Backups
NetDefense can automatically back up each device’s full configuration to an S3-compatible storage provider. Backups are encrypted and run on a named schedule — the same scheduler used for syncs and run commands.
How Backups Work
Section titled “How Backups Work”Backup configuration has two levels:
- Organization-level config — defines the S3 endpoint, bucket, credentials, the schedule that drives backup runs, and a master encryption key. This is set up once per organization.
- Per-device toggle — each device can be individually enabled or disabled for backups. This lets you exclude lab or test devices from the backup schedule.
Encryption Keys
Section titled “Encryption Keys”All backups are encrypted before upload. There are two key levels:
- Organization key (
org) — the default encryption key shared across all devices in the organization. Set withndcli backup config set, which prompts for it when it creates the backup configuration;--encryption-keychanges it later. - Device key (
device) — an optional per-device override encryption key. When set, this device’s backups use its own key instead of the organization key.
Show Backup Config
Section titled “Show Backup Config”Open Backups and click the chevron on the S3 Backup Configuration card: it holds the bucket, the endpoint URL, the access key, the schedule that drives backup runs and the default encryption key. See Backups.
ndcli backup config showOrganization: example-orgStatus: ○ DISABLED
S3 Endpoint: https://s3.us-east-1.wasabisys.comS3 Bucket: example-firewall-backupsS3 Folder: productionS3 Key ID: AKIAIOSFODNN7EXAMPLESchedule: nightly-maintenanceEncryption Key: ● Configured
Created: 2026-02-20 19:19:51Updated: 2026-02-20 19:19:51The Schedule field shows the name of the schedule driving backup runs. To change when backups run, update the schedule itself — or attach a different one with ndcli backup config set --schedule <name>.
View Backup Status
Section titled “View Backup Status”The Device Backup Status table on Backups lists every device with its Enabled toggle, its encryption key, its last backup and its status, with a short reason when the last one failed.
ndcli backup status╭───────────────────┬──────────┬─────┬─────────────┬───────────╮│ Device │ Backup │ Key │ Last Backup │ Status │├───────────────────┼──────────┼─────┼─────────────┼───────────┤│ fw-branch-austin │ Enabled │ org │ 2d │ ● FAILED ││ fw-branch-chicago │ Enabled │ org │ 6h │ ● SUCCESS ││ fw-branch-denver │ Enabled │ org │ 6h │ ● SUCCESS ││ fw-guest-lobby │ Disabled │ - │ Never │ - ││ fw-hq-primary │ Enabled │ org │ 6h │ ● SUCCESS ││ fw-hq-secondary │ Enabled │ org │ 6h │ ● SUCCESS ││ fw-lab-bench │ Disabled │ - │ Never │ - ││ fw-staging-01 │ Enabled │ org │ 1d │ ● SUCCESS │╰───────────────────┴──────────┴─────┴─────────────┴───────────╯
Total: 8 devices (6 with backup enabled)Reading this output:
- Key: org — the device uses the organization-level encryption key for its backups.
- Key: device — the device uses a device-specific encryption key (set with
ndcli backup encryption-key set <device>). fw-branch-austinshows FAILED — backups are enabled but the last attempt failed, likely due to a connectivity issue (this device also shows as NOT SYNCED).fw-guest-lobbyandfw-lab-benchhave backups Disabled — the guest firewall is excluded intentionally, and the lab device is still PENDING so backups don’t apply.
Backup schedule states
Section titled “Backup schedule states”A device’s backup status reflects both its per-device toggle and the organization-level schedule attachment:
| State | Meaning |
|---|---|
| Enabled / Scheduled | The device is opted in and the org config has a named schedule attached. Backups will run automatically. |
| Enabled / Not scheduled | The device is opted in but no schedule is attached to the org config. Backups will not run until a schedule is set. You can still back up now. |
| Disabled | The device is opted out. No backups run regardless of the schedule state. |
To attach or change the schedule, expand the S3 Backup Configuration card on Backups and pick a schedule from the dropdown.
To attach or change the schedule:
ndcli backup config set --schedule nightly-maintenanceTo view and manage schedules: Schedules.
To see the recurring backup task: Scheduled Tasks.
Back up now
Section titled “Back up now”You don’t have to wait for the schedule.
On Run, pick the Backup command, choose devices and OUs or the entire organization as the target, and click Run now.
Run ndcli run backup with --device, --ou or --all:
ndcli run backup --device fw-hq-primaryOnly devices with backup enabled are backed up. A device that is offline does not take the backup later, and its task expires after about a minute. See run backup for the targets and the reasons a device can be skipped.