Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 7.2

Working With Configuration Files

---

This chapter describes how to use commands that show, copy, and erase the configuration file. It contains the following sections:

• Displaying the Current Configuration

• Displaying the Current Submode Configuration
• Filtering the Current Configuration Output
• Filtering the Current Submode Configuration Output
• Displaying the Contents of a Logical File
• Backing Up and Restoring the Configuration File Using a Remote Server

• Creating and Using a Backup Configuration File

• Erasing the Configuration File

Displaying the Current Configuration

Note The CLI output is an example of what your configuration may look like. It will not match exactly due to the optional setup choices, sensor model, and IPS version you have installed.

Use the show configuration or the more current-config command to display the contents of the current configuration.

To display the contents of the current configuration, follow these steps:

Step 2 Display the current configuration.

Displaying the Current Submode Configuration

Use the show settings command in a submode to display the current configuration of that submode.

To display the current configuration of a submode, follow these steps:

Step 2 Display the current configuration of the service analysis engine submode.

Step 3 Display the current configuration of the service anomaly detection submode.

Step 4 Display the current configuration of the service authentication submode.

Step 5 Display the current configuration of the service event action rules submode.

Step 6 Display the current configuration of the external product interface submode.

Step 7 Display the current configuration of the service global-correlation submode.

Step 8 Display the current configuration of the service health-monitor submode.

Step 9 Display the current configuration of the service host submode.

Step 10 Display the current configuration of the service interface submode.

Step 11 Display the current configuration for the service logger submode.

Step 12 Display the current configuration for the service network access submode.

Step 13 Display the current configuration for the notification submode.

Step 14 Display the current configuration for the signature definition submode.

Step 15 Display the current configuration for the SSH known hosts submode.

Step 16 Display the current configuration for the trusted certificates submode.

Step 17 Display the current configuration for the web server submode.

Filtering the Current Configuration Output

Use the more keyword | [ begin | exclude | include ] regular-expression command to search the output of the more command.

The following parameters apply:

• keyword —Specifies either the current-config or the backup-config:

– current-config —Specifies the current running configuration. This configuration becomes persistent as the commands are entered.

– backup-config —Specifies the storage location for the configuration backup file.

• |— The pipe symbol indicates that an output processing specification follows.
• begin —Begins unfiltered output of the more command with the first line that contains the regular expression specified.
• exclude —Excludes lines in the output of the more command that contain a particular regular expression.
• include —Includes only the lines in the output of the more command that contain the regular expression you specify.
• regular-expression —Specifies any regular expression found in the more command output.

Note The regular-expression option is case sensitive and allows for complex matching requirements.

Filtering Using the More Command

To filter the more command, follow these steps:

Step 2 Filter the current-config output beginning with the regular expression “ip,” for example.

Note Press Ctrl-C to stop the output and return to the CLI prompt.

Step 3 Exclude the regular expression “ip” from the current-config output.

Note Press Ctrl-C to stop the output and return to the CLI prompt.

Step 4 Include the regular expression “ip” in the current-config output.

Filtering the Current Submode Configuration Output

Use the show settings | [begin | exclude | include] regular_expression command in the submode you are interested in to search or filter the output of the contents of the submode configuration.

The following parameters apply:

• |— The pipe symbol indicates that an output processing specification follows.

• begin —Begins unfiltered output of the show settings command with the first line that contains the regular expression specified.
• exclude —Excludes lines in the output of the show settings command that contain a particular regular expression.
• include —Includes only the lines in the output of the show settings command that contain the regular expression you specify.
• regular_expression —Specifies any regular expression found in the show settings command output.

Note The regular_expression option is case sensitive and allows for complex matching requirements.

Filtering the Submode Output

To search or filter the output of the contents of the submode configuration, follow these steps:

Step 2 Search the output of the event action rules settings for the regular expression, “filters,” for example.

Step 3 Filter the output of the network access settings to exclude the regular expression.

Step 4 Filter the output of the host settings to include the regular expression “ip.”

Displaying the Contents of a Logical File

Note Operators and viewers can only display the current configuration. Only administrators can view hidden fields such as passwords.

Use the more keyword command to display the contents of a logical file, such as the current system configuration or the saved backup system configuration.

The following parameters apply:

• keyword —Specifies either the current-config or the backup-config:

– current-config —Specifies the current running configuration. This configuration becomes persistent as the commands are entered.

– backup-config —Specifies the storage location for the configuration backup file.

You can disable the more prompt in more current-config or more backup-config by setting the terminal length to zero using the terminal length 0 command. The more command then displays the entire file content without pausing.

Displaying the Logical File Contents

To display the contents of a logical file, follow these steps:

Step 2 Display the contents of the current configuration file.

The current configuration is displayed.

For More Information

For the procedure for using the terminal command, see Modifying Terminal Properties.

Backing Up and Restoring the Configuration File Using a Remote Server

Note We recommend copying the current configuration file to a remote server before upgrading.

Use the copy [ /erase ] source_url destination_url keyword command to copy the configuration file to a remote server. You can then restore the current configuration from the remote server. You are prompted to back up the current configuration first.

The following parameters apply:

• /erase —Erases the destination file before copying.

This keyword only applies to the current-config; the backup-config is always overwritten. If this keyword is specified for destination current-config, the source configuration is applied to the system default configuration. If it is not specified for the destination current-config, the source configuration is merged with the current-config.

• source_url —The location of the source file to be copied. It can be a URL or keyword.
• destination_url —The location of the destination file to be copied. It can be a URL or a keyword.

• current-config —The current running configuration. The configuration becomes persistent as the commands are entered.

• backup-config —The storage location for the configuration backup.

The exact format of the source and destination URLs varies according to the file. Here are the valid types:

– ftp:—Source or destination URL for an FTP network server. The syntax for this prefix is:

ftp://[[username@]location][/relativeDirectory]/filename

ftp://[[username@]location][//absoluteDirectory]/filename

Note You are prompted for a password.

– scp:—Source or destination URL for the SCP network server. The syntax for this prefix is:

scp://[[username@]location][/relativeDirectory]/filename

scp://[[username@]location][//absoluteDirectory]/filename

Note You are prompted for a password. You must add the remote host to the SSH known hosts list.

– http:—Source URL for the web server. The syntax for this prefix is:

http://[[username@]location][/directory]/filename

Note The directory specification should be an absolute path to the desired file.

– https:—Source URL for the web server. The syntax for this prefix is:

https://[[username@]location][/directory]/filename

Note The directory specification should be an absolute path to the desired file. The remote host must be a TLS trusted host.

Backing Up the Current Configuration to a Remote Server

To back up your current configuration to a remote server, follow these steps:

Enter yes to copy the current configuration to a backup configuration.

cfg 100% |************************************************| 36124 00:00

 

---

 

Restoring the Current Configuration From a Backup File

To restore your current configuration from a backup file, follow these steps:

---

Step 1 Log in to the CLI using an account with administrator privileges.

Creating and Using a Backup Configuration File

To protect your configuration, you can back up the current configuration and then display it to confirm that is the configuration you want to save. If you need to restore this configuration, you can merge the backup configuration file with the current configuration or overwrite the current configuration file with the backup configuration file.

To back up your current configuration, follow these steps:

Step 2 Save the current configuration. The current configuration is saved in a backup file.

Step 3 Display the backup configuration file. The backup configuration file is displayed.

Step 4 You can either merge the backup configuration with the current configuration, or you can overwrite the current configuration:

• Merge the backup configuration into the current configuration.

• Overwrite the current configuration with the backup configuration.

Erasing the Configuration File

Use the erase { backup-config | current-config } command to delete a logical file.

The following parameters apply:

• current-config —The current running configuration. The configuration becomes persistent as the commands are entered.

• backup-config —The storage location for the configuration backup.

To erase the current configuration and return all settings back to the default, follow these steps:

Step 2 Press Enter to continue or enter no to stop.