SETUP

Devices & connections

Add and connect devices over SSH, RDP or serial, move files with SFTP, SCP and TFTP, read Meraki site reports, and check the supported platforms.

Verified against AI NetShell 0.4.13

Purpose#

Build an accurate device inventory and open the right type of connection for each authorized network device, server, or Meraki site. Move files to and from devices, and read a Meraki site's health without leaving the app.

Before You Begin#

Have the device name, host or IP address, port, vendor or OS, and a saved Credential ready. For SSH, obtain the expected host-key fingerprint from a trusted source. For serial, know the console port settings. For RDP, use a saved password Credential. For Meraki, have a Meraki Dashboard API key for the organization.

Steps#

1. Add a device#

1. Select Inventory in the left navigation rail.
2. Select the plus button labeled Add a device or cloud account.
3. Select Add new device….
4. In Add device, enter a unique Name and the device Host / IP.
5. Choose Type, select the platform under Vendor / OS, and confirm the port. Platforms are listed by product name, such as Cisco IOS XE. The port label follows the selected Vendor / OS: it reads Port (SSH) for an SSH platform, Port (RDP) for Windows, and Port (Cloud API) for a cloud-managed platform.
6. Under Credential, choose a saved Credential. Select New credential if you need to create one.
7. Optionally choose a Folder, or select New folder to create one.
8. For a network device that supports backup, leave Keep a config baseline selected to capture its configuration on the first successful connection.
9. Select Add device.

The default protocol follows the saved device: Windows uses RDP, cloud-managed entries use their API, and other saved devices use SSH.

Right-click in any text field, such as Name or Host / IP, for the standard Cut, Copy, Paste, and Select all menu. The terminal and the remote desktop tab keep their own right-click menus.

If the first baseline capture does not succeed, Inventory shows Config baseline pending on the device, and the app tries again after the next connection. On later connections, the app stores a new copy only when the running configuration has changed. These copies appear in Config & Compliance > Snapshots labeled connect baseline · running or connect baseline · startup.

2. Edit a device#

1. In Inventory, right-click the device.
2. Select Edit device….
3. Update the host, port, vendor or OS, Credential, folder, or other settings.
4. Select Save changes.
5. Reconnect to confirm the updated endpoint and authentication.

Changing a saved record does not prove that the new endpoint is reachable. Treat the next connection as the test. To start a new entry from an existing one, right-click the device and select Duplicate device….

3. Remove a device#

1. Close or disconnect any session you no longer need.
2. Right-click the device in Inventory.
3. Select Delete device….

The app asks first. Select Delete to confirm. Nothing on the device itself changes; the app removes only its inventory record. A Credential is a separate saved item, so remove it under Credentials only if no other device needs it.

4. Connect to a saved device#

Double-click a device in Inventory to use its default protocol. You can also right-click an entry and select Open terminal (SSH), Open SFTP…, Open RDP…, or Open site report when that action applies to the device.

For a first SSH connection, compare the displayed SHA-256 fingerprint with the trusted value before accepting it. A later host-key mismatch is refused instead of offering an in-app bypass.

5. Add discovered devices from Discovery#

After an Active Discovery run completes, select Devices in Discovery. The result has one row per device and shows Device, Found via, Status, model, serial, lifecycle dates, Lifecycle match, and Actions when an action is available. A device counts as partial only when part of its data is missing, and its Status cell then names what is missing. A device whose lifecycle match is unknown has its own lifecycle unknown count and is not called partial.

Select reached, identified rows, then select Add to Inventory (n). In Add discovered devices, choose Existing group or New group, then confirm Add to Inventory (n). If the run did not fully cover the selected devices, review the warning and use Add anyway (n) only when you accept that incomplete evidence. Review Inventory results for per-device added, updated, skipped, refused, or failed outcomes. Added devices show In Inventory with their group.

Unreachable or unidentified rows cannot be added. A separate passive Discovered pane is not present; neighbor information is incorporated into Discovery results and the map.

When discovery starts from a saved Seed device, it links each device it finds to your matching saved device, so that device keeps one snapshot and backup history. It links them only when the saved device is in the same folder as the seed device, or in a folder inside it, and the address, port and name all match. Anything unclear stays separate. A device that is not linked is listed in Config & Compliance > Snapshots under Found by discovery, not linked to a saved device. Older histories saved by name are listed there too, marked Saved by name before this version.

6. Choose SSH, RDP, or serial#

7. Transfer files with SFTP, SCP, and TFTP#

File transfers are your own actions, like commands you type in a terminal. Lina does not run them, and they do not go through the change review. SFTP and SCP connect with the device's saved Credential and the host key you trusted for it.

Browse and edit files over SFTP

1. In Inventory, right-click a saved device and select Open SFTP…. The action is offered for a device on port 22 with a Credential, and for a device whose Credential uses a private key file or an SSH agent.
2. In the terminal of a device saved with the Server type, you can instead right-click and select Open SFTP here. The browser starts in the terminal's current folder when it can, and otherwise in your home folder.
3. If the device's host key is not trusted yet, Unknown host key shows the fingerprint. Select Trust only if it matches your trusted value.
4. The browser opens in its own tab, named SFTP: followed by the device name. Double-click a folder to open it, and use Up one directory to go back. Sort by Name, Size, or Modified, narrow the list with Filter…, and use the eye button to show or hide dot files. Each row also shows Owner and Perms.
5. Right-click a file for Download…, Rename…, or Delete…. Right-click a folder for Download folder…, Upload here…, Rename…, or Delete…. Right-click empty space for New file…, New folder…, or Upload…. The Upload button puts a local file into the current folder.
6. Double-click a file to open it in the built-in editor. Edit it, then select Save or press Ctrl+S. Close asks before it discards unsaved changes. The keyboard button lists the editor shortcuts, including Ctrl+F for find and replace.

Before it saves, the editor checks whether the file changed on the device since you opened it. If it did, File changed on server asks before it overwrites the remote copy. The editor opens text files up to 5 MiB and refuses binary files; download those instead.

Deletes cannot be undone, and only empty folders can be deleted. A folder download shows live progress, skips links and names that are unsafe on Windows, and stops at 32 folder levels, 10,000 files, 4 GiB in total, or 1 GiB for one file. Files it already saved are kept, and the result line lists what was skipped and why the download stopped.

Copy one file with SCP

Use SCP for a device that accepts SCP but does not offer SFTP.

1. In the Inventory pane, select SCP.
2. In SCP file transfer, choose the Device.
3. Under Direction, choose Download (device → this PC) or Upload (this PC → device).
4. Enter the Remote path on the device, then set Local file. Use Browse… to pick it.
5. Select Transfer. When it finishes, the dialog reports how many bytes were transferred.

SCP does not offer to trust a new host key. Connect to the device once from its terminal or SFTP browser and confirm the fingerprint first.

Serve files with the built-in TFTP server

Use the TFTP server when a device needs to pull a file from this PC, such as a software image for recovery, or needs to send a file to it. The server is off until you start it.

1. In the Inventory pane, select TFTP.
2. In Built-in TFTP server, set Served folder. Use Browse… to pick it.
3. Review Bind address and Port. The default bind address, 0.0.0.0, listens on every interface, and the dialog warns that any host that can reach the port can read the served folder. Enter one interface address to limit exposure.
4. Under Allowed peers (IPv4 CIDR, comma-separated), list the device addresses or subnets allowed to connect. When the field is empty, every host that can reach the server may pull files. An entry that is not valid IPv4 CIDR keeps the server from starting.
5. Leave Allow devices to write files (uploads) into the served folder off unless a device must send a file to this PC. Turn it on only on a trusted network.
6. Select Start server. The dialog shows the folder and address being served, an example device command such as copy running-config tftp://<your-ip>/name, and each transfer as it happens.
7. When the device is done, select Stop server. The server keeps running after you close the dialog, so open TFTP again to stop it.

TFTP has no sign-in. Limit who can reach it with Allowed peers and a single bind address.

8. Add a Meraki organization#

AI NetShell reads Cisco Meraki networks through the Meraki Dashboard API. Each Meraki network you add becomes one site in Inventory, listed under a top-level entry for its organization.

1. In Inventory, select the plus button labeled Add a device or cloud account, then select Add cloud account….
2. In Add cloud account, leave Provider set to Cisco Meraki.
3. Under Meraki API key, choose a saved key, or choose + New API key…. With no key saved yet, the dialog opens on New Meraki API key. Enter Name this key, paste the key into API key, and select Save key. The dialog's hint reads: "Use a read-only key scoped to a single organization. It is stored in your OS keychain, never in a file." On Windows, that is Windows Credential Manager. The saved key is also listed under Credentials.
4. Select List orgs, then pick the organization under Organization. A key can span several organizations. The sites you add, and what a whole-organization question can see, stay within the one you pick.
5. Review Account name. It starts as the organization's name, and you can rename it later.
6. Under Sites to add, check each network you want. Each row shows the network's Meraki product types.
7. Select Add. The button names how many sites it will add.

Each checked network becomes one Inventory entry linked to its organization. If a site cannot be added, for example because an entry with the same name already exists, the dialog lists what it skipped and why, and keeps the sites it added.

Right-click the organization for Rename account…, Rotate API key…, Add / refresh sites…, and Remove account…. Rotate API key… replaces the stored key, and the account and its sites keep working. Remove account… deletes the organization's sites from Inventory and leaves the stored key under Credentials, where you can delete it.

You can also add one site by hand. In Add device, choose Cisco Meraki under Vendor / OS, then enter its Organization ID and Network ID. The Dashboard API host is filled in for you and cannot be edited.

9. Read a Meraki site report#

Double-click a Meraki site in Inventory, or right-click it and select Open site report. The report opens in its own tab. Its header names the site, then shows the organization, read-only, and how long ago the data was fetched.

The report shows:

• One status: Needs attention, Not reporting, Status incomplete, or No issues detected in the checks completed, with a one-line summary. The site's overview gives the same verdict. A check that could not be read is named, and the site shows Status incomplete.
• Devices: how many devices are online, offline, alerting, and not reporting, with a row for each. A device that is not reporting has Mark spare, for equipment you keep on the shelf, and Unmark. Marks are saved on this computer, and nothing is written to Meraki.
• Internet: each uplink with its address and status.
• VPN: the site-to-site VPN peers, Meraki and third-party, with their status. A site without site-to-site VPN says so.
• Wireless: the number of enabled SSIDs, clients online now (wired and Wi-Fi), how many are on Wi-Fi now, and the busiest clients under Top talkers.
• Alerts: each open alert with its device and severity, or None open.

Select a card's title to open a panel with more live detail: Devices · detail is a table of each device with its model, serial, firmware and status, with licensing in plain words. Internet · uplinks shows each uplink's addressing, loss and latency. VPN · detail shows each Meraki peer's latency and loss; a peer with no data reads "no quality data". Wireless · health shows the last day's connection counts from association to success, recent failed connections with the most common failing step, and the broadcasting SSIDs. Alerts · detail shows each alert's severity, category, device, and Open since time. Select Site overview or press Esc to return.

Select Refresh to fetch the report again from the Meraki Dashboard API.

A row that needs attention has an Investigate button. It opens a Lina conversation for the site with a question about that row already filled in. Nothing is sent until you select Send. The button at the end of the report, which starts with Ask Lina:, does the same with the report's suggested question. When Inventory has a cloud account, Lina's starter questions also include Meraki organization health.

In that conversation, Lina reads the site through the Meraki Dashboard API. She can use only a fixed list of read requests, such as device status, uplinks and VPN status, alerts, clients, wireless health, switch ports, VLANs, and firewall rules. Every request AI NetShell can send to Meraki is a read, so nothing in the app can change your Meraki dashboard.

To share the report, open Export:

• Copy for a ticket copies redacted plain text, ready to paste.
• Copy for an email copies a redacted version formatted for an email body. If formatted copying is unavailable, it copies plain text and says so.

If redaction fails, nothing is copied. The site report has no file export, such as a PDF; Export copies to the clipboard only.

10. Review lifecycle data#

Discovery records lifecycle dates and match status in the Devices table. Open Settings > Lifecycle Data to manage optional Cisco EoX credentials. Without those credentials, the bundled lifecycle dataset remains available.

11. Use the live-verified network platform list#

The GA supported-vendors table separates live-verified reads from governed-write status:

This table does not promise support for every platform visible in the app's vendor selector. Use only the entries listed above for the verified GA network workflow. Meraki sites are read-only by design and are not part of this table.

Expected Result#

The device appears in Inventory with the intended endpoint, vendor or OS, and Credential. Double-clicking it opens the configured SSH or saved-Windows RDP path, or the site report for a Meraki site, while Serial opens a local console with the selected line settings. SFTP, SCP, and TFTP move files only when you start them. Discovery can show lifecycle matches.

Troubleshooting#

Add device is unavailable#

Enter both Name and Host / IP, then wait for any active save to finish. Each field must also be free of control characters and no longer than 253 characters. The button's tooltip names the field to fix. The port field and Credential do not control whether the button is available.

SSH authentication fails#

Open Edit device… and confirm the assigned Credential. Then review Credentials for password rotation, private-key paths, or SSH agent availability.

The SSH host key is new or changed#

Do not accept an unexpected fingerprint. Confirm the endpoint and fingerprint with a trusted administrator or through the device console.

Open RDP is not available#

Confirm that the saved device uses the Windows vendor or OS, port 3389 unless your server uses another port, and a password Credential. Quick connect has no RDP connection.

A remote desktop session ended#

Closing the RDP tab or reloading the window ends the session. So does 30 seconds with no response from the window. Resizing a split pane can sometimes end a session too. Open the session again from Inventory.

No serial ports appear#

Connect the console adapter, select Refresh in the serial dialog, and confirm that Windows recognizes the port. Close other programs that may already own the port.

A deleted device is still open#

Removing an inventory record does not close an already-open session. Close the session separately.

Open SFTP is not in the menu#

Confirm that the device has a Credential and uses port 22, or that its Credential uses a private key file or an SSH agent. Meraki sites and devices that connect over RDP do not offer SFTP. For a device on another SSH port with a password Credential, open its terminal and, for a Server device, use Open SFTP here.

SCP reports an unknown host key#

SCP does not trust a new host key on its own. Open the device's terminal or SFTP browser, confirm the fingerprint, then try the transfer again.

The TFTP server does not start#

Confirm that Served folder exists and that every Allowed peers entry is valid IPv4 CIDR. If the message says the address could not be bound, it adds that port 69 needs administrator rights and suggests an alternate port. Try another Port, and point the device at that port.

A file does not open in the SFTP editor#

The editor refuses binary files and files over 5 MiB. Use Download… instead.

List orgs finds no organization#

The dialog says This key can't see any organizations. The list shows only the organizations the key has access to. Check the key's access in Meraki, or save a different key with + New API key….

A Meraki site report shows an error#

Read the error at the top of the report, then select Refresh. If the key was replaced in Meraki, right-click the organization, select Rotate API key…, and paste the new key. The account and its sites keep working with the new key.

Related#

• Credentials
• Quick Start: your first 10 minutes
• Set up AI
• Investigate