Netgate

This guide covers Netgate appliances and virtual machines running TNSR. For pfSense, see the separate pfSense guide.

TNSR

Create a backup account. TNSR authenticates CLI users against the underlying host system, so create a dedicated system user — for example netwatch-backup — on the TNSR host and grant it access to the TNSR CLI per the TNSR user-management documentation. The account needs rights to display the running configuration; it does not need permission to change configuration, so use the most restrictive role your TNSR version offers that can still show the full running dataset.

Enable SSH. TNSR management is performed over SSH by default; make sure the host SSH service is enabled on the management interface and reachable from the Netwatch collector. Use TNSR's host ACL or firewall configuration to restrict SSH on the management interface to the collector's IP address.

Platform notes.

• QUARK retrieves the configuration by running the CLI's show-configuration commands over SSH; the RESTCONF API is not required and can remain disabled.
• If you enable client-certificate or key-based authentication for management access, you can register the collector's SSH public key for the backup account instead of a password.

Enable backup in Netwatch

Once the device is prepared, open its host in Netwatch (Data collection > Hosts) and add the Config Backup macros — the supported status flag, the model code for this platform, and the credentials you created. See Getting started for the full macro list and values.