Very slow config backups on Fortigate FWs (NCM 7.2.2)

August 4, 2014, 1:53 am

≫ Next: help needed for job application

≪ Previous: add existing node to NCM

$

0

0

Hi

 

I am attempting to backup Fortigate FWs using the NCM.

 

I am having two issues with the backups

 

First is that it is taking roughly 4 hours a device to complete over SSH and I have around 80 devices to be backed up.

 

Second is that when the job finally does complete I see alot of connection refused errors in the log. If I go to these devices individually and laugh a backup from the web console or the NCM application they complete with no issues.

 

Has anyone seen issues like these before and have anyway to resolve them ?

 

Thanks

 

Richie

---

help needed for job application

August 3, 2014, 1:14 am

≫ Next: SSH from NCM

≪ Previous: Very slow config backups on Fortigate FWs (NCM 7.2.2)

$

0

0

HI,

I am an IT graduate and recently applying for a service desk role, I've came across few job questions that I have not much Idea about. This role is a service desk role and since i don't have much service desk experience I am having difficulties in answering them and thought if anyone could share their experience and give me some suggestion in answering them. the question require me to explain a situation where i had to handle customer service request which was not possible due to limitation (technical or resource restriction) that existed in the business environment i was working in, I would really appreciate any suggestion.

 

 

thanks

SSH from NCM

August 4, 2014, 2:05 am

≫ Next: Muliple Commands in a Device Type Template in NCM

≪ Previous: help needed for job application

$

0

0

Is there a way to SSH to the device by a click of a button from NCM?

Muliple Commands in a Device Type Template in NCM

August 2, 2014, 5:58 pm

≫ Next: Is there a script to backup a Juniper MX router?

≪ Previous: SSH from NCM

$

0

0

I am hoping for some assistance with determining how to run multiple commands during a configuration download command.

 

My Example is below:

 

<Commands>

  <Command Name="RESET" Value=""/>

  <Command Name="EnterConfigMode" Value="config"/>

  <Command Name="ExitConfigMode" Value="end"/>

<Command Name="Running" Value="show role all${CRLF}Show config"/>

  <Command Name="DownloadConfig" Value="${ConfigType}"/>

  </Commands>

 

However, this is for only providing an output for the first command and not the second command.

 

Anyone have any ideas on how to do this?

Is there a script to backup a Juniper MX router?

July 31, 2014, 11:22 am

≫ Next: Execute script with if/else statement possible?

≪ Previous: Muliple Commands in a Device Type Template in NCM

$

0

0

I am trying to backup the configuration for a Juniper MX router.  I have found a couple scripts but have been unsuccessful.  Has anyone created a script for NCM to do this?

Execute script with if/else statement possible?

July 31, 2014, 6:33 am

≫ Next: F5 backing up configs

≪ Previous: Is there a script to backup a Juniper MX router?

$

0

0

Hi,

 

is it possible to make if-statements by an execute script?

 

I want to execute a script (not a template) and want to ask if something is set or not.

 

I know I can use variables so can I use the same functions such as in templates?

 

 

Kind regards,

Flo

F5 backing up configs

February 10, 2011, 12:33 pm

≫ Next: 3com 5500 series -- difficultly saving configuration

≪ Previous: Execute script with if/else statement possible?

$

0

0

I have seen the F5 Big IP template in the content sharing section but it does not address the following?

How do you use it? Where do you download or import it too? and how can I backup and report on changes to the following configs in by BigIP/F5's

 

These are all the config files I need to monitor for changes on 6 different f5's.

Where does the template go?

/defaults/config_base.conf.
/config/bigip_base.conf.
/config/bigip_sys.conf.
/usr/bin/monitors/builtins/base_monitors.conf.
/config/profile_base.conf.
/config/daemon.conf.
/config/bigip.conf.
/config/bigip_local.conf.
 
How do I use NCM to do this?

Help would be appreciated.

3com 5500 series -- difficultly saving configuration

July 28, 2014, 4:10 pm

≫ Next: RTCD slow after processing compliance remediation script.

≪ Previous: F5 backing up configs

$

0

0

Hi all -- has anyone encountered or resolved an issue with saving changes to 3com 5500 series switches? I am able to download the current configuration or script an update but am unable to save. Tried creating a template variable and executing from command script without success.

 

<Command Name="SaveConfig" Value="Save${CRLF}y${CRLF}${CRLF}"/>

 

example of manual save:

 

[rhcn0asw01]save

The configuration will be written to the device.

Are you sure?[Y/N]y

Please input the file name(*.cfg)(To leave the existing filename

unchanged press the enter key):

Now saving current configuration to the device.

Saving configuration. Please wait...

......

Unit1 save configuration flash:/rhcn0asw01_2014.jun.5.13.23.cfg successfully

Unit2 save configuration flash:/rhcn0asw01_2014.jun.5.13.23.cfg successfully

Unit3 save configuration flash:/rhcn0asw01_2014.jun.5.13.23.cfg successfully

Unit4 save configuration flash:/rhcn0asw01_2014.jun.5.13.23.cfg successfully

 

 

%Jul 28 15:49:59:208 2014 rhcn0asw01 CFM/3/CFM_LOG:- 1 -Unit1 saved configuration successfully.

%Jul 28 15:49:59:211 2014 rhcn0asw01 CFM/3/CFM_LOG:- 1 -Unit2 saved configuration successfully.

%Jul 28 15:49:59:214 2014 rhcn0asw01 CFM/3/CFM_LOG:- 1 -Unit3 saved configuration successfully.

%Jul 28 15:49:59:218 2014 rhcn0asw01 CFM/3/CFM_LOG:- 1 -Unit4 saved configuration successfully.

[rhcn0asw01]

 

Thanks Everyone.

---

RTCD slow after processing compliance remediation script.

August 6, 2014, 10:51 am

≫ Next: How can I get a true configuration from a Cisco ASA and WLC?

≪ Previous: 3com 5500 series -- difficultly saving configuration

$

0

0

Been playing quite a bit with Policy Compliance and remediation scripts and one thing I've noticed is that after the script is run on a node, RTCD is very slow at processing the nodes for updating.

 

The last lines in my remediation script are "write mem", so I can see it triggering RTCD in the Trap Viewer on the server.    I have the # of nodes to process simultaneously to 30, so the uploading of the remediations scripts goes pretty quickly.    All of this happens pretty quickly, it can go through several hundred nodes pretty fast.    However, even though the nodes configurations are updated quickly, and the Trap Viewer is telling me that its processing the RTCD rule (I also have it colorize the trap viewer  line so I can see it) very quickly, it then takes forever to download the changed configurations.

 

From the "NCM Events", where I have it tell me when RTCD has downloaded a config, it tells me its doing 5-6 per minute.   At first I was thinking that it was going slow because all the 30 simultaneous processes I have allotted are going to processing the remediation scripts, but long after the remediations script is done its still processing the downloading of the new configs at 5-6 per minute.

 

If I just tell it to download configurations it also goes quickly...

 

Wondering if anyone else is experiencing this?   I like to double-check that the remediation scripts ran ok by updating the Compliance reports and seeing what it says, but right now I have to wait quite a long time for it to finish downloading the configs before I can do this.

 

Wishlist for Solarwinds Folks:   When RTCD is downloading a config, I'd like to see it in my "Transfer Status" under "Configuration Management".     If its not processing the RTCD downloads as part of this queue and has its own queue and pacing (ie: 1 at a time for 5-6 total per minute or something) I'd like to see it become part of this queue.    Maybe allow the us to designate "30 total jobs, allocate X to RTCD when busy doing other things" or something like that.  That way when the server isn't busy, RTCD could use the entire 30 slots, but if it was busy doing something else, RTCD could still be guaranteed some slots...

How can I get a true configuration from a Cisco ASA and WLC?

May 9, 2014, 10:19 am

≫ Next: Get config from Cisco switches with SNMP/TFTP

≪ Previous: RTCD slow after processing compliance remediation script.

$

0

0

Hi All,

 

I've had no problems getting Cisco switches and router configurations downloaded and baselined using NCM 7.2.2, but when it comes to the other Cisco equipment I use (ASA 5505s, 5520s, WLC 2405s, and 5508s), I'm having trouble with getting a configuration.

 

With Cisco WLCs, I get a show inventory statement, which isn't the same as the configuration.  I can't even get a configuration off of an ASA.  In the NCM properties of the device, I've set the Device Template to the correct device, but it's still not working.

 

Any tips or tricks before I decide to call support?

 

Thanks!

 

Matthew

 

PS - Polling ASAs with SNMP is also not working.  I've called Cisco, as I thought that the issue was the ASA not responding to the polls.  I've verified it's responding with a packet capture, but SW still says the query fails on Read/Write...  that's another issue though.  ;-)

Get config from Cisco switches with SNMP/TFTP

December 7, 2011, 2:56 am

≫ Next: F5 backing up configs

≪ Previous: How can I get a true configuration from a Cisco ASA and WLC?

$

0

0

Hello all,

I am new to NCM, and I have one question for which I can't seem to find answer in documentation. Can anyone explain me configuration retrieval process when SNMP/TFTP is used. I was under impression it is possible to retrieve (download) Cisco switch configuration by reading it using SNMP RO string and transfering it using TFTP to TFTP server that is up and running on SolarWinds NCM server. Now that I've written it like this, I am not really sure it is possible. What is the correct procedure and is there a way to keep network environment more secure by not enabling RW access from SolarWinds NCP server (and still being able to get config)?

Thanks, MSM

F5 backing up configs

February 10, 2011, 12:33 pm

≫ Next: Nortel Switch configuration in NCM

≪ Previous: Get config from Cisco switches with SNMP/TFTP

$

0

0

I have seen the F5 Big IP template in the content sharing section but it does not address the following?

How do you use it? Where do you download or import it too? and how can I backup and report on changes to the following configs in by BigIP/F5's

 

These are all the config files I need to monitor for changes on 6 different f5's.

Where does the template go?

/defaults/config_base.conf.
/config/bigip_base.conf.
/config/bigip_sys.conf.
/usr/bin/monitors/builtins/base_monitors.conf.
/config/profile_base.conf.
/config/daemon.conf.
/config/bigip.conf.
/config/bigip_local.conf.
 
How do I use NCM to do this?

Help would be appreciated.

Nortel Switch configuration in NCM

September 23, 2011, 4:28 am

≫ Next: making SolarWinds monitored node status available to other systems

≪ Previous: F5 backing up configs

$

0

0

Dear All,

I am not able to login on Nortel switch through NCM,i  have all ready given my correct Credential,

Error show login faild at Banner,

How the Pass Ctrl Y screen

making SolarWinds monitored node status available to other systems

August 7, 2014, 6:45 am

≫ Next: Is there a best practice for installing modules?

≪ Previous: Nortel Switch configuration in NCM

$

0

0

Does anyone publish or export status of down devices to external systems?  If so, what does your solution look like?

 

We had a working system that must now be redesigned due to a combination of NCM 7.3 upgrade and SSL handshake issues with Linux server that retrieves an NCM report via curl command (separate website bound to another TCP port in IIS).  The NCM 7.3 upgrade made the NCM report show only devices down that were assigned to that particular poller.  Easy enough to fix, and I ended up recreating this on my additional poller and as long as both reports were retrieved, my issue was a done deal.  Since that time though, a new SSL certificate has been installed on our SolarWinds servers and the curl command fails on the SSL handshake with our pollers.

 

As there's more than one way to skin a cat, I tried to make a report schedule that saved this report on a filesystem.  Although not ideal as it executes only once per day instead of every few minutes like I would need to provide semi-realtime information, I planned to fight that in Windows Task Scheduler once SolarWinds Report Scheduler made the job.  The issue I'm fighting there is permissions-related.  The service accounts I'm trying to use so far have been unable to authenticate or make reports on my SolarWinds server or the network shares I've tried.  Potentially that requires logon as batch for this account.  A local account on my SolarWinds sever was created for this purpose  and has been unable to work in the report scheduler dialog.

 

I am also considering a batch file that uses pscp and PKI as I already move configs to a Linux server this way.  Arguably I would hit the same dilemma where the Linux server is not able to complete SSL handshake with SolarWinds pollers.  And I still have to make the down nodes information a file on the filesystem.

 

I've tried using the DirectLink account solution, although this has not worked.  I've considered an alert with an action executed every minute or two--that action being an HTTP post.  As this information is already presented to external customers, the lack of encryption was not a concern. 

 

While I ponder which of these solutions is least painful to remedy, I thought I would pose the question to the federal sector folks.  Does anyone else make SolarWinds information available to external customers with no AD access?  As they say, security isn't supposed to be convenient.

Is there a best practice for installing modules?

August 8, 2014, 8:46 am

≫ Next: How can I do a custom SWQL query with a node variable?

≪ Previous: making SolarWinds monitored node status available to other systems

$

0

0

Greetings.

 

     I'm looking to see if there is a best practice for installing the various SolarWinds modules on the pollers. Specifically sequestering the OS and the applications to separate drives. Does SolarWinds have a position on this matter? What has been the experience of the community?

 

Thank you.

---

How can I do a custom SWQL query with a node variable?

July 14, 2014, 2:40 am

≫ Next: Connectivity issues, discarding configuration (or configuration is too short) NCM 7.1

≪ Previous: Is there a best practice for installing modules?

$

0

0

Hi,

 

in Node Details I want to do a custom SWQL query with the NodeID or Name.

 

Something like "... WHERE NodeID = ${NodeID}" is that possible??

 

I want to display for every single Node it's own Node details the lldp descriptions for example.

 

Do you have an idea?

 

kind regatds,

Flo

Connectivity issues, discarding configuration (or configuration is too short) NCM 7.1

October 5, 2012, 8:29 am

≫ Next: Netscreen ISG2000 NCM Login issue

≪ Previous: How can I do a custom SWQL query with a node variable?

$

0

0

I've captured the configs on about 500 routers, but on about 10 of them, I get the following error in config download every time:

Connectivity issues, discarding configuration (or configuration is too short)

How do I troubleshoot this?  I can login manually, and do a show configuration without a problem.

All routers should have identical configuration and IOS version.

Netscreen ISG2000 NCM Login issue

August 10, 2014, 10:53 pm

≫ Next: Whats wrong with the config templates

≪ Previous: Connectivity issues, discarding configuration (or configuration is too short) NCM 7.1

$

0

0

Hi All,

 

I have a problem when I try to ssh to my Netscreen device.I am able to ssh with the user but cannot from Solarwinds.I got the following error message below..Any Ideas?

 

Connection Profile

Manage Connection Profiles

Global Connection Profile:	<No Profile>  <New Profile>  <Auto Detect>  Solarwinds SSH Connection  Solarwinds Telnet Connection  Netscreen
Login Credentials:	User  Device
Username:	Reset to ${GlobalUsername}
Password:	Reset to ${GlobalPassword}
Enable Level:	${GlobalEnableLevel}  <No Enable Login>  enable
Enable Password:	Reset to ${GlobalEnablePassword}
Execute Scripts Using:	${GlobalExecProtocol}  TELNET  SSH1  SSH2  SSH auto
Request Configs Using:	${GlobalConfigRequestProtocol}  TELNET  SSH1  SSH2  SSH auto  SNMP
Transfer Configs Using:	${GlobalConfigTransferProtocol}  SSH auto  TFTP  SCP
Telnet Port:	Reset to ${GlobalTelnetPort}
SSH Port:	Reset to ${GlobalSSHPort}
	Test

Communication

Device Template:	Auto Determine  3Com  Adtran  Alaxala AX3630S and AX2530  Apresia 3424GT and 13200  Arris  Aruba  Business Policy Switch 2000  Cisco Adaptive Security Appliance  Cisco Catalyst 1900  Cisco Catalyst Cat OSS  Cisco Catalyst Cat OSS  Cisco Catalyst CatOS  Cisco Catalyst CatOS4006  Cisco Catalyst CatOS5000  Cisco Catalyst CatOS5500  Cisco Catalyst CatOS5509  Cisco Catalyst CatOS6006  Cisco Catalyst CatOS6500  Cisco CSS 11500 Series  Cisco CSS 11501  Cisco IOS  Cisco IOS2505  Cisco IronPort  Cisco Pix Firewall 501  Cisco Pix Firewall 506  Cisco Pix Firewall 506E  Cisco Pix Firewall 515  Cisco Pix Firewall 515E  Cisco Pix Firewall 520  Cisco Pix Firewall 525  Cisco Pix Firewall 535  Cisco Pix Firewall  Cisco VPN concentrator  Cisco WLC  Dell PowerConnect Switch  Dell PowerConnect Switch  Dell PowerConnect Switch  Enterasys Cabletron SmartSwitch Router 16 slot  Enterasys Cabletron SmartSwitch Router 32 slot  Enterasys Cabletron SmartSwitch Router 8 slot  Extreme XOS  Extreme  Fortigate  Foundry  Generic  HP J4865A ProCurve Switch 4108GL  HP J4865A ProCurve Switch 4108GL  HP Switch  Juniper NetScreen  Juniper  Mikrotik  Motorola  NetScaler  Nortel BayStack 460-24T  Nortel Baystack380  Nortel Baystack5510  Nortel Baystack5520  Nortel Passport  Nortel Switch 325-24T  Nortel Switch 460-24T  Nortel Switch 460-24T-PWR  Nortel Switch 470-48T-PWR  Nortel Switch 5520-24T  Nortel Switch 5520-48T  NortelBPS2000  PaloAlto5050  Radware WSD  Riverbed Steelhead  SMC Switch 6128L2  SMC Switch 8926EM
Allow Terminal Server Support:	Yes  No
Use Keyboard Interactive Authentication:	Yes  No

Whats wrong with the config templates

August 11, 2014, 9:26 am

≫ Next: NCM job save results to file

≪ Previous: Netscreen ISG2000 NCM Login issue

$

0

0

I have downloaded a few of the config change templates and they are imported in what looks like corrupt.  There are special characters where I am guessing txt should be.

NCM job save results to file

August 12, 2014, 5:23 am

≫ Next: Help needed with backing up Check Point R75.40

≪ Previous: Whats wrong with the config templates

$

0

0

Anyone doing this?

 

I am attempting to setup our nightly config backu job for our routers and switches to save the log file to our DFS. However, I can only get so far on teh FQDN share i.e. \\DFS\Root\ITG....here is where it fails. If I put any folders beyond this, no joy.

 

I thought about just saving them locally and setting up a nightly task to copy them to our DFS.

 

Any thoughts gang?

 

Best Regards,
OhioNetAdmin