Nokia

This guide covers Nokia service routers running SR OS in the classic CLI (TiMOS) and in the model-driven CLI, including the 7705 SAR, 7210 SAS, 7450 ESS, 7750 SR, and 7950 XRS families and devices managed alongside NSP.

SR OS (TiMOS)

This section applies to SR OS devices operating in classic CLI mode.

Create a backup account. Create a dedicated local user with console access:

configure system security user "netwatch-backup" access console
configure system security user "netwatch-backup" console member "administrative"
configure system security user "netwatch-backup" password "your-password"
admin save

Displaying the complete configuration uses the admin display-config command, which the default read-only profile does not permit — hence the administrative profile above. If you prefer a tighter account, create a custom profile that permits only show commands and admin display-config, and assign that instead.

Enable SSH. The SSH server is enabled by default on SR OS. To restrict management access to the Netwatch collector, configure a management-access filter (configure system security management-access-filter) or a CPM filter permitting SSH only from the collector's IP address.

Platform notes. There is no separate enable password on SR OS; the user's profile fully determines command access. QUARK runs admin display-config and show commands only — it never enters the configure branch.

SR OS model-driven CLI

This section applies to SR OS devices running in model-driven configuration mode (7705 SAR, 7210 SAS, 7450 ESS, 7750 SR, 7950 XRS, and routers deployed with NSP).

Create a backup account. Create a local user with console access and a profile that can read the configuration:

edit-config private
configure system security user-params local-user user "netwatch-backup" password "your-password"
configure system security user-params local-user user "netwatch-backup" access console true
configure system security user-params local-user user "netwatch-backup" console member ["administrative"]
commit

As in classic mode, the administrative profile guarantees the account can display the full configuration; a custom profile limited to show and configuration-display commands also works if you prefer least privilege.

Enable SSH. SSH is enabled by default. Restrict management access to the Netwatch collector's IP address with a management-access filter or CPM filter, as in classic mode.

Platform notes.

• QUARK detects whether the device presents the classic or model-driven CLI and issues the matching commands automatically; you do not need to configure anything differently in QUARK for the two modes.
• On mixed-mode routers, back up from whichever CLI mode is authoritative for your configuration workflow; the retrieved output reflects the active configuration either way.
• If the router is managed by NSP, a direct SSH path from the collector to the router is still required.

Enable backup in Netwatch

Once the device is prepared, open its host in Netwatch (Data collection > Hosts) and add the Config Backup macros — the supported status flag, the model code for this platform, and the credentials you created. See Getting started for the full macro list and values.