Browse documentation
Backing up device configuration
↩ Devices
Switches, routers and firewalls can have their running configuration collected, kept with history, and compared version to version. It answers "what changed on this switch, and when?" without anyone having to remember.
You need an SSH credential first
Config backup uses its own credential slot on the device — an SSH credential, separate from the scanning profile that does SNMP polling.
Without one, the Config tab does not appear at all. It isn't greyed out or empty; it simply isn't there. If a switch has no Config tab, this is why.
The Config tab
Once a config credential is set, the device gains a Config tab showing:
- The current running configuration.
- Version history — each version with its size, how many lines were added and removed, and when it was collected and last verified.
- A diff between any two versions, side by side.
- Download — a version, or a diff as a unified patch.
- Fetch now for an on-demand collection.
If a collection fails, a last fetch failed banner says so rather than quietly showing stale text as if it were current.
Who can see the configuration
The version list is visible to anyone who can view the device. The configuration text itself requires Write.
That's deliberate, not an oversight: a device config contains SNMP community strings and VPN pre-shared keys. Someone with read-only access can see that a config changed and when, which is what they need for troubleshooting, without being handed the secrets inside it.
Scheduling backups
Settings → Config Backups defines scheduled backup profiles. A profile has a schedule and an assignment, which can be:
| Scope | Applies to |
|---|---|
| Device | One device |
| Site | Every eligible device at a site |
| Group | A device group |
| Device type | All switches, all routers, and so on |
| Global | Everything eligible |
Each profile shows a coverage count, so you can see how many devices it actually reaches — the quickest way to spot devices falling through the gaps.
Notes & tips
- Set the config credential when you add the device. It's easy to forget and invisible afterwards, because a missing tab looks like a feature that doesn't exist.
- Coverage counts are the thing to check after any bulk change — a global profile that reaches fewer devices than you expect usually means missing credentials.