Aruba

This guide covers Aruba switches running AOS-CX, mobility controllers running AOS-W, and Aruba Instant access points.

AOS-CX

AOS-CX runs on the CX switch families, including the 6000, 6100, 6300, 6400, 8100, 8320/8325, and 8400 series.

Create a backup account. Add a user in the built-in operators group, which is read-only and can display the running configuration:

configure terminal
user netwatch-backup group operators password plaintext <password>

Enable SSH access. SSH is typically enabled during initial setup; ensure it is enabled in the VRF the collector will use:

ssh server vrf mgmt

Use vrf default instead if you manage the switch in-band. To restrict sources, apply an ACL or control-plane policy so only the collector's IP reaches TCP port 22.

Notes. No enable password exists on AOS-CX; group membership alone determines rights, so the operators account is all QUARK needs.

AOSW

AOS-W runs on Aruba mobility controllers and Mobility Conductor (7000 and 7200 series and their predecessors).

Create a backup account. Create a management user with the read-only role:

configure terminal
mgmt-user netwatch-backup read-only

You are prompted for the password. The read-only role can display the running configuration; the root role is not required.

Enable SSH access. SSH is enabled by default for management users. If you use firewall policies or a management access control list in front of the controllers, permit TCP port 22 from the collector's IP.

Notes. In a Mobility Conductor deployment, back up the conductor and each managed controller you want individual history for.

Aruba Instant

Aruba Instant runs on Instant access point (IAP) clusters, where one AP acts as the virtual controller.

Create a backup account. In the Instant web UI, add a dedicated administrator under the system administration settings (System > Admin). Use the read-only administrator option where your Instant release provides it; otherwise use a local admin account — QUARK only reads the configuration.

Enable SSH access. Instant APs accept SSH management on the virtual controller IP with the same credentials. Confirm the virtual controller IP is static and reachable from the collector, and restrict access to the collector's IP with your network ACLs (Instant offers limited built-in management filtering).

Notes. Always target the virtual controller IP, not individual AP addresses — the cluster configuration lives on the virtual controller and survives AP failover.

Enable backup in Netwatch

Once the device is prepared, open its host in Netwatch (Data collection > Hosts) and add the Config Backup macros — the supported status flag, the model code for this platform, and the credentials you created. See Getting started for the full macro list and values.