Solved

Removing multiple configuration entries from a Cisco ASA

Posted on 2013-01-29
8
461 Views
Last Modified: 2013-02-06
Hi,

I have 50,000 lines of configuration that needs removing from a live ASA5505.

The lines are objects and look like this...

object network India1
subnet 1.6.0.0 255.254.0.0
object network India2
subnet 1.22.0.0 255.254.0.0
object network India3
subnet 1.38.0.0 255.254.0.0
object network India4
subnet 1.186.0.0 255.255.0.0
object network India5
subnet 1.187.0.0 255.255.0.0
object network India6
subnet 14.96.0.0 255.252.0.0
object network India7
subnet 14.102.0.0 255.255.128.0

...etc.

Obviously I could enter in command line each line...

no object network India1
no object network India2
no object network India3

... but that is quite long winded.

If I copy from a TFTP server to the startup-config and then to the running-config I think the config will merge meaning the entries will still exist.

There must be a simple and quick way of doing this.  Any ideas?

Thanks
0
Comment
Question by:SWCG
8 Comments
 
LVL 8

Expert Comment

by:R_Edwards
ID: 38831827
copy start run, acts more like a copy & paste operation: the contents of the startup configuration are processed as though they were issued via the CLI. This means that running configuration lines that aren't in the startup configuration won't be overwritten or removed. The result is usually a messy, incomplete configuration.

try this instead:
configure replace nvram:startup-config

Router# configure replace nvram:startup-config
This will apply all necessary additions and deletions
to replace the current running configuration with the
contents of the specified configuration file, which is
assumed to be a complete configuration, not a partial
configuration. Enter Y if you are sure you want to proceed. ? [no]: y


Links:
http://www.cisco.com/en/US/docs/ios/12_3t/12_3t7/feature/guide/gtrollbk.html
https://supportforums.cisco.com/docs/DOC-5820

good luck,
-=Richard
0
 
LVL 20

Accepted Solution

by:
rauenpc earned 500 total points
ID: 38832065
I'm not sure if the "config replace" command is available on an ASA, but if it's not, here's what I would do.

I ALL the object groups are named the same except the incrementing number, create a spreadsheet with the following columns. Quotes aren't needed in the cells themselves, I'm just using them to separate columns and to emphasize where spaces are.

"no ","object network India","1"

The space after "no " is important. From there it's just a fill down function to increase the number on each line but keep the text the same. Once all filled in, I would copy/paste to notepad, remove the tabs caused by the spreadsheet, and now you can copy paste the whole thing in to the ASA.

If the objects aren't all the same, do a "show run | inc object network". From there you would have to weed out what you still want. Using the filtered list in notepad, you can do a replace of "object " with "no object " and now you can copy/paste to the ASA.
0
 
LVL 8

Expert Comment

by:R_Edwards
ID: 38832256
I just checked on my asa and you are correct it does not work.  are you using ASDM?  with that you can just right click on objects and delerte.  i realize that command line is best, but the GUI ccan come in handy every  once in a while.
0
 
LVL 17

Expert Comment

by:rochey2009
ID: 38833034
Hi,

Copy the lines into notepad and use find and replace. Find the word object and replace it with no object. When you're happy that its correct, copy and paste it back to the asa.
0
PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

 
LVL 1

Author Comment

by:SWCG
ID: 38850635
Hi,

The 'excel' method and 'notepad find and replace' method are the usual techniques I would use.  However, this is 50,000 lines of config.  I am not comfortable pasting in such large amounts from the clipboard via ssh.  This has been known to miss bits out and still need entering in smaller chunks.

There must be a way to copy the config over to the running-config without merging or restarting.

It's a shame config replace is reported as not working.

None of the above ideas are accepted as solutions yet, so further ideas are welcome.

Thanks
0
 
LVL 8

Expert Comment

by:R_Edwards
ID: 38850990
SWCG,
     Do you have a config that has all the items removed?

can you afford downtime?  if so shut down the appliance, remove the CF card place in to a reader on your PC/MAC, rename the config to config.old place the new config into the CF start the ASA back up.  it should take the config and you are good to go, if not you can replace the config
0
 
LVL 1

Author Comment

by:SWCG
ID: 38851720
To clarify...

I can not have downtime
I won't use copy and paste in CLI
I won't individually remove each object in ASDM
I can mass change the config in anyway using excel

I need to find a way to remove these lines of config abiding to the above constraints.

There must be a way to do this...
0
 
LVL 1

Author Closing Comment

by:SWCG
ID: 38860239
This is the solution I used.  It was the best method suggested.  Although, it was not quite what I was looking for as it took a good 45 minutes to implement.  Thanks for your help.
0

Featured Post

Control application downtime with dependency maps

Visualize the interdependencies between application components better with Applications Manager's automated application discovery and dependency mapping feature. Resolve performance issues faster by quickly isolating problematic components.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Quality settings for cisco routers 8 52
traffic flow without STP 9 45
Cisco ACS 5.4 "management" proc stuck in Restarting 2 33
Possible RST Flood on IF X0 Sonicwall 6 131
Cisco Pix/ASA hairpinning The term, hairpinning, comes from the fact that the traffic comes from one source into a router or similar device, makes a U-turn, and goes back the same way it came. Visualize this and you will see something that looks …
I recently attended Cisco Live! in Las Vegas, a conference that boasted over 28,000 techies in attendance, and a week of hands-on learning hosted by a solid partner with which Concerto goes to market.  Every year, Cisco displays cutting-edge technol…
This is a video that shows how the OnPage alerts system integrates into ConnectWise, how a trigger is set, how a page is sent via the trigger, and how the SENT, DELIVERED, READ & REPLIED receipts get entered into the internal tab of the ConnectWise …
The Email Laundry PDF encryption service allows companies to send confidential encrypted  emails to anybody. The PDF document can also contain attachments that are embedded in the encrypted PDF. The password is randomly generated by The Email Laundr…

932 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

9 Experts available now in Live!

Get 1:1 Help Now