Your firewall rules, VPN users and exceptions took months to tune. One dead disk can erase them all — unless you keep one small exported file. Here is the backup and update routine that keeps a free firewall recoverable.
Ask experienced admins for their worst firewall day and it is rarely an attack — it is a failed box with no configuration backup. NG Firewall exports its entire configuration in a couple of clicks, yet most small offices never do it. This page builds the habit: when to export, where copies must live, how to update without gambling, and why you should rehearse one restore before you ever need it.
Hardware is replaceable in an afternoon; your configuration is not. Months of tuned firewall rules, VPN users, exceptions for the accounting software, that one port forward nobody remembers creating — all of it lives in the configuration. If the disk dies or an upgrade goes wrong, a current backup restores the office to exactly where it was. Without one, you rebuild from memory while the internet is down and everyone watches. NG Firewall makes this easy: the Backups section under system settings exports the full configuration to a file. The feature being easy is precisely why forgetting it is unforgivable.
Routines beat intentions. Tie the backup to moments that already exist:
NG Firewall can download and apply updates automatically, and for security fixes that default is healthy — an unpatched firewall is a decorated door. But automatic is not the same as unattended. Sensible practice for a small office: let security and minor updates flow, schedule major version upgrades for a quiet window (they can require a reboot), take the configuration backup first, and glance at the release notes for anything touching VPN or your WAN setup. Where the Arista ETM Dashboard manages your device, it can also hold configuration backups centrally — worth enabling if you already use it, since it removes the "copies only on the box" risk in one move.
A backup you have never restored is a hope, not a plan. Once — on a spare PC, a virtual machine, or simply by walking through the restore screens without committing — prove that your exported file loads and your version notes make sense. Note how long it takes; that number is your real recovery time on the worst day of the year, and knowing it changes panic into a schedule. Keep one printed page with the basics: where backups live, the admin login location, the current version, and who to call. The video shows a firewall that is simple to run — this page makes sure it stays simple to recover.
Watch the video setup, then take your first configuration backup the same day.
▶️ Watch Full VideoUnder the system settings, in the Backups section — it exports the full configuration as a downloadable file. Take one after setup, after every major change, and always before a version upgrade, and store copies away from the firewall itself.
Security and minor updates on automatic is a healthy default; an unpatched firewall is a real risk. For major version upgrades, work deliberately: back up first, pick a quiet window in case a reboot is needed, and skim the release notes for VPN or WAN changes that affect you.
With a current backup and a spare machine, typically the time to install the software and restore the file — an hour-scale job. Without a backup, you are rebuilding rules and VPN users from memory, which is a day-scale job done under pressure. The backup is the entire difference.