The routine that makes upgrades boring: back up the configuration, update in a quiet window, verify, and always keep a way back.
A gateway update touches the one box the whole office depends on, so it deserves a ritual instead of a shrug. The ritual has two halves that belong together: back up the configuration before anything changes, and update deliberately, in a window, with verification after. Arista also offers automatic configuration backups through the ETM Dashboard for registered appliances — belt and braces is the right amount of caution for an edge device.
NG Firewall keeps its whole personality — interfaces, racks, rules, policies — in its configuration, and the admin interface lets you download a settings backup file. Take one before every upgrade and after every significant change, name it with the date and what changed, and store it off the box: a backup that lives only on the gateway's own disk fails exactly when the disk does. Registered appliances can also keep automatic configuration backups in the ETM Dashboard, which covers the day someone forgets the manual step. A backup is also your migration tool: if the hardware dies, the replacement box becomes your gateway again by restoring this file, not by rebuilding a year of rules from memory.
The upgrade settings let the box check for and install new versions automatically, or wait for you. Both are defensible. Automatic suits a small office that would otherwise run a year behind on security fixes. Manual suits a managed site where the admin wants release notes read and a window booked. The indefensible option is the third one most boxes actually live in: nobody knows which mode it is in. Open the upgrade screen today and make it a decision.
If verification fails badly, the backup file plus a reinstall is the documented way back — which is why step one was first.
VM installs get one extra safety net: a hypervisor snapshot taken with the backup, minutes before the upgrade. A snapshot is not a replacement for the configuration backup (it cannot be restored onto different hardware, and old snapshots must not linger), but as a same-evening undo button it is unmatched. Delete it once the upgraded box has run cleanly for a few days.
The install and configuration video walks the real interface — the same screens where backups and upgrades live.
▶️ Watch Full VideoUpgrades are designed to carry your configuration forward — interfaces, racks and policies survive. The backup habit is not about expecting loss; it is about the rare bad day (a power cut mid-upgrade, a dying disk) and about hardware replacement, where the backup file turns a disaster into a restore.
Arista ships app and signature updates continuously and platform version upgrades periodically in the 17.x series. The practical answer is: often enough that 'we update when something breaks' guarantees you will eventually update in a panic. Enable update checks, glance at the dashboard monthly, and apply version upgrades in planned windows.
Off the gateway, in two places if you can: your normal IT file store, and the automatic ETM Dashboard backup for registered boxes. Treat the file as sensitive — it describes your whole network edge — so it belongs in access-controlled storage, not in a shared downloads folder.