Backup and restore strategy (and meanwhile how to recover the encrypted file?)
-
I have a problem with a blocked remote firewall and I'm wondering if it's possible to recover it when I do the technical intervention.
The firewall is configured to save the encrypted configuration in the cloud.
If I install a new device, the machine will probably be different, but I still want to recover the configuration: Users, names, alias, IP address, rules, some app config..
How do I get that file back?What is the best backup and restore strategy in general?
Also, is the backup file better to be created after every change or scheduled every "X" days? -
If you have a note of the ACB key you can just enter that in the new firewall and, as long as the password is set the same, it will be able to fetch it and decrypt it.
Alternatively you can fetch the config on any pfSense install and download it from there.
If you don't have the ACB key we can usually find it if you have the NDI or the hint you set.
I personally prefer the backup after config changes option. It allows you to roll back specific changes or choose between multiple changes in one day which is normally what I'm doing.
Steve
-
@darkcorner We download the backup every time we make changes to a router, ours or a client’s. That way we have it to do a restore for an emergency replacement. Often we’ll save a copy on site there as well.
-
I apologize for the late response, but I had other more pressing issues to follow up on.
@stephenw10 said in Backup and restore strategy (and meanwhile how to recover the encrypted file?):
Alternatively you can fetch the config on any pfSense install and download it from there.
I didn't get the hint.
If you don't have the ACB key we can usually find it if you have the NDI or the hint you set.
and I didn't even understand this. What is NDI?
-
@darkcorner ACB is the auto config backup. If configured you can set ACB up again on the new install and download the config from Netgate ("in the cloud").
NDI = Netgate Device ID, shown on the dashboard.
-
Can we assume you don't have a note of the ACB key then?
