[Disclaimer: I haven't seriously touched Cisco gear in years, but occasionally, people still ask me for advice]
Hi, I am wondering what's the easiest way to pull the full configuration (sans passwords/keys, if that makes things any easier) from a PIX or ASA box. On a Unix system, I'd write something along the lines from="172.16.42.24",command="show run" ssh-rsa AAAAB3NzaC1y... into /root/.ssh/authorized_keys, and be done. That way, the ssh key in question would only be accepted from 172.16.42.24, and only the command "show run" would be permitted. Can this somehow be done on a PIX/ASA? As far as I know, there is no TACACS in the game, all accounts are local. One hint that I already got was to use an SNMP request to make the PIX/ASA dump its config to a tftp server, but both SNMP and tftp are unencrypted, which is not desireable. I guess that I could build an IPSEC tunnel for the SNMP and tftp connections, but I'd rather prefer to avoid this. Any hints would be appreciated. Greetings Marc -- ----------------------------------------------------------------------------- Marc Haber | "I don't trust Computers. They | Mailadresse im Header Mannheim, Germany | lose things." Winona Ryder | Fon: *49 621 72739834 Nordisch by Nature | How to make an American Quilt | Fax: *49 3221 2323190 _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
