Cisco ASA Multiple Context backup with NCM 7.2.2 (What has changed?)

jvoisin

I am having an issue with the new NCM 7.2.2 in that I am unable to continue to download firewall configurations form my ASA 5585 Firewalls.  I am running multiple contexts and it has been working fine until I upgraded to 7.2.2 (and discovered it's a web console now)

in NCM when I try and do a download of config, it only shows Config types "Running" and "Startup"

Before upgrading I had the options for the contexts when connecting to the management interface of the firewall.. (admin context)

(I was on a very old release so had to go to 7.1 and then 7.2.2 if that matters..

I have the same Config.Mgmt.Commands file as before:

"Cisco ASA 8.4 Multi Context-1.3.6.1.4.1.9.1.669.ConfigMgmt-Commands"

<!--Multi Context Download tool for Meridian ASA 5585X Firewalls--> <!--Apply this to the Admin Context only.  Do not download direct from other contexts as they are SNMP only--> <Configuration-Management Device="Cisco ASA5585 Multi Context" SystemOID=" 1.3.6.1.4.1.9.1.669">     <Commands>         <Command Name="Reset" Value="terminal pager 0${CRLF} ${ConfigType}" RegEx="#"/>         <Command Name="Context-prod" Value="changeto context prod"/>         <Command Name="Context-qadev" Value="changeto context qadev"/>         <Command Name="Context-int" Value="changeto context int"/>         <Command Name="Context-corporate" Value="changeto context corporate"/>         <Command Name="Context-system" Value="changeto context system"/>         <Command Name="DownloadConfig" Value="show running-config"/>         <Command Name="Reboot" Value="reload noconfirm"/>         <Command Name="EnterConfigMode" Value="config terminal"/>         <Command Name="ExitConfigMode" Value="quit"/>         <Command Name="Startup" Value="startup"/>         <Command Name="Running" Value="running"/>         <Command Name="UploadConfig" Value="${EnterConfigMode}${CRLF}${ConfigText}${CRLF}${ExitConfigMode}"/>         <Command Name="DownloadConfigIndirect" Value="write net ${StorageAddress}:/${StorageFilename}"/>         <Command Name="UploadConfigIndirect"/>         <Command Name="EraseConfig" Value="write erase${CRLF}Yes"/>         <Command Name="SaveConfig" Value="write memory"/>         <Command Name="Version" Value="show version"/>     </Commands> </Configuration-Management>

noobes

Hi jvoisin. Firstly I am sorry but I don't have any help for you regarding the issues you've had since upgrading to 7.2.2. We are upgrading to that soon so will probably share your pain then! I have a question though I would like to ask you if you'd give it a minute....

I am trying to set up our NCM to automate the back up of config on multi context firewalls. Thus far we have always used the "Auto determine" option when choosing which device template to use for a node, however we are now trying to automate back ups of multi context firewalls. I understand the idea of the device templates, there's a good article here: Orion NCM - How to Extend Device Support 101

What it fails to explain is how NCM actually uses the commands. I can see from your template that you've provided a set of instructions such as <Command Name="Context-system" Value="changeto context system"/> this particular command is of course of interest to me. But what I need to know is how does NCM know in what sequence to run the commands?

For example I want to download the System, Admin and firewall context on the one firewall, so what I want to do is the following;

NCM to log on to admin context

enter enable mode

"changeto system" context

show running-config all (save)

show context (now I somehow need to get a handle on what contexts are configured record context names as variables (con1, con2))

changeto context (con1)

show running-config all (save)

changeto context (con2)

show running-config all (save)

etc

So if I have given NCM the instruction set by means of this device template where does the intelligence come from which would enable NCM to step through the process above? I am guessing NCM would not be able to determine whether there are 1, 2 or 3 contexts to switch between so I am thinking that I would have to create an individual device template for each Firewall tailored to each?