SONiC

This guide covers data-center switches running Enterprise SONiC distributions.

Create a dedicated backup account

SONiC is Debian-based, so accounts are ordinary Linux users. From a shell on the switch:

sudo useradd -m -s /bin/bash netwatch-backup
sudo passwd netwatch-backup
sudo usermod -aG sudo netwatch-backup

Membership in the sudo group lets the account read the full configuration. On Enterprise SONiC builds that derive the CLI role from group membership, mirror the group memberships of the default admin user if the new account is denied show commands in the management CLI.

Enable SSH access

SSH is provided by the standard OpenSSH server and is enabled by default on the management interface. To restrict sources, use the distribution's control-plane ACL feature to permit SSH only from the QUARK collector's IP address, or enforce the same restriction in an upstream firewall.

Platform notes

• QUARK collects the switch configuration with read-only show commands (for example the management CLI's show running-configuration) and does not touch config_db.json or issue any config commands.
• If your fleet uses public-key authentication for automation accounts, you can install the collector's SSH public key in the account's ~/.ssh/authorized_keys instead of setting a password.

Enable backup in Netwatch

Once the device is prepared, open its host in Netwatch (Data collection > Hosts) and add the Config Backup macros — the supported status flag, the model code for this platform, and the credentials you created. See Getting started for the full macro list and values.