SSH Command Access for Kentik NMS

This article describes how Kentik’s Network Monitoring System (NMS) uses SSH to give AI Advisor device configurations and read-only diagnostic command results.

Overview

Kentik NMS has two SSH-powered features that give AI Advisor more context:

• Command Access (On-Demand Device Diagnostics)

• Config Context (Backups and Diffs)

With these features, AI Advisor becomes more powerful: It can access, analyze, and interpret device configurations and, with user permission, pull real-time operational data from devices during live investigations using read-only show commands via SSH.

"Show me why my network performance dropped after last night's edge router change."

IMPORTANT:

• Access to this feature requires an active NMS device license (see Licenses).

• Kentik enforces AI Advisor’s strict read-only behavior with Kentik-managed restrictions, a block-list of prohibited commands that always applies. You can add Allow Rules and Deny Rules on top of it. A Super Administrator can also turn off AI Advisor’s access to device configurations and read-only diagnostic commands for your entire organization (see Where to Enable AI Advisor Access).

Prerequisites

Before configuring AI Advisor for network device analysis, ensure your environment meets the following requirements:

• Licensing: An active NMS device license is required for each device you intend to monitor.

• Kentik Universal Agent: You must have the latest version of the Universal Agent deployed within your infrastructure with network reachability to the target devices.

• Connectivity: Port TCP/22 (SSH) must be open between the Universal Agent and the device management IP.

  Note: The Universal Agent must have a direct route to the device's management IP. It does not scrape configuration data via the data plane.

• Supported Platforms: Ensure your device OS is supported for configuration scraping:

  Platform	Support Level	Recommended Role
  Juniper Junos	Full	read-only class
  Cisco NX-OS	Full	network-operator
  Arista EOS	Full	network-operator
  Cisco IOS-XE	Full	Parser View (Custom)

• Credentials: A read-only SSH user account must be configured on the device (see Configuration Examples for platform-specific templates).

SSH Access & Security Policy

Kentik brings context to your observability data by securely pulling state data via SSH.

• Read-Only: Kentik never requests write access to your infrastructure. A Super Administrator can turn off AI Advisor’s access to device configurations and diagnostic commands for your entire organization. Kentik-managed restrictions and your own Allow Rules and Deny Rules limit which commands AI Advisor can run.

• Zero Configuration Changes: Kentik’s features scrape configuration diffs and run ad hoc troubleshooting commands. Kentik never executes configure terminal or commit changes.

• Audit Trail: All activity is initiated via your local Collection Agent, ensuring every command is logged in your local AAA (TACACS+/RADIUS) systems.

Where to Enable AI Advisor Access

These settings exist at two levels. AI Advisor can use a feature on a device only when both levels are turned on.

Note: Only Super Administrators can change organization-level settings. Administrators can view them, and Members can’t open the pane. Enable Configuration Access affects only AI Advisor. You can view configurations and diffs on the Configs tab in Device Details without it. See Command Access Pane.

If AI Advisor can’t run commands or access configurations, see Why Command Access May Fail.