Cisco

This guide covers Cisco platforms running ACSW, AireOS, ASA, AsyncOS, CatOS, Catalyst Express, ExaLink Fusion (Nexus 3550-F), FireLinuxOS, IOS, IOS XR, NGA, NX-OS, SMA, SMB (Nikola series), UCS, Viptela and VPN3000. Many of these follow the same pattern — a dedicated account, SSH access, and privileged mode where the platform requires it to display the running configuration.

ACSW

Create a backup account. Create a dedicated account named netwatch-backup. Displaying the full running configuration requires an administrative role, so assign the account the highest available privilege or supply the enable password to QUARK with a lower-privilege login.

Enable SSH access. Enable the SSH server on the management interface and permit the collector's IP in any management access class you apply.

Notes. QUARK issues show commands only and never enters configuration mode.

AireOS

AireOS runs on Cisco Wireless LAN Controllers (2500, 3504, 5508, 5520, 8540 and WiSM series).

Create a backup account. Create a read-only management user — a read-only user can display the controller's full configuration:

config mgmtuser add netwatch-backup <password> read-only

You can also create the user in the web UI under Management > Local Management Users.

Enable SSH access. SSH is enabled by default on the management interface. Verify the collector can reach the controller on TCP port 22. To restrict management sources, use a CPU ACL (Security > Access Control Lists > CPU Access Control Lists) that permits the collector's IP.

Notes. If the controller authenticates management users via TACACS+ or RADIUS, create the account there with read-only management rights instead.

ASA

ASA runs on Cisco ASA 5500/5500-X firewalls and the ASA Services Module.

Create a backup account. Displaying the running configuration requires privileged EXEC mode. Create a privilege 15 user and let it drop straight into privileged mode:

username netwatch-backup password <password> privilege 15
aaa authentication ssh console LOCAL
aaa authorization exec LOCAL auto-enable

Without auto-enable, QUARK must also be given the enable password to reach privileged mode.

Enable SSH access. Generate an RSA key if one does not exist, then permit SSH from the collector on the appropriate interface — the ASA only accepts SSH from explicitly listed hosts, which acts as a built-in management ACL:

crypto key generate rsa modulus 2048
ssh version 2
ssh <collector-ip> 255.255.255.255 inside

Notes. In multiple-context mode, add each context you want backed up as its own device. QUARK never issues write or configuration commands.

AsyncOS

AsyncOS runs on Cisco Secure Email Gateway (ESA) and Secure Web Appliance (WSA).

Create a backup account. In the web UI, create a dedicated user named netwatch-backup under System Administration > Users. Assign the Operator or Read-Only Operator role — the account needs permission to display the appliance configuration from the CLI.

Enable SSH access. The AsyncOS CLI is reached over SSH on the management interface, enabled by default. Verify the collector can reach the appliance on TCP port 22, and permit the collector's IP in any network access list you configure for the management GUI/CLI.

Notes. AsyncOS can display the configuration with password fields masked or encrypted; QUARK works with either, but be aware that masked output is not restorable verbatim.

CatOS

CatOS runs on legacy Catalyst switches such as the 4000, 5000/5500 and 6000/6500 series in hybrid mode.

Create a backup account. CatOS commonly authenticates with a shared login password plus an enable password rather than named local accounts. Displaying the full configuration requires enable mode, so provide QUARK with both passwords. If your CatOS version supports local user accounts or TACACS+, create a dedicated netwatch-backup account there with enable-level authorization instead.

Enable management access. SSH is available only on crypto (K9) CatOS images; enable the SSH server after generating an RSA key, or fall back to Telnet on images without crypto support. CatOS supports permit lists for management access — restrict Telnet/SSH sources to the collector's IP.

Notes. These platforms are end-of-life; if SSH is unavailable, place the device on a protected management VLAN before enabling Telnet.

Catalyst Express

Catalyst Express 500/520 switches are managed only through the web-based Device Manager.

Create a backup account. Set the device management username and password in the Device Manager; the platform does not support multiple local accounts, so QUARK uses the same administrative credentials.

Enable management access. Ensure the collector can reach the switch's management IP over HTTP/HTTPS; there is no SSH CLI on this platform.

Notes. Configuration retrieval on this platform is limited compared to IOS switches; QUARK versions what the device exposes through its management interface.

ExaLink Fusion (Nexus 3550-F)

Create a backup account. Create a dedicated netwatch-backup account through the device's management CLI or web interface with rights to display the device configuration; prefer a read-only role where your firmware provides one.

Enable SSH access. The Fusion is managed over SSH on its management port. Verify the collector can reach the management IP on TCP port 22.

Notes. QUARK reads the layer-1 cross-connect and system configuration with show commands only.

FireLinuxOS

FireLinuxOS runs on Cisco Firepower (former Sourcefire) appliances.

Create a backup account. Create a dedicated netwatch-backup administrator on the appliance (in the local user management of the device's web UI or CLI). The account must be able to display the device configuration from the CLI; read-only analyst roles are not sufficient on all versions, so use an administrator role if show access fails.

Enable SSH access. Enable SSH management access on the appliance's management interface and permit the collector's IP address in the appliance's access list for management connections.

Notes. For devices managed by a Firepower Management Center, policy content lives on the FMC; QUARK collects the local device configuration visible from the appliance CLI.

IOS

IOS and IOS XE run on Catalyst switches, ISR/ASR routers and many other Cisco platforms.

Create a backup account. show running-config requires privilege 15, so create the account at privilege 15, or create a lower-privilege account and give QUARK the enable secret:

username netwatch-backup privilege 15 secret <password>

Enable SSH access. Ensure a hostname and domain name are set, generate an RSA key, then restrict the VTY lines to SSH with local login:

crypto key generate rsa modulus 2048
ip ssh version 2
line vty 0 4
 login local
 transport input ssh

To restrict management sources to the collector:

access-list 10 permit host <collector-ip>
line vty 0 4
 access-class 10 in

Notes. If AAA (TACACS+/RADIUS) is in use, create the account on the AAA server with privilege 15 exec authorization. QUARK never writes to the device or saves the configuration.

IOS XR

IOS XR runs on ASR 9000, NCS and CRS series routers.

Create a backup account. Create a user in a group that can display the running configuration; netadmin is the simplest built-in choice, or define a custom task group with read-only access if you want tighter scoping:

username netwatch-backup
 group netadmin
 secret <password>

Enable SSH access. Enable the SSH server (classic IOS XR requires the k9/security package and an RSA key):

ssh server v2

Permit the collector's IP in any management-plane protection or VTY access list you apply.

Notes. QUARK reads the running configuration in EXEC mode; the account never needs commit rights.

NGA

The NetFlow Generation Appliance (NGA 3140/3240) is managed through a web UI and a CLI.

Create a backup account. Create a dedicated netwatch-backup administrator in the appliance's user management — administrative rights are required to display the full configuration.

Enable SSH access. Enable SSH on the management interface and verify the collector can reach the appliance on TCP port 22.

Notes. QUARK retrieves the configuration with show commands only.

NX-OS

NX-OS runs on Nexus and MDS data-center switches.

Create a backup account. The built-in network-operator role has read access to the device, including the running configuration:

username netwatch-backup password <password> role network-operator

Enable SSH access. SSH is enabled by default (feature ssh). Verify the collector can reach the mgmt0 or in-band management address on TCP port 22, and permit the collector's IP in any management ACL applied to the management interface.

Notes. If your environment uses AAA, create the account there and map it to network-operator. On some platforms certain sensitive sections (for example SNMP communities) are hidden from network-operator; use network-admin only if your backups must include them.

SMA

The Content Security Management Appliance (SMA) runs AsyncOS for management.

Create a backup account. In the web UI, create a netwatch-backup user under Management Appliance > System Administration > Users with an Operator or Read-Only Operator role that can display the appliance configuration from the CLI.

Enable SSH access. SSH to the management interface is enabled by default; verify reachability from the collector on TCP port 22 and permit the collector's IP in any management access list.

Notes. The same considerations as the AsyncOS section apply, including masked password fields in displayed configurations.

SMB (Nikola series)

This covers Cisco Small Business switches (SG/SF 200, 220, 250, 300, 350, 500 series).

Create a backup account. In the web UI under Administration > User Accounts, create netwatch-backup with Read/Write Management Access (privilege 15). On these switches a read-only user cannot display the full running configuration, so the top privilege level is required.

Enable SSH access. Enable the SSH service under Security > TCP/UDP Services. If you use management access profiles, add a rule permitting the collector's IP address.

Notes. Lower-end models (200 series) expose only a limited CLI or are web-managed; QUARK collects what the platform's CLI exposes.

UCS

UCS Manager runs on UCS Fabric Interconnects.

Create a backup account. In UCS Manager, create a netwatch-backup local user under Admin > User Management and assign the read-only role — it can display the system configuration over the CLI.

Enable SSH access. SSH to the Fabric Interconnect management IPs (and the cluster IP) is enabled by default; verify the collector can reach them on TCP port 22.

Notes. Add the cluster management IP as the device so backups follow the primary Fabric Interconnect during failover.

Viptela

Viptela software runs on Cisco SD-WAN (vEdge) routers and controllers.

Create a backup account. Create a dedicated netwatch-backup user on the device (or push it via a vManage device template so it survives template overwrites). Assign a group with read-only privileges that can display the running configuration.

Enable SSH access. SSH is the standard management method; verify the collector can reach the device's management or system IP on TCP port 22 and permit it in any control-plane ACL.

Notes. On template-managed devices, any locally created account is removed the next time a template is pushed — always define the backup account in the template.

VPN3000

The VPN 3000 Concentrator series (3005–3080) is a legacy platform managed via a web UI and a menu-based CLI.

Create a backup account. In the web UI, create a dedicated administrator under Administration > Access Rights > Administrators. Grant rights sufficient to view the configuration; modification rights are not needed.

Enable management access. Enable SSH in the concentrator's management protocol settings (Telnet is the fallback on very old software), and use the management access control lists to permit the collector's IP.

Notes. This platform is long end-of-life; keep its management interface on a protected network.

Enable backup in Netwatch

Once the device is prepared, open its host in Netwatch (Data collection > Hosts) and add the Config Backup macros — the supported status flag, the model code for this platform, and the credentials you created. See Getting started for the full macro list and values.