HP

This guide covers HP Comware switches and routers (HP A-series, H3C, 3Com), ProCurve / ArubaOS-Switch devices, BladeSystem enclosures (Onboard Administrator), MSA storage arrays, and MSM wireless controllers.

Comware (HP A-series, H3C, 3Com)

Create a backup account. Displaying the full running configuration on Comware requires management-level rights (network-admin on Comware 7, level 3 on Comware 5); the read-only operator level is not sufficient. On Comware 7:

system-view
local-user netwatch-backup
 password simple <password>
 service-type ssh
 authorization-attribute user-role network-admin
 quit

On Comware 5, replace the role line with authorization-attribute level 3.

Enable SSH.

ssh server enable
ssh user netwatch-backup service-type stelnet authentication-type password
line vty 0 15
 authentication-mode scheme
 protocol inbound ssh

On Comware 5 the VTY commands are entered under user-interface vty 0 15 instead of line. To restrict management access, apply an ACL to the SSH service or the VTY lines permitting the Netwatch collector's IP.

ProCurve

Applies to ProCurve and ArubaOS-Switch devices (for example the 2500–5400 series).

Create a backup account. The operator level cannot display the full configuration; a manager-level login is required:

crypto key generate ssh
password manager user-name netwatch-backup

Enter the password when prompted. (crypto key generate ssh is only needed once, before enabling SSH.)

Enable SSH.

ip ssh

To restrict management access to the Netwatch collector:

ip authorized-managers <collector-ip> 255.255.255.255 access manager

Take care to include your own management stations in the authorized-managers list before applying it.

BladeSystem (Onboard Administrator)

Create a backup account. In the Onboard Administrator web UI, create a local user netwatch-backup under the enclosure's user/authentication settings. An operator-level (read) account with access to the enclosure is normally sufficient to display the configuration script; use an administrator account only if your OA firmware restricts configuration display.

Enable SSH. SSH is enabled by default on the OA management interface. If you use the OA's trusted-host/IP restriction features, add the Netwatch collector's IP.

Notes. In redundant-OA enclosures, add the enclosure's active OA address to QUARK; the standby OA mirrors the configuration.

MSA

Applies to MSA storage arrays (for example MSA 1040/2040/2050).

Create a backup account. In the array's management UI, create a user netwatch-backup with the monitor (read-only) role and CLI/SSH access enabled for the account. The monitor role can display the array configuration, which is all QUARK needs.

Enable SSH. The CLI over SSH is enabled by default on the management controllers. Confirm both controller management IPs are reachable from the Netwatch collector, and restrict management access to the collector's IP if you filter it upstream.

Notes. QUARK records the array's configuration (not the data volumes' contents).

MSM (wireless controller)

Applies to MSM7xx wireless controllers.

Create a backup account. Create a dedicated netwatch-backup manager account in the controller's management settings; manager rights are required to display the full configuration.

Enable SSH. Enable SSH access to the controller's CLI in its management settings, and confirm reachability from the Netwatch collector. If the controller's management access controls allow source restrictions, permit only the collector's IP and your management stations.

Notes. Controlled APs do not need preparation; their provisioning is contained in the controller configuration.

Enable backup in Netwatch

Once the device is prepared, open its host in Netwatch (Data collection > Hosts) and add the Config Backup macros — the supported status flag, the model code for this platform, and the credentials you created. See Getting started for the full macro list and values.