VMware

This guide covers VMware NSX environments — NSX Edge configuration, NSX Edge firewall rules, and the NSX Distributed Firewall — all backed up through the NSX Manager REST API rather than SSH.

NSX Edge (configuration)

Create a backup account. In NSX Manager, create a dedicated local user (or map a directory account) named netwatch-backup and assign it the built-in Auditor role. Auditor is read-only and is sufficient for the API read operations QUARK performs; no administrator role is needed.

Enable API access. QUARK talks to the NSX Manager API over HTTPS (TCP 443) using the account's credentials. Allow the Netwatch collector to reach NSX Manager on port 443, and restrict that access to the collector's IP with your firewall or NSX Manager's management network controls. If NSX Manager uses a self-signed certificate, either install a trusted certificate or note the fingerprint so you can approve it when adding the device.

Notes. Add one QUARK device entry per edge you want tracked, pointing at the NSX Manager address with the edge's identifier. The versioned history captures the edge configuration as returned by the API.

NSX Edge (firewall rules)

Create a backup account. The same Auditor-role account described above covers firewall rule retrieval — create it once and reuse it. QUARK performs read-only API calls only.

Enable API access. Access requirements are identical: HTTPS (TCP 443) from the Netwatch collector to NSX Manager, restricted to the collector's IP.

Notes. Edge firewall rules are retrieved as a separate document from the full edge configuration. Add a distinct device entry per edge if you want independent change history for its firewall rule set — useful when rules change far more often than the rest of the edge configuration.

NSX Distributed Firewall

Create a backup account. Use the same read-only Auditor account in NSX Manager; it can read the distributed firewall configuration through the API.

Enable API access. As above, allow HTTPS (TCP 443) from the Netwatch collector to NSX Manager and restrict the source to the collector's IP.

Notes. The distributed firewall configuration is environment-wide, so add a single device entry per NSX Manager. Rule sets in large environments can be sizeable; the versioned history makes rule changes easy to diff and attribute over time.

Enable backup in Netwatch

Once the device is prepared, open its host in Netwatch (Data collection > Hosts) and add the Config Backup macros — the supported status flag, the model code for this platform, and the credentials you created. See Getting started for the full macro list and values.