---
title: "SSH Command Access for Kentik NMS"
slug: "ssh-command-access-for-kentik-nms"
description: "This article provides an overview of and prerequisites for configuring and using Kentik NMS with AI Advisor to assist with NetOps. "
status: "update"
updated: 2026-09-18T14:56:46Z
published: 2026-09-18T14:56:46Z
canonical: "kb.kentik.com/ssh-command-access-for-kentik-nms"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://kb.kentik.com/llms.txt
> Use this file to discover all available pages before exploring further.

# SSH Command Access for Kentik NMS

This article covers how to configure and use Kentik NMS with AI Advisor to assist with NetOps.

![AI Advisor performing an NMS device configuration analysis, highlighting changes and their impacts.](https://cdn.us.document360.io/082e25b5-afce-42d4-8f47-70bd3f1d02b7/Images/Documentation/ANMS-device-details-AIA-overlay.png?sv=2026-02-06&spr=https&st=2026-11-05T15%3A45%3A23Z&se=2026-11-05T16%3A45%3A23Z&sr=c&sp=r&sig=bzJnIUdFZqrjPVZs%2Ft2pV4iZfLdKu8ZgIKtCx%2B4DMfs%3D)

*AI Advisor performing an NMS device configuration analysis, highlighting changes and their impacts.*

## Overview

[**Kentik NMS**](/v1/docs/nms-overview) has two SSH-powered features to supercharge [**NetOps**](https://www.kentik.com/kentipedia/what-is-netops-network-operations/) practitioners with better network intelligence:

- [**Command Access**](/v1/docs/ai-assisted-netops-command-access) (On-Demand Device Diagnostics)
- [**Config Context**](/v1/docs/config-context) (Backups and Diffs)

With these features, [**AI Advisor**](/v1/docs/ai-advisor) becomes more powerful: It can access, analyze, and interpret device configurations and, with user permission, pull real-time operational data from devices during live investigations using read-only show commands via SSH.

`"Show me why my network performance dropped after last night's edge router change."`

> [!WARNING]
> **IMPORTANT**:
> 
> - Access to this feature requires an active NMS device license (see [**Licenses**](/v1/docs/licenses)).
> - Kentik enforces AI Advisor’s strict read-only behavior by default using a standard command block-list. Users can supplement the block-list with custom allow or deny filters. For additional company-wide control, administrators can independently disable access to stored platform configurations and the ability to execute filtered show commands (see [**SSH Access & Security Policy**](/v1/docs/agentic-analysis-for-nms#ssh-access-security-policy)).

## Prerequisites

Before configuring AI Advisor for network device analysis, ensure your environment meets the following requirements:

- **Licensing**: An active NMS Device [**License**](/v1/docs/licenses) is required for each device you intend to monitor.
- **Kentik Universal Agent**: You must have the latest version of the [**Universal Agent**](/v1/docs/universal-agents) deployed within your infrastructure with network reachability to the target devices.
- **Connectivity**: Port TCP/22 (SSH) must be open between the Universal Agent and the device management IP.

> [!NOTE]
> **Note**: The Universal Agent must have a direct route to the device's Management IP; it does not scrape configuration data via the data plane.
- **Supported Platforms**: Ensure your device OS is supported for configuration scraping:

| Platform | Support Level | Recommended Role |
| --- | --- | --- |
| **Juniper Junos** | Full | `read-only` class |
| **Cisco NX-OS** | Full | `network-operator` |
| **Arista EOS** | Full | `network-operator` |
| **Cisco IOS-XE** | Full | `Parser View` (Custom) |

- **Credentials**: A read-only SSH user account must be configured on the device (see [**Configuration Examples**](/v1/docs/configuration-examples) for platform-specific templates).

## SSH Access & Security Policy

Kentik brings context to your observability data by securely pulling state data via SSH.

- **Read-Only**: Kentik never requests write access to your infrastructure. Administrators can disable AI Advisor’s config backup and SSH command features entirely, while built-in vendor block-lists and customizable user filters provide extra execution safety.
- **Zero Configuration Changes**: Kentik’s features are designed to scrape config diffs and execute ad hoc troubleshooting commands. Kentik will never execute `configure terminal` or `commit` changes.
- **Audit Trail**: All activity is initiated via your local **Collection Agent**, ensuring every command is logged in your local AAA (TACACS+/RADIUS) systems.