---
title: "SSH Command Access for Kentik NMS"
slug: "ssh-command-access-for-kentik-nms"
description: "Learn to configure Kentik NMS with AI Advisor for enhanced NetOps, enabling real-time device analysis and improved network intelligence."
status: "new"
updated: 2026-05-04T18:47:44Z
published: 2026-05-04T18:50:57Z
canonical: "kb.kentik.com/ssh-command-access-for-kentik-nms"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://kb.kentik.com/llms.txt
> Use this file to discover all available pages before exploring further.

# SSH Command Access for Kentik NMS

This article covers how to configure and use **Kentik NMS** with **AI Advisor** to assist with NetOps.

![AI Advisor performing an NMS device configuration analysis, highlighting changes and their impacts.](https://cdn.us.document360.io/082e25b5-afce-42d4-8f47-70bd3f1d02b7/Images/Documentation/ANMS-device-details-AIA-overlay.png)

*AI Advisor performing an NMS device configuration analysis, highlighting changes and their impacts.*

## Overview

[**Kentik NMS**](/v1/docs/nms-overview) has two SSH-powered features to supercharge [**NetOps**](https://www.kentik.com/kentipedia/what-is-netops-network-operations/) practitioners with better network intelligence:

- [ ] [**Command Access**](/v1/docs/ai-assisted-netops-command-access) (On-Demand Device Diagnostics)
- [ ] [**Config Context**](/v1/docs/config-context) (Backups and Diffs)

With these features, [**AI Advisor**](/v1/docs/ai-advisor) becomes more powerful: It can access, analyze, and interpret device configurations and, with user permission, pull real-time operational data from devices during live investigations using read-only show commands via SSH.

`"Show me why my network performance dropped after last night's edge router change."`

> [!WARNING]
> **IMPORTANT**: **Early Access Feature**
> 
> - This feature is in open Early Access. Functionality may change.
> - Requires an active NMS device license (see [**Licenses**](/v1/docs/licenses)).
> - AI Advisor is **read-only**. It cannot push changes or execute `write memory`/`commit` commands (see [**SSH Access & Security Policy**](/v1/docs/agentic-analysis-for-nms#ssh-access-security-policy)).

## Prerequisites

Before configuring AI Advisor for network device analysis, ensure your environment meets the following requirements:

- **Licensing**: An active NMS Device [**License**](/v1/docs/licenses) is required for each device you intend to monitor.
- **Kentik Universal Agent**: You must have the latest version of the [**Universal Agent**](/v1/docs/universal-agents) deployed within your infrastructure with network reachability to the target devices.
- **Connectivity**: Port TCP/22 (SSH) must be open between the Universal Agent and the device management IP.

> [!NOTE]
> **Note**: The Universal Agent must have a direct route to the device's Management IP; it does not scrape configuration data via the data plane.
- **Supported Platforms**: Ensure your device OS is supported for configuration scraping:

| Platform | Support Level | Recommended Role |
| --- | --- | --- |
| **Juniper Junos** | Full | `read-only` class |
| **Cisco NX-OS** | Full | `network-operator` |
| **Arista EOS** | Full | `network-operator` |
| **Cisco IOS-XE** | Full | `Parser View` (Custom) |

- **Credentials**: A read-only SSH user account must be configured on the device (see [**Configuration Examples**](/v1/docs/configuration-examples) for platform-specific templates).

## SSH Access & Security Policy

Kentik brings context to your observability data by securely pulling state data via SSH.

- **Read-Only**: Kentik does not request, nor want, write access to your infrastructure.
- **Zero Configuration Changes**: Kentik’s features are designed to scrape config diffs and execute ad-hoc troubleshooting commands. Kentik will never execute `configure terminal` or `commit` changes.
- **Audit Trail**: All activity is initiated via your local **Collection Agent**, ensuring every command is logged in your local AAA (TACACS+/RADIUS) systems.