Backup Cisco WLC Configuration (Without Cisco Prime)

This article is part of a new mini-series here on my blog as I work toward obtaining my Cisco Wireless 640-722 CCNA certification.

The official way Cisco wants you to do this is to buy and implement Cisco Prime.

One way you can get around this is to use SolarWinds CatTools to send commands to your devices.

Using this I configured a job to connect to the WLC via SSH and push a backup of the config to my TFTP server.  Here's how:


>transfer upload mode tftp
>transfer upload datatype config
>transfer upload filename WLC-Config-Backup_%DateISO%.txt
>transfer upload path .
>transfer upload serverip 192.168.1.5
>transfer upload start

Once you select "Y" to begin the backup you'll see in the text a warning that file encryption is disabled.  Solarwinds CatTools can answer this Y or Yes if needed.  After this the config will push to your TFTP directory.

The variable in the command %DateISO% will automaticaly fill out the date of the file for you.  As of now the freeware version is limited to 5 devices and 5 activities only.

If you need more it can scale up from there.

Archive Cisco Switch and Router Configs Using TFTP and Configuration Archive

The worst time to realize you don't have a current backup of your switch or router is when that device is having issues or worst case dies and it is actually needed.  For a great comprehensive list of Cisco IOS commands I recommend THIS BOOK.  It's for Amazon Kindle.

Administrators have the ability to run a manual backup of the configs or you can set it to do this automatically or every time you do a "write memory" to save a config change.

Given how easy this is to setup there's no reason for you not to have this on your switches.

Let's dive into how easy this is to setup.

First you'll need a good TFTP server program.  Personally I like the free Solarwinds TFTP Server.  This like is for the Windows version.  You can run it on a server or a workstation if needed.  The price is right, setup is simple, and you'll have this going in a couple of minutes.

Next it's time to setup the switch or router to do the automatic backups for you.

Let's look at a couple of way to set this up.

The first way is to just backup each time you do a "write memory".  This is my favorite setup as it does not generate unnecessary network traffic and I know that the files on my TFTP server are the latest config as long as they were saved.

R1(config)#archive R1(config-archive)#path tftp://192.168.1.10/R1-config R1(config-archive)#write-memory R1(config-archive)#exit

Now one of the details I add after the IP address and forward slash is the name of the device so when it creates the automatic backup file I know which device it came from based on the device's host name.

Another way to set this up is to do backups daily for you automatically without the need to a manual update.  This setup will archive every day or if you do a "write memory" command on the switch.

R1(config)#archive R1(config-archive)#path tftp://192.168.1.10/R1-config R1(config-archive)#write-memory R1(config-archive)#time-period 1440

Now these two methods ensure your switch configs are backed up either as you do a change and save it or automatically each day.

Finally the great thing about these auto backups is you can also restore them using the same functions.  One thing to note is that this command does not merge the settings with what is currently running, it fully replaces it so use caution.

R1# configure replace tftp://192.168.1.10/R1-config-3 This will apply all necessary additions and deletions to replace the current running configuration with the contents of the specified configuration file, which is assumed to be a complete configuration, not a partial configuration. Enter Y if you are sure you want to proceed. ? [no]: Y Loading R1-config-3 ! [OK - 3113/4096 bytes]

Backup and Restore ESXi Host Configuration

Today's post involves something I haven't done before which is backing up and then restoring an ESXi hosts's configuration.  

In my examples today I am going to use the tools directly built into ESXi and vSphere to get this done.  I'm going to use PowerCLI 5.5 (latest version as of this writing) to get this done.

PowerCLI is one of the many tools that are bundled for free with the vSphere environment.  I highly recommend you have it installed on your management server or workstation and if you're running vCenter on Windows it's even better to place it there.  You can download PowerCLI from the VMware website.

The process of backing up and restoring the configuration is pretty simple so here we go.

Before running any of these commands you should run this command in PowerShell on Windows to make sure PowerCLI has the ability to execute the commands needed for this process to work.

Set-ExecutionPolicy RemoteSigned

Open PowerCLI and use the Connect-VIServer IPAddress command to connect to the server.

Next run the command below to backup your host's configuration.  Make sure you create the backup location folder before you run the command.

Get-VMHostFirmware -VMHost ESXi_host_IP_Address -BackupConfiguration -DestinationPath “Output_Directory”

When the process completes you'll have files that look like this:

That's all there is to backing up the configuration of your ESXi host.  Now for the really cool part.  

If you're upgrading hosts to new hardware there a couple of things I've done and the restore has went off without a hitch.  Make sure you have the VMware install on the new host at the exact same version as the host you backed up.  If not this isn't a supported process but you can use the "-force" command at the end of the restore to make it do it anyway.  The next thing is to ensure you have the network cables in the exact same port numbers as the old host.  In other words port 0 on the old host should get the cable for port 0 on the new.

If you're unsure which cables correspond to which port, once you've migrated all VMs off of the old host you can look at the network configuration in the vSphere client and pull the cables one at a time.  From there just label each one so you know where to put it in the new server.

Once you've got the new box cabled up, on the same build of VMware as the old server, and powered on here's all you need to do.

First put the host into maintenance mode.  This is required or the next step will not work.  You can use the hostname, IP address, or FQDN if you want.

Set-VMHost -VMHost esx1 -State “Maintenance”

Next enter the restore command.

Set-VMHostFirmware -VMHost -Restore -Force -SourcePath

Once you do this the host will immediately restart.  During the restart it will import the backed up configuration prior to completing the loading process.

After the host has fully restarted you will be able to see that all of your prior settings have been restored including those many times complicated network, VLAN, and MTU settings.

On the hosts I have performed this on if they have local storage I have had to configure the large datastore again but given how much time this saves that's a minor thing to get the new server online much, much quicker.

Good luck with your upgrades!

Exchange 2013 Blank ECP/OWA Screen, Showing Event ID 15021 HttpEvent System Log

I hit this one today after switching out an expired UCC certificate on two Exchange 2013 servers in a DAG.  Both the ECP/OWA screens after login just went to a white page and never load.  The servers were both showing hundreds of ID 15021 in the system event log that says "An error occurred while using SSL configuration for endpoint 0.0.0.0:444.  The error status code is contained within the returned data."

Here's the steps to fix it:

1. Open a command prompt.

2. Enter netsh http show sslcert  This will show the certs on the server.  Copy and paste this information into notepad.  Copy this info "IP: port: 127.0.0.1:443".  Note that this information contains the certificate hash and the application ID.  This is the information needed.

3.  Run this command:  netsh http delete sslcert ipport=0.0.0.0:444

4.  Next run this command:  netsh http add sslcert ipport=0.0.0.0:444 certhash=123443211234321123 appid="{ab34k32abkr3252jsnekgljw}"  Make sure to include the quotes around the appid.

5. Finally restart the server.

This is all it takes to correct the issue.  Apparently this glitch is specific to Exchange 2013 as a web based ECP doesn't exist in the earlier versions.

Simple fix to a real inconvenience.

Good luck!

Certificate Not Showing After Importing Into Exchange 2013

I ran into this one today with two servers in a DAG.  This is caused by the certificate you're using not having the private key.  Here's how I fixed it:

Go to the 1st server -> Start -> Run -> MMC -> File -> Add/Remove Snap Ins -> Certificates -> Computer Certificates -> Local Computer

Browse to the personal certificate store, right click on the correct certificate, select All Tasks, and then Export.  Make sure here you choose "Export Private Key" and assign a password.  Click Next and then name the file and where you want to save it.  The file will have a .pfx extension.

From there on the 1st server inside ECP you can go to Servers -> Certificates -> Choose the server you want and then import the certificate.

Once this process is done just assign the services to the certificate (SMTP, POP, etc) and then restart the server if possible.  If not some say you can do an IISRESET from the command prompt and then you'll be good.

Good luck!