How do I perform a backup and restore from a NOKIA IP VPN 10i to another NOKIA IP VPN 10i in the event of a hardware failure?

Transcription

1 BACKUP AND RESTORE 1 (14) How do I perform a backup and restore from a NOKIA IP VPN 10i to another NOKIA IP VPN 10i in the event of a hardware failure? This document will demonstrate the backup process and restore process using the TFTP method. I will include some of the errors you may experience during the restore process, if the proper steps are not followed in the correct sequence. Assuming you have a current backup of the NOKIA IP VPN 10i and the PIN, you will be able to restore the backup onto another NOKIA IP VPN 10i device. 1. You can create your backup from NOKIA VPN Manager -> Actions menu by selecting Backup Flash 2. Enter the TFTP Server address. In my example below, my TFTP Server was running on The address is entered in a URL format. tftp://

2 BACKUP AND RESTORE 2 (14) 3a. You should see the status of the flash backup appear; close when all tasks completed. 3b. You should see the files copying in console during the backup process as shown below.

3 BACKUP AND RESTORE 3 (14) 4. I used TFTPD32 TFTP Server. This application is available for free. You can download this application from In the image below, you can see the write status of the backup test_ fsv. 5. The image below just shows you the backup file was saved in the base TFTP directory V:\FTP. This location can be configured in the TFTPD32 -> Settings.

4 BACKUP AND RESTORE 4 (14) 6. This is the NOKIA IP VPN 10i with SN: 7h that I created the backup file with. 7. Execute the command pin show from console as shown below. You will need to copy & paste the output into a text file for later use. We need the pin to restore the flash backup, as the backup is encrypted. The pin is used to decrypt the flash backup. Without the pin, you cannot restore a backup flash.

5 BACKUP AND RESTORE 5 (14) 8. The following two images show my basic IP and routing configuration. We will need to know this information when configuring the new device we will restore the backup on. Execute commands show int and show ip route. Take notes on the interface configuration and routing configuration. Reviewing the images below. In my example, eth-1 is external /24 and eth-2 is internal /24. My default route is

6 BACKUP AND RESTORE 6 (14) 9. At this point we have completed our backup and have the information we need to restore the flash onto another NOKIA IP VPN 10i device. We have saved the pin to a text file in Step#7 and have taken notes on our interface and routing configuration in Step# Swap all the cables with your new NOKIA IP VPN 10i device. Ensure all the cables are swapped out correctly, or you may experience connectivity issues. Shown below is the initial boot of an unconfigured NOKIA IP VPN 10i, where you would normally paste your configuration from the NOKIA VPN Manager. We are going to exit this. 11. We exit using CTRL^Z as shown below.

7 BACKUP AND RESTORE 7 (14) 12. This is the NOKIA IP VPN 10i with SN: 7h that I will restore the backup file with. 13. We need to configure the interface and route information on the new device with the same information we noted from our previous device. In my example, the commands I would need to execute are: > conf Config# interface eth-1 up external address netmask Config# interface eth-2 up address netmask Config# route default Config# exit > NOTE: Only interfaces that lead to the TFTP Server and NOKIA VPN Manager need to be configured. The example shows us how to configure both an external and an internal interface.

8 BACKUP AND RESTORE 8 (14) 14a. Now that our interfaces and routing configuration has been entered and we have connectivity on the network. We can restore the backup flash from the TFTP Server. NOTE: You must disable IPSec (crypto clear) and enter the pin (pin set XXXX ) before restoring the backup flash. In my examples below, I am just showing you some of the errors that may appear if you do not perform these steps first. 14b. Here we attempted to restore the backup flash from the TFTP Server using the command backup restore tftp:// /test_ fsv flash: (we must use the exact path and filename) without disabling IPSec. The error shown below is Network is unreachable. Use crypto clear command to disable IPSec.

9 BACKUP AND RESTORE 9 (14) 14c. We attempted to restore our backup again using the command backup restore tftp:// /test_ fsv flash: (we must use the exact path and filename) after disabling IPSec with the command crypto clear. Now we can see the backup flash file copy to the device from the TFTP Server. We can see the activity in TFTPD32 and at console we see Restoring flash

10 BACKUP AND RESTORE 10 (14) 14d. As shown below, we get another error after the flash has been restored BACKUP MAC INTEGRITY CHECK FAILED. We would get this error if we did not enter our PIN we saved from the previous device. We use the command pin set XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX to enter the PIN. You can copy and paste the PIN we saved from Step#7. Once the PIN has been set, you will need to perform another backup restore.

11 BACKUP AND RESTORE 11 (14) 15. Shown below is a successful backup restore without any errors. 16. We need to reboot the device for changes to take effect and load the restored flash into memory.

12 BACKUP AND RESTORE 12 (14) 17. Notice the hostname has been configured from our restore. You can see the hostname in the prompt>. In my example, the hostname is test and the last ipsec_policy file was restored.

13 BACKUP AND RESTORE 13 (14) 18. To ensure we are up to date on the IPSec policy and ensure we have connectivity from our NOKIA VPN Manager to the new NOKIA IP VPN 10i device. We will Apply Changes. Select the gateway. Select the Actions Menu and select Apply Changes. 19. You may get a warning that states changes have been made through command line, this is normal. Continue will override.

14 BACKUP AND RESTORE 14 (14) 20. Shown below, tasks were completed with 1 warning. We have now successfully applied changes. The warning was indicating that changes were made at the command line, which is normal. We have successfully backed up the flash from one NOKIA IP VPN 10i device and have restored the backup flash onto another NOKIA IP VPN 10i device!