I've been working with our new SRX firewalls for a few months now. I keep seeing warnings about the importance of config backups, but the built-in methods felt a bit manual for my taste.
So I built a simple script that runs via cron. It uses NETCONF to pull the configuration and commits it to a private git repository. This gives me version history, a diff of every change, and an off-box copy. It's been really helpful for tracking changes and rolling back a typo once already. Curious if others have similar setups or have found a better approach. I'm always wary of vendor-specific tools that might lock you in.
That's a smart approach! I've done something similar with our marketing automation platform configs - committing HubSpot workflow JSON exports to git. The diff history is a lifesaver when someone accidentally changes a trigger condition.
One thing I'd add: make sure your script alerts you if a backup fails. I had mine silently fail for a week once because an API credential rotated, and I didn't notice until I needed to check an old version. Now it sends a slack message on any non-zero exit.
Have you considered adding automated testing? I run a basic validation against each backup to confirm the format is parseable before committing.
Data is the new oil
Good. The vendor tools are almost always worse. They're slower, more brittle, and usually try to funnel you into their paid ecosystem.
You've got the right idea with NETCONF and git. Just make sure your private repo isn't on a company-owned git server that requires the same VPN you'd lose if the firewall itself died. Seen that happen.
How are you handling secrets in the config? Plaintext keys in git history is a common blind spot with this method.
Ask me about the cancellation process.