Juniper

This guide covers Junos devices (EX, QFX, MX, SRX, ACX, PTX and related families) and legacy ScreenOS (NetScreen) firewalls.

Junos

Junos runs on Juniper routers, switches, and firewalls, including the EX, QFX, MX, SRX, ACX, and PTX series.

Create a backup account. Create a dedicated login class that can view the configuration but not change it, and assign it to a netwatch-backup user:

set system login class netwatch-backup permissions view
set system login class netwatch-backup permissions view-configuration
set system login user netwatch-backup class netwatch-backup
set system login user netwatch-backup authentication plain-text-password
commit

The view-configuration permission is required — the built-in read-only class alone is not sufficient to display the full configuration.

Enable SSH. SSH is often already enabled; if not:

set system services ssh
commit

To restrict management access to the Netwatch collector, apply a firewall filter to the loopback (lo0) interface that permits SSH only from the collector's IP address, or use the SRX host-inbound-traffic settings on the relevant zone.

Platform notes. No enable password exists on Junos; the login class fully controls what the account can see. Passwords and other secrets appear in encrypted form in the retrieved configuration.

ScreenOS (NetScreen)

ScreenOS runs on legacy NetScreen and SSG firewalls.

Create a backup account. Create a read-only administrator:

set admin user "netwatch-backup" password "your-password" privilege "read-only"
save

A read-only admin can run get config and display the full configuration.

Enable SSH. Enable the SSH service and permit SSH management on the interface QUARK will connect to:

set ssh version v2
set ssh enable
set interface ethernet0/0 manage ssh
save

Replace ethernet0/0 with your management interface. To restrict management access, define permitted management hosts with the ScreenOS permitted-IP settings so only the Netwatch collector can reach the device.

Platform notes. ScreenOS is end of life; very old firmware may only support weak SSH ciphers, in which case Telnet can be used as a fallback on isolated management networks.

Enable backup in Netwatch

Once the device is prepared, open its host in Netwatch (Data collection > Hosts) and add the Config Backup macros — the supported status flag, the model code for this platform, and the credentials you created. See Getting started for the full macro list and values.