Cisco 500 series Administration Manual page 376

Secure Sensitive Data
Configuration Files
Cisco 500 Series Stackable Managed Switch Administration Guide
• When copied from a source file, the copy will fail if the passphrase in the
source file is in plaintext. If the passphrase is encrypted, it is ignored.
• When directly configuring the passphrase, (non file copy), in the Running
Configuration, the passphrase in the command must be entered in plaintext.
Otherwise, the command is rejected.
• Configuration commands with encrypted sensitive data, that are encrypted
with the key generated from the local passphrase, are configured into the
Running Configuration. Otherwise, the configuration command is in error,
and is not incorporated into the Running Configuration file.
Backup and Mirror Configuration File
A device periodically generates its Mirror Configuration file from the Startup
Configuration file if auto mirror configuration service is enabled. A device always
generates a Mirror Configuration file with encrypted sensitive data. Therefore, the
File SSD Indicator in a Mirror Configuration file always indicates that the file
contains encrypted sensitive data.
By default, auto mirror configuration service is enabled. To configure auto mirror
configuration to be enabled or disabled, click Administration > File Management >
Configuration File Properties.
A user can display, copy, and upload the complete mirror and backup
configuration files, subject to SSD read permission, the current read mode in the
session, and the file SSD indicator in the source file as follows:
• If there is no file SSD indicator in a mirror or backup configuration file, all
users are allowed to access the file.
• A user with Both read permission can access all mirror and backup
configuration files. However, if the current read mode of the session is
different than the file SSD indicator, the user is presented with a prompt
indicating that this action is not allowed.
• A user with Plaintext Only permission can access mirror and backup
configuration files if their file SSD Indicator shows Exclude or Plaintext Only
sensitive data.
• A user with Encrypted Only permission can access mirror and backup
configuration files with their file SSD Indicator showing Exclude or
Encrypted sensitive data.
22
376