Can password and key in backup restore on new switch?

[pcon]

Hi All

New in community have a question about backup and restore.

During failed switch replacement can the hashed password & key restored automatically from backup config or they need configure separately? Eg. bgp passwd, ntp key, user passwd..

Thanks.

Regards

Paul

[Devaa]

Copy paste from backup config file. It will work. 

[pcon]

Thanks!, I assume I can copy the backup as startup config and it would be OK too?

[Devaa]

Yes, that will also work.

Method 1:

You can do the normal copy paste from backup startup config file via device console, but it may take some time. 

Method 2: 

Use copy command with scp / ftp/ tftp to backup in some server or laptop or pendrive. Then while restoring, you can do some basic config via console to bring the switch / router reachable in network and then use copy command with scp / ftp/ tftp to restore. 

To Backup:

# copy startup-config scp:

To Restore:

# copy scp: startup-config

[Karsten Iwen]

There is more to this problem. If you use password encryption, you must first supply the encryption key to the system.

Look out for type 6 passwords or the command "password encryption aes" in your config. In this case, you need the original "key config-key password-encryption MASTER-KEY" to make these passwords work again.

[Devaa]

Thanks @Karsten Iwen That's also one case to lookup

@pcon check if you have any type 6 password or any other corner case of encryption involved in config. Refer this doc for more info. 

show running-config | include _6_
show running-config | include pass

[pcon]

Thanks Karsten and Devaa! I checked the config, it only have service password-enc, but no password enc aes. Password encr found is

user secret 9, radius key 7 and bgp password 7. So based on the ref it should be ok to copy them across device. right?

Thanks.

[Karsten Iwen · Accepted solution]

Yes, these can be copied to the new device.

[Devaa]

Yes, it should be all good as I mentioned before. You can just copy paste method via console or scp way as I mentioned in the past comment.