Setting Up Config Backups

MantisNMS backs up the configuration of your firewalls, routers and switches once a day, keeps every change as a new version, shows you exactly what changed, and checks each backup against compliance rules. Setup takes three things: a probe that can reach the device, the device added as an SNMP sensor, and a read-only login MantisNMS can use. This page walks through each one, with the account to create on every supported vendor.

On this page: Supported devices · Before you start · Set up a backup · Vendor setup · How backups work · Restoring a config · Troubleshooting

Supported devices

MantisNMS picks the vendor automatically from what the device reports over SNMP (its ENTITY-MIB manufacturer, model and sysDescr). There is nothing to choose per device.

Before you start

• A probe at the site. Backups run from your MantisNMS probe, not from the cloud, so the device's management interface never has to be reachable from the internet. See Installing a Network Probe.
• The probe can reach the device on UDP 161 (SNMP, to identify the device) and TCP 22 (SSH, to read the config). SSH must be on port 22. Check any firewall between the probe and the management interface, including the device's own management access list or trusted-hosts setting.
• The device is an SNMP sensor in MantisNMS with system information collected (the default for new SNMP sensors). Devices only appear on the Config page once their make is detected. See Sensors.
• A login for backups. Create a dedicated, read-only account on the device (see Vendor setup). The probe signs in with a username and password; SSH-key login isn't used for backups yet, so the device must accept password (or keyboard-interactive) authentication for that account.

Set up a backup

1. Create the backup account on the device using the steps for your vendor below.
2. Save the login in the Customer Portal. Go to portal.mantisops.net → Credentials → add a credential of type SSH with the Username and Password. Fill in Enable password only if the device needs a separate password for enable mode (Cisco, Arista, HPE); left blank, the login password is used. Assign the credential to the company or site the probe belongs to. Credentials are encrypted at rest and are never shown again after you save them.
3. Optional: use a different login for one device. In MantisNMS, edit the SNMP sensor and pick it under Config backup login (SSH). Otherwise the device inherits the SSH credential of the probe's site, then its company.
4. Start the first backup. In MantisNMS open Monitor → Config backups, select the device and click Backup now (or select the device on the network map and click Back up now in its side panel). The probe picks the job up on its next check-in, usually in under a minute. Backup now also turns on Auto-backup daily.
5. Check the result. The device shows backed up and the first version, initial backup. If it shows error, the message under Last backup failed says why; see Troubleshooting.

Viewing the Config backups page needs the Sensors permission; starting backups, changing settings and trusting a new host key need permission to edit sensors.

Vendor setup

In every case, create an account used only by MantisNMS, give it the least access that can still read the whole configuration, and restrict where it can sign in from if the device supports it. A login that can see only part of the config produces a partial backup.

Fortinet FortiGate

Turn off console paging. FortiOS pages long output with --More--, which would cut the backup short. MantisNMS detects this and refuses to save the copy, so set the console to standard output first (in a multi-VDOM setup, run it under config global):

config system console
    set output standard
end

Create a read-only profile and admin. Give every permission group read access so no section is hidden from the export, and allow the CLI get and show commands, which a read-only profile doesn't have by default:

config system accprofile
    edit "mantis-backup"
        set secfabgrp read
        set ftviewgrp read
        set authgrp read
        set sysgrp read
        set netgrp read
        set loggrp read
        set fwgrp read
        set vpngrp read
        set utmgrp read
        set wanoptgrp read
        set wifi read
        set cli-get enable
        set cli-show enable
    next
end
config system admin
    edit "mantis-backup"
        set accprofile "mantis-backup"
        set password <password>
        set trusthost1 <probe-ip> 255.255.255.255
    next
end

Encrypted values (ENC strings) and private keys in the export are masked before the backup is stored.

Cisco IOS and IOS XE

Reading the full running and startup config needs privilege level 15. Either give the backup account privilege 15, or give it a lower level and put the enable secret in the credential's Enable password field. If you use TACACS+ or AAA command authorization, you can limit the account to show commands.

username mantis-backup privilege 15 algorithm-type scrypt secret <password>
line vty 0 15
 transport input ssh
 login local

IOS XE 17.18 / 26 and later in secure mode enforce complex passwords, and SNMPv1/v2c communities are no longer accepted. Use an SNMPv3 sensor so MantisNMS can identify the device. Paging is turned off automatically for the session.

Cisco NX-OS

Create a local user with a role that can run show running-config and show startup-config (for example network-operator), and make sure SSH is enabled (feature ssh). Paging is turned off automatically for the session.

Juniper (Junos)

The built-in read-only class can't read the configuration. Create a class with the view and view-configuration permissions, and a user in that class:

set system login class mantis-backup permissions [ view view-configuration ]
set system login user mantis-backup class mantis-backup authentication plain-text-password

Junos prompts for the password. Make sure SSH accepts password login: if system services ssh contains no-passwords (common on cloud images such as vSRX), remove it with delete system services ssh no-passwords, then commit.

Palo Alto Networks (PAN-OS)

Create an administrator with the built-in Superuser (read-only) role (superreader) under Device → Administrators, then Commit. Make sure SSH is allowed on the management interface profile, and add the probe's address to its permitted IPs if you use them. Paging is turned off automatically for the session.

Arista EOS

Create a local user that can run show running-config in privileged mode, for example with privilege 15, or a lower level plus the enable password in the credential's Enable password field. Paging is turned off automatically for the session.

HPE / Aruba ProCurve

The running config is readable at manager level. Use an account with manager access, or an operator login plus the manager password in the credential's Enable password field. Make sure SSH is enabled (ip ssh). Paging is turned off automatically for the session.

MikroTik RouterOS

Create a user in the built-in read group, which includes the ssh and read policies, and limit where it can sign in from:

/user add name=mantis-backup group=read password=<password> address=<probe-ip>/32

Cisco Meraki

Meraki devices are cloud-managed, so MantisNMS reads their settings from the Meraki Dashboard API instead of over SSH, and no probe access is needed for the backup itself.

1. In the Meraki dashboard, generate an API key for a read-only organization administrator (Organization → API & webhooks), and note the organization ID.
2. In the Customer Portal → Credentials, add a credential of type Cisco Meraki with the Dashboard API key and Organization ID, and assign it to the device's company or site.
3. In MantisNMS → Config backups, select the device and click Backup now. After that, Meraki settings are pulled once a day (06:00 UTC).

The device still needs to be added as an SNMP sensor so MantisNMS can identify it; it's matched to the dashboard by its IP address.

How backups work

• Daily schedule. With Auto-backup daily on, each device is backed up about every 24 hours. A failed attempt is retried on the next daily run; use Backup now after fixing the cause.
• A new version only when something changed. Each backup is compared with the previous one. Lines that change on their own (timestamps, “last configuration change” headers, build numbers, byte counts) and blank lines are ignored, so an unchanged device keeps showing no changes since vN. A real change is saved as a new version with a summary such as +3 / -1 lines, and an entry on the device's timeline.
• Compare and download. For each version you can view it, see the change from the previous version (Δ prev), compare any two versions, or download it as a text file. Downloads are recorded in your activity log.
• Secrets are masked. Passwords, enable secrets, hashes, keys, pre-shared keys, RADIUS/TACACS keys and SNMP communities are replaced with <secret:…> tokens before a config is stored. Each token is derived from the original value, so changing a password still shows up as a change in the diff without the password ever being stored.
• Incomplete copies are refused. If the device pages its output or answers with an error instead of its config (for example, the account lacks permission), the backup fails with an explanation and no version is saved, so a half-config never replaces a good one.
• SSH host keys are pinned. The first successful backup remembers the device's SSH host key. If a different key appears later, the backup is refused before any password is sent. If you replaced the device or regenerated its key, check that this is expected, then click Trust new host key on the device in Config backups.
• Compliance rules. Every backup is checked against built-in rules for the vendor (for example: Telnet disabled, no default SNMP community, password encryption, NTP and syslog configured), and against your own rules. A custom rule is a pattern the config must or must not contain, with a severity and remediation text. Turn rules on or off under Config backups → Compliance rules. New high or critical findings open an incident and notify you through your alert channels (email, Slack, Teams or webhook); the incident closes when a later backup passes.

Restoring a config

Where your platform supports it, apply with a safety net: commit confirmed on Junos, a configuration revision you can revert to on FortiGate and PAN-OS, or configure replace with a timer on Cisco IOS XE.

Troubleshooting

Still stuck? Email support@mantisops.net with the device's vendor, model, software version and the error shown on the Config page.