Restorepoint Plug-in Guide. Version 4.0

Transcription

1 Restorepoint Plug-in Guide Version 40 Contents 1 Overview 2 2 Supported Devices 3 3 Real-time Change Detection 5 4 Device-specific Settings 6 5 Generic push plugin 27 6 Copyright notice 30 1

2 Overview This guide provides additional configuration instruction for some of the devices supported by Restorepoint New device plug-ins are continuously being developed; please check the Restorepoint web site for the latest updates In addition to the devices that are specifically supported by Restorepoint, you may also use the generic push plug-in, which add support for any device which is capable of uploading its configuration to an FTP server; please see Section 5 for more information Restorepoint can automatically detect when the configuration of some devices change, and initiate a configuration backup if required; please see Section 3 for more information Also check Table 1 to see which devices support this feature Please note that manufacturers may change their device specifications and backup/restore procedures without notice, and this may affect the correct operation of Restorepoint In such situations, Restorepoint will attempt to release a software update to resolve the issue wherever possible 2

3 Supported devices Table 1 lists all the network devices and platforms currently supported by Restorepoint Vendor Product Software Tested Protocols Real-time 3Com SuperStack x, 6x telnet/tftp Alcatel Omnistack 1x telnet/tftp Alcatel Omniswitch 63 telnet/ftp Allied Telesis AT Switches 30 telnet/tftp Array Networks SPX ArrayOS 83 SSH/TFTP Aruba Controllers ArubaOS 34 telnet/ssh/tftp Astaro Security Gateway 83 SSH Barracuda Networks Web Filter (1) (2) 3x FTP Barracuda Networks Spam Firewall 3x HTTP Bloxx TVT (1) (2) 4x FTP Blue Coat PacketShaper 84 SSH/FTP Blue Coat ProxySG SGOS 4, 5, 6 SSH/FTP Brocade FastIron 4x SSH/TFTP Brocade Fabric Switches Fabric OS 5, 6 SSH/FTP Brocade Fabric Switches Fabric OS 5, 6 SSH/FTP Check Point SecurePlatform (DB Export) NGX R65, R70 SSH/TFTP/SCP Check Point UTM Edge X 7x SSH Check Point Gaia NGX R7540 SSH/TFTP/SCP Check Point Provider-1 NGX R65, R70 SSH/TFTP/SCP Check Point SecurePlatform NGX R65, R70 SSH/TFTP/SCP Check Point Security Gateway 80 R71 SSH/TFTP/SCP Cisco ACE SSH/telnet Cisco ASA/FWSM ASA 7, 8 SSH/telnet/TFTP/SCP Yes Cisco CatOS Switches/Routers CatOS telnet Cisco CSS telnet Cisco IOS Switches/Routers IOS 12 SSH/telnet/TFTP/SCP Yes Cisco Ironport (2) AsyncOS 71, 75 SSH Cisco MDS SAN-OS 31 SSH/telnet/TFTP Cisco Nexus Switches/Routers NX-OS 4 SSH/telnet/TFTP Yes Cisco PIX Firewall PIX 5-8 SSH/TFTP Yes Cisco Wireless LAN Controller 50 telnet/tftp Citrix Netscaler 91 SSH/SCP Consentry LANShield LANShield OS 3 telnet/tftp Crossbeam C-Series COS 611 SSH/SCP Crossbeam X-Series XOS 813 SSH/SCP D-Link DGS SSH/telnet/TFTP EfficientIP SOLIDServer 4 SSH Extreme Networks Switches EW telnet Extreme Networks Switches XOS 11 and above telnet/tftp f5 BigIP 9,10 SSH Fortinet FortiGate FortiOS 3 SSH/TFTP Generic Netconf-compatible devices HP A-Series and G-Series Switches Comware 5 telnet/ssh/tftp HP GbE2c Ethernet Blade Switches 11, 20 telnet/tftp HP ProCurve Switches 10 telnet/tftp 3

4 IBM SAN Volume Controller 51 SSH/SCP Imperva SecureSphere 70 SSH Imperva SecureSphere SSH Infoblox Network Appliance (2) NIOS v4 HTTPS Infoblox Network Appliance NIOS v5 HTTPS Juniper Netscreen/SSG Firewall ScreenOS 4, 5, 6 SSH/telnet/TFTP/SCP Yes Juniper Switches/Routers JUNOS 8-12 SSH/telnet/FTP/SCP Yes Juniper Secure Access Series IVE 7 HTTPS Juniper WLC MSS 80 telnet/ssh/tftp Juniper WX/WXC WXOS 57 SSH/TFTP McAfee Firewall Enterprise 8 SSH/FTP McAfee Web Gateway (Webwasher) 68 SSH/TFTP Mirapoint Message Server/Razorgate 41 IMAP NetApp FAS ONTAP 7 SSH NetApp FAS ONTAP 7 SSH Nokia IP Series IPSO 3, 4, 6 telnet/ssh/tftp Nortel Baystack telnet/tftp Nortel Ethernet Routing Switches 4 and above telnet/tftp Palo Alto Firewall 31 SSH/TFTP PineApp Mail-SeCure 3 HTTPS PineApp Mail-SeCure (1) (2) 3 FTP Proofpoint Enterprise Protection (2) 5, 6 SSH Radware Alteon 27 SSH/FTP Radware AppDirector 2 SSH Riverbed Steelhead RiOS 5, 6, 7 SSH/FTP Riverbed Steelhead RiOS 5 SSH/FTP Ruckus ZoneDirector 91 HTTPS SEPPMail Appliance 61 HTTPS Stonegate SMC 52 (Linux) SSH 3Com SuperStack Com OS 3 telnet/ssh/tftp TippingPoint SMS (2) 32 SSH Trend Micro ISWSVA 56 SSH Tufin T-Series Appliance 6 SSH VMware Hypervisor ESXi 40 HTTPS Watchguard Firebox X Core/Peak 10 SSH/TFTP Watchguard Firebox X Core/Peak 10 SSH/TFTP WatchGuard XTM 11 SSH/TFTP Notes: (1) Supported via the Generic Push plug-in (2) Restore operation not supported 4

5 Real-time Change Detection By analysing device logs, Restorepoint can automatically detect when the configuration of the devices change, and initiate a configuration backup if required Please check Table 1 to see which devices support this feature In order to use this feature, you must configure the device to send its logs to Restorepoint using syslog Device-specific instructions are available in Section 4 If you are using a 3rd party log management product to collect your device logs, you can configure it to forward syslog messages to Restorepoint Please consult the log management product user guide for more information 5

6 Device-specific instructions The following section gives notes and specific settings for a number of supported devices 3Com SuperStack Restorepoint will use telnet to connect to the device, and the device will use TFTP to transfer its configuration to Restorepoint Please ensure that ports 23/tcp and 69/udp are not blocked by any firewalls between Restorepoint and the device When adding a SuperStack 5500 to Restorepoint, use the Unit pull-down menu to specify which unit in a stack you wish to backup 3Com recommends resetting the switch to factory settings before restoring a configuration Restorepoint has been tested with 4400 (software 5x, 6x) and 5500 (software 3x) Alcatel Omnistack Alcatel Omnistack switches require an additional password ("enable mode" password) When Alcatel Omnistack is selected in the device type pull-down menu, an additional Secondary Password field is displayed; use this field to enter the enable password The backup operation saves the device running configuration, not the startup configuration The restore operation copies the backup to the startup configuration Restorepoint will use telnet to connect to the device, and the device will use TFTP to transfer its configuration to Restorepoint Please ensure that ports 23/tcp and 69/udp are not blocked by any firewalls between Restorepoint and the device Restorepoint has been tested with software version 1x Alcatel Omniswitch The backup operation saves the device running configuration, not the startup configuration The restore operation copies the backup to the startup configuration Restorepoint will use telnet and FTP to connect to the device Please ensure that ports and 23/tcp are not blocked by any firewalls between Restorepoint and the device Restorepoint has been tested with software version 63 Allied Telesis The backup operation saves both the running configuration and the startup configuration The restore operation copies the startup or running configuration, depending on user selection, to the startup configuration Restorepoint will use telnet to connect to the device, and the device will use TFTP to transfer its configuration to Restorepoint Please ensure that ports 23/tcp and 69/udp are not blocked by any firewalls between Restorepoint and the device Restorepoint has been tested with AT firmware version 30 6

7 Array Networks SPX Restorepoint will use SSH to connect to the device, and the device will use TFTP to transfer its configuration to Restorepoint Please ensure that ports 22/tcp and 69/udp are not blocked by any firewalls between Restorepoint and the device The restore operation will merge the configuration saved by Restorepoint with the running configuration, rather than replacing it Restorepoint has been tested with ArrayOS 83 Aruba Controller Aruba Controllers require an additional password ("enable" password) When Aruba Controller is selected in the device type pull-down menu, an additional Secondary Password field is displayed; use this field to enter the enable password The backup operation saves the device running configuration, not the startup configuration The restore operation copies the backup to the startup configuration Restorepoint can use telnet or SSH or SCP to connect to the device; the device will use TFTP to transfer its configuration to Restorepoint Please ensure that ports 23/tcp (for telnet) or 22/tcp (for SSH) and 69/udp are not blocked by any firewalls between Restorepoint and the device Restorepoint has been tested with ArubaOS version 34 Astaro Security Gateway Before adding the device to Restorepoint, you need to enable shell access on the ASG (<i>management->system Settings->Shell Access</i>), click Allow Password Authentication and set the loginuser and root passwords The backup and restore operations use the ASG binary configuration; Restorepoint also displays a text representation of the configuration to help identify configuration changes Note however that Restorepoint uses the binary configuration when restoring Restorepoint uses SSH to connect to the ASG Please ensure that port 22/tcp is not blocked by any firewalls between Restorepoint and the device Restorepoint has been tested with ASG 83 Barracuda Spam Firewall Please ensure that the IP address of Restorepoint is added to the Allowed SNMP and API IP/Range in the Barracuda's Basic->Administration menu, and the API Password is set The Username field is ignored (the standard Barracuda 'admin' user is used); the password field must match the API Password configured above In the Backup Port field specify the port used in the Barracuda user interface (for example, ' Please ensure that this TCP port is not blocked by any firewalls between Restorepoint and the Barracuda SPAM Firewall Please note that this plug-in only backs up the device configuration; Bayes and User databases are not saved If you wish to backup these databases, you need to use the Generic Push Plug-in as described in section 51 7

8 Restorepoint has been tested with Barracuda firmware versions 34 and 35 Blue Coat PacketShaper Restorepoint will use SSH to connect to the device, and the device will use FTP to transfer its configuration to Restorepoint Please ensure that ports 22/tcp and 20-21/tcp are not blocked by any firewalls between Restorepoint and the device Restorepoint has been tested with software version 84 Blue Coat ProxySG Please ensure your ProxySG is configured for command line access using SSH, as shown below The ProxySG requires an additional password ("enable mode" password) When ProxySG is selected in the device type pull-down menu, an additional Secondary Password field is displayed; use this field to enter the enable password Restorepoint backs up the full configuration, including: CLI commands CPL VPM Policy XML VPM Policy Local Policy Central Policy Forwarding Policy Cerificates and private keys 8

9 Restorepoint will use SSH to connect to the device, and the device will use FTP to transfer its configuration to Restorepoint Please ensure that ports 22/tcp and 20-21/udp are not blocked by any firewalls between Restorepoint and the device Restorepoint has been tested with SGOS 4, 5 and 6 Brocade FastIron Restorepoint will use SSH to connect to the device, and the device will use TFTP to transfer its configuration to Restorepoint Please ensure that ports 22/tcp and 69/udp are not blocked by any firewalls between Restorepoint and the device The backup operation saves the running configuration; the restore operation copies the configuration saved by Restorepoint to the startup configuration Restorepoint has been tested with software version 4x Brocade Fabric Switches Restorepoint will use SSH to connect to the device, and the device will use The backup operation saves the running configuration The restore operation will merge the configuration saved by Restorepoint wit Restorepoint has been tested with Fabric OS 5 and 6 Brocade Fabric Switches Restorepoint will use SSH to connect to the device, and the device will use FTP to transfer its configuration to Restorepoint Please ensure that ports and 22/tcp are not blocked by any firewalls between Restorepoint and the device The backup operation saves the running configuration The restore operation will merge the configuration saved by Restorepoint with the running configuration, rather than replacing it The switch will be disabled during the restore operation Restorepoint has been tested with Fabric OS 5 and 6 Check Point SmartCenter Database Import/Export This plugin backs up all the Check Point configuration of a SmartCenter running on Secureplatform or Linux independently of hardware, operating system or Check Pooint version, but does not include any operating system settings; it can restore to the same or a different SmartCenter When this plugin is selected in the device type pull-down menu, an additional Secondary Password field is displayed Use this field to enter the expert password Restorepoint can use SSH or SCP to backup the device; SCP is the most secure method When connecting via telnet or SSH, the device will use TFTP to transfer its configuration to Restorepoint When using SCP, TFTP is not used In order to allow SCP, please follow these steps: The user account used to connect must be added to the file /etc/scpusers on SecurePlatform For instance, if the username is "admin", you need to run the following command: echo admin >> /etc/scpusers 9

10 within a SecurePlatform expert shell The user account used to connect must have an unrestricted shell, so that an expert password is not required; in order to change the default shell for the "admin" account, you need to run the following command: chsh /bin/bash admin within a SecurePlatform expert shell Please ensure that port 22/tcp (for SSH) and 69/udp are not blocked by any firewalls between Restorepoint and the device If SCP is used, only port 22/tcp needs to be allowed You will also need to enable SSH in the SecurePlatform Web user interface When backing up a Check Point SmartCenter, please ensure that no SmartCenter clients are connected to the device, otherwise the backup may fail because the configuration is locked Restorepoint has been tested with SecurePlatform R65 and R70 Check Point Gaia Use the Gaia plugin for Check Point appliances and open servers running the Check Point Gaia operating system The user account used to connect to the device should be a full administrator with the "bash" shell: navigate to User Management->Users in the Gaia UI and create or edit a user account change the user shell from /etc/clish to /bin/bash ensure that the user is assigned the adminrole tick the Command Line check box under Access Mechanisms Restorepoint can use SSH or SCP to backup the device; SCP is the most secure method When connecting via SSH, the device will use TFTP to transfer its configuration to Restorepoint When using SCP, TFTP is not used Please ensure that port 22/tcp (for SSH) and 69/udp are not blocked by any firewalls between Restorepoint and the device If SCP is used, only port 22/tcp needs to be allowed You will also need to enable SSH in the Gaia UI under System Management->Host Access If you are backing up or restoring a Check Point SmartCenter, please ensure that no SmartCenter clients are connected to the device, otherwise the operation will fail because the configuration is locked Restorepoint has been tested with Gaia R7540 Check Point Provider-1 Use the Provider-1 plugin for SecurePlatform-based installations of Provider-1 This plugin will produce a smaller backup than the generic SecurePlaftorm plugin; however, please note that the Provider-1 plugin only backs up the MDS configuration, which excludes system-related configuration (appliance IP addresses, routing tables, etc) and logs If you require a full appliance backup, please use the SecurePlatform plugin instead Provider-1 is selected in the device type pull-down menu, an additional Secondary Password field is displayed Use this field to enter the expert password Restorepoint can use SSH or SCP to backup the device; SCP is the most secure method When connecting via telnet or SSH, the device will use TFTP to transfer its configuration to Restorepoint When using SCP, TFTP is not used In order to allow SCP, please follow these steps: The user account used to connect must be added to the file /etc/scpusers on SecurePlatform For instance, if the username is "admin", you need to run the following command: echo admin >> /etc/scpusers within a SecurePlatform expert shell 10

11 The user account used to connect must have an unrestricted shell, so that an expert password is not required; in order to change the default shell for the "admin" account, you need to run the following command: chsh +s /bin/bash admin within a SecurePlatform expert shell Please ensure that port 22/tcp (for SSH) and 69/udp are not blocked by any firewalls between Restorepoint and the device If SCP is used, only port 22/tcp needs to be allowed You also need to enable SSH in the SecurePlatform Web user interface Restorepoint has been tested with Provider-1 R65 and R70 on SecurePlatform-based appliances/servers Check Point SecurePlatform/Connectra Use the SecurePlatform plugin for Intel-based servers running SecurePlatform, as well as Connectra, Provider-1, UTM-1 and Power-1 appliances When SecurePlatform is selected in the device type pull-down menu, an additional Secondary Password field is displayed Use this field to enter the expert password Restorepoint can use SSH or SCP to backup the device; SCP is the most secure method When connecting via SSH, the device will use TFTP to transfer its configuration to Restorepoint When using SCP, TFTP is not used In order to use SCP, you need to configure SCP on the appliance first, following these steps: The user account used to connect must be added to the file /etc/scpusers on SecurePlatform For instance, if the username is "admin", you need to run the following command: echo admin >> /etc/scpusers within a SecurePlatform expert shell The user account used to connect must have an unrestricted shell, so that an expert password is not required; in order to change the default shell for the "admin" account, you need to run the following command: chsh -s /bin/bash admin within a SecurePlatform expert shell Please ensure that port 22/tcp (for SSH) and 69/udp are not blocked by any firewalls between Restorepoint and the device If SCP is used, only port 22/tcp needs to be allowed You will also need to enable SSH in the SecurePlatform Web user interface If you are backing up a Check Point SmartCenter, please ensure that no SmartCenter clients are connected to the device, otherwise the backup will fail because the configuration is locked Note that Provider-1 backups may be very large If this is undesiderable, please use the specific Provider-1 plugin Restorepoint has been tested with SecurePlatform R65 and R70 Check Point Security Gateway 80 When SG 80 is selected in the device type pull-down menu, an additional Secondary Password field is displayed Use this field to enter the expert password Restorepoint can use SSH or SCP to backup the device; SCP is the most secure method When connecting via SSH, the device will use TFTP to transfer its configuration to Restorepoint When using SCP, TFTP is not used In order to use SCP, first you need to enable direct login to expert mode, following these steps: Connect to the appliance using SSH Enter expert mode, then run the following command: bashuser on 11

12 Please ensure that port 22/tcp (for SSH) and 69/udp are not blocked by any firewalls between Restorepoint and the device If SCP is used, only port 22/tcp needs to be allowed You will also need to enable SSH in the SecurePlatform Web user interface Restorepoint has been tested with Check Point version R71 Cisco ASA When Cisco ASA is selected in the device type pull-down menu, an additional Secondary Password field is displayed Use this field to enter the ASA enable password If you are entering an exec (privileged) user, please leave the secondary password blank The backup operation saves the device running configuration, not the startup configuration The restore operation copies the backup to the startup configuration Restorepoint can use telnet, SSH or SCP to backup the device; SCP is the most secure method When connecting via telnet or SSH, the device will use TFTP to transfer its configuration to Restorepoint When using SCP, TFTP is not used In order to allow SCP to the ASA, the following configuration line must be added: ssh scopy enable and you need to use a privileged user, so that an enable password is not required Please ensure that ports 23/tcp (for telnet) or 22/tcp (for SSH) and 69/udp are not blocked by any firewalls between Restorepoint and the device If SCP is used, only port 22/tcp needs to be allowed Restorepoint has been tested with ASA version 7 and 8 In order to enable real-time change detection, the following configuration lines must be added: logging enable logging trap notifications logging host inside [IP address of Restorepoint] Cisco IOS Cisco IOS devices require an additional password ("enable mode" password) When Cisco IOS is selected in the device type pull-down menu, an additional Secondary Password field is displayed; use this field to enter the enable password If you are entering an exec (privileged) user, please leave the secondary password blank The backup operation saves both the device running configuration and the startup configuration Both configurations can be viewed by clicking on the relevant tab Clicking Diff will show any differences between running and startup configuration Clicking Download or Save will perform the specified action for the selected configuration file 12

13 If Config Change is selected, besides alerting if the configuration has changed, Restorepoint will also if the running configuration is different from the startup configuration The restore operation restores either the startup or running configuration, depending upon user selection; a device reset will be required in order to reload the configuration Restorepoint can use telnet, SSH or SCP to backup the device; SCP is the most secure method When connecting via telnet or SSH, the device will use TFTP to transfer its configuration to Restorepoint When using SCP, TFTP is not used In order to allow SCP to the Cisco switch or router, the following configuration line must be added: ip scp server enable and you need to use a privileged user, so that an enable password is not required Please ensure that ports 23/tcp (for telnet) or 22/tcp (for SSH) and 69/udp are not blocked by any firewalls between Restorepoint and the device If SCP is used, only port 22/tcp needs to be allowed Restorepoint has been tested with IOS version 12x In order to enable real-time change detection, the following configuration lines must be added: logging [IP address of Restorepoint] Cisco IronPort Use a full Administrator when adding an IronPort device to Restorepoint The restore operation is not yet available for IronPort This plugin does not back up individual users' Safelists and Blacklists For this purpose, please the specific IronPort SL/BL plugin Restorepoint will use SSH to connect to the device Please ensure that port 22/tcp is not blocked by any firewalls between Restorepoint and the device Restorepoint has been tested with AsyncOS version 71 and 75 Cisco MDS 13

14 Restorepoint will use telnet or SSH to connect to the device, and the device will use TFTP to transfer its configuration to Restorepoint Please ensure that ports 23/tcp (for telnet) or 22/tcp (for SSH) and 69/udp are not blocked by any firewalls between Restorepoint and the device The backup operation saves both the device running configuration and the startup configuration The restore operation will merge the configuration saved by Restorepoint with the running configuration, rather than replacing it Restorepoint has been tested with SAN-OS 31 Cisco NX-OS The backup operation saves both the device running configuration and the startup configuration Both configurations can be viewed by clicking on the relevant tab Clicking Diff will show any differences between running and startup configuration Clicking Download or Save will perform the specified action for the selected configuration file If Config Change is selected, besides alerting if the configuration has changed, Restorepoint will also if the running configuration is different from the startup configuration The restore operation restores the startup configuration; a device reset will be required in order to reload the configuration Restorepoint can use telnet or SSH to connect to the device; the device will use TFTP to transfer its configuration to Restorepoint Please ensure that ports 23/tcp (for telnet) or 22/tcp (for SSH) and 69/udp are not blocked by any firewalls between Restorepoint and the device Restorepoint has been tested with NX-OS version 4 In order to enable real-time change detection, the following configuration lines must be added: logging server [IP address of Restorepoint] 14

15 Cisco PIX Firewall The PIX firewall needs to be configured for SSH access Please refer to the Cisco PIX documentation When Cisco PIX is selected in the device type pull-down menu, an additional Secondary Password field is displayed Use this field to enter the PIX enable password If you are entering an exec (privileged) user, please leave the secondary password blank The backup operation saves the device running configuration, not the startup configuration The restore operation copies the backup to the startup configuration Restorepoint will use Secure Shell (SSH) to connect to the device, and the device will use TFTP to transfer its configuration to Restorepoint Please ensure that ports 22/tcp and 69/udp are not blocked by any firewalls between Restorepoint and the device Restorepoint has been tested with PIX from version 5 to 8 In order to enable real-time change detection, the following configuration lines must be added: logging enable logging trap notifications logging host inside [IP address of Restorepoint] Cisco Wireless LAN Controller (WLC) Restorepoint will use telnet to connect to the device, and the device will use TFTP to transfer its configuration to Restorepoint Please ensure that ports 23/tcp (for telnet) and 69/udp are not blocked by any firewalls between Restorepoint and the device The backup operation saves both the device running configuration and the startup configuration The restore operation will reset the device Restorepoint has been tested with firmware 50 Citrix Netscaler Restorepoint will use SSH and SCP to connect to the device Please ensure that port 22/tcp is not blocked by any firewalls between Restorepoint and the device A super-user account must be used in the device definition The backup operation saves the device running configuration The restore operation copies the backup to the startup configuration ConSentry LANShield ConSentry switches/controllers require an additional password ('enable mode' password) When ConSentry LANShield is selected in the device type pull-down menu, an additional Secondary Password field is displayed; use this field to enter the enable password The backup operation saves the device running configuration, not the startup configuration The restore operation copies the backup to the startup configuration Restorepoint will use telnet to connect to the device, and the device will use TFTP to transfer its configuration to Restorepoint Please ensure that ports 23/tcp and 69/udp are not blocked by any firewalls between Restorepoint and the device 15

16 Restorepoint has been tested with LANShieldOS 3x Crossbeam C-series Restorepoint will use SSH and SCP to connect to the device Please ensure that port 22/tcp is not blocked by any firewalls between Restorepoint and the device The backup operation saves the device running configuration, not the startup configuration The restore operation will merge the configuration saved by Restorepoint with the running configuration, rather than replacing it Restorepoint has been tested with COS 611 Crossbeam X-series Restorepoint will use SSH and SCP to connect to the device Please ensure that port 22/tcp is not blocked by any firewalls between Restorepoint and the device The backup operation saves the device running configuration; VAP groups are not backed up The restore operation will merge the configuration saved by Restorepoint with the running configuration, rather than replacing it Restorepoint has been tested with XOS 813 D-link DGS 3100 The backup operation saves both the device running configuration and the startup configuration Both configurations can be viewed by clicking on the relevant tab Clicking Diff will show any differences between running and startup configuration Clicking Download or Save will perform the specified action for the selected configuration file If Config Change is selected, besides alerting if the configuration has changed, Restorepoint will also if the running configuration is different from the startup configuration The restore operation restores the startup configuration; a device reset will be required in order to reload the configuration Restorepoint can use telnet or SSH to connect to the device; the device will use TFTP to transfer its configuration to Restorepoint Please ensure that ports 23/tcp (for telnet) or 22/tcp (for SSH) and 69/udp are not blocked by any firewalls between Restorepoint and the device Restorepoint has been tested with firmware version 3 EfficientIP SOLIDServer Please ensure your SOLIDServer is configured for command line access using SSH, and a password is set for the admin user These settings are configured in the Administration tab on the SOLIDServer, under Services->SSH Server Use the admin account when adding the device to Restorepoint Restorepoint will use SSH and SCP to connect to the device Please ensure that port 22/tcp is not blocked by any firewalls between Restorepoint and the device The restore operation will perform a full restoration (system and network configuration, services and database) and reset the device upon completion Restorepoint has been tested with SOLIDServer 4 16

17 Extreme Networks Restorepoint will use telnet to connect to the device, and the device will use TFTP to transfer its configuration to Restorepoint Please ensure that ports 23/tcp and 69/udp are not blocked by any firewalls between Restorepoint and the device Restorepoint has been tested with XOS version 12 and above f5 BigIP Restorepoint will use SSH and SCP to connect to the device Please ensure that port 22/tcp is not blocked by any firewalls between Restorepoint and the device When entering the logon credential, use an account with the advanced shell enabled Restorepoint has been tested with BigIP software version 9 Generic Netconf HP A-Series and G-Series Switches Restorepoint backs up and restores the startup configuration Restorepoint will use telnet or SSH to connect to the device, and the device will use TFTP to transfer its configuration to Restorepoint Please ensure that ports 23/tcp (for telnet), 22/tcp (for SSH) and 69/udp are not blocked by any firewalls between Restorepoint and the device Restorepoint has been tested with HP A-Series and G-Series switches running Comware version 5 HP GbE2c Ethernet Blade Switch Restorepoint will use telnet to connect to the device, and the device will use TFTP to transfer its configuration to Restorepoint Please ensure that ports 23/tcp and 69/udp are not blocked by any firewalls between Restorepoint and the device Restorepoint has been tested with HP software version 11 and 20 HP ProCurve Restorepoint backs up the switch running configuration Restorepoint will use telnet to connect to the device, and the device will use TFTP to transfer its configuration to Restorepoint Please ensure that ports 23/tcp and 69/udp are not blocked by any firewalls between Restorepoint and the device When entering the logon credentials, you must use a read/write account Restorepoint has been tested with HP ProCurve with software version 10 and above IBM SAN Volume Controller (SVC) 17

18 Restorepoint will use SSH and SCP to connect to the device Please ensure that port 22/tcp is not blocked by any firewalls between Restorepoint and the device The IBM SVC does not support password authentication, therefore Use SSHv2 PKA must be ticked in the device screen The Restorepoint Public Key must also be uploaded to the device before Restorepoint can connect The restore operation is only supported on an unconfigured SVC; this is not a limitation of Restorepoint Please refer to the IBM SVC Administrator Guide for instructions on how to prepare a controller for a restore operaton The SVC has been tested with software version 51 Imperva SecureSphere The SecureSphere plugin requires three passwords - root secure and system When Imperva SecureSphere is selected in the device type pull-down menu, two additional password fields are displayed; use the "standard" password field to enter the root password The restore operation completely replaces the exiting configuration and the database; SecureSphere services will be stopped during restore Restorepoint uses SSH to backup the device; please ensure that port 22/tcp is not blocked by any firewalls between Restorepoint and the device Restorepoint has been tested with SecureSphere version 7 in standalone mode only Infoblox Network Appliance Restorepoint will use HTTPS to connect to the device Please ensure that port 443/tcp is not blocked by any firewalls between Restorepoint and the device Please note that during a restore operation, the Infoblox user interface will be temporarily unavailable Restorepoint has been tested with NIOS v4 Infoblox Network Appliance Restorepoint will use HTTPS to connect to the device Please ensure that port 443/tcp is not blocked by any firewalls between Restorepoint and the device Please note that during a restore operation, the Infoblox user interface will be temporarily unavailable Restorepoint has been tested with NIOS v5 Juniper Netscreen/SSG/ISG Firewall When you enter the administrator credentials, you must use the root administrator username and password; a read-write administrator is not able to backup a Juniper Netscreen firewall using TFTP, or restore a configuration with either TFTP or SCP The backup operation saves the running configuration The restore operation copies the saved configuration to the startup configuration On an ISG system with the optional IDP blade, Restorepoint will not backup the IDP configuration Restorepoint can use telnet, SSH or SCP to backup the device; SCP is the most secure method When connecting via telnet or SSH, the device will use TFTP to transfer its configuration to Restorepoint When using SCP, TFTP is not used In order to allow SCP to a ScreenOS device, the following configuration line must be added: set scp enable When using the web UI, SSH and SCP must be enabled under 18

19 Configuration!Admin!Management Please ensure that ports 23/tcp (for telnet) or 22/tcp (for SSH) and 69/udp are not blocked by any firewalls between Restorepoint and the device If SCP is used, only port 22/tcp needs to be allowed Restorepoint has been tested with ScreenOS version 5 and 6 In order to enable real-time change detection, the following configuration lines must be added: set syslog config [IP address of Restorepoint] set syslog enable Juniper JUNOS Please ensure you use an account with Super User privileges when you enter the administrator credentials If you use the root account, you must use SSH as the connection protocol The backup operation saves the running configuration; the restore operation copies the saved configuration to the startup configuration Restorepoint will use SSH or telnet to connect to the device If you use SSH, please ensure that port 22/tcp (SSH) is not blocked by any firewalls between Restorepoint and the device; if you use telnet, port 23/tcp telnet should be allowed from Restorepoint to the device, and 20-21/tcp (FTP) should be allowed from the device to Restorepoint In order to enable real-time change detection, the following configuration lines must be added to the system configuration: syslog { host IP address of Restorepoint { any any; match "/*Commit operation in progress*/"; } } Restorepoint has been tested with JUNOS version 8 and above Juniper SA 1 When adding a Juniper SA to Restorepoint, you must use the SA built-in admin account, or another full SA administrator, who is allowed to sign-in to the "*/admin" page, and that is mapped to the Administrators role, similarly to the built-in admin account 2 The backup operation can save the System, User and XML configurations, depending on your selection 3 When restoring, all settings are overwritten; in particular, restoring the System configuration will also overwrite the device IP address and certificates 4 Restorepoint uses HTTPS to backup the device; please ensure that port 443/tcp is not blocked by any firewalls between Restorepoint and the device Juniper WLC Restorepoint performs a complete backup of the boot configuration of the WLC, including WebAAA pages, backup configuration files, image files, and any other files stored in the user files area of nonvolatile storage Uncommitted changes to the running are not saved; use the save config command to commit changes to the boot configuration Restorepoint uses SSH or telnet to connect to the device, and the firewall uses TFTP to transfer its configuration to Restorepoint Please ensure that SSH (22/tcp) or telnet (23/telnet), and TFTP (69/udp) are not blocked by any firewall between Restorepoint and the device 19

20 Restorepoint has been tested with Juniper Mobility System Software 80 Juniper WX/WXC Restorepoint will use SSH to connect to the device, and the device will use TFTP to transfer its configuration to Restorepoint Please ensure that ports 22/tcp and 69/udp are not blocked by any firewalls between Restorepoint and the device The backup operation saves the device running configuration The restore operation copies the backup to the startup configuration McAfee Firewall Enterprise Restorepoint backs up all database information, including any configuration changes made from the McAfee GUI Several other files are also backed up; this is controlled by the file /secureos/etc/configconf on the Firewall Normally you do not need to modify this file Restorepoint does not back up the licence; please ensure you have a copy of the license if you are restoring on a new firewall The restore operation will force a device reboot after the database is restored; the reboot may occur a few minutes after Restorepoint has reported a successful restore Restorepoint uses SSH to connect to the device, and the firewall uses FTP to transfer its configuration to Restorepoint Please ensure that SSH (22/tcp) and FTP (20-21/udp) are not blocked by the firewall Restorepoint has been tested with McAfee Firewall Enterprise 8 McAfee Web Gateway (aka Webwasher) Please ensure your appliance is configured for command line access using SSH, as shown below 20

21 Restorepoint will use SSH to connect to the device, and the device will use FTP to transfer its configuration to Restorepoint Please ensure that ports 22/tcp and 20-21/tcp are not blocked by any firewalls between Restorepoint and the device Restorepoint has been tested with software 68 Mirapoint Message Server and Razorgate Restorepoint will use IMAP on a non-standard port (tcp/10143) to connect to the device Please ensure that traffic on tcp/10143 is not blocked by any firewalls between Restorepoint and the device Restorepoint will not restore the licences during a restore operation Restorepoint has been tested with software 41 NetApp FAS When adding a NetApp filer to Restorepoint, use the root account credentials Restorepoint will use SSH to connect to the device Please ensure these port 22/tcp is not blocked by any firewalls between Restorepoint and the device The restore operation will copy the saved configuration to the startup configuration Restorepoint has been tested with ONTAP 7 NetApp FAS Restorepoint will use SSH to connect to the device Please ensure these port 22/tcp is not blocked by any firewalls between Restorepoint and the device 21

22 The restore operation will copy the saved configuration to the startup configuration Restorepoint has been tested with ONTAP 7 Nokia IP Series Restorepoint can use telnet, SSH or SCP to backup the device; SCP is the most secure method When connecting via telnet or SSH, the device will use TFTP to transfer its configuration to Restorepoint When using SCP, TFTP is not used Please ensure that port 23/tcp (for telnet), 22/tcp (for SSH) and 69/udp are not blocked by any firewalls between Restorepoint and the device If SCP is used, only port 22/tcp needs to be allowed Restorepoint will attempt to obtain an exclusive configuration lock when connecting; this may prevent other administrators logged on to the Nokia appliance from making any changes Log files and administrators' home directories are not backed up Installed software packages are backed up if they are selected for backup in the Nokia Voyager Backup and Restore page Restorepoint has been tested with IPSO version 38 and above Nortel Baystack Restorepoint will use telnet to connect to the device, and the device will use TFTP to transfer its configuration to Restorepoint Please ensure that ports 23/tcp and 69/udp are not blocked by any firewalls between Restorepoint and the device Nortel Ethernet Routing Switch Restorepoint will use telnet to connect to the device, and the device will use TFTP to transfer its configuration to Restorepoint Please ensure that ports 23/tcp and 69/udp are not blocked by any firewalls between Restorepoint and the device When entering the logon credentials, you must use an account with read/write permissions Restorepoint has been tested with Ethernet Routing Switches with software version 4 and above Palo Alto Firewall Restorepoint will use SSH to connect to the device, and the device will use TFTP to transfer its configuration to Restorepoint Please ensure that ports 23/tcp and 69/udp are not blocked by any firewalls between Restorepoint and the device During a restore operation, Restorepoint will restore and commit the saved configuration Restorepoint has been tested with Palo Alto v31 Pineapp Mail-SeCure Restorepoint will use HTTPS over port 7443 to connect to the device Please ensure that ports 7443/tcp is not blocked by any firewalls between Restorepoint and the device If you are restricting access to the PineApp appliance in the System->Remote Access page, you need to add the IP address of Restorepoint to the Management IP list We do not recommend using the Backup Now feature with a Barracuda Spam Firewall The backup operation can 22

23 take a long time and dur Please note that this plug-in only backs up the device configuration; mailboxes are not saved If you wish to backup the mailbox databases, you can use the Generic Push Plug-in as described in section 53 Restorepoint has been tested with firmware versions 37 Proofpoint Enterprise Protection The Proofpoint plugin backs up the following data: Dictionaries Certificates Server configurations - for example, parameters and attributes If you have deployed Proofpoint SmartSearch, the Smart Search configuration settings are also backed up Lists of entries - for example, groups, safe senders, and blocked senders The User Repository Saved reports Appliance configurations:- DNS server- Firewall settings- DomainConfigurations such as lists and dictionaries created by the administrator for the Firewall, SpamDetection, Virus Detection, Digital Assets, and Regulatory Compliance modules are also backed up The plugin does not back up the following data: System and Proofpoint Protection Server passwords Data in the database - for example, messages in the Quarantine, or Smart Search index entries Log files Fully qualified instance name (FQIN) - for example, hostname-1000_instance1 Update history Appliance configurations:- Hostname- Network settings - IP addresses, gateway, and net mask sendmail settings Use the admin account credential when adding a Proofpoint appliance to Restorepoint The restore operation is not available for Proofpoint Restorepoint will use SSH to connect to the device Please ensure that port 22/tcp is not blocked by any firewalls between Restorepoint and the device, and that SSH access is allowed in the Proofpoint appliance configuration Restorepoint has been tested with Proofpoint version 5 and 6 Radware Alteon Restorepoint will use SSH to connect to the device, and the device will use FTP to transfer its configuration to Restorepoint Please ensure that ports 22/tcp and 20-21/udp are not blocked by any firewalls between Restorepoint and the device The backup operation will fail if the configuration has not been applied and saved The restore operation will not restore any private key information, because this would require entering the private key passphrase If this is required, you can download the backup from Restorepoint to your PC and restore it manually Radware AppDirector Restorepoint will use SSH connect to the device, and the device will use TFTP to transfer its configuration to 23

24 Restorepoint Please ensure that the SSH management protocol is enabled on the AppDirector, and that ports 22/tcp and 69/udp are not blocked by any firewalls between Restorepoint and the device Restorepoint has been tested with Radware AppDirector software version 2 Riverbed Steelhead The backup and restore operations use the Steelhead active saved configuration, which is a binary file Restorepoint can also display the commands to recreate the active saved configuration; note however that Restorepoint always uses the binary configuration when restoring Restorepoint will use SSH to connect to the device, and the device will use FTP to transfer its configuration to Restorepoint Please ensure that ports 20, 21 and 22/tcp are not blocked by any firewalls between Restorepoint and the device Restorepoint has been tested with RiOS 5, 6, 7 Riverbed Steelhead Restorepoint will use SSH to connect to the device, and the device will use FTP to transfer its configuration to Restorepoint Please ensure that ports 20, 21 and 22/tcp are not blocked by any firewalls between Restorepoint and the device Restorepoint has been tested with RiOS 5 Ruckus ZoneDirector Restorepoint will use HTTPS to connect to the device Please ensure that ports 443/tcp is not blocked by any firewalls between Restorepoint and the device The ZoneDirector configuration is a binary file and therefore cannot be displayed by Restorepoint The restore operation may reset the device SEPPMail Appliance 1 Before adding a SEPPMail appliance to Restorepoint, please ensure that a backup password has been set on SEPPMail The backup password will be used to display a decrypted view of the configuration, as well as to restore it 2 When restoring, you need to ensure that the backup password in Restorepoint is the correct one for the configuration you are restoring, or decryption error will be generated 3 Restorepoint uses HTTPS (by default over port 8443) to backup the device; please ensure that port 8443/tcp is not blocked by any firewalls between Restorepoint and the device 4 Restorepoint has been tested with SEPPMail version 61 Stonegate SMC Restorepoint will use SSH and SCP to connect to the device Please ensure that port 22/tcp is not blocked by any firewalls between Restorepoint and the device When entering the logon credential, you must use the root account details Restorepoint has been tested with SMC Linux version 52 24

25 3Com SuperStack 5000 Switches Restorepoint backs up and restores the startup configuration When adding a switch stack, you need to enter the individual switches that constitute the stack and enter the corresponding Unit number Restorepoint will use telnet or SSH to connect to the device, and the device will use TFTP to transfer its configuration to Restorepoint Please ensure that ports 23/tcp (for telnet), 22/tcp (for SSH) and 69/udp are not blocked by any firewalls between Restorepoint and the device Restorepoint has been tested with SuperStack 5500 switches running 3Com OS version 3 TippingPoint SMS Trend Micro:InterScan Web Security Virtual Appliance Restorepoint will use SSH to connect to the device Please ensure that the remote CLI is enabled (<i>administration->network Configuration->Remote CLI</i>) and that port 22/tcp is not blocked by any firewalls between Restorepoint and the device Restorepoint uses the root account to connect to the device; when entering the logon password, you need to use the CLI enable password Restorepoint has been tested with ISWSVA Version 56 Tufin:T-Series Appliance There are two Tufin T-Series Appliance plugins; the Full plugin performs a full configuration backup and revision database backup, therefore the backup size will generally be rather large and will take a long time to complete If this is not desirable, you can use the Config Only plugin, which will not back up the revision database Note however that restoring the configuration only will effectively wipe the revision database All settings, including: Users, Domains, Zones, Licences, TOP plugins Policy Analysis Quieries Reports and Audit Definitions ^(*) Performance Alerts Topology Policy Revisions Revision Comments Automatic Policy Generator Data Rule Documentation Rule and Object Usage Data Firewall OS Monitoring Data Published Reports Plug-n-Play License Information Rule Change Reports Security Risk report exceptions 25