MonsterOps logo MonsterOps
Docs / Network / NAS Manager

NAS Manager

Overview

NAS Manager logs into your network devices over SSH or Telnet (via Netmiko) to manage their running configuration — pull it, keep version history, diff, edit, push changes back, run commands, and dispatch to many devices at once. It also writes RADIUS-client config for you with the one-click RADIUS Setup.

This is separate from a NAS entry: a NAS entry lets a device speak RADIUS; NAS Manager is the config-management layer on top. Stored device credentials are AES-256-GCM encrypted.

Where things are

  • Managed device list — devices you've added with SSH/Telnet credentials.
  • Config — pull and store the running config; keep version history with scheduled fetch, retention, and diff between versions; edit and push config back.
  • Console — a per-device command console (live output over SSE).
  • Dispatch — send a command to many devices at once, with an audit log.
  • RADIUS Setup tab — generate and push the vendor-specific RADIUS-client config to point the device at this server (see below).

Point a NAS at this RADIUS server

Once a device is managed (SSH/Telnet reachable, credentials stored), RADIUS Setup writes the client config so you don't type it into the router by hand:

  1. Tick the services that should authenticate against RADIUS — PPP/PPPoE, hotspot, device admin login, 802.1X. The list is vendor-aware.
  2. Confirm the RADIUS server address (pre-filled from MONSTEROPS_RADIUS_SERVER_IP, or auto-detected as the egress IP toward the device) and the auth/acct ports.
  3. Preview the exact commands. The shared secret is taken from the device's own NAS entry, so both ends match. Device-specific unknowns (interface names, hotspot profiles) appear as notes to apply by hand, never pushed.
  4. Deploy to device — the running config is snapshotted first (for rollback from Config History), then the generated lines are pushed over SSH.

MikroTik (choose RouterOS v6 or v7 — syntax differs) and Huawei produce real, pushable config; every other vendor gets a preview-only reference block. MikroTik config also enables /radius incoming set accept=yes so the router accepts CoA / Disconnect-Message — which is what lets MonsterOps drop a live session.

Problems you may hit

Can't connect to a device

Check the SSH/Telnet credentials, the reachable management IP, and that the device allows the protocol. Netmiko needs the right device type — pick the correct vendor when adding it.

NAS Manager logins broke after changing the secret key

Credentials are encrypted with a key derived from MONSTEROPS_SECRET_KEY. If you changed it directly, the stored ciphertext no longer decrypts. Rotate with monsterops rotate-secret-key instead — see Configuration.

  • Deploy shows "notes" instead of pushing everything — some vendor specifics can't be known safely and are surfaced as notes to apply manually; that's by design.
  • A non-MikroTik/Huawei device only previews — other vendors are preview-only; copy the reference block to the device by hand.
  • NAS — the RADIUS-client entry (shared secret used by RADIUS Setup)
  • Automation — run a NAS command automatically on an event
  • Configuration — MONSTEROPS_RADIUS_SERVER_IP, secret-key rotation