firewall back up

javier_ccs · 01-06-2006, 08:48 AM

hello,

i was trying to back up my firewall configuration (juniper 5gt) and i found out that i could do it using the CLI save command to a tftp server as follows:

>telnet 192.168.127.5
>login:javier
>password:javier
>save config to tftp 192.168.127.4

only the administrator can use the save config command, so if i need that script to telnet to the firewall, it must read the login and password from somewhere (clear text file) and i can't save the admin login and password (anybody knows why?) on a file, so i created an user with less permissions but he can't use the save config command, he only can use a get config wich is equally to a more a.txt (i have to press the bar every page), i would like to create a routine that backs up my firewall configuration each 30 days, can anybody tell me how that script could go or where can i find such script?

acid_kewpie · 01-07-2006, 02:02 AM

are you saying you just basically want to run those 4 commands automatically on a cron job? well firstly don't use telnet, use ssh. you can easily use something like expect to read the responses from a process and reply accordingly, or if you really can't use ssh, you can actually pipe commands into telnet BUT as it's not unix i wouldn't know how well the juniper would respond. this really doesn't seem like that great a solution though, is there no better way? I'd suggest that you should be able to use writeable SNMP on the firewall from the server to force it to send it's config out to ftp etc... or maybe the box will even schedule it's own backups. and i would recommend using ftp over tftp if possible too.

javier_ccs · 01-07-2006, 01:36 PM

thanx for answering, yes, basically the problem that box isn't running on unix so i can't run the commands on a cron job, i read somewhere about the expect language, wich i think would be perfect, because once you run those commands you have to programm a couple of responses to grab the configuration, but the problem is that i'm on a deadline and i really don't have the time to learn another language (not that i wouldn't like to do so), snmp sounds like a better deal but the problem again is that i don't think i can use ssh instead of telnet, and i dont want clear text files flying around, but since the box can't schedule it's own backups....

i really don't know what to do...

acid_kewpie · 01-07-2006, 01:54 PM

expect is hardly a language, just a few simple conventions to interact with stdout tesxt streams.

javier_ccs · 01-07-2006, 02:04 PM

hi.....

i was trying to make the rutine on expect and this is what i came out with...

Code:

#!/usr/bin/expect -f
#
set force_conservative 0  ;# set to 1 to force conservative mode even if
                          ;# script wasn't run conservatively originally
if {$force_conservative} {
        set send_slow {1 .001}
        proc send {ignore arg} {
                sleep .1
                exp_send -s -- $arg
        }
}
set timeout 2
puts "\n"
#
spawn telnet 192.168.127.5
expect {
 -exact "conection refused" {puts "Conexion denegada\n";exit}
 -exact "Host name lookup failure" {puts "Servidor desconocido\n";exit}
 -exact "Name (localhost:root):*"
}
send -- "javier\r"
expect "Password:"
send -- "javier\r"
expect -exact "> "
send -- "get config\r"
send -- "show test\r"
expect {
        "More" {send -- "\r";exp_continue}
        ">" {}
        }
puts "\n"
exit

the problem is that i don't know if its ok, and i don't know how can i run it (first time ever to do a rutine on expect) and i dont know what to expect...

thanx...