Backing up and managing network device configurations

A failed device can be replaced; without its configuration, rebuilding the same VLANs, routes and ACLs from memory takes hours. And a large share of outages start right after a configuration change. That makes config backup and management one of the cheapest, most effective things a network team can do.

Why manual backups aren't enough

• They happen when someone remembers — rarely right before a failure.
• Nobody knows which file is newest, or what changed between two.
• Files end up on one person's laptop or an uncontrolled share.
• There's no record of who changed what, and when.

How automatic config backup works

The system connects over SSH (or Telnet for older gear) on a schedule, reads the configuration and stores a new version whenever it differs. The result is a full history you can diff and restore from.

Notes for common vendors

• Cisco IOS: show running-config; volatile lines such as last-change timestamps must be ignored to avoid false changes.
• MikroTik RouterOS: /export is text and diffable; .backup files are binary and aren't.
• HP/Aruba: show running-config, much like Cisco.

Beyond backup: drift and compliance

• Drift detection: compare the actual config with the desired one and alert on differences.
• Compliance: rules such as “Telnet must be disabled”, “no default SNMP community” or “NTP must be set” are checked on every config, with violations reported.
• Security audit: review a config against a security checklist and propose remediation commands.

Change control: the four-eyes principle

In sensitive environments no change to core devices should go in without a second reviewer. The change is proposed with its exact commands, the text is frozen, another user approves, it's applied with the full transcript recorded, and drift and compliance are re-checked immediately. All of it lands on a change calendar, so the first incident question — “what changed?” — has an answer in seconds.

Getting started

1. List the devices to back up (core, edge and firewalls first).
2. Create a read-only backup user on each device.
3. Enable daily automatic backups with versioning.
4. Keep a copy off the main server (for example S3/MinIO).
5. Define a few baseline compliance rules and grow them.
6. Require four-eyes approval for changes to critical devices.

Conclusion

Automatic config backup is cheap insurance, and with diffs, compliance and approval it becomes full change control. BehMon configuration management does all of it, with ready-made baselines for Cisco, MikroTik and HP/Aruba.