Command to loading previous configuration

[Rpinfo]

Because of wrong FW security policy configuration, we miss the control from a GUI client. Which is the command to load the previous configuration in FW1 NG AI R55 Secure Platform?

any suggestion will be really appreciate

Thanks for a prompt reply

Raffaele

 

[ChrisAC]

It all depends on if you actually saved a previous configuration or not. From SmartDashboad you can go to 'File > Database Revision Control' and select any saved configs and restore the old policy.

Chris.

**********************
Chris Andrew, CCNA, CCSA
chris@iproute.co.uk
**********************

 

[Rpinfo]

We have a saved previous version checked and working. We cannot connect a GUI client because of wrong version actually running. Could "FW unload" solve the problem? or FW Load ???

Raffaele

 

[ChrisAC]

I thought that you were refering to a previous security policy, not a completely different firewall version!

So, what exactly are you trying to do? Restore a previous firewall installation? Restore a security policy?

If you just can't connect to the firewall because you are running the wrong version of the GUI then just use the correct version to connect. If you can't connect using the correct version because the security policy is blocking your IP address then just issue "fw unload local" at the command line and then you will be able to login via the GUI and change the security policy.

Chris.

**********************
Chris Andrew, CCNA, CCSA
chris@iproute.co.uk
**********************

 

[Rpinfo]

Chris,

Great! the security policy was blocking our ip addresses. With the command suggested by you "fw unload local" now we have again the full control. I guess we need to add on the top the of security policy the rules to access always the FW. Are these rules right?:

fwadmin@any ---> mgtserver--->FW1_fgmt ---> Client Encryption

and for GUI

gui-client ---> mgtserver-->cpmi-->Accept

Many thanks

Raffaele

 

[ChrisAC]

I normally have a group of management IP addresses which I create a rule for to allow them to access the firewall using CPMI (and some other FW-1 ports), ssh, ftp and https.

mgmt_IPs > firewall > CP_mgmt > allow

Under that put a stealth rule in as well,

Any > firewall > any > drop.

Chris.

**********************
Chris Andrew, CCNA, CCSA
chris@iproute.co.uk
**********************

 

[Piloria]

remember to add any GUI clients in cpconfig