpn plug-in
ica
rdp
ssh, telnet
vnc
 

 
ciscoasa # export webvpn plug-in protocol rdp tftp://tftpserver/backupfilename

auto-update server url [source interface] [verify-certificate | no-verification]

where url has the following syntax:

http [s ]:// [user:password@ ]server_ip [:port ]/pathname

The source interface keyword and argument specify which interface to use when sending requests to the Auto Update Server. If you specify the same interface specified by the management-access command, the Auto Update requests travel over the same IPsec VPN tunnel used for management access.

For HTTPS, the verify-certificate keyword (the default) verifies the certificate returned by the Auto Update Server. To disable verification (not recommended), specify the no-verification keyword.

auto-update device-id {hardware-serial | hostname | ipaddress [if-name] | mac-address [if-name] | string text}

The identifier used is determined by specifying one of the following parameters:

• The hardware-serial argument specifies the ASA serial number.

• The hostname argument specifies the ASA hostname.

• The ipaddress keyword specifies the IP address of the specified interface. If the interface name is not specified, it uses the IP address of the interface used to communicate with the Auto Update Server.

• The mac-address keyword specifies the MAC address of the specified interface. If the interface name is not specified, it uses the MAC address of the interface used to communicate with the Auto Update Server.

• The string keyword specifies the specified text identifier, which cannot include white space or the characters ‘, “, , >, & and ?.

auto-update poll-period poll-period [retry-count [retry-period]]

The poll-period argument specifies how often (in minutes) to check for an update. The default is 720 minutes (12 hours).

The retry-count argument specifies how many times to try reconnecting to the server if the first attempt fails. The default is zero.

The retry-period argument specifies how long to wait (in minutes) between retries. The default is five minutes.

auto-update poll-at days-of-the-week time [randomize minutes ] [retry_count [retry_period ]]

The days-of-the-week argument is any single day or combination of days: Monday, Tuesday, Wednesday, Thursday, Friday, Saturday, and Sunday. Other possible values are daily (Monday through Sunday), weekdays (Monday through Friday), and weekends (Saturday and Sunday).

The time argument specifies the time in the format HH:MM at which to start the poll. For example, 8:00 is 8:00 a.m. and 20:00 is 8:00 p.m.

The randomize minutes keyword and argument specify the period to randomize the poll time following the specified start time. The range is from 1 to 1439 minutes.

The retry_count argument specifies how many times to try reconnecting to the Auto Update Server if the first attempt fails. The default is zero.

The retry_period argument specifies how long to wait between connection attempts. The default is five minutes. The range is from 1 to 35791 minutes.

auto-update timeout period

The period argument specifies the timeout period in minutes between 1 and 35791. The default is to never time out (zero minutes). To restore the default, enter the no form of this command.

Use the auto-update timeout command to be sure that the ASA has the most recent image and configuration. This condition is reported with system log message 201008.

ciscoasa(config)# client-update enable

client-update {component {asdm | image} | device-id dev_string | 
family family_name | type type} url url-string rev-nums rev-nums}

The component {asdm | image} parameter specifies the software component, either ASDM or the boot image of the ASA.

The device-id dev_string parameter specifies a unique string that the Auto Update client uses to identify itself. The maximum length is 63 characters.

The family family_name parameter specifies the family name that the Auto Update client uses to identify itself. It can be asa, pix, or a text string with a maximum length of seven characters.

The rev-nums rev-nums parameter specifies the software or firmware images for this client. Enter up to four, in any order, separated by commas.

The type type parameter specifies the type of clients to notify of a client update. Because this command is also used to update Windows clients, the list of clients includes several Windows operating systems.

The url url-string parameter specifies the URL for the software/firmware image. This URL must point to a file appropriate for this client. For all Auto Update clients, you must use the protocol “http://” or “https://” as the prefix for the URL.

Configure the parameters for the client update that you want to apply to all ASAs of a particular type. That is, specify the type of ASA and the URL or IP address from which to get the updated image. In addition, you must specify a revision number. If the revision number of the remote ASA matches one of the specified revision numbers, there is no need to update the client, and the update is ignored.

To configure a client update for ASA 5525-Xs, enter the following command:

ciscoasa(config)# client-update type asa5525 component asdm url 
http://192.168.1.114/aus/asdm710.bin rev-nums 9.10(1)