Zyxel

This guide covers Zyxel platforms: classic ZyNOS devices, the GS-series and MGS-series switch variants, ZyNOS ADSL gateways, ZyNOS CLI DSLAMs such as the SAM1316, NDMS routers, and 1308-series switches.

ZyNOS

This applies to classic ZyNOS devices such as older Prestige routers and ES-series switches.

Prepare the account. Classic ZyNOS has a single administrator login rather than named users — set a strong admin password and store those credentials in QUARK. QUARK only reads the configuration and never modifies the device.

Enable management access. Most classic ZyNOS devices are managed over Telnet; SSH is absent on many models, so use Telnet where it is the only option. Many ZyNOS devices let you limit remote management to a Secured Client IP in the remote management settings — set it to the Netwatch collector's IP, or restrict access with an upstream ACL.

Notes. Isolate Telnet-only devices on a dedicated management VLAN.

ZyNOS (GS series)

This applies to GS-series managed switches.

Prepare the account. Create an admin-level login in the switch's management interface where the firmware supports multiple accounts; otherwise use the built-in admin credentials. Administrator access is required to display the full configuration — lower access levels are not sufficient.

Enable management access. Managed GS models offer SSH in their remote management settings — enable it and prefer it over Telnet. Use the switch's remote management access control to restrict sources to the Netwatch collector's IP.

Notes. Disable Telnet once SSH retrieval is confirmed.

ZyNOS ADSL

This applies to ZyNOS-based ADSL gateways (Prestige DSL models).

Prepare the account. These devices use a single administrator password; set a strong one and store it in QUARK.

Enable management access. Management is via the Telnet CLI on this generation. In the remote management settings, restrict the allowed management source (secured client IP) to the Netwatch collector's address, or apply an upstream ACL.

Notes. Verify a manual login and configuration display once before adding the device — menu and CLI behavior vary across firmware revisions.

ZyNOS CLI (DSLAMs)

This applies to ZyNOS CLI DSLAMs such as the SAM1316 and related IES/SAM shelves.

Prepare the account. Create a dedicated login through the DSLAM's user management where the firmware supports it, with rights to display the complete configuration; otherwise use the administrator credentials. Administrative access is generally required for a full configuration display.

Enable management access. These shelves are managed over the Telnet CLI on most firmware; enable SSH only if your release provides it. Restrict management to the Netwatch collector's IP with the shelf's management access controls where present, or an upstream ACL.

Notes. The configuration includes subscriber line provisioning, so the versioned history is useful for service restoration.

ZyNOS (MGS series)

This applies to MGS-series metro Ethernet switches.

Prepare the account. Create an admin-level login where supported, or use the built-in admin account with a strong password. Full configuration display requires administrator access.

Enable management access. Enable SSH in the remote management settings where the firmware provides it; otherwise use Telnet. Restrict management sources to the Netwatch collector's IP using the switch's access control settings or an upstream ACL.

Notes. Confirm configuration retrieval manually once after setup.

NDMS

NDMS runs on Keenetic-era Zyxel routers.

Prepare the account. Create a dedicated user in the device's web interface and grant it administrative rights — full configuration access requires them. Store the credentials in QUARK; QUARK never changes the configuration.

Enable management access. NDMS exposes a CLI over Telnet by default; later releases can add SSH through an installable system component — prefer SSH where available. Restrict management to the LAN/management interface and limit the source to the Netwatch collector's IP with the device's firewall rules.

Notes. Component sets differ between installations, so verify which CLI transport your device offers before adding it.

1308

This applies to Zyxel 1308-series switches.

Prepare the account. These switches use a single administrator login — set a strong password and store the credentials in QUARK.

Enable management access. Enable the strongest management transport the firmware offers (SSH where present, otherwise Telnet). The built-in source filtering is limited on this series, so restrict management access to the Netwatch collector's IP with an ACL on the upstream network.

Notes. Log in manually once and confirm the configuration can be displayed in full before adding the device.

Enable backup in Netwatch

Once the device is prepared, open its host in Netwatch (Data collection > Hosts) and add the Config Backup macros — the supported status flag, the model code for this platform, and the credentials you created. See Getting started for the full macro list and values.