Safe Configuration Backup Workflow

Scenario

The problem

Netmiko Fundamentals taught you how to pull a device's running config over a real SSH connection. This lab picks up exactly where that leaves off: once you have that text, what do you actually do with it so it's useful later? A backup that's never verified isn't a backup you can trust -- this lab builds the write-then-verify pair, not just the write.

Safe sample workflow -- read this before the real-device extension below

Everything in this lab's required task runs against a fixed Python string standing in for a device's running config. No device, connection, or credential is used or required. A short, clearly separate note at the end names what changes if you point this at a real device later -- that part is optional and not required to complete this lab.

Starter data

starter.py

import os
from datetime import datetime, timezone

# Stands in for what conn.send_command("show running-config") would
# return over a real Netmiko connection -- a plain string, not a live device.
SAMPLE_RUNNING_CONFIG = """hostname SW1
interface GigabitEthernet0/1
description mgmt-uplink
interface GigabitEthernet0/2
description guest-vlan-uplink
ntp server 10.10.10.2
"""

BACKUP_DIR = "backups"

Fixed sample data written for this lab. 10.10.10.2 is documentation address space, matching this curriculum's convention throughout -- not a real server.

Task

Write backup_config(hostname, running_config, backup_dir=BACKUP_DIR, now=None) that:

Creates backup_dir if it doesn't already exist.
Builds a filename shaped "<hostname>_<UTC timestamp>.cfg" (e.g. SW1_20260115T093000Z.cfg) — accept an optional now datetime so the function is testable without depending on the real current time.
Writes running_config to that file.
Returns the file path.

Then write verify_backup(filepath, expected_config) that reads the file back and returns True only if its content exactly matches expected_config.

Hints

Expected output

expected output

Backup written to: backups\SW1_20260115T093000Z.cfg
Verified: True
--- Backup file content ---
hostname SW1
interface GigabitEthernet0/1
description mgmt-uplink
interface GigabitEthernet0/2
description guest-vlan-uplink
ntp server 10.10.10.2

Real, verified output, using a fixed "now" (2026-01-15 09:30:00 UTC) so the timestamp in the filename is reproducible. Your own run will use the real current time unless you pass now= explicitly, so your filename's timestamp will differ -- that's expected.

Validation checklist

backup_config() creates the backups/ directory if it doesn't exist, without raising an error if it does
The returned file path's name matches the pattern <hostname>_<timestamp>.cfg
Reading the written file back returns content identical to SAMPLE_RUNNING_CONFIG
verify_backup() returns True for a correctly-written backup
Calling verify_backup() with a deliberately wrong expected_config returns False, not an error

Self-check only -- nothing here is submitted or graded. Compare against your own output manually.

Solution

Try the task yourself first -- the full solution and explanation stay hidden until you click above.

Key takeaways

A backup you haven't verified isn't a backup you can trust -- write and verify are two separate, both-necessary steps.
Accepting the current time as an injectable parameter (now=None) is what makes a timestamp-dependent function actually testable.
This lab's required task is 100% offline -- SAMPLE_RUNNING_CONFIG stands in for what a real Netmiko connection would return, never a live device.
The real-device extension is explicitly optional, clearly separated, and reuses only what Netmiko Fundamentals already taught -- never a new safety pattern.

Safe Configuration Backup Workflow

Objective

Prerequisites

Scenario

Starter data

Task

Expected output

Solution

Related lessons