> Source: https://docs.nometa.az/v4.8.0/device-onboarding

# Device Onboarding

SAMURAI Networks is agentless: each platform connects over its native API or SSH with a
**read-only / least-privilege** account. It never makes configuration changes; it polls
and reads. SSH device commands are restricted to `show`.

| Platform | Connection | Account |
| --- | --- | --- |
| Cisco ACI (APIC) | HTTPS API | Read-only admin |
| Nexus Dashboard Orchestrator | HTTPS API | Read-only |
| Cisco FMC | HTTPS API | Read-only API user |
| Cisco FTD / ASA | SSH (CLISH) | Read-only |
| Cisco ISE | ERS / OpenAPI | Read-only ERS admin |
| Palo Alto | XML API | Read-only |
| FortiGate | REST API | Read-only |
| Juniper SRX | SSH (Junos CLI) | Read-only |
| VMware vCenter | vSphere API | Read-only |
| Active Directory | LDAP | Bind account (paged read) |
| Routers / Switches (IOS / IOS-XE / NX-OS / IOS-XR / Junos) | SSH | Privileged `show` access |
| VyOS | HTTPS API or SSH | API key / read-only account |

After adding a device, SAMURAI Networks runs an initial sync and then re-syncs on a schedule
(configurable in **Settings**). For what each platform exposes once connected, see the
per-vendor [Device Panels](https://docs.nometa.az/md/v4.8.0/device-panels.md).

## Network access

All device traffic is **outbound** from the SAMURAI Networks server: it polls each device over the
device's management API or SSH. Open each platform's management port from the server to the
device. Vendor defaults are shown below; adjust if you have changed them. (Inbound syslog
ingestion is also available: enable the syslog listener under **Settings → Logging**.)

If the server cannot reach a management subnet directly (segmented networks, DMZ hosts),
route that traffic through a SOCKS5 gateway instead of opening a direct path; see
[Outbound Proxy](https://docs.nometa.az/md/v4.8.0/administration/outbound-proxy.md).

| Platform | Protocol | Port |
| --- | --- | --- |
| Cisco ACI (APIC) | HTTPS | TCP 443 |
| Nexus Dashboard Orchestrator | HTTPS | TCP 443 |
| Cisco FMC | HTTPS | TCP 443 |
| Cisco FTD / ASA | SSH | TCP 22 |
| Cisco ISE | HTTPS (ERS / OpenAPI) | TCP 443 (ERS: 9060) |
| Palo Alto | HTTPS (XML API) | TCP 443 |
| FortiGate | HTTPS (REST API) | TCP 443 |
| Juniper SRX | SSH | TCP 22 |
| VMware vCenter | HTTPS (vSphere API) | TCP 443 |
| Active Directory | LDAP / LDAPS | TCP 389 / 636 |
| Routers / Switches | SSH | TCP 22 |
| VyOS | HTTPS (API) / SSH | TCP 443 / 22 |

Devices on a non-default SSH port can be added as `address:port`; the explicit port is
also used by the reachability probe.

> Credentials are stored encrypted at rest (AES-256-GCM) and used read-only. Grant the
> account only the access listed above; SAMURAI Networks never needs write or configuration rights.