Pushing configs to live devices with the NetBase connector

The NetBase editors are powerful on their own, but the moment you want to push a config to a real device, a connector enters the picture. A connector is a small process you run on-prem — via Docker or as a Windows service — that speaks SSH to your devices and pulls work from NetBase over HTTPS. It keeps all device traffic inside your network while letting you design and deploy from the browser.

Once live, a connector:

1. Polls your devices on a schedule and uploads running-config, interface counters, and reachability state to NetBase. This is what powers the Fabric, Inventory, and Deployments views.
2. Pulls deploy jobs from the queue — either “merge this config” or “run this terminal session” — and executes them via SSH.
3. Reports results back so the Deployments panel can show you exactly which line succeeded and which one the device rejected.

The connector is the side that initiates the HTTPS connection outbound, so your firewall policy doesn’t have to change to let NetBase in.

Open Connectors in the sidebar and click New connector. A 3-step wizard opens:

• Step 1 — Connector details — pick a name (for example dc1-primary). That’s it. No hidden options.
• Step 2 — Install — NetBase generates the install command for your chosen platform and embeds the enrolment token into it. Pick Docker or Windows and the right snippet appears.
• Step 3 — Waiting for live status — NetBase polls while you run the command and flips the modal to success when the connector reports in.

You don’t need to look anything up — the command you’re about to run is copy-pasteable from step 2 and already has everything it needs.

On Docker, the generated command looks roughly like this (the real token is filled in for you):

docker run -d --name netbase-connector --restart unless-stopped \
  -v netbase-connector-data:/data \
  -e API_BASE_URL=<netbase endpoint> \
  -e CONNECTOR_BOOTSTRAP_TOKEN=<enrolment token> \
  -e DEVICE_PROVIDER=cisco-ssh \
  -e CONNECTOR_STATE_PATH=/data/connector-state.json \
  tawfekk/netbase-connector:latest

On Windows there’s an equivalent one-liner that pulls a PowerShell script and runs it with the token. Both snippets live behind copy buttons in the modal — no manual env-var wiring.

Run the command on any host in your network that can reach the devices you plan to manage. The container / service persists its state to a volume so restarts don’t re-enrol it.

Back in the modal, NetBase is already polling. The connector typically comes online within a minute of the container starting. When it does, the modal switches to a success state and closes; the Connectors card on the page now lists a new entry with a live status indicator and a “last seen” timestamp.

If the connector doesn’t go live, the modal surfaces a timeout error — most commonly the container host can’t reach the NetBase endpoint outbound on 443.

Also on the Connectors page, the Devices panel lists every router and switch in your project. Expand a device to open its access form:

• Connectors — one or more of your connectors, or “All connectors” if you want every one of them to be allowed to reach this device.
• Management IP / DNS — how the connector finds the device.
• SSH username — account to log in as.
• Authentication — password or private key, with a generate-strong-password helper for the first case.
• Enable secret — used if the SSH session lands at a > prompt and needs to enable.
• Host key fingerprint — optional, for strict SSH host verification.
• Port — defaults to 22.

Save the form. From this point forward the connector polls the device on its schedule and running-config snapshots start landing in the device’s history.

Open the Router or Switch editor, pick the device, make a change. When you click Deploy, NetBase opens the review modal with two tabs:

• Changes — field-level, human-readable diff against the last NetBase deploy.
• Config — side-by-side code diff against the device’s actual live running-config, which the connector pulled a few seconds ago.

Every deploy runs in merge mode — only the missing lines are pushed; existing device-side config outside your edits is untouched. If NetBase’s planned config already matches the running-config, you get a “nothing new to push” state and the Deploy button stays disabled.

Click Deploy and NetBase queues the job. The connector picks it up within a second, executes the merge, and streams back:

• Line-by-line command output, visible in the Deployments panel in real time.
• A snapshot of the running-config before the change, kept under Device history for one-click rollback.
• A pass/fail status that shows up in the Activity feed on the Dashboard.

If anything goes wrong the failed job shows up with the full output, so you can see exactly which line IOS rejected without reaching for SSH.

• The enrolment token is one-shot. Once the connector uses it, the token is retired automatically — a stolen copy can’t be used to enrol a second connector.
• Device credentials are scoped to the project. Only people you’ve invited to that project can see them.
• The connector scrubs its own logs: passwords, SSH keys, enable secrets, and enrolment tokens are replaced with [redacted] before anything is written out.

The connector model is what turns NetBase from a nice IOS generator into a real operations tool. You design the change in the same editor you’ve been using, the review modal shows you exactly what will land on the box, the connector does the push, and every step is archived.

If you haven’t tried the connector yet, sign in, open the Connectors page, and click New connector — the wizard does the rest.