Configuration management
Network changes you can review, test and roll back
Back up every device configuration, check it against compliance rules, compose changes as reviewable drafts and apply them through your own collectors. Credentials stay write-only in the vault.
- 30 OS families backed up
- SSH · NETCONF · gNMI
- 10 built-in compliance rules
How a change moves
Six steps from backup to verified change
Every step is recorded against the change request, so an auditor can see who asked, who approved and what the device ran.
- 01CaptureScheduled SSH backups for 30 OS families, with drift shown where a running configuration breaks the intent you declared.
- 02DraftWrite the intent once, use templates, or let Brain draft it when an AI provider is configured.
- 03CheckPreview checks diff the change against the device's intent and its platform's schema, without touching the device.
- 04ApproveChange requests carry approvers and a maintenance window.
- 05ApplyThe collector next to the device applies it over SSH, or NETCONF and gNMI where supported.
- 06VerifyRead the configuration back, compare it, and restore the previous version if needed.
Compliance
Know which devices drift from policy, and why
Ten built-in rules cover the checks every audit asks about, and text checks cover anything specific to your network. Compliance evaluates every managed device each time you open it.
- Every proposed change gets preview checks before it can become a request
- Drift shows where a running configuration breaks the intent you declared
- Reports show results by device, rule and severity
Credentials
Device passwords go in. They never come back out.
Credentials are write-only. Nobody can view them after saving, including administrators, and collectors receive them only for the job they are running.
Envelope encryption
AES-256-GCM with a per-tenant key.
Just in time
Delivered to the collector for one job, not stored on it.
Host-key pinning
SSH sessions refuse a device whose key has changed.
No reveal endpoint
There is no API or screen that returns a saved secret.
Better together
When a change causes a problem, the evidence is already linked
Config changes are events in the same workspace as your traces, device metrics and alerts. Problems can cite the change that started them.
- Network device monitoringSNMP v2c and v3 polling with built-in device profiles, plus traps and syslog.Learn more
- Discovery & topologyCIDR sweeps find devices, and the LLDP neighbors they report draw the map of how they connect.Learn more
- Problems & BrainCorrelate a latency spike with the change that preceded it, and draft the rollback.Learn more
Supported platforms
What works on which platform, stated plainly
Tested in our lab shows what has run end to end against the vendor's software. The other families follow each vendor's documented commands and permissions.
| Platform | Backup and drift | Apply changes | Scoped writes | Tested in our lab |
|---|---|---|---|---|
| Arista EOS | SSH | SSH | NETCONF, gNMI | Backup |
| Nokia SR Linux | SSH | Scoped writes only | gNMI | Command check |
| FRRouting | SSH | Not yet | Not yet | Backup |
| Cisco IOS, NX-OS, IOS-XR | SSH | SSH | Not yet | Planned |
| Juniper Junos | SSH | SSH | Not yet | Planned |
| Fortinet FortiOS | SSH | SSH | Not yet | Planned |
| Palo Alto PAN-OS | SSH | SSH | Not yet | Planned |
| VyOS | SSH | SSH | Not yet | Planned |
| 20 more OS families | SSH | Not yet | Not yet | Planned |
Backup also covers Cisco ASA, Aruba, Dell, Huawei, H3C, Extreme, F5, Check Point, MikroTik, Cumulus, SONiC and more. Scoped writes cover hostname, domain name, banners and interface description or state, plus ACL deny entries over gNMI.
Can Tracix install firmware?
Do collectors store device credentials?
Do my devices need internet access?
Do I need Brain to use NCM?
Back up your first device in minutes
Install a collector next to your devices, add a credential to the vault and schedule a backup.