# Network configuration management

How Tracix backs up device configurations, keeps intended and running configuration apart, and moves changes from draft to device through your collectors.

Configuration management (NCM) backs up the running configuration of your network devices, shows how it differs from the configuration you intend, and changes devices through reviewed, approved requests. This page explains the moving parts; the pages under it walk through each task.

In the console, open **Network › Config Mgmt**. The tabs along the top are **Intent & templates**, **Drafts**, **Inventory**, **Reports**, **Backup policies**, **Changes**, **Compliance**, **Images**, **Upgrades**, **Activity** and **Credentials**.

## How it works

Tracix reaches your devices only through your collectors. Each managed device is assigned a collector on its network, and that collector does the device work:

1. Your workspace queues a job, such as a backup or a change, for the device's collector.
2. The collector asks your workspace for the credential the job needs, uses it in memory for that job only, and connects to the device over SSH, or over NETCONF or gNMI where the platform supports it.
3. The collector reports the result back. A backup becomes a new configuration version when the configuration changed.

Devices only need to accept the collector's connection. The collector itself makes outbound connections to your workspace.

## Intended and running configuration

Tracix keeps two views of each device:

* **Running**: what the device ran at its last backup.
* **Intended**: what you declare the device should run, from templates, Brain or hand-written configuration.

The **Inventory** tab compares the two and gives each device a status:

| Status            | Meaning                                                                                                 |
| ----------------- | ------------------------------------------------------------------------------------------------------- |
| **in sync**       | The latest backup meets every requirement in the intended configuration, and it is less than a day old. |
| **drift**         | The latest backup violates a requirement in the intended configuration.                                 |
| **not evaluated** | Some requirements couldn't be checked against the backup.                                               |
| **stale**         | The latest backup is more than a day old.                                                               |
| **no intent**     | A backup exists, but no intended configuration has been declared.                                       |
| **no backup**     | Tracix hasn't captured the device's configuration yet.                                                  |

Intended configuration lists requirements, so extra settings on the device don't count as drift unless a section is set to exact matching. Configuration you write by hand on a device's **Manual** tab is manually owned: Tracix shows how it differs, but it never counts as drift.

## Add devices to configuration management

**1. Open the inventory**

Open **Network › Config Mgmt** and select **add devices**.

**2. Choose the devices**

On **From monitored inventory**, select devices that SNMP discovery already found and confirm the platform Tracix guessed for each. On **Manual entry**, enter a **Hostname**, a **Management IP** and a **Platform** for a device monitoring hasn't seen.

**3. Assign a collector**

Under **Reachable via collector**, pick a collector that can reach the devices' management addresses. You can also assign a collector later from the inventory.

A new device has no configuration history. Its first backup captures the running configuration. Before a backup can run, the device needs a collector and a [credential binding](https://tracix.io/docs/network/ncm/vault); the inventory counts devices that lack either one.

## Who can do what

Configuration management has four permissions. The built-in roles map to them as follows, and a custom role can grant any of them.

| Permission | What it allows                                                                                                          | Built-in roles        |
| ---------- | ----------------------------------------------------------------------------------------------------------------------- | --------------------- |
| Read       | View inventory, configurations, changes, compliance and activity                                                        | Viewer, editor, admin |
| Write      | Add devices, credentials and bindings, backup policies, templates and maintenance windows; run backups; propose changes | Editor, admin         |
| Approve    | Approve or reject change requests                                                                                       | Admin                 |
| Apply      | Save approved intent, deploy to devices, stage firmware images, manage a device's host keys                             | Admin                 |

See [Users and roles](https://tracix.io/docs/admin/users-and-roles) to assign roles.

## Configuration management tasks

- [Device credential vault](https://tracix.io/docs/network/ncm/vault): Store write-only credentials and bind them to devices

- [Backups and drift](https://tracix.io/docs/network/ncm/backups): Schedule backups, compare versions and restore

- [Drafts and change requests](https://tracix.io/docs/network/ncm/change-requests): Templates, approvals, windows and deployment

- [Compliance rules](https://tracix.io/docs/network/ncm/compliance): Built-in and custom configuration checks

- [Supported platforms](https://tracix.io/docs/network/platforms): What each OS family supports