CCNA Security online course

Secure Cisco IOS Images and Configuration Files with IOS Resilient Configuration

Learn how Cisco IOS Resilient Configuration protects the running IOS image and startup configuration from remote deletion or tampering.

Why Protect IOS Images and Configuration Files?

A Cisco router depends on two stored assets for reliable operation: the IOS image and the startup configuration. The IOS image is the Cisco IOS software file used to boot and run the device. The startup configuration is the saved configuration loaded when the router starts.

The IOS image is commonly stored in flash, a nonvolatile file system. The startup configuration is traditionally stored in NVRAM, although some platforms use flash or another persistent file system. If either asset is deleted, replaced, or damaged, the router may fail to boot normally or may start without its intended configuration.

• Accidental deletion: An administrator may remove the wrong file while managing flash storage.
• Malicious remote access: A compromised administrative account could be used to alter or delete stored files.
• Image replacement: An unauthorized IOS image could change device behavior or prevent normal startup.
• Loss of startup configuration: Deleting the saved configuration can cause the device to restart with missing interfaces, routing, security, or management settings.

File protection is only one part of security. IOS Resilient Configuration does not replace device hardening, strong administrative authentication, authorization, secure management access, configuration backups, software integrity validation, or recovery planning. It protects selected stored copies against removal through remote sessions; it does not make the entire router secure by itself.

What Is Cisco IOS Resilient Configuration?

Cisco IOS Resilient Configuration is a Cisco IOS feature that creates protected working copies of the currently running IOS image and the startup configuration. Together, these protected copies are called the primary bootset or secure bootset.

The secure image archive is stored in flash. The protected startup configuration is stored as an archive file, normally in flash. The purpose is to preserve a usable image and configuration even if a remote user attempts to remove ordinary files.

Protected resilient-configuration files cannot be removed through remote sessions. Disabling IOS Resilient Configuration requires authorized access through the local physical console. This makes physical security important: protect the console port, restrict local access, and require change-control approval before disabling the feature.

Prerequisites and Operational Planning

Before enabling resilience, be comfortable with Cisco IOS command modes, the difference between running and startup configuration, flash and NVRAM file systems, and local console access. Confirm that the platform and IOS release support the commands used in this lesson.

1. Check that flash has enough capacity for the protected image and configuration archives.
2. Identify the IOS image that is currently running.
3. Review the running configuration and save the intended settings to startup configuration.
4. Enable image resilience and configuration resilience.
5. Verify both protected archives immediately.

Use reliable time settings, such as NTP, when timestamps are important for operations and audit records. See Configure NTP on a Cisco Router for related timekeeping practice.

Protect the Running IOS Image

The running image is the IOS image currently executing on the router. The image-resilience command copies that active image into a protected secure archive in flash.

From privileged EXEC mode, enter global configuration mode and enable image resilience:

Router# configure terminal
Router(config)# secure boot-image

A successful activation message indicates that IOS has created the protected copy of the currently running image. The exact wording can vary by platform and software release, so treat the success message as confirmation that image-resilience creation completed rather than relying on a particular punctuation or filename format.

During verification, the secure image archive details can include:

• Image filename: The IOS software file preserved in the archive.
• Archive type: The type or format identified by IOS for the protected image.
• File size: The amount of flash space used by the archive.
• Runnable status: Whether IOS identifies the archive as usable for execution or boot recovery.
• Entry point: The location from which the image begins execution.
• Run location: The storage location associated with the running or protected image.

Image resilience protects the selected copy at the time the command is issued. After a planned IOS upgrade, identify the new intended boot image, confirm flash capacity, and revisit the resilient copy so the protected bootset corresponds to the intended operational software.

Protect the Startup Configuration

The startup configuration is the saved configuration loaded during device startup. Before creating its protected archive, save the configuration you intend the router to use:

Router# copy running-config startup-config

Then enable configuration resilience from global configuration mode:

Router# configure terminal
Router(config)# secure boot-config

IOS reports successful configuration-resilience activation and creates a protected, timestamped configuration archive in flash. The generated filename and exact directory syntax are platform-dependent; use the verification command to identify the actual archive path.

IOS Resilient Configuration Commands

Verify the Primary Bootset

Use show secure bootset from privileged EXEC mode:

Router# show secure bootset

The command displays the protected secure bootset. After successful setup, output should contain both an IOS image resilience section and an IOS configuration resilience section.

Example End-to-End Workflow

1. Enter privileged EXEC mode and inspect the file systems and available flash capacity.
2. Identify the IOS image currently running and confirm that it is the intended software.
3. Review the running configuration.
4. Save the intended configuration with copy running-config startup-config.
5. Enter global configuration mode and run secure boot-image.
6. Run secure boot-config to protect the saved configuration.
7. Return to privileged EXEC mode and run show secure bootset.
8. Confirm that both protected archives are listed, with sensible paths, sizes, activation timestamps, and image metadata.

For a software upgrade, do not assume that an older protected image is automatically the desired rollback or recovery image. Identify the new image, verify available flash capacity, perform the normal upgrade checks, and validate or update resilient protection after the change. Likewise, refresh configuration protection after major approved configuration changes so the protected archive matches the intended startup state.

Troubleshooting

Only image resilience appears

If the secure bootset shows image resilience but no configuration resilience, the configuration command may not have been issued, or the intended startup configuration may not have been prepared and saved.

1. Run show secure bootset and review the listed archives.
2. Save the intended configuration with copy running-config startup-config.
3. Enable configuration resilience with secure boot-config.
4. Run show secure bootset again.

Only configuration resilience appears

If configuration resilience is present but image resilience is absent, image protection may not have been enabled or archive creation may not have completed successfully.

1. Confirm the active IOS image.
2. Check available flash capacity.
3. Enable image resilience with secure boot-image.
4. Verify again with show secure bootset.

A remote administrator cannot delete or disable the protected files

This is the expected behavior. IOS Resilient Configuration is designed to prevent removal of protected resilient files through remote sessions such as SSH or Telnet. If disabling the feature is legitimately required, use authorized local console access and follow physical-security and change-control procedures.

The protected configuration lacks recent changes

Changes may have remained only in running configuration when the archive was created, or the archive may predate later saved changes.

1. Compare the running and startup configuration state.
2. Save the intended changes.
3. Review the platform-supported workflow for refreshing resilient configuration protection.
4. Verify the resulting archive and activation information.

Security Boundaries and Related Practices

IOS Resilient Configuration protects stored resilient copies from remote removal. It does not prevent an attacker from changing the running configuration, obtaining administrative privileges, attacking management services, replacing other unprotected files, or gaining physical access to the device. Combine it with secure administrative access, AAA, SSH, control-plane protection, physical console security, backups, and recovery testing.

For related study, review Enable SSH on a Cisco Router, AAA Explained, Passwords on IOS Devices, Protect the Management Plane, and Protect the Control Plane.

Exam-Relevant Notes

• The IOS image is the software used to boot and run the router; the startup configuration is the saved configuration loaded at startup.
• IOS Resilient Configuration creates protected copies of the running IOS image and startup configuration.
• The protected pair is called the primary bootset or secure bootset.
• secure boot-image protects the currently running IOS image.
• secure boot-config protects the startup configuration as it exists when the command is issued.
• show secure bootset verifies resilience status and archive metadata.
• Protected resilient files cannot be removed through remote sessions, and disabling the feature requires local console access.
• Always save intended configuration changes before protecting or refreshing the startup-configuration archive.