I recently ran into a telnet, console, and enable password issue that was unexpected and I am hoping someone can explain what happened.
I had two working Cisco ASA 5505's that were two end-points of a Site-to-Site VPN. I had used the ASDM file management tools to copy disk0 startup-config.cfg to a file named old-startup-config.cfg on disk0, on both ASA systems, and I wanted those two files to function as good working startup-config backups that I could return to, right there on the firewall, if I had to. I also used the ASDM file management tools to make configuration "zip" backups to my local computer. I am aware that the actual startup-config file is some type of hidden file.
I had made some changes to both Cisco ASA 5505s, but no password changes, and everything was working great and was reloading great. Then, I suddenly found that I needed to revert back to the old working configurations that I had backed up previously. I used the ASDM file management tools to copy old-startup-config.cfg back to startup-config.cfg on disk0 on both machines. I think I may have also issued the CLI command copy old-startup-config.cfg startup-config. I asked both systems to reload without writing the running-config's to memory.
When the systems reloaded, the console, telnet, and enable passwords were no longer recognized on the CLI and Web interface. The interfaces loaded normally, but the passwords didn't work and the cisco default passwords didn't work either. I had to go to each unit's physical location and perform a power cycle and console password recovery.
I am not sure why that happened. Is the startup-config.cfg file on disk0 an altered version of the actual startup-config configuration with missing or encrypted password credentials? I would have never guessed in a million years that my procedure would have knocked out the enable password.
Instead of copy startup-config.cfg old-startup-config.cfg, should I have issued the command copy startup-config old-startup-config.cfg to make a local backup of a working configuration?
I have one more semi-related question. If one uses ASDM file management to create a zip backup of a startup-config or running-config and then proceeds to restore a running-config, when does the restored running-config take effect?
This event continues the conversation of our recent Community Ask Me Anything event "Secure Remote Workers".
To participate in this event, please use the button to ask your questions
Here’s your ch...
User Experience Enhancements
As part of the Cisco Common User Experience program, we are working towards a more uniform user experience and terminology alignment. This program runs across all Cisco security products.
Early Access introduces a...
This video features a step by step walk through of configuring Cisco AnyConnect on FTD managed by FMC. Timestamps included for certificate installation, Access Control, Licensing, NAT, and Deployment failures.
I am trying to solve a CSR signing issue in a home lab.Can someone clarify this theoretical point? According to Wikipedia: "Before creating a CSR, the applicant first generates a key pair, keeping the private key secret. The...
Threat Response integrates with Cisco's Web Security Appliance (WSA) to provide visibility into web-bourne threats. By adding a Web Security or SMA Web module to Threat Response, investigators will be able to search for domains, URLs, and file hashes th...