Using expect scripts to backup your Cisco configuration

Something else available in Debian’s repositories is RANCID, which does the above without TFTP,
works with more than just IOS [eg HP Procurve, Juniper, …] and stores the configs in SVN, so you
get an email summary with config changes in every time it runs.

rancid script to download router (or switch) config:

$ROUTERS = “r1 r2 r3″
D=”`date +%Y%m%d%H%M`”

function getRouterConfig {
(clogin -c “show run” $1) > “configs/$D/$1”
echo “$1 got conf”
(clogin -c “show tech” $1) > “configs/$D/$1.showtech”
echo “$1 got show tech”
}

mkdir -p “configs/$D”
for R in $ROUTERS; do
getRouterConfig $R &
done

The advantage of getting “show tech” too is that you have everything you need in case of failure : what serialnumbers of equipment failed, what the error counters are (and how they were historically), …

The problem is the 15 logins vty limit. Clogin will make sure it actually does the logout, but if you’re over the limit, you’re thoroughly fucked.

Can you use if statements with expect scripting, for example when you do a “show interface description” on a cisco, you need to page through the output until it has completed. So the script would have to search for “–More—“ ; then send a space bar character?

Thanks Tom, that works a treat.

However, as this script will be running on several devices I am not sure how much paging or “\n” will be needed. Hence, I was hoping to do some kind of while loop for example: –

send “show interface description”

while (match = –More–) {
send “\n”
}

This would then allow me to move onto the next command and complete a network audit of sorts :-).

Do you think that expect performs conditional checks like this?

Hi,

you don’t need to mess around with expect to filter for –More– from the output of a “show run” or “show tech” command.

You just need to send a “term length 0” to the Cisco IOS device before sending your various show commands. This command disables paging for the whole time of your session.

Cheers
Zalph.

I followed your instructions but when I run the script, I get the following error.

wrong # args: should be “set varName ?newValue?”
while executing
“set device 192.168.1.1 # cisco device”
(file “./getConfig” line 7)

@tzh
delete comments on the set variable lines

this:
set device 192.168.0.100 # cisco device
in
set device 192.168.0.100

hey tom…
do you have any script that will allow uploading cisco configuration backup from linux directly to router?

Turning off password encryption will not decrypt your password, it will simple not encrypt newly configured password. “sh run” should contain encrypted passwords, on routers and switches at least, which can be copied back just fine to restore a config. No need to know the password if you just need to restore the config.

What may be an issue is that in default config interfaces are shutdown, which is normally the case when replacing hardware during outages. But hey that’s common knowledge, right?

When backing up firewalls you can use other commands to see the _full_ configuration (hint hint…). 😉

First of all, Thank you for this script. I have never even looked at an expect script before, and this made it easy to understand what is going on.

I have found that the comments in the configuration break the script with the version of Expect on OS X.

I have modified the script to work with SSH, as I do not use Telnet on my router.

Again, Thank you for this wonderful script.. I probably would not have figured out so easily without your help, and now Im not afraid of Expect scripts 🙂

–Brian

#!/usr/bin/expect

## TomDV
## http://blog.penumbra.be/2010/02/expect-scripts-backup-cisco-config/
##
## Modified for SSH support by Brian Cooney

# —————- configuration —————- #
set device 10.20.3.1
set tftp 10.20.3.107
set user UserNameHere
set pass PasswordHere
set config rt-HOSTNAME-confg
set timeout 60

# ————– do not edit below ————– #
spawn ssh $user@$device
expect “Password:”
send “$pass\n”
expect “>”
send “en\n”
expect “Password:”
send “$pass\n”

send “copy running-config tftp://$tftp/$config\n\n\n”
expect “$tftp”
send “\n”
expect “$config”
send “\n”
send “exit\n”

————–
E.g.:
expect “–More–”
send “\n”

This will send a new line if it comes across “–More–“.
——————-
See CLI command
terminal length 0