Automated, Encrypted Configuration Backups Across Mixed-Vendor Network Infrastructure

Executive Summary & Context

In multi-vendor network and hypervisor environments, device configuration backups are frequently relegated to manual exports or fragmented, proprietary GUI tools. This operational gap creates configuration drift, complicates auditability, and extends mean time to recovery (MTTR) during hardware outages.

Within an enterprise-pattern infrastructure lab, firewall, core switching, wireless controller, and hypervisor configurations needed a single scheduled pipeline with encrypted, auditable version history. Because each platform exports configuration state differently—and certain embedded network operating systems restrict non-interactive SSH—a dedicated Configuration Backup Orchestrator was engineered on an isolated Linux VM to execute scheduled nightly backups and commit each device’s state into its own git-crypt encrypted repository.

---

Architecture & Technical Execution

+-------------------------------------------------------------+
|            Configuration Backup Orchestrator                |
|        (Dedicated Linux VM / Scheduled Nightly Job)         |
|                                                             |
|  +------------------+   +-------------------+   +--------+  |
|  | Job Dispatcher   |-->| Per-Target Driver |-->| Expect |  |
|  +------------------+   +-------------------+   +--------+  |
+-------------------------------------------------------------+
       |             |              |              |         |
       | (API Pull)  | (SSH/Expect) | (TFTP Push)  | (rsync) | (Container Exec)
       v             v              v              v         v
  +----------+  +----------+  +-----------+  +----------+  +-----------+
  | Stateful |  | Managed  |  | Wireless  |  | Proxmox  |  | Container |
  | Firewall |  |  Switch  |  | Controller|  | VE Host  |  | Services  |
  +----------+  +----------+  +-----------+  +----------+  +-----------+
       \             \              |              /         /
        +-------------+-------------+-------------+---------+
                                    |
                                    v
                  +-----------------------------------+
                  |   Staging & Credential Scrubbing  |
                  +-----------------------------------+
                                    |
                                    v
                  +-----------------------------------+
                  |  Isolated Git Repositories        |
                  |  Encrypted at Rest via git-crypt  |
                  |  (Keys Held Offline in Vault)     |
                  +-----------------------------------+

Transport Selection per Platform (Vendor Constraint Handling)

Rather than forcing a brittle one-size-fits-all script, the dispatcher uses the transport protocol each target natively supports reliably:

1. Stateful Firewall (OPNsense): Pulled via HTTPS API using a dedicated, least-privilege backup service account.
2. Core Managed Switch (Aruba CX): Pulled via automated SSH/Expect CLI session capturing the running configuration.
3. Wireless Virtual Controller (Aruba Instant): Because non-interactive SSH sessions abort on certain embedded SSH implementations, the controller is driven via automated CLI interaction to push its configuration over TFTP to a pre-staged, permission-hardened staging file that is locked down immediately upon transfer completion.
4. Hypervisor Host (Proxmox VE): Extracted via rsync of cluster configuration directories paired with a scoped API call using a dedicated audit-role token rather than root SSH keys.
5. Container Workloads (LXC): Captured via host-level container execution combined with tar archive streaming.

Security & Least-Privilege Governance

• Per-Target git-crypt Repositories: Every target writes to its own isolated Git repository encrypted transparently with git-crypt. Symmetric keys are stored offline in a password manager so a compromised backup repository reveals no plaintext network secrets or preshared keys.
• Audit-First Account Scoping: Credential changes follow a strict sequence: rotate credentials, scope permissions, and validate using throwaway test accounts before modifying production service accounts. During the firewall backup account audit, test accounts verified the exact minimum configuration-history privilege required by the backup API endpoint—enabling the backup account to be removed from full administrative group membership.

---

Measurable Impact & Results

• 100% Automated Nightly Coverage: All 5 infrastructure targets across 4 distinct platform architectures are backed up automatically with zero manual intervention.
• Encrypted Version Control & Drift Visibility: Every configuration change across firewall rules, switch VLANs, wireless controllers, and hypervisor cluster files can be diffed or rolled back via Git while remaining encrypted at rest via git-crypt.
• Audit-Driven Privilege Reduction: Identified and validated the minimum privilege scope required for automated API backups, replacing broad administrative group membership with least-privilege service accounts.