Network sites (routers and switches)

A **site** is a place with network devices: an office, a data center, a POP. Zaryn shows each site live: - **Inventory.** Every device's model, OS version, serial number, interfaces and how long it has been up. - **Config backups and drift.** Each device's config is saved every time it changes. Zaryn compares it with the **approved** one, so you see at once when a device has been changed, by how many lines, and exactly what changed. - **A live map.** The map is drawn from what the devices report about their neighbors (CDP, LLDP, MikroTik's MNDP), their routing adjacencies (OSPF, BGP) and the subnets they share. Devices and links whose loss would cut other devices off are marked as **single points of failure**. - **An address plan.** Every subnet, the addresses in it, how full it is, and **conflicts**: one address on two interfaces, an address answered by two MACs, one subnet with different masks on different devices. - **What changed, when.** Config changes, interfaces going down and coming up, neighbors appearing and disappearing, devices becoming unreachable. - **Why A can't reach B.** [Path Explain](/docs/en/network-paths) follows traffic hop by hop through the devices' routes, ACLs and firewalls, and **probes** check what matters every minute. - **What a change would do, before it's made.** The [digital twin](/docs/en/network-twin) shows which traffic a config change stops, starts or reroutes, and checks every pull request on a repository of configs. Sites work with **Cisco IOS and IOS-XE, Huawei VRP, MikroTik RouterOS, FRRouting and VyOS**. They're free for up to 10 devices. Premium reads up to 1,000. ## How it works A **collector** runs on a machine at the site: any Linux box, a VM or a Raspberry Pi with zev installed. It logs in to the devices over SSH and runs **read-only commands** (`show`, `display`, `print`, `/export`). The commands are built into zev, so nothing Zaryn sends can make the collector change a device. It sends what the devices print to Zaryn over HTTPS. Your device passwords **never leave the collector**. They're kept in a file only the collector can read, and Zaryn only knows each credential's name. Secrets inside configs (enable secrets, SNMP communities, local user hashes, VPN keys) are replaced with tags like `<secret:3fa2c1d0>` **before** the config is sent. The tag is made with a key only your collector has, so a changed password still shows up as a change, but nobody can work the password out from it. The collector only makes outgoing connections. You don't open any ports. ## 1. Make a site On [zaryn.xyz/sites](https://zaryn.xyz/sites), create a site (for example `hq`) for yourself or for an organization. On an organization's site, its owners and admins manage everything and its members can look. ## 2. Start the collector On the site's **Collector and settings** tab, choose **Set up the collector**. Zaryn shows a token once. On the collector machine, run: ```bash zev site join zsite_… --server https://api.zaryn.xyz ``` Then tell the collector how to log in to your devices. Each login is a **credential** with a name of your choice: ```bash zev site cred add core-admin --user netops # asks for the password zev site cred add branch-mt --user admin # a second login, for other devices zev site cred add old-ios --user admin --enable # Cisco: also asks for the enable secret zev site cred add frr --user netops --key /root/.ssh/id_ed25519 ``` Before adding devices, try one: ```bash zev site test 10.0.0.1 --cred core-admin ``` ```text ✓ CORE-SW1 Cisco IOS / IOS-XE 15.2(2)E7 WS-C2960X-48FPD-L, serial FOC1234X5YZ (1840 ms) interfaces 52 (31 up) neighbors 4 config 612 lines, 7 secrets replaced before upload ``` `zev site test` reads the device right away and shows what Zaryn would see, without sending anything (add `--config` to print the config as it would be uploaded). When everything looks right, run the collector as a service: ```bash sudo zev site install ``` The service keeps its files in `/var/lib/zev/site`. It checks with Zaryn every 30 seconds for work and reads each device every 15 minutes (you can change this in the site's settings). ## 3. Add devices On the **Devices** tab, add a device by its address, choose its vendor (or let zev tell from its SSH banner) and the credential to log in with. Within a minute the collector reads it. To find devices, add the ranges to look in under **Collector and settings** (for example `10.0.0.0/24`). The collector checks which addresses answer on SSH and what they say they are. Neighbors your devices report that aren't in the site yet show up too. Both appear under **Found on the network**, where you add them with one click or ignore them. ## Config backups and drift The first config the collector reads becomes the **approved** config. Every later change is saved as a new version. When the running config differs from the approved one, the device is marked **drifted** and its page shows the difference line by line. - If the change was intended, choose **Approve this config**. It becomes the new approved version, and Zaryn records who approved it. - If it wasn't, the diff shows exactly what to put back. Lines that change by themselves (Cisco's "Last configuration change at…", NTP clock periods, RouterOS's export timestamp) are left out, so a config that didn't change never looks changed. Any version can be downloaded as a file. Zaryn keeps the last 500 versions of each device, and always keeps the approved one. ## The map The **Map** tab shows the site's devices and how they connect: - **Solid lines** are cabled links that CDP, LLDP or MNDP reported, with the port at each end (hover a device to see them). One device's report is enough, and when both ends report a link it shows once. - **Dashed lines** are OSPF or BGP adjacencies with no cabled link reported. - **Dotted lines** join devices that share a subnet. When three or more devices share one, they hang off a segment named after the subnet. - Neighbors that aren't devices of the site (an ISP's router, a server) show with a dashed outline. - An **amber ring** marks a single point of failure: a device or link whose loss would cut devices of the site off from the rest. The map says how many. ## The address plan and IP conflicts The **Addresses** tab lists every subnet configured on an interface, with the addresses in it. That includes your devices' own addresses and the hosts their ARP tables have seen, with the MAC and which device saw it. A bar shows how full each subnet is. Conflicts are listed with the subnet: | Conflict | What it means | |---|---| | on two interfaces | The same address is configured twice, on two devices or two interfaces. | | answered by two MACs | Two machines answer for one address. Often a duplicate IP, or a failover pair. | | also used by another machine | A device's own address is answered by a different MAC elsewhere. | | masks differ between devices | One subnet is configured with different masks, for example /24 here and /25 there. | ## When a device can't be read (login, SSH, host key) The device's page says why, in words: | What you see | What to do | |---|---| | the device refused the login | Check the credential's user and password: `zev site cred add <name> …` again replaces it. | | nothing answers on the SSH port | Turn SSH on on the device, or check the port in the device's settings. | | the collector can't reach the device | Check the route and firewall from the collector to the device. | | the device's SSH host key changed | If that's expected (a new device, a reinstall), run `zev site forget-key <address>` on the collector. | | needs privileged mode | Cisco: log in at privilege 15, or add the enable secret with `--enable`. | | the collector has no credential named … | Run `zev site cred add <name> …` on the collector, or choose another credential. | zev uses the system's OpenSSH and also allows the older algorithms many devices still need (`diffie-hellman-group14-sha1`, `ssh-rsa`, CBC ciphers), as long as your OpenSSH still has them. ## Commands ```text zev site join <token> [--server URL] make this machine the site's collector zev site cred add <name> --user <user> [--key <file>] [--enable] [--password-stdin] zev site cred ls · zev site cred rm <name> the logins kept on this collector zev site test <address> [--cred <name>] [--vendor cisco|huawei|mikrotik|frr|vyos] [--config] [--json] zev site discover <range>… which addresses answer on SSH, and what they are zev site probe ping|tcp|http|dns <target> run a probe from here (see Path Explain and probes) zev site run [--once] collect what Zaryn asks for and run its probes (what the service runs) sudo zev site install run the collector as a systemd service zev site status this collector, its devices, missing credentials zev site forget-key <address> after a device's SSH key changed on purpose ``` As root, the collector keeps its files in `/var/lib/zev/site`; otherwise in `~/.config/zev/site` (set `ZEV_SITE_DIR` to choose). `zev site status` reads the service's files when run with `sudo`.