Nexapp - Backup and Restore

Backup and Restore

NexappOS includes a flexible and reliable backup system to save and restore all gateway configuration settings. Backups protect your SD-WAN policies, firewall rules, VPN settings, security profiles, and system preferences so the unit can be recovered quickly after failures or changes.

Open System → Backup & Restore, then click Download backup.
If the device has an active subscription, backups are created automatically as well.

Backups include: - all relevant configuration files
- a list of extra packages installed by the administrator

The extra package list is stored here:

• /etc/backup/installed_packages.txt

Backup

NexappOS supports both encrypted and unencrypted backups.

Unencrypted Backup

You can always download an unencrypted backup:

• Click Download unencrypted

Encrypted Backup

To enable encrypted backups:

1. Click Configure passphrase
2. Set a strong passphrase
3. The Download encrypted button becomes available

Note
If you lose the encryption passphrase, you will not be able to restore the encrypted backup.

To disable encrypted backups:

• Click Remove passphrase
• The Download encrypted button will become inactive

Restore

To restore a backup:

1. Go to System → Backup & Restore → Restore tab
2. Click Restore backup
3. Upload the backup file
4. If the backup is encrypted, enter the passphrase
5. Click Restore to start the process

After restore completes, NexappOS will reboot automatically.

If extra packages were installed earlier, restore them by following the instructions under Restore extra packages in this manual.

Devices with an Active Subscription

Subscription required
The following behavior applies only when the unit has a valid subscription.

Backups behave differently on subscribed devices:

• Unencrypted backups can still be downloaded locally by clicking Download unencrypted.
• Encrypted backups are stored in the cloud and integrated with the central operations portal.
  This enables easy restore by selecting a stored backup directly during recovery.

Enabling Encrypted Cloud Backups

1. Click Configure passphrase and set a strong passphrase
2. After encryption is enabled, you may:
   • Click Run cloud backup to create one immediately
   • Allow the system to create backups automatically every night

Encrypted backups are sent securely to the cloud portal.
Backup timestamps shown in the portal follow the portal server time, so displayed dates may differ by time zone.

Warning
Cloud backups without encryption are being phased out.
Non-encrypted cloud backups may stop working in future releases.
Always enable encryption to keep backups protected and compatible.

Backup Encryption Alert

Not encrypting backups is a security risk. Anyone with access to an unencrypted backup can read its configuration content.

Each night, NexappOS checks if backup encryption is enabled.
If encryption is missing, an alert is generated in the cloud operations portal.

To resolve the alert: - Click Configure passphrase - Set a strong passphrase
The alert clears automatically on the next nightly check.

To disable the alert from CLI:

```bash uci set ns-plug.config.backupalertdisabled=1 uci commit ns-plug