SonicWall – Backup Configuration Using SSH or SCP

automationfortinetsonicwall

I'm evaluating whether to get a SonicWall TZ or a comparable Fortinet firewall. One thing i can't find but would really like to have is the ability to automate backing up the firewall configuration.

Is there a (preferably simple) way to fetch the running configuration from a SonicWall using scriptable command line-fu, utilising secure transport like ssh or scp?

Also, can the retrieved file be edited and uploaded to a TZ to reconfigure the firewall?

Both tricks seem to be doable on a Fortinet firewall.

Best Answer

Sonicwall export files are compiled , thus is not possible to edit them offline and reupload to a different appliace.

There is a way to fetch config files , I never tried, but on stackoverflow there was a discussion on it, with an example script.

https://stackoverflow.com/questions/14147473/shell-script-to-automate-sonicwall-firewall-ssh-session-not-working

I have no experience on Fortinet , sorry...

Related Solutions

Cisco – Automate configuration backup (every minute) in Cisco IOS

You have several options to get this type of functionality on a Cisco device. (Which one you use depends on your needs and sometimes on the device and IOS load. Some older devices/IOS loads will have different capabilities.)

EDIT: You are asking about doing this every one minute, which as you found out in our chat about this question, will bog down your router. (Especially in GNS3.) The below options are available to you for automating confirguation backup, however I would not recommend doing so every 1 minute.

You could either:

Use Cisco's Kron functionality for command scheduling. This will allow you to execute predefined commands on a scheduled basis. As you pointed out, copy run tftp requires file prompt confirmation. (Unless you've turned off file prompt confirmation, however I don't recommend it as a normal setting.) Redirecting does not require confirmation. So the command used in the scheduler is show run | redirect tftp://$SERVERIP/$PATH/$FILE
Use Cisco's Archive functionality for configuration management. Archive is a way to store multiple copies of the config in a sequential fashion and roll back configs if needed to a previous version. Copying out with Kron overwrites the previous config, while Archive allows you to keep up to 14 different config versions in the specified location. See this link on the Cisco Learning network for more useful info on Archive. Specifically how to dynamically set the filename with the $h and $t tags.

In either of the below samples, you can adjust the times to your needs, these are just what I quickly pulled out of some production gear.

Sample config to have Kron write config and back it up to a tftp server once a week:

kron occurrence SaveConfig at 23:50 Mon recurring
policy-list SaveConfig
!
kron occurrence BackupRunningConfig at 23:55 Mon recurring
policy-list BackupRunningConfig
!
kron policy-list SaveConfig
cli write
!
kron policy-list BackupRunningConfig
cli show running-config | redirect tftp://10.10.10.10/configs/testswitch.txt

Sample config to have Archive back up your config to a tftp server daily:

archive
 path tftp://10.10.10.10/configs/$h-$t
 time-period 1440
 maximum 14

Sonicwall – How to Connect a Sonicwall Firewall to Its High Availability Unit Using One Switch

If you have a managed switch that supports VLANs, just separate the WAN and LAN ports onto separate VLANs and you're good. I would not recommend using one switch with all traffic on the same L2 broadcast domain - it causes multiple headaches, the most basic will be the sonicwall will report a bunch of spoofed traffic.

Best Answer

Related Solutions

Cisco – Automate configuration backup (every minute) in Cisco IOS

Sonicwall – How to Connect a Sonicwall Firewall to Its High Availability Unit Using One Switch

Related Topic