Cisco Prime - Automated Device Backup - TFTP/FTP/SFTP?

[Peter Hinton-Smith]

When Prime backs up switch configuration automatically how is it doing this TFTP/FTP/SFTP or via SNMP?

We have a requirement to encrypt the traffic and to backup regularly but I can't see anywhere to control the schedule or the method of backup.

[balaji.bandi]

Look at the example document :

https://www.cisco.com/c/en/us/td/docs/net_mgmt/prime/infrastructure/2-0/user/guide/prime_infra_ug/chgdevconfig.html

if you looking secure, then SFTP is best option.

[pieterh]

go to Administration / Servers / TFTP/FTP/SFTP Servers

you can add multiple entries to the same IP-address with a different protocol to use

create an entry with the correct IP-address and server-type SFTP and a name to recognize it as sftp-server

then select this reference to be used for configuration backup

[Peter Hinton-Smith]

I think I may have confused the matter by mentioning SFTP.

After looking into it I believe that Cisco Prime pulls the configuration of devices it knows about (switches, routers, etc...) using whatever settings you chose during Discovery i.e SNMPv3 and SSH.

Which means I need to implement SNMPv3 and SSH on all our network devices to ensure encryption.

[pieterh]

yes that is correct

you need ssh/https/snmpv3 to issue the command for config backup

AND you need a sftp server to receive the config over an encrypted connection.

alternatively you can send an encrypted configuration over a "normal" tftp/ftp connection

[Peter Hinton-Smith]

Does the configuration backup not get saved to the Cisco Prime box?

I thought you only needed an SFTP server if you were intending to save the configuration to an off-box repository?

[pieterh]

according to this doc Cisco Prime uses an integral TFTP/FTP server 

this suggests if you want to use SFTP you need to configure an external server