Supported platforms
Configuration management backs up 30 network OS families over SSH. A smaller set also takes changes. This page lists what each family supports, the protocols you can choose, and the command and access every backup needs.
Support at a glance
| Platform | Backup and drift | Apply changes | Scoped writes | Tested in our lab |
|---|---|---|---|---|
| Arista EOS | Yes | Over SSH | NETCONF, gNMI | Backup |
| Nokia SR Linux | Yes | Scoped writes only | gNMI | Capture command |
| FRRouting | Yes | Not yet | Not yet | Backup |
| Cisco IOS and IOS XE, NX-OS, IOS-XR | Yes | Over SSH | Not yet | Not yet |
| Juniper Junos | Yes | Over SSH | Not yet | Not yet |
| Fortinet FortiOS | Yes | Over SSH | Not yet | Not yet |
| Palo Alto PAN-OS | Yes | Over SSH | Not yet | Not yet |
| VyOS | Yes | Over SSH | Not yet | Not yet |
| 20 more OS families | Yes | Not yet | Not yet | Not yet |
- Backup and drift: Tracix captures the running configuration, saves a version when it changes, and compares it with the intended configuration. See Backups and drift.
- Apply changes: the collector applies approved configuration over SSH. See Drafts and change requests.
- Scoped writes: the collector changes only the fields a change names, reads them before and after, and restores them when the readback doesn't match. They cover the hostname, the domain name, login and MOTD banners, and the description or enabled state of an existing interface. Over gNMI they can also add or remove a single deny entry for an address in an existing ACL.
- Tested in our lab: backups have run end to end against Arista EOS and FRRouting in our lab, and the capture command has been checked against Nokia SR Linux. The other families follow each vendor's documented command and permissions, but we haven't tested them against real devices yet.
The 20 more families are Nokia SR OS (classic CLI), Aruba AOS-CX, Aruba AOS-Switch, ArubaOS Mobility, Cisco ASA, Dell SmartFabric OS10, Dell Networking OS9, Huawei VRP, H3C and HPE Comware, Extreme EXOS, Extreme VOSS, Ruckus FastIron, MikroTik RouterOS, F5 BIG-IP TMOS, Check Point Gaia, NVIDIA Cumulus Linux, A10 ACOS, Ubiquiti EdgeOS, NETGEAR managed switches and SONiC.
Not yet
NETCONF and gNMI writes beyond Arista EOS and Nokia SR Linux aren't available. Neither is installing firmware; Tracix stages images without installing them.
Management protocols
Every family uses SSH by default. On some, you can choose another protocol for a device under Connection settings on its configuration management page.
| Protocol | OS families | Used for |
|---|---|---|
| SSH | All 30 | Backups, and changes on the families that apply them |
| NETCONF | Arista EOS, Cisco NX-OS, Cisco IOS-XR, Juniper Junos | Backups, and scoped writes on Arista EOS |
| gNMI | Arista EOS, Cisco NX-OS, Nokia SR OS, Nokia SR Linux | Backups, and scoped writes on Arista EOS and Nokia SR Linux |
gNMI uses TLS by default. A Plaintext gNMI option exists for isolated labs only, because it sends credentials unencrypted. Choosing a protocol never falls back to another one: if the device refuses it, the job fails.
Backup commands and access
A backup runs one read-only command and never enters configuration mode. The account behind the credential needs permission to read the full configuration. Login means the command runs at the access level the account signs in with; Enable means it needs privileged mode, from an enable binding or an account that signs in privileged; Shell means a Linux shell.
| OS family | Command | Access | Scope notes |
|---|---|---|---|
| Cisco IOS and IOS XE | show running-config | Enable | Privilege 15 or equivalent |
| Cisco NX-OS | show running-config | Login | An NX-OS role that can read the configuration |
| Cisco IOS-XR | show running-config | Login | Task-based authorization with config-services read |
| Cisco ASA | show running-config | Enable | Covers the current security context; the device may mask secrets |
| Arista EOS | show running-config | Enable | |
| Juniper Junos | show configuration | no-more | Login | The login must land in the CLI, not a Unix shell |
| Nokia SR OS | admin display-config | Login | Classic CLI only |
| Nokia SR Linux | info flat from running | Login | |
| Fortinet FortiOS | show full-configuration | Login | The account and VDOM scope bound the snapshot |
| Palo Alto PAN-OS | show config running | Login | Needs configuration read permission |
| VyOS | show configuration commands | Login | |
| FRRouting | vtysh -c 'show running-config' | Shell | Needs access to vtysh and the FRR daemons |
| Aruba AOS-CX | show running-config | Enable | Manager context |
| Aruba AOS-Switch | show running-config | Enable | Manager context |
| ArubaOS Mobility | show running-config | Enable | Mobility controller or conductor scope |
| Dell SmartFabric OS10 | show running-configuration | Login | |
| Dell Networking OS9 | show running-config | Enable | |
| Huawei VRP | display current-configuration | Login | A command level that can read the configuration, typically level 3 |
| H3C and HPE Comware | display current-configuration | Login | network-admin or network-operator authorization |
| Extreme EXOS | show configuration | Login | |
| Extreme VOSS | show running-config | Enable | |
| Ruckus FastIron | show running-config | Enable | |
| MikroTik RouterOS | /export | Login | Hidden secrets are excluded; not a binary backup |
| F5 BIG-IP TMOS | tmsh -q -c 'cd /; list recursive' | Shell | Configuration objects only, not UCS archives or certificates |
| Check Point Gaia | show configuration | Login | Gaia OS settings only, not the management server's firewall policy |
| NVIDIA Cumulus Linux | nv config show -o commands | Shell | NVUE-managed configuration only |
| A10 ACOS | show running-config | Enable | The current partition only |
| Ubiquiti EdgeOS | show configuration commands | Login | Not UniFi controller configuration |
| NETGEAR managed switches | show running-config | Enable | Full managed-switch CLI; not Lite CLI models |
| SONiC | show runningconfiguration all | Shell | Needs ConfigDB read access |
| Generic | show running-config | Login | A profile you pick for an unlisted device, with no vendor guarantee |
Junos covers Juniper routing, switching and SRX devices whose login lands in the CLI. A backup that returns an error or nothing at all fails rather than being saved as a configuration.
To see which template requirements Tracix can translate for each platform, open the coverage matrix on Network › Config Mgmt › Intent & templates.