REFERENCE
Known limitations
The product boundaries for platforms, RDP, AI routes, Meraki, governed changes and rollbacks, Discovery, maps, and the plan limits on exports.
Verified against AI NetShell 0.4.11
Purpose#
Set accurate expectations for AI NetShell. These are current product boundaries verified against the shipped desktop code and live-proof records.
Before You Begin#
Use the Devices & connections supported table as the GA platform list. A platform, provider, protocol, or control appearing somewhere in the app does not by itself mean every workflow for it is live-verified or available.
Steps#
1. Review the current product boundaries#
| Area | Current boundary | What to do |
|---|---|---|
| MikroTik RouterOS | The app ships a RouterOS read policy and vendor selection, but there is no RouterOS lab device or live verification. RouterOS is intentionally absent from the GA supported-platform table, and its reads do not run automatically. | Do not rely on RouterOS for a production GA workflow. Use independently verified commands and normal change control. |
| Cisco FTD | FTD read workflows are live-verified. Governed configuration writes are not implemented for FTD, so the GA scope is read-only. | Use FTD for the supported read workflow. Make configuration changes through an approved FTD management path outside AI NetShell. |
| RDP | A saved Windows device opens in the embedded RDP tab and needs a password Credential. Quick connect has no RDP connection. The saved-device RDP path has not been promoted to a stronger live-verified support claim. Resizing a split pane can sometimes end a remote desktop session. | Create a saved Windows device if you need to test the available RDP entry point. If a resize ends the session, open it again. Keep another approved RDP client available. |
| ChatGPT sign-in | ChatGPT sign-in is a separate Your own AI route with its own model group: GPT-6.1 Sol, the default, and GPT-6 Luna. The sign-in renews itself before it expires. A sign-in made before version 0.4.9 cannot renew itself, and it stops when it expires. ChatGPT investigations still stop at the round limit or the time limit. Provider availability and terms can change outside the app. | Treat the group heading as the payment and routing context, and keep another configured AI route available. If Settings says Your ChatGPT sign-in expired. Sign in again., select Sign in with ChatGPT account. |
| Cisco Meraki | Meraki sites are read-only. AI NetShell sends only read requests to the Meraki Dashboard API and cannot change the dashboard. The site report copies to the clipboard for a ticket or an email and has no file export. | Make Meraki changes in the Meraki dashboard. Use Copy for a ticket or Copy for an email to share a site report. |
| Account approval identity | The app has Sign out, but it does not display the device identifier shown by the account portal. | Use in-app Sign out on a PC you control. For a lost PC, use portal details to identify the approval before selecting Revoke. Do not guess if several approvals could match. |
| Enable password | A saved Credential can answer a device's second password prompt, but Quick connect does not use the saved enable password. | Save the device in Inventory and assign that Credential when automatic enable is required. |
| App update restart | An update can be ready while the host refuses to restart because work is still in progress. | Finish the work named in the message, then select Restart now again. The app does not restart itself. |
| Governed rollbacks and run alerts | The change timeline shows Governed rollback only for a device-confirmed rollback of an approved change on Cisco IOS, IOS XE, NX-OS, Arista EOS, or Palo Alto PAN-OS. Except for a change to a single interface on the first four, it also needs a backup between the change and its rollback, such as the post-change backup. A run alert reads Explained by a governed change only when every change it covers is one of those rollbacks or an approved single-interface change on Cisco IOS, IOS XE, NX-OS, or Arista EOS. Other changes, including an approved change to several interfaces or to other parts of the configuration, read No governed change recorded in an alert. A device that discovery reached through a neighbor and did not link to your saved device keeps a separate history, and its alerts read No governed change recorded. | Open Change timeline for the device to see the operator, the recorded intent, and whether the change came through the governed workflow. |
| Typing during a change | AI NetShell lets only one of its own tasks type on a device session at a time. It does not stop you from typing in that device's terminal while it applies or rolls back a change, and your typing can make the change stop part way. | Wait until the change or rollback has finished before you type in that terminal. |
| Roll back after a stray key | On Cisco IOS and IOS XE, the app clears the device's command line before it types a change or a rollback. On Cisco NX-OS and Arista EOS it does not yet, so a stray Escape left in that terminal tab can break the first line of a rollback. On any platform, half-typed text left on the command line can still make the first Roll back fail safe on its first line. The failed line changes nothing on the device. If a change times out partway, the first Roll back can also fail safe. | Follow the message, then select Roll back again. |
| Neighbours seen only by name | A neighbour that discovery saw only by name, with no address, is named in the completion line and the report, but it has no box on the map. If the device discovery started from has no reported name, a neighbour's name for it can appear in the saved run as a separate device outside your range. | Check the report's coverage limitations for the full list. |
| Account site sign-in | Billing and account buttons open the account site for whichever account your browser is signed in to there. A pack bought there goes to that account. | Check which account the page shows before you buy. |
| Rollback copy on Arista EOS and Cisco NX-OS | After a rollback, the app removes its rollback copy, but does not yet read the device back to confirm it is gone. On Cisco IOS and IOS XE it does. | If you need to confirm the copy is gone, list the device's files yourself after the rollback. |
| Fixes the app cannot check | AI NetShell cannot check HSRP settings, OSPF interface settings, port-channel membership, or duplex settings on Arista EOS after a change. Lina's fix for one of these is marked Manual change. After it is applied, the change is not marked verified. | Confirm the result on the device yourself. Then select Keep without the check, or select Roll back. |
| Large maps | A map too large for one image cannot be saved as an image. The export says This map is too large to save as one image. View it on screen, or run discovery on a smaller scope to save it. The as-built package and the network report are still made, and they print the same sentence where the map would be. While a large map is being saved, the window can stop responding for several seconds. | View the map on screen, or run discovery on a smaller scope. Wait for a large save to finish. |
| Device histories | Discovery links a device it finds to your saved device only when the run started from a saved seed device, the saved device is in the same folder as that seed device or in a folder inside it, and the address, port and name all match. A discovery started from an address does not link the devices it finds. Their histories stay separate, listed under Started from an address. After you update, the first scheduled run of a discovery that was started from an address cannot see its 0.4.8 baseline, so that one interval gives no drift alert. Two saved devices whose names differ only in upper and lower case can see each other's older backups. They are marked saved under another name and are never credited to the wrong device. | Start discovery from a saved seed device when you want what it finds in your saved devices' histories. Unlinked histories are in Config & Compliance > Snapshots under Found by discovery, not linked to a saved device. |
2. Understand Discovery results#
Discovery is the home for Active Discovery results. A completed run has Map and Devices tabs. Devices presents one row per device, not one row per neighbor claim. Found via shows the primary source, and a row can disclose that more sources were recorded. A reached endpoint that did not yield an identity is labeled Found, not identified. A device counts as partial only when part of its data is missing, and its Status cell names what is missing. An unknown lifecycle match has its own lifecycle unknown count and does not make a device partial.
The Devices tab can add reached, identified devices to Inventory. It does not add unreachable or unidentified rows. Select the intended rows, choose Add to Inventory, then choose Existing group or New group. Results remain per device: added, updated, skipped, refused, or failed. A successful row changes to In Inventory with its group.
Completed runs appear in the named Snapshots list. Select a run's visible name to reopen it. A map-only snapshot has no Devices tab. Deleting a snapshot removes its saved run after an explicit confirmation.
When subscription access changes, the mounted Discovery result and its in-memory snapshot clear before access is checked again. Saved discovery records are not deleted by that screen clear. When access is restored, reopen an available run from Snapshots.
3. Understand topology map coverage#
The topology map is built from an Active Discovery run that has already completed its device reads. For the normal completed-run path, select Map inside Discovery. Viewing, curating, comparing, printing, or exporting the map does not create a new unapproved device connection.
Creating a map requires running Active Discovery. Investigate and higher can run the discovery needed to create one. Investigate includes scheduled discovery, drift alerts, discovery backups, lifecycle views, maps on screen in every view, and topology change comparisons between runs. Map images, printable maps, and every other export are part of Resolve.
AI NetShell also collects CDP and LLDP neighbor facts passively from the sessions you already have open. Those facts feed the topology map, which counts a neighbor that was heard about but not visited and draws it as an unmanaged device. There is no separate Discovered pane on any tier. On pay as you go the facts are still collected locally, but the map that displays them requires Investigate or higher.
The shipped layer boundary is specific:
- Physical is the default view, and it is marked (no data) when a run collected no physical facts.
- Spanning Tree is available when the run read spanning-tree state from at least one device. A run without that data marks the layer (no data). Use VLAN or All VLANs to select its scope.
- Routing is available when the run read routing adjacencies. Those reads run only where the routing-protocol census finds a routing protocol, and a run without that data shows the layer as unavailable. On this view, devices with no routing and devices whose routing was not read are not drawn as cards; they are named in a strip under the map, and each group is kept separate.
Each layer draws only what its own run collected, so do not treat one run as a complete Layer 2 or Layer 3 control-plane view. Coverage counts retain hidden and excluded devices even when the drawing does not show them.
Physical links can be confirmed by both endpoints, one-sided, or inferred from routing evidence. Use the legend to show or hide edge kinds. Shared management segments stay grouped instead of being expanded into false point-to-point links.
The Spanning Tree layer can show root and per-VLAN state from the run. Use Search devices to find a card, Collected to open Collection details, and More > Reset view to fit the drawing again. Pan by dragging and zoom with the mouse wheel. The map appears only after a run has topology data.
4. Understand topology subscription boundaries#
| Account state | Map access | Export and document boundary |
|---|---|---|
| Pay as you go, including Free | Map views are hidden, and the current Discovery result clears when access changes. Saved discovery records are not deleted. | No map export or network documents |
| Investigate subscription | Create, view, curate, and compare maps | No map export or network documents; maps are viewed on screen. The export controls are shown but locked, with the line Exports and documentation are part of Resolve. and a link to change your plan. |
| Resolve or Resolve 6K subscription | Investigate map and comparison functions, plus Document this network… | Map image (.png), Printable map (.pdf), Network report (.pdf), and Device tables (.csv). Paid Resolve and Resolve 6K exports carry no AI NetShell watermark. During the Resolve trial, exports carry the watermark. |
This boundary is based on subscription tier, not the presence of unused AI credits. Pack credits power read-only Included AI but do not unlock maps or Active Discovery. Map creation, viewing and topology run comparison begin at Investigate. Map images, printable maps, network reports, device tables, and the as-built package begin at Resolve, including the Resolve trial. Watermark-free exports begin with a paid Resolve or Resolve 6K month. The app has no setting for your own logo or business name on exports. White label coming soon.
The app enforces these subscription boundaries. It checks your plan before it writes any export file.
5. Treat support scope as workflow-specific#
A supported read workflow does not imply governed writes, RDP, topology, or every firmware variation is supported for the same platform. Before production use, confirm all of these separately:
- Platform and firmware
- Connection method and entry point
- Read-only versus configuration-change workflow
- AI provider route and selectable model
- Subscription feature required for the surface or export
- Independent recovery path
Expected Result#
You can identify which workflows are live-verified, read-only, entry-point limited, catalog limited, or subscription limited before depending on them in production.
Troubleshooting#
A selector shows a platform that is not in the supported table#
Treat the GA supported table as authoritative. The selector can include policy or development surfaces that have not completed live verification.
Quick connect will not start RDP#
Quick connect has no RDP connection. Use a saved Windows device for the embedded RDP tab, or an approved external RDP client.
The topology map asks for a subscription#
Confirm that an Investigate, Resolve, or Resolve 6K subscription is active. Credits from a pack power read-only Included AI but do not unlock the map. After access is restored, reopen Discovery and select the intended run's name. Investigate includes topology comparisons and maps on screen. Resolve or Resolve 6K is required for Map image (.png), Printable map (.pdf), the as-built package, network reports, and device tables.
Spanning Tree or Routing cannot be selected on the map#
The map marks a layer (no data) when the run did not collect its facts. Start a new run from Discovery so the spanning-tree and routing reads can execute, then select Map. A device with no routing protocol contributes nothing to the routing layer, and that is expected. When the layer has data, such a device is listed in the strip under the map as No routing on n devices.