Configuration file handling task list
84
IPLink Software Configuration Guide
7 • Configuration file handling
Pre-requisites:
Only authorized users have configuration access to the IPLink. The configurations can be stored
in plain form on the IPLink. SNMP Write Access shall be restricted by means of communities and ACLs to
prevent unauthorized SNMP initiated configuration downloads. Telnet access shall be restricted by means of
credentials and ACLs.
Encrypted Configuration Download
An external encryption tool on the PC is used to encrypt the configuration file:
enctool encrypt <plain-config-file> <enc-config-file> [<key>]
The encrypted configuration file can then be downloaded with TFTP triggered by
•
The CLI copy command:
copy tftp://<host>/<path> <config-file>
•
Auto provisioning
•
SNMP
•
HTTP
On the IPLink the encryption is detected and the configuration file is automatically decrypted before stored to
flash.
A custom encryption key can be:
•
Downloaded to the IPLink software
•
Specified with the PC encryption tool
The encryption key may include the MAC address and/or serial number of the IPLink using the placeholders
$(system.mac) and $(system.serial) respectively.
An encrypted configuration file can be uploaded to a TFTP server on request, specifying the encrypted flag:
copy <config-file> tftp://<host>/<path> encrypted
On the PC the encryption tool can be used to decrypt the file:
enctool decrypt <enc-config-file> <plain-config-file> [<key>]
A log file lists the last up/downloads:
show log file-transfer
Use Cases
Install a custom encryption key (optional)
You can install a custom encryption key with the IPLink. The encryption key is used to automatically decrypt
an encrypted configuration file that is downloaded later. A default encryption key is already installed on the
IPLink.
To install an encryption key you have to create a file on your TFTP server that contains the key. Then you have
to download this key file to the IPLink using the
copy
command of the IPLink.