PDF

Configuration backup and recovery

Updated: April 15, 2026

Want to summarize with AI?

Log in

Configuration backups enable you to restore Cisco APIC to a known-good configuration state and protect secure properties in exported configuration files.

Use configuration backup and recovery to:

  • Restore Cisco APIC to a known-good configuration state by importing a previously exported configuration.

  • Encrypt secure properties in exported Cisco APIC configuration files.

Cisco APIC supports scheduled and on-demand backups of the user configuration. Periodic backups provide known-good configuration files that you can use to recover from configuration errors.

Atomic replace

To restore a known-good configuration, use the Atomic Replace option. The configuration import policy (configImportP) supports atomic-replace operations with the following property values:

  • importMode=atomic

  • importType=replace

With these values, Cisco APIC replaces the existing configuration with the configuration in the imported file.

Caution
An atomic-replace operation deletes any existing configuration that is not present in the imported configuration file. Before performing the operation, verify that the imported file contains the complete configuration that you want to restore.

You can restore a configuration by using the Cisco APIC GUI, CLI, or REST API.

Backup recommendations

Create periodic configuration backups and exports. You can also perform an on-demand export after verifying that the current configuration is in a known-good state.

Related information

For more information about recovering Cisco APIC configuration states, see the Cisco Application Centric Infrastructure Fundamentals Guide.

Configuration File Encryption

Configuration file encryption uses a global AES-256 setting to protect secure properties in exported configuration files.

  • A 16-32-character passphrase generates the AES-256 encryption keys.

  • The same passphrase generates the same keys, which enables an encrypted configuration export to be imported into another fabric that uses the same passphrase.

  • You can compare the passphrase hashes on different fabrics to determine whether they use the same passphrase.

  • The passphrase is not stored and cannot be recovered. Encryption keys are not exported and cannot be retrieved through the REST API.

Encrypted Configuration File Guidelines

  • You can import a configuration from an older ACI release into a fabric that uses AES encryption. You cannot import an AES-encrypted configuration into a fabric that runs an older Cisco APIC release.

  • Enable AES encryption when you export a fabric backup. Encryption includes secure properties in the backup so that they can be restored. If encryption is disabled, the export omits secure properties, and restoring that file can cause administrators and other users to lose access.

  • Store the AES passphrase securely. Administrators and other users cannot view or recover it.

  • For troubleshooting, temporarily disable encryption to export a configuration without secure properties. When you import this file, use merge mode instead of replace mode to preserve the secure properties in the existing configuration.

Warning

By default, the system rejects a configuration import if any field cannot be decrypted. Do not disable this protection. If the imported file does not match the fabric AES settings, disabling the protection can remove passwords and lock out all users, including administrators.

Configure a Remote Location Using the GUI

A remote location specifies an external destination for exported data and backup files.

Procedure

  1. On the menu bar, choose ADMIN > Import/Export.

  2. In the navigation pane, right-click Remote Locations, and choose Create Remote Location.

    The Create Remote Location dialog box opens.

  3. Enter the remote-location settings in the Create Remote Location dialog box.

    Tip

    To display help for a field, click its i icon.

  4. Click Submit.

The remote location is available as a destination for exported data and backups.

Configure an Export Policy Using the GUI

This procedure explains how to configure an export policy using the Cisco Application Policy Infrastructure Controller ( APIC ) GUI. Use the following procedure to trigger a backup of your data.

Note

The Maximum Concurrent Nodes value that is configured in a scheduler policy determines the number of configuration export policies to act at the time that is specified in the scheduler policy.

For example, if the Maximum Concurrent Nodes is set to 1 in a scheduler policy and you have configured two export policies, both utilizing the same scheduler policy, one export policy is successful and other fails. However, if the Maximum Concurrent Nodes is set to 2 , both configurations are successful.

When the user is logged in with read-only privileges, Tech Support data can still be exported by right-clicking on the On-Demand Tech Support or Configuration Export polices and choosing Trigger .

Procedure

  1. On the menu bar, choose Admin > Import/Export .

  2. In the Navigation pane, right-click Export Policies and choose Create Configuration Export Policy .

    The Create Configuration Export Policy dialog appears.

  3. Enter the appropriate values in the Create Configuration Export Policy dialog fields.

    For an explanation of a field, click the help ( ? ) icon to display the help file.

  4. After you finish entering values in the Create Configuration Export Policy dialog fields, click Submit .

    You have now created a backup. You can view this under the Configuration tab. The backup file will appear in the Configuration pane on the right.

    Note

    When deployed and configured to do so, the Cisco Network Assurance Engine (NAE) creates export policies in the Cisco APIC for collecting data at timed intervals. You can identify a Cisco NAE export policy by its name, which is based on the assurance control configuration. If you delete a Cisco NAE export policy in the Cisco APIC , the Cisco NAE export policy will reappear in the Cisco APIC . We recommend that you do not delete the Cisco NAE export policies.

  5. In the Navigation pane, choose Export Policies > Configuration > policy_name .

  6. In the Work pane, choose the Operational > Job Status tabs.

    On this screen, you can view a table with information about the export jobs. If you did not trigger an export job, then the table is empty. The State column indicates the status of an export job. The possible values are:

    • success : The job succeeded.

    • failed : The job failed.

    • success-with-warnings : The job succeeded, but there were some issues.

    The Details column indicates whether the integrity validation succeeded or failed.

    If you created a backup, the Cisco APIC creates a file that is shown in the Operational view of the backup file that was created. If you want to then import that data, you must create an import policy.

Configure an Import Policy Using the GUI

Use a configuration import policy to restore configuration data from a backup.

Procedure

  1. On the menu bar, choose ADMIN > Import/Export.

  2. In the navigation pane, right-click Import Policies, and choose Create Configuration Import Policy.

    The Create Configuration Import Policy dialog box opens.

  3. Enter the import-policy settings in the Create Configuration Import Policy dialog box.

    Tip

    To display help for a field, click its i icon. For information about import types and modes, including Replace, Merge, Best Effort, and Atomic, see the Cisco Application Centric Infrastructure Fundamentals Guide.

  4. Click Submit.

    After a clean fabric reload, importing a previously saved configuration resets the Cisco APIC cluster time zone to UTC. After the import, reset the cluster to the appropriate local time zone.

The configuration import policy is created and available for restoring backed-up configuration data.

Enable AES Encryption for Configuration Files Using the GUI

AES-256 encryption is a global setting. When encryption is enabled, all secure properties use this setting.

A configuration export policy can export part of the ACI fabric configuration by specifying a targetDn. A REST API request cannot export part of the fabric configuration, such as a tenant configuration, with secure properties protected by AES encryption. Secure properties are omitted from partial-configuration REST API exports.

Procedure

  1. On the menu bar, choose ADMIN > AAA.

  2. In the navigation pane, click AES Encryption Passphrase and Keys for Config Export (and Import).

    The Global AES Encryption Settings for all Configurations Import and Export window appears in the work pane.

  3. Create a passphrase that contains 16-32 characters.

    The passphrase can contain any characters.

  4. Click SUBMIT.

    The Key Configured field displays yes. The Encrypted Passphrase field displays an encrypted hash, not the passphrase.

    After you submit the passphrase, the system generates the encryption keys, and the passphrase cannot be recovered. Store the passphrase securely. You must provide the same passphrase to open an encrypted backup.

  5. Select Enable Encryption.

    Warning

    Keep Fail Import if secure fields cannot be decrypted selected in import policies. This option is selected by default. If you clear it, the system attempts to import the fields that it can decrypt and leaves other secure fields blank or missing. Missing administrator passwords can lock you out of the system. If the option is selected, security checks stop the import when secure fields cannot be decrypted. For recovery information, see the Cisco APIC Troubleshooting Guide.

    Note

    • When Enable Encryption is cleared, exported configurations omit secure fields such as passwords and certificates.

    • When Enable Encryption is selected, exported configurations include secure fields in encrypted form.

    • After you enable encryption, you cannot configure a passphrase in an individual import or export policy. The passphrase applies globally to all configurations and tenants.

    • A backup created while encryption is enabled includes secure properties. A backup created while encryption is disabled omits secure properties and can be shared for support analysis without exposing those values.

    • Use the clear option to remove the encryption key.

    The following table describes configuration import behavior:

    Table 1. Configuration Import Behavior

    Condition

    Result

    The configuration is from a previous release.

    The import is supported and includes the secure fields stored in the older configuration.

    AES encryption is not configured.

    A configuration without secure fields imports successfully. A configuration with secure fields is rejected.

    The AES passphrases do not match.

    A configuration without secure fields imports successfully. A configuration with secure fields is rejected.

    The AES passphrases match.

    The configuration imports successfully.

    Copied secure fields were encrypted with a different passphrase.

    If any property fails to decrypt during the first parsing pass, the import fails before any shards are imported. If one shard contains a property that cannot be decrypted, all shards are rejected.

    The Global AES Encryption Settings field is enabled by default in export and import policies.

AES-256 encryption is enabled globally for configuration export and import operations.