Cisco – Get WLC Running-Config Including All Secrets as Plaintext

ciscowireless

Our WLC 5508 pair is going EOL. I need to migrate the complete configuration (including secrets) to a new pair of CT3504 WLCs.

The problem I have is when I run show run-config commands, username / password secrets are obfuscated with ****.

I need those secrets as plaintext so I can paste the full configuration into the new WLC pair without loosing any configruation items. For instance, the mgmtuser entries are all obfuscated:

mgmtuser add mpenning **** read-write

I already tried config switchconfig secret-obfuscation disable and this still leaves many secrets obfuscated.

How do I get a full WLC configuration including all secrets as plaintext?

Best Answer

CLI:
You can use transfer upload (via CLI or GUI).

You should use transfer upload datatype config and transfer encrypt disable from the CLI to get the WLC's text configuration.

GUI:

In both cases, the passwords are hashed, but not obfuscated.

Related Solutions

Cisco WLC External WebAuth Apparent Random Behavior

I've seen similar issues twice in the past.

The first time, it had to do with DNS resolution. I performed a DNS lookup on a client that was having issues, and realized that the client wasn't capable of resolving the URL that I was passing for the login page. This was because I was passing an external DNS server. Check that first. I resolved that by passing the IP in the URL, although you could create a cname that resolves to 1.1.1.1.

The second time, it was a certificate issue. Some default browsers won't show the splash screen if the user must accept a self-signed certificate. I would test that by manually browsing to the splash screen or login page from a client that does not automatically show it.

Hope one of those helps you out. I know that I was ready to pull my hair out when I saw this the first time.

Cisco – BGP “no synchronization” command not showing up in running-config

In most modern versions of IOS (since 12.2(8)T - thanks @ytti) BGP synchronization is disabled by default (and shown in the running config as such, ie no synchronization shows up in show run when you turn on BGP). As to which IOS version they decided to make it a "hidden default", I'm not entirely too sure, but you should be able to do:

show running-config all

show running-config full

To get the router to show the entirety of the running config, including the defaults which are normally hidden. Look for no synchronization in there.

Best Answer

Related Solutions

Cisco WLC External WebAuth Apparent Random Behavior

Cisco – BGP “no synchronization” command not showing up in running-config

Related Topic