---
title: Network Configuration Management Rollbacks
description: Roll back a network device to a previous configuration from NDM.
breadcrumbs: >-
  Docs > Network Monitoring > Network Device Monitoring > Network Configuration
  Management Rollbacks
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Network Configuration Management Rollbacks

## Overview{% #overview %}

Network Configuration Management (NCM) rollbacks let you restore a network device to a previous configuration directly from Datadog. Rollbacks use a [Private Action Runner (PAR)](https://docs.datadoghq.com/actions/private_actions.md) to apply the selected configuration back to the device.

Rollbacks are supported for the following vendors and platforms:

- Cisco IOS
- Arista (EOS)

## Prerequisites{% #prerequisites %}

- [Network Configuration Management](https://docs.datadoghq.com/network_monitoring/devices/config_management.md#viewing-configurations) must be set up for your devices.
- The Datadog Agent must be on version `7.83.0` or later.
- A [Private Action Runner](https://docs.datadoghq.com/actions/private_actions.md) that the Agent's IPC port (default `5001`) can reach, either on the same host or over the network.

## Setup{% #setup %}

### Agent{% #agent %}

1. Add the following to your `datadog.yaml` to enable rollbacks:

   ```yaml
   network_devices:
     config_management:
       rollback:
         enabled: true
   ```

Alternatively, set the `network_devices.config_management.rollback.enabled` configuration option to `true`.

1. In `conf.d/network_config_management.d/conf.yaml`, optionally set how often the Agent reports its configuration inventory:

   ```yaml
   init_config:
     ## @param inventory_report_max_interval - integer - optional - default: 3600 (1 hour)
     ## Maximum interval, in seconds, between inventory reports.
     inventory_report_max_interval: 3600
   ```

1. Optionally, configure the local store that holds configurations eligible for rollback:

   ```yaml
   init_config:
     store:
       ## @param min_configs_per_device - integer - optional - default: 2
       ## Minimum number of configurations to retain per device, regardless of age.
       min_configs_per_device: 2
       ## @param max_configs_per_device - integer - optional - default: 24
       ## Maximum number of configurations to retain per device before older ones are evicted.
       max_configs_per_device: 24
       ## @param max_raw_config_store_bytes - integer - optional - default: 2000000000 (2 GB)
       ## Maximum size, in bytes, of the local configuration store before older configurations are evicted.
       max_raw_config_store_bytes: 2000000000
   ```

1. The Agent process needs write access to the `run_path` directory where rollback data is stored locally.

1. Restart the Agent to apply the configuration changes.

### Private Action Runner{% #private-action-runner %}

1. [Set up a Private Action Runner](https://docs.datadoghq.com/actions/private_actions.md) on a host that the Agent's IPC port can reach.

1. Add `com.datadoghq.remoteaction.networkconfigmanagement.rollbackConfig` to the `private_action_runner.actions_allowlist` section of `/etc/datadog-agent/datadog.yaml`. See [Change the allowlist of a runner](https://docs.datadoghq.com/actions/private_actions/use_private_actions.md?tab=linux#change-the-allowlist-of-a-runner) for details.

1. Register the runner in Datadog and assign it to an execution group. Within that group, create a policy that allows the `com.datadoghq.remoteaction.networkconfigmanagement.rollbackConfig` action.

   - The policy must grant `Editor` access to users with the `NCM Device Config Write` role.

   {% image
      source="https://docs.dd-static.net/images/network_device_monitoring/config_mgmt/execution_group_policy.dece89c52017ef6362b3f3c43e4e9794.png?auto=format&fit=max&w=850 1x, https://docs.dd-static.net/images/network_device_monitoring/config_mgmt/execution_group_policy.dece89c52017ef6362b3f3c43e4e9794.png?auto=format&fit=max&w=850&dpr=2 2x"
      alt="Screenshot that shows how to add the NCM Write role to an execution group policy" /%}

### Permissions{% #permissions %}

Rollbacks use the following NCM permissions:

| Permission | Allows                        |
| ---------- | ----------------------------- |
| NCM Read   | Viewing device configurations |
| NCM Write  | Triggering a rollback         |

## Trigger a rollback{% #trigger-a-rollback %}

1. Navigate to the [Configuration tab](https://docs.datadoghq.com/network_monitoring/devices/config_management.md#viewing-configurations) for a device in the NDM device view.

1. Select the configuration version you want to roll back to. The side panel displays a Rollback button for that version.

1. Click Rollback, review the diff in the confirmation modal.

1. Click Rollback again to confirm.

   {% image
      source="https://docs.dd-static.net/images/network_device_monitoring/config_mgmt/config_rollback.975a9084f6645d49374196fbb70fdac7.png?auto=format&fit=max&w=850 1x, https://docs.dd-static.net/images/network_device_monitoring/config_mgmt/config_rollback.975a9084f6645d49374196fbb70fdac7.png?auto=format&fit=max&w=850&dpr=2 2x"
      alt="Screenshot that shows when a rollback has been initiated and what to expect" /%}

## Further Reading{% #further-reading %}

Additional helpful documentation, links, and articles:

- [Network Configuration Management](https://docs.datadoghq.com/network_monitoring/devices/config_management.md)
- [Private Action Runner](https://docs.datadoghq.com/actions/private_actions.md)