Clone a Cisco router - best practices?

[Philipp Philippov]

Hello

Recently I had a task to clone Cisco 881 router, I mean I had to transfer a config from one 881 to another.

However, I faced some issues with this task:

SSH doesn't work after the transfer, as I understand it is required to regenerate certificates, consequently it is mandatory to activate telnet before transfer, because I didn't have console access: routers are in the datacenter

AAA wil not work, I had to delete all aaa strings from the config

IOS images should be transfered first as well ass IPS signatures

username password + service password encryption will result an impossibility to login, username secret should be used

Probably, there are even more possible problems which I don't know. How do you guys clone routers? Maybe there are some best practises?

I used TFTP for transfering config and I have a question concerning it: when I do copy tftp run it overwrites running config or append it?

Thank you in advance.

[Leo Laohoo]

SSH doesn't work after the transfer

Maybe your IOS does not support SSH.

[Philipp Philippov]

It does IOS and router itself are the same.

[Leo Laohoo]

cryp key generate rsa general-keys modulus NNN

Maybe because you won't find this in a router config you've copied from.

[mfurnival]

When working as a field engineer and swapping out a router I would always strip out all of the AAA config and just apply a simple "username cisco priv 15  password cisco" and then get the router operational. The last thing you want to be doing is trying to work out why you can't login when you are trying to restore service. Once it is up and running and you are happy with it then you can save the config.

Next you would reapply the AAA config. Assuming nothing has changed  (IP addresses, TACAC+ shared secret etc.) then it should just work. And at this point if it does lock you out you can just reboot the box because you saved the config at the point that the router was operational but before you applied the AAA config.

In order to generate the RSA key for SSH you would do "crypto key generate rsa"

Once you have SSH configured you can use TFTP / FTP / SCP to transfer any files to flash. I like to use WINSCP.

To my knowledge there is not an easy way to "clone" a router - there are always a few tasks that need doing manually.

[Philipp Philippov]

mfurnival, thank you very much for sharing your experience

During cloning where did you copy config from tftp: to running-config or startup-config?

[mfurnival]

If you were starting from a blank router (obviously with IP addresses configured for connectivity to your TFTP server) I would just do a "copy tftp run" and then do a write when you are happy with things.