Skip to main content

Read-Only Device Accounts

Infracast collects on-premises routers, firewalls and load balancers through a relay, using an account you create on each device. Use a read-only account. Infracast only reads: it never changes device configuration. A read-only account means a stolen collector credential cannot change your network either.

Each recipe below was checked on a live appliance (October 2026, versions listed). For every one we confirmed two things: the account can read everything Infracast collects, and the device refuses configuration changes and reboots from it (the same change made by an admin account succeeds).

Palo Alto Networks (PAN-OS)​

Use the built-in devicereader role. Do not build a custom admin role with XML API "Configuration" enabled: on PAN-OS that permission includes writing the candidate configuration (it has no read-only variant).

set mgt-config users infracast-ro password
set mgt-config users infracast-ro permissions role-based devicereader localhost.localdomain
commit

Verified on PAN-OS 11.2.15: configuration and operational reads work over REST and the XML API. Configuration set/delete, commit, and clear/request operational commands are refused.

F5 BIG-IP​

Create a local user with the guest role on all partitions (all partitions so list calls are not silently filtered to Common):

tmsh create auth user infracast-ro password '<temporary>' shell none partition-access replace-all-with { all-partitions { role guest } }
Change the password once as the user

A user created by tmsh starts as password expired. Every iControl REST call then returns 401 until the user changes its own password. Change it once, as infracast-ro, before giving it to Infracast (the new password must differ from the temporary one):

curl -sk -u 'infracast-ro:<temporary>' -X PATCH -H 'Content-Type: application/json' \
  https://<bigip>/mgmt/shared/authz/users/infracast-ro \
  -d '{"oldPassword":"<temporary>","password":"<final>"}'

Verified on BIG-IP 17.1.3.7: the user can read virtual servers, pools and members, iRules, client-SSL profiles and self-IPs. Create, modify, delete and user creation are refused. guest can still request save sys config, which writes the running configuration to disk unchanged.

Juniper (Junos / SRX)​

A login class with view permissions, plus deny-commands for the few file and system commands that view otherwise permits:

set system login class infracast-ro permissions [ view view-configuration ]
set system login class infracast-ro deny-commands "^(file (delete|copy|rename)|request system (reboot|halt|power-off|zeroize|software))"
set system login user infracast-ro class infracast-ro authentication plain-text-password
set system services netconf ssh

Infracast connects over NETCONF on the SSH port (22 unless you set ssh_port on the connector).

Verified on vSRX 23.4R2: configuration mode, commit, reboot, clear bgp and shell access are refused over CLI and NETCONF. Without the deny-commands line, a view user can delete files under /var/tmp. The deny-commands line itself has not yet been re-tested on a live device.

AWS vSRX images

The AWS vSRX image's aws-default configuration group sets system services ssh no-passwords, which blocks password login for every user. Use key authentication for infracast-ro, or exclude that group from the SSH stanza (set system services ssh apply-groups-except aws-default).

Cisco IOS-XE​

Default: a read-only account. Infracast collects the device, interfaces, routes, BGP and VLANs from a privilege-7 account allowed the specific show commands it runs:

username infracast-ro privilege 7 secret <password>
privilege exec level 7 show running-config
privilege exec level 7 show ip route
privilege exec level 7 show ip bgp
privilege exec level 7 show interfaces
privilege exec level 7 show version
privilege exec level 7 show vlan brief
privilege exec level 7 show cdp neighbors detail
NAT rules are not collected with a read-only account

IOS-XE returns an empty show running-config to any account below privilege 15, even when that command is explicitly allowed, and also with a CLI parser view. NAT rules exist only in the running configuration, so with the account above Infracast collects no NAT rules for the device. Infracast records a warning on the collection; it does not guess. Paths that depend on that router's NAT are reported as unresolved, not as open or closed.

Opt-in: privilege 15, for NAT. If you need NAT rules modelled, give the collector a privilege-15 account. That account can change the device configuration, so treat its credential like any other administrator credential (dedicated account, restrict its source to the relay host with an access-class on the VTY lines, log its sessions). Infracast itself still issues only show commands.

Verified on Catalyst 8000V IOS-XE 17.18.05: from privilege 7, configure terminal, write memory and reload are refused, and every collected command works except the running-config, which is empty as described.

Fortinet FortiGate​

Create a REST API administrator with a read-only access profile and generate its token (execute api-user generate-key infracast-ro), restricted with trusthost to the relay's address. This recipe was not part of the October 2026 live run (the FortiGate was used only as a router in that lab).