Wednesday, October 17, 2007

Cisco ASA issues: Configuration line too long

When trying to write the configuration to startup-config or doing something like copying the running-config to a file or remote system (tftp and the like) an error like "Configuration line too long" might occur.

When you issue a command that uses the running-config, like:

# copy running-config startup-config
# wr

or anything that uses the running config, a similar error could occur:

# wr
Cryptochecksum: deadbeef cafebabe feedface %Error
reading system:/running-config (Configuration line too long
Error executing command [FAILED]

This is actually a bug that occurs in version 7.2(1)25 or greater (includes 7.2(2)) of the firewall.

This is actually caused by "snmp-server" commands. One workaround is to remove such lines (you can add them later, it might "trick" it). Not all "snmp-server" lines seem to affect it either. Just remove them one at a time, and wr. See if it works.

Another workaround would be to downgrade to something pre-7.2(1)25 or upgrade to anything more recent than 7.2(2.2) or 8.0(0.141).

Either way, it can be a time consuming issue, and, although it's supposed to be a corner case, it's already happened to me on several occasions... and it took me a while to shotgun-debug my way to the offending line (as you can probably realize, it's NOT the longest line that causes the issue... in fact, it was one of the shorter lines... so it took a while to realize it's caused by the "snmp-server" lines. This was later confirmed by the Cisco bug database).