---
title: "SSH Command Access for Kentik NMS"
slug: "ssh-command-access-for-kentik-nms"
description: "This article provides an overview of and prerequisites for configuring and using Kentik NMS with AI Advisor to assist with NetOps. "
status: "update"
updated: 2026-11-10T03:42:58Z
published: 2026-11-10T03:42:58Z
canonical: "kb.kentik.com/ssh-command-access-for-kentik-nms"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://kb.kentik.com/llms.txt
> Use this file to discover all available pages before exploring further.

# SSH Command Access for Kentik NMS

This article describes how Kentik’s Network Monitoring System (NMS) uses SSH to give AI Advisor device configurations and read-only diagnostic command results.

![AI Advisor performing an NMS device configuration analysis, highlighting changes and their impacts.](https://cdn.us.document360.io/082e25b5-afce-42d4-8f47-70bd3f1d02b7/Images/Documentation/ANMS-device-details-AIA-overlay.png?sv=2026-02-06&spr=https&st=2026-11-10T16%3A04%3A31Z&se=2026-11-10T17%3A04%3A31Z&sr=c&sp=r&sig=Vj%2BmhuMAbGXmLucwyL9MOOPzCZS7QPpM9QmtUWx8JP4%3D)

*AI Advisor performing an NMS device configuration analysis, highlighting changes and their impacts.*

## Overview

[**Kentik NMS**](/v1/docs/nms-overview) has two SSH-powered features that give AI Advisor more context:

- [**Command Access**](/v1/docs/ai-assisted-netops-command-access) (On-Demand Device Diagnostics)
- [**Config Context**](/v1/docs/config-context) (Backups and Diffs)

With these features, [**AI Advisor**](/v1/docs/ai-advisor) becomes more powerful: It can access, analyze, and interpret device configurations and, with user permission, pull real-time operational data from devices during live investigations using read-only show commands via SSH.

`"Show me why my network performance dropped after last night's edge router change."`

> [!WARNING]
> **IMPORTANT**:
> 
> - Access to this feature requires an active NMS device license (see [**Licenses**](/v1/docs/licenses)).
> - Kentik enforces AI Advisor’s strict read-only behavior with Kentik-managed restrictions, a block-list of prohibited commands that always applies. You can add [**Allow Rules and Deny Rules**](/v1/docs/kentik-ai#allow-rules-and-deny-rules) on top of it. A Super Administrator can also turn off AI Advisor’s access to device configurations and read-only diagnostic commands for your entire organization (see [**Where to Enable AI Advisor Access**](/v1/docs/ssh-command-access-for-kentik-nms#where-to-enable-command-access)).

## Prerequisites

Before configuring AI Advisor for network device analysis, ensure your environment meets the following requirements:

- **Licensing**: An active NMS device [**license**](/v1/docs/licenses) is required for each device you intend to monitor.
- **Kentik Universal Agent**: You must have the latest version of the [**Universal Agent**](/v1/docs/universal-agents) deployed within your infrastructure with network reachability to the target devices.
- **Connectivity**: Port TCP/22 (SSH) must be open between the Universal Agent and the device management IP.

> [!NOTE]
> **Note**: The Universal Agent must have a direct route to the device's management IP. It does not scrape configuration data via the data plane.
- **Supported Platforms**: Ensure your device OS is supported for configuration scraping:

| Platform | Support Level | Recommended Role |
| --- | --- | --- |
| **Juniper Junos** | Full | `read-only` class |
| **Cisco NX-OS** | Full | `network-operator` |
| **Arista EOS** | Full | `network-operator` |
| **Cisco IOS-XE** | Full | `Parser View` (Custom) |

- **Credentials**: A read-only SSH user account must be configured on the device (see [**Configuration Examples**](/v1/docs/configuration-examples) for platform-specific templates).

## SSH Access & Security Policy

Kentik brings context to your observability data by securely pulling state data via SSH.

- **Read-Only**: Kentik never requests write access to your infrastructure. A Super Administrator can turn off AI Advisor’s access to device configurations and diagnostic commands for your entire organization. Kentik-managed restrictions and your own [**Allow Rules and Deny Rules**](/v1/docs/kentik-ai#allow-rules-and-deny-rules) limit which commands AI Advisor can run.
- **Zero Configuration Changes**: Kentik’s features scrape configuration diffs and run ad hoc troubleshooting commands. Kentik never executes `configure terminal` or `commit` changes.
- **Audit Trail**: All activity is initiated via your local **Collection Agent**, ensuring every command is logged in your local AAA (TACACS+/RADIUS) systems.

## **Where to Enable AI Advisor Access**

These settings exist at two levels. AI Advisor can use a feature on a device only when both levels are turned on.

| Feature | Device level (**SSH** tab in **Device Settings**) | Organization level (Organization Settings » Kentik AI » **Command Access** pane) |
| --- | --- | --- |
| **Command Access** | **Enable SSH command access to devices** and **Enable Read-Only Diagnostic Commands** | **Enable Read-Only Diagnostic Commands** |
| **Config Context** | **Enable SSH command access to devices** and **Enable device configuration sync and backup** | **Enable Configuration Access** |

> [!NOTE]
> **Note**: Only Super Administrators can change organization-level settings. Administrators can view them, and Members can’t open the pane. **Enable Configuration Access** affects only AI Advisor. You can view configurations and diffs on the **Configs** tab in [**Device Details**](/v1/docs/device-details-pages) without it. See [**Command Access Pane**](/v1/docs/kentik-ai#command-access-pane).

If AI Advisor can’t run commands or access configurations, see [**Why Command Access May Fail**](/v1/docs/ssh-command-access-troubleshooting#why-command-access-may-fail).