Creating configuration backups enables you to later Restore a Configuration. This is useful when you want to revert the firewall to all the settings of an earlier configuration because you can perform the restoration as a single operation instead of manually reconfiguring each setting in the current configuration. You can either save backups locally on the firewall or export backups to an external host.
When you commit changes, the firewall automatically saves a new version of the running configuration. If a system event or administrator action causes the firewall to reboot, it automatically reverts to the current version of the running configuration, which the firewall stores in a file named running-config.xml. However, the firewall does not automatically save a backup of the candidate configuration; you must manually save a backup of the candidate configuration as a snapshot file using either the default name (.snapshot.xml) or a custom name.
When you edit a setting and click OK, the firewall updates the candidate configuration but does not save a backup snapshot. Additionally, saving changes does not activate them. To activate changes, perform a commit (see Commit, Validate, and Preview Firewall Configuration Changes). As a best practice, back up any important configuration to a host external to the firewall.
Back Up a Configuration
Save a local backup snapshot of the candidate configuration if it contains changes that you want to preserve in the event the firewall reboots. These are changes you are not ready to commit—for example, changes you cannot finish in the current login session. Perform one of the following tasks based on whether you want to overwrite the default snapshot (.snapshot.xml) or create a snapshot with a custom name: Overwrite the default snapshot—Click Save at the top of the web interface. Create a custom-named snapshot: Select Device > Setup > Operations and Save named configuration snapshot. Enter a Name for the snapshot or select an existing snapshot to overwrite. Click OK and Close.
Export a candidate configuration, a running configuration, or the firewall state information to a host external to the firewall. Select Device > Setup > Operations and click an export option: Export named configuration snapshot —Export the current running configuration, a named candidate configuration snapshot, or a previously imported configuration (candidate or running). The firewall exports the configuration as an XML file with the Name you specify. Export configuration version —Select a Version of the running configuration to export as an XML file. The firewall creates a version whenever you commit configuration changes. Export device state —Export the firewall state information as a bundle. Besides the running configuration, the state information includes device group and template settings pushed from Panorama. If the firewall is a GlobalProtect portal, the information also includes certificate information, a list of satellites, and satellite authentication information. If you replace a firewall or portal, you can restore the exported information on the replacement by importing the state bundle.

Related Documentation