Skip to main content

Device Credentials

Device credentials are required to connect to network devices and endpoints via CLI over SSH, SNMP, or HTTP. Credentials can be associated with devices and endpoints in several ways. Refer to the Connectivity Test for more information.

Credentials can be configured directly using the Credentials Page or when adding/importing device(s) to the inventory.

How credentials are stored​

  • SaaS deployments — Credential secrets are encrypted and stored within the application server's database. Each organization's secrets are encrypted with a per-organization key that is protected by AWS KMS. Collectors fetch secrets from the application server at collection time and hold them only in memory — they are not written to disk on the collector. For details on the encryption architecture and the optional Bring Your Own Key (BYOK) capability, see Cloud-Managed Secret Encryption and BYOK.
  • On-premises deployments — Credential secrets are encrypted using AES-256-GCM and stored within the application server's database. The encryption key is auto-generated on first startup and managed by the server — collectors are not involved in the encryption process.

Add Credentials via Credentials page​

To add credentials from the Credentials page, go to Collection > Credentials, then select one of the following tabs: CLI, SNMP, or HTTP.

Add Credential

tip

Once the credentials are added, a Connectivity Test might have to be performed to auto-associate appropriate network devices with their respective credential.

CLI Credentials​

CLI credentials are used to access network devices via a command-line interface (SSH or telnet):

  • Login: Provides basic access to the device CLI using a username and password.

    Add CLI Login Credentials

  • Privileged mode: Provides elevated access using a privileged-mode password, so the Collector can run the configuration and state commands that require it. Optionally set a Privilege level; when left blank, the device's default (typically its highest) level is used.

    Add CLI Privileged Mode Credentials

  • Avi shell: Enables access to the Avi Vantage CLI shell on Avi platforms using a username and password.

    Add CLI Avi Shell Credentials

  • Expert mode: Provides a password for entering Check Point expert mode after login.

    Add CLI Expert Mode Credentials

  • SSH key: Authenticates to the device CLI with an SSH private key instead of a password. Provide a Username and the SSH key in OpenSSL PEM format. Optionally add an SSH certificate in OpenSSH format, select a Privileged mode credential for elevated access, and enable Auto associate to match the credential against devices automatically.

    Add CLI SSH Key Credentials

SNMP Credentials​

SNMP credentials are used for polling device performance metrics, discovering devices, and accessing (custom) SNMP network endpoints:

  • SNMP: Enables collection of basic device information and performance metrics using SNMP OIDs (object identifiers). Select the SNMP Version (v3 or v2c); v3 adds authentication and privacy settings. Port (default 161) and Timeout (default 5 seconds) are optional. For more details, check out the Performance data collection documentation.

    Add SNMP Credentials

HTTP Credentials​

HTTP credentials are used to access device APIs and web interfaces:

  • Login: Provides basic HTTP access to the device interface using a username and password.

    Add HTTP Login Credentials

  • API key: Enables the Collector to authenticate to devices that require an API key.

    Add HTTP API Key Credentials

Adding Credentials Through Devices Wizard​

Credentials can also be added during the device onboarding process in the Devices wizard.