Summary: How often to back up switch and firewall configs, how to keep versions and how to track changes: the routine to set up before the next outage.
A single wrong line on a switch can take a whole floor offline. According to Uptime Institute's 2025 outage analysis, half of all network outages start with a wrong or unrecorded config change. A regular backup and change-tracking routine is enough to prevent a large share of them.
1. List what you need to back up
Core and distribution switches, access switches, firewalls and wireless controllers. Without an inventory the backup plan stays incomplete; start with the device list, IP addresses and access methods.
2. Scheduled backups and post-change backups
A scheduled nightly backup gives the baseline. On top of that, take a backup right after every planned change so the pre-change state is always at hand.
3. Keep versions instead of overwriting
Overwriting one file every night means a broken config gets backed up too. Store each backup with a version number and date so you can choose the point to roll back to.
4. Read the difference between two versions
When something breaks, the first question is "what changed?". A line-by-line comparison (diff) of two versions shows within minutes which interface, VLAN or spanning-tree setting was changed. Who made the change and when should be recorded as well.
5. Protect passwords and backups
Config files contain password hashes, SNMP community strings and VPN keys. Store backups encrypted and mask secrets in reports and screens. Keeping backups inside the company matters especially in KVKK, ISO 27001 and NIS2 audits.
6. Keep the network diagram current
A topology diagram drawn at the end of a project goes stale within months. Reading links regularly from LLDP/CDP neighbours keeps track of which switch connects where and which ports are free.
7. Watch PoE budgets and loop symptoms
When a new camera or access point is added, a switch's PoE budget can fill up silently. Likewise, MAC addresses flapping between ports and frequent spanning-tree topology changes signal a loop. These symptoms appear before the outage.
8. Test a restore
A backup that has never been restored is only assumed to exist. At least once a year, run a restore test on a spare device or in a lab.
Set a change window and add a short note to every change. Six months later, the answer to "why is this set like this?" will be in those notes.
Running this routine from one screen
Denetta Network backs up Cisco IOS / IOS-XE switch and FortiGate firewall configs on your own server, fully offline, encrypted and versioned. It shows every change with who made it, draws the network as a live map and tracks used and free ports, PoE budgets and loop symptoms on each switch's front panel. It ships as a ready-made virtual machine or a Windows install and supports up to 1,000 devices per installation.
See your network before the next outage
In a Denetta Network demo, let's plan a setup that fits your network.
Request a demo