vlan.dat files

Question

Current backups using cirrus are incomplete on most L2/L3 cisco devices as cirrus only backs up the setup. As Cisco does not save the VTP information in the setup yet (they have promised to do so in a future versions of IOS), but in a file named VLAN.DAT in the flash, this is insufficient.

I've looked through the fora but no-one has mentionned this that I could see. How are all of you backing up your vlan.dat files?

ceclark · Answer

I have the same security concerns. Hopefully SW is addressing them otherwise we will not be able to use Cirrus anymore.

patrick.hayes · Answer

The architecture is complicated & the client has specified that the startup-conf, running-conf & vlan.dat files need to be saved for all cisco devices. At present I think I'll use the following script to save the running-conf, startup-conf & vlan.dat files for each device every day. Cirrus' inventory will be used to determine when changes occur but are insufficient due to the absence of the vlan.dat files.

copy flash:/vlan.dat tnms/.../Vlan-dat-${NodeCaption}${CRLF}${CRLF}
copy system:running-config tnms/.../Running-Config-${NodeCaption}${CRLF}${CRLF}
copy nvram:startup-config tnms/.../Startup-Config-${NodeCaption}${CRLF}${CRLF}

patrick.hayes · Answer

I'd already developped a similar script but there are the following problems when doing so:

* Cirrus' transport setup (ssh2) goes unused (tftp is banned for evident security reasons) & the tftproot is not a secure area.
* Even if tftp was allowed, Cirrus' tftp server is not a windows service so unless an administrator is logged and running it, the script wouldn't work. I would need a different tftp server like http://www.tftp-server.com/ which needs to be validated.
* The only secure method I see for pushing the vlan.dat files from the devices to the server using "copy flash:vlan.dat ..." would be to use scp & configure cygwin/openssh on the cirrus server. I use cygwin/openssh all the time but for this project it is likely to be very difficult/impossible to get the client to accept free, unsupported software.

* Even if I use a secure transport like scp instead of tftp, allowing the devices write access to the archive should not be permitted. The cirrus server is under our physical control. The network equipment is distributed throughout the city and should not be trusted.
* We need to have the config files available in the file system grouped in a coherent structure. Cirrus allows this through the config mirror. Using a script defeats this unless I start writing & running scripts to move the vlan.dat files from the area where they are being transferred from the devices to the defined mirror config hierarchy.

* There is no change validation in "copy flash:vlan.dat ...". I could do this myself through scripts, but once I do so Cirrus becomes a mere glorified scheduler.

Ideally there is a way I have not yet discovered to change Cirrus' "get configuration" method so that I can tell it to recover the vlan.dat file every time it determines that the equipment configuration has changed.

Thanks for your suggestions