NetCrosswalk: Cross-Vendor Network Task Translator

Steps

1. Binary backup (full, device-specific): /system backup save name=router-2026-09-08 — then download it from Files.
2. Text export (portable, reviewable): /export file=router-2026-09-08
3. Include secrets in the export (RouterOS 7): /export show-sensitive file=full-config
4. GUI: Files → *Backup* button for binary; New Terminal for the export.

Changed across versions

• 6.x/export includes secrets (PPP passwords, WPA keys, API credentials) in the output by default — no extra flag needed.
• 7.x/export hides sensitive values by default; you must add show-sensitive to get the same secrets RouterOS 6 gave you for free. An export taken without it restores everything except credentials, and nothing warns you at restore time.

Gotchas & notes

• The two formats are not interchangeable. A binary .backup restores everything including keys and MAC addresses but is tied to the same RouterOS version and model. A .rsc export is plain text, portable, and diffable — but excludes passwords and certificates unless you use show-sensitive.
• Take both. The binary for fast same-device recovery, the export for reading, diffing, and rebuilding on new hardware.
• /export compact (the default in v7) only shows non-default values, which is great for review; /export verbose prints everything if you need the full picture.
• Files stored on the router are lost in a factory reset — download them, do not just create them.

Steps

1. GUI: click the admin avatar / user menu in the top-right → Configuration → Backup → choose *Local PC*, optionally tick Encryption and set a password.
2. CLI: execute backup config tftp <filename> <tftp-server-ip> (also supports ftp, scp, usb).
3. Restore: same menu → Configuration → Restore.
4. Check what you got: the file is text and starts with #config-version=...

Gotchas & notes

• The backup is in the user menu at the top right, not in System. This is the single most-asked 'where is it' question on FortiOS.
• Without the Encryption option, private keys and certificates are not included. An unencrypted backup restores your policies but not your VPN certs. Encrypt it, and store the password somewhere you will still have it during an outage.
• With VDOMs enabled you must back up Global to capture everything; a VDOM-scoped backup contains only that VDOM and restoring it will not rebuild the system config.
• A config file only restores cleanly to the same model and a compatible firmware version. The #config-version header line records both — check it before a restore.
• Automate it: System → Automation (or config system automation-stitch) can push a scheduled backup, which is far better than remembering.

Steps

1. Settings → System → Backups → *Download Backup* (choose how much history to include).
2. Auto-backups: configure the schedule and retention on the same page.
3. Site-only export: Settings → System → Backups → Export Site (moves one site between controllers).
4. Restore: on a fresh controller, choose *Restore from backup* during setup.

Gotchas & notes

• There are two different exports: a full controller backup (.unf, all sites, all history, device adoption state) and a *site export* (.unf site-only, for moving a site to another controller). Using the wrong one during a migration is a common misstep.
• Restores are version-sensitive — you generally cannot restore a backup into an older controller version. Note the controller version alongside the file.
• Backups live on the controller by default. If the Cloud Key's disk is the thing that failed, so is your backup. Download them off-box or configure remote/cloud backup.
• A restore re-adopts devices, which needs them reachable and, in some cases, factory-reset — it is not the instant operation people expect.
• Device firmware is not part of the backup; a restored site may push a provision that mismatches current device firmware.

Steps

1. Save to NVRAM (survives reload): copy running-config startup-config (or write memory).
2. Off-box: copy running-config tftp: — or scp:/ftp: — and answer the prompts.
3. Local archive: archive → path flash:/backup/config → write-memory, then archive config.
4. Verify: show startup-config | include hostname and show archive.

Gotchas & notes

• copy running-config startup-config is not a backup, it is a save. It protects you from a reload, not from a bad change or a dead device. Both steps are needed.
• Configure the archive feature with write-memory so every copy run start automatically snapshots a copy — this gives you configure replace rollback, which is the closest IOS has to a candidate config.
• Passwords in the config are stored as type 7 (trivially reversible) or type 5/8/9 hashes. A config in a git repo or a ticket is a credential leak — treat backups as secrets.
• show running-config output omits some defaults; a config restored from it is usually equivalent but not byte-identical.
• On IOS-XE, also consider copy running-config nvram:startup-config explicitly if the platform has multiple config stores.

Steps

1. Device → Setup → Operations: *Export named configuration snapshot* (a specific saved config) or *Export configuration version*.
2. For the live config: *Save named configuration snapshot* first, then export it.
3. Device state (includes certs and licences): *Export device state*.
4. CLI: scp export configuration from running-config.xml to user@host:/path
5. Restore: *Import named configuration snapshot* → then Load it → then Commit.

Gotchas & notes

• PAN-OS keeps a candidate, a running, and a stack of saved versions. running-config.xml is what is live; a snapshot you saved is not. Know which one you are exporting.
• Importing a config does not apply it. You must Import, then *Load named configuration snapshot*, then Commit — three steps. Stopping after the import is a frequent restore failure.
• *Export device state* is the one to take before an RMA: it bundles the config plus certificates, licences, and (on Panorama-managed units) the managed-device list.
• Device → Config Audit diffs any two config versions and is excellent for 'what changed since Tuesday' — no other vendor here has it built in.
• PAN-OS auto-saves a version on every commit, so rollback via *Load configuration version* is usually faster than restoring a file.

Steps

1. Diagnostics → Backup & Restore → Backup & Restore tab → *Download configuration as XML*.
2. Optionally tick Encrypt this configuration file and set a password.
3. Consider unticking *Backup RRD data* for a much smaller file.
4. Restore: same page → *Restore configuration* → pick the area (ALL or a single section).
5. Automatic: the AutoConfigBackup service (Netgate account) or a cron/API job.

Gotchas & notes

• The config is a single config.xml containing everything, including secrets in cleartext or reversible form — VPN pre-shared keys, RADIUS passwords, certificates. Encrypt it, and never paste it into a ticket.
• Selective restore is the underrated feature: you can restore just *Firewall Rules* or just *DHCP Server* from an old backup instead of rolling back the whole box.
• pfSense keeps local config history in Diagnostics → Backup & Restore → Config History — the last 30 changes with a one-click revert and a diff. Check there before hunting for a file.
• Installed packages are recorded but their data may not be; after a restore, packages reinstall and some need reconfiguration.
• RRD data makes the backup large and is only monitoring graphs — exclude it for routine backups.

Steps

1. Device → Settings → Firmware and Backups (Gen7 UI; older builds label it Manage → Updates).
2. Click Export Settings — this downloads a proprietary settings file (not plain text) to your PC. This is your portable backup.
3. Separately, the same page lets you create an on-box Backup snapshot of the current firmware+settings pair before you make risky changes — this is stored on the appliance itself, not on your PC.
4. If Capture Security Center / MySonicWall cloud backup is licensed and enabled, backups can also sync to the cloud automatically.
5. Restore: same page → Import Settings, pick the file, confirm reboot.

Gotchas & notes

• The exported file is a binary blob, not text. Unlike FortiGate's #config-version=... text file, you cannot open it, diff it, or hand-edit it before restoring.
• There is no CLI equivalent. Export/Import Settings only exist as a browser file download/upload in the GUI — you cannot script a backup over SSH the way you can on MikroTik (/export) or Cisco (copy running-config). If you need unattended, scheduled backups you're relying on MySonicWall cloud backup licensing, not a local script.
• The on-box Backup snapshot (as opposed to the exported file) is tied to that physical appliance's serial number — it is not a portable disaster-recovery copy, it's a local undo point before firmware/config changes.
• A settings file restores cleanly only to the same model and a compatible firmware version; cross-model restores are not supported and will be rejected or partially applied.

Steps

1. Cloud-managed routers, Orbi Pro APs, and Insight-managed switches (no local CLI on this path): Insight Cloud Portal → Devices → double-click the device → Configuration Backup & Restore → Create Backup (or +), give it a name/description → Create Backup Now. Insight keeps up to 3 backups per device.
2. Location-level version: Locations → select a location → Settings → Configuration Backup & Restore for a bundled backup of everything at that site.
3. Insight app equivalent: open the device → Backup & Restore → Backup Now (same 3-generation limit).
4. Smart Switches also have a *separate* local-GUI export: log into the switch's own HTTPS UI → Maintenance → Backup Configuration (downloads a binary .cfg to your PC) — this is independent of, and does not sync with, the Insight cloud backup.
5. M4200/M4300 (real CLI): first persist the running config with copy system:running-config nvram:startup-config, then export it as a portable text file with copy nvram:startup-config <tftp://server-ip/filename> (also supports usb:/scp:). This file is a plain CLI-command script, not a binary blob.

Gotchas & notes

• You get up to three completely different 'backup' concepts depending on what box you're touching: an Insight cloud backup (routers/APs/managed switches), a local-switch-GUI binary export (Smart Switches only), and a TFTP/USB text config (M4200/M4300 only) — none of them restore across each other.
• Insight cloud backups are per-device settings; NETGEAR's own documentation notes a restored backup does not bring back wireless or VLAN settings, so don't treat an Insight 'restore' as a full disaster-recovery undo for an AP or switch VLAN layout — verify those separately after restoring.
• There is no scheduled/automatic backup for Insight-managed routers or Orbi Pro APs — someone has to click Create Backup manually, and only the last 3 are kept, so an old known-good backup silently ages out.
• The M4300 export is a CLI script (like Cisco's), so it's relatively version-tolerant on the same model, but you cannot skip the copy system:running-config nvram:startup-config save step first — trying to copy nvram:startup-config tftp://... right after making changes without saving will export the *old* startup-config, not what's currently running.
• Routers and Orbi Pro APs have zero CLI, so there is no show running-config-style text export for them at all — the Insight cloud backup is the only copy you will ever get off the box.