Plexusby JBB Networks
Welcome back
Sign in to your Plexus account.
Trouble signing in? Contact your administrator.
Restricted system. Sign-ins are recorded.
Sign in to your Plexus account.
Trouble signing in? Contact your administrator.
Restricted system. Sign-ins are recorded.
Everything at a glance
| Run | Groups | Succeeded | Failed | Skipped |
|---|
| Time | Device | Error |
|---|
Inventory synced from LibreNMS · assign backup groups
| Device | IP | Vendor / OS | Firmware | Group | Last backup | Status |
|---|
What runs on each platform, and which script each vendor/OS or device uses
Every stored backup, grouped by device IP · click a device to expand
Every backup as v1 → latest · compare any two versions
| Host | Vendor | Versions | v‑4 | v‑3 | v‑2 | v‑1 | latest |
|---|
Every sign-in to this server — web UI, SSH and administrative changes
| Date | Source | Username | Source IP | Action | Detail |
|---|
| User | IP | Browser | Started | Last seen | Expires |
|---|
Raise an alert when a message matches — by text, device and severity
| Rule | Match | Scope | Severity | Cooldown | Hits | State |
|---|
Every installer and image archive kept locally, so a rebuild never needs the internet
| Version | File | Kind | Size | SHA-256 | Stored |
|---|
Customer equipment as the ACS knows it
| Device | PPPoE username | Model | Firmware | WAN IP | Public IP | Optical Rx / Tx | Last inform | Snapshot |
|---|
Every TR-069 parameter path seen across the fleet
Loading…
| Parameter path | Devices |
|---|
Tasks and provisions the ACS could not complete
| Device | Channel | Code | Message | Retries | When |
|---|
GenieACS northbound endpoints Plexus reads from
The northbound API has no authentication of its own. Keep it bound to 127.0.0.1 and let these page permissions be the access control — anything that can reach it directly can read every CPE and reboot the fleet.
| Name | NBI URL | CPEs | Last sync | Result | Discovery preset |
|---|
How Plexus polls the ACS, and how the ACS itself is configured
These take effect immediately. They govern how Plexus reads the ACS — not the ACS itself.
Every sync writes each CPE's receive and transmit power and transceiver temperature to InfluxDB, one point per inform; the Graphs tab on a CPE draws them. The history is kept for the time above and older points expire on their own; the change applies at the next sync.
A bulk disappearance above the removal safety share is always held for review, whichever action is chosen — a truncated response must not be able to erase the estate.
Every option GenieACS documents. These are read once when each service starts, so a change needs a restart — which drops CWMP sessions in flight. CPEs retry, so the cost is a short gap rather than lost devices.
Blank means “use the default”. Options owned by docker-compose.yml are shown with their running value but cannot be edited here, because a container that disagrees with its own port mapping or database URL simply fails to work.
Each ring is a set of spans; both ends of every span are read for optical power on a fixed clock
Every ring port against its own baseline — worst first, with where the loss most likely is
| Status | Ring | Port end | Far end | Rx now | Baseline | Change | Trend /wk | Far-end Tx | Since | Likely cause |
|---|
Every time a ring port's status changed — what it was, what it became, and why
| When | Ring | Port end | Change | Rx | Δ dB | Detail |
|---|
Managed ranges and how much of each is in use
| Pool | Prefix | Gateway | Site / VRF | Utilisation | Free |
|---|
Allocate, release and track every address
| Address | Status | Customer | Service ID | Since | History |
|---|
Who holds addresses, and everything they have ever held
| Customer | Code | Contact | Active IPs | Ever held |
|---|
Search by address, customer or service ID — see the full history from day one
Every field change detected on sync, plus UI actions and alerts
| Time | Device | Field | Change | Source |
|---|
| Time | Kind | Message | Mailed |
|---|
Every alert the system can send · toggle email / Telegram per template · edit wording with {placeholders}
| Placeholder | Meaning | Used by |
|---|
Custom templates can be fired from the API: POST /api/alert-templates/<key>/fire with a JSON body {"context": {...}}.
Live messages received from your network devices
Leave the host empty for every device. Leave the dates empty for the last 30 days.
Showing the last 24 hours by default. You can go back at most 720 hours (30 days).
| Time | Device | Severity | Module | Message |
|---|
Host-wise consumption for configuration backups and syslog
| Host | Files | Size |
|---|
| Host | Lines | Size |
|---|
Interfaces, addressing, gateway and DNS of this server
| Interface | IPv4 | Netmask | Gateway | MAC | State | Speed / MTU | Traffic |
|---|
Reachability test from this server to any IP or hostname
Path this server takes to reach a host
| Hop | Address | RTT | Raw |
|---|
Expose this server to LibreNMS so it graphs like any other device
Devices whose connection settings differ from the defaults
| Device | IP | Vendor / OS | Group | What is overridden |
|---|
Network devices allowed to authenticate against this server
| Name | Address | Shared secret | Group | Description | State |
|---|
Accounts engineers use to log into network devices
| Username | Name | Group | Password | Enable | Expires | State |
|---|
Privilege level and command authorisation profiles
Reusable permit/deny rules attached to groups
Every login attempt against the TACACS+ server
| Date | NAC (client IP) | NAS (device IP) | Username | Port | Type | Action | Reason | Server |
|---|
Every command and shell authorisation decision
| Date | NAC (client IP) | NAS (device IP) | Username | Priv | Command | Action | Reason | Server |
|---|
Every configuration change, validation and listener restart
| Date | Who | Action | Object | Name | Detail | From IP |
|---|
Every command run on your devices, by whom and where
| Date | NAC (client IP) | NAS (device IP) | Username | Port | Action | Priv | Command |
|---|
Daemon configuration and shared secrets
Usernames separated by commas or new lines. Their authentication, authorisation and accounting rows are still recorded and exported by name, but the three reports, the accounting tiles and the device-activity view leave them out, so the account Plexus backs up with does not bury the engineers. Each report has a "show hidden" switch for when they are wanted.
Device configuration example (Huawei):
hwtacacs-server template nb
hwtacacs-server authentication <this-server-ip>
hwtacacs-server shared-key cipher <secret>
Cisco IOS:
tacacs server NB
address ipv4 <this-server-ip>
key <secret>
MikroTik RouterOS does its AAA over
RADIUS, not TACACS+, so it does not authenticate against this server —
point it at a RADIUS server instead:
/radius add service=login address=<radius-server-ip> secret=<secret>
/user aaa set use-radius=yes
Live utilisation of the backup server · alerts above threshold are mailed
Database + credential encryption key + config — what S3 device archives do not contain. Restore instructions are inside each archive.
| File | Created | Size |
|---|
External systems: inventory source and alert channels
Devices keep the server they came from; the dashboard Sync button can sync one server or all at once.
The connection method (telnet/SSH) now lives on each script binding — see Devices → Scripts → Bindings, or override it per device with its Config button.
Create a bot with @BotFather, then message the bot (or add it to a group) and use @userinfobot / getUpdates to find the chat ID.
Uploads every 7z archive created since the last successful upload. Minimal IAM policy: s3:PutObject + s3:ListBucket on the bucket.
Uses DNS-01 (no port 80 needed). Host must have: apt install -y certbot python3-certbot-dns-cloudflare. Checked weekly (Mon 05:00); certbot renews inside 30 days of expiry and reloads nginx.
Personal Gmail: use Connect account below — a service account has no Drive storage of its own. Google Workspace with a Shared Drive can use a service-account JSON instead.
In Google Cloud → APIs & Services →
Credentials, create an OAuth client ID (type: Web application) and add this exact
redirect URI:
…
Paste the folder ID (or URL) of the Drive folder to upload into. For a service account, also share that folder with the account's e-mail.
Used by any group that doesn't choose its own. Pick as many as you like.
Host UFW managed from the GUI — rules apply to the whole server
| # | To | Action | From |
|---|
Your account, user administration, and access history
At login you can use an authenticator app or an e-mail one-time code. Set an e-mail below to enable the code option — a handy fallback if you don't have your authenticator.
| User | Role | 2FA | Created |
|---|
The user chooses a second factor at login — an authenticator app they enroll, or an e-mail one-time code (available whenever an e-mail address is set).
| Page | Read | Edit | Delete | Execute | Export | All |
|---|
| Time | User | IP | Action | Detail |
|---|
Keep this server up to date
Installing restarts the server, including this interface. It goes away for a minute or two while the update is applied, then comes back on its own. Pick a time when nothing is running — the backup cycle and the nightly archive are the ones to avoid.
| Time | Event | Source |
|---|
Changes apply immediately · secrets stay masked until replaced
"auto" uses cores × sessions-per-core. Telnet/SSH is I/O-bound, so 2–4 per core is usually safe and much faster.
When on, every account must enroll an authenticator at first login, and users cannot disable their own 2FA. Lost phone → admin uses "Reset 2FA" on the Users page. If the only admin is locked out: docker compose exec backend python -m app.rescue admin
Point devices here, e.g. on Huawei VRP:
info-center enable
info-center loghost <server-ip> facility local4
info-center source default channel 2 log level warning
Port changes need a container restart. Open the port in the Firewall page for
your device networks.
Runs after each backup cycle (daily backstop at 04:30). 7z archives never uploaded to S3 follow the local-days rule instead, so nothing is deleted before it could go off-site. History entries in Files/Versions remain, marked "file missing".
Session tokens are stored hashed, sent HttpOnly and marked Secure over HTTPS. Changing a password signs out that user's other sessions automatically.
Devices rewrite CRCs, digests and "last saved" timestamps on every save. Without this, each backup looks like a configuration change. Defaults cover Huawei VRP, Cisco IOS/NX-OS and JunOS.
| Group | Schedule | When | Cloud targets | Devices |
|---|
Re-enabling a device restores the group it came from. With the second option off, a subnet rule will pull disabled devices back into a scheduled group on the next sync.
Backups and version history are always kept, even when a device row is deleted — the files stay on disk and remain browsable on the Files page.
Devices matching a CIDR are auto-assigned to the group on every sync — except the excluded IPs, which keep their manual group.
Policy precedence — evaluated in this order, higher wins:
1️⃣ Vendor config (below): a disabled vendor locks all its devices to never, everywhere.
2️⃣ Group rules (subnet conditions): applied to the remaining devices, minus each rule's exceptions.
3️⃣ Manual assignment: whatever you set per device or per batch, for devices no rule touches.
At cycle time, "Pause all" and each device's Enabled flag are still respected on top.
Unticked vendors are skipped during cycles (their devices show as skipped, no failure mails).
Applies to the whole interface, not just sign-in: addresses outside the list cannot even load the page or the application code. Internet scanners read the JS to learn the API before probing it — with a list set they get nothing. 127.0.0.1 is always allowed, so the server itself can never be locked out.
Your current IP: ? — include it before saving or you will be locked out (127.0.0.1 always works).
Every failed attempt, CLI capture or TFTP push, is tried again after the delay, whatever the cause, until the attempts are used up. A wrong password is retried as well, so keep the attempts low on gear that locks an account after a few failed logins.
How long to wait for the device's upload before the attempt counts as failed. A shorter wait (e.g. 20s) fails unreachable devices fast instead of holding a worker for two minutes.
Placeholders: {ip} {hostname} {ddmmyyyy} {hhmm} {date} {time}. Example result: 10.8.0.36_14082026_1400 — .zip is appended automatically for TFTP-push; the server verifies the zip, stores the extracted .cfg, then deletes the zip.
A vendor and OS can have several scripts — one for older firmware, one for SSH-only sites. Only the name has to be different. Which one a device uses is decided in Bindings, or pinned to the device itself.
How this vendor escalates after login. Type the command to send (enable, su, super…); leave it blank (or none) to send nothing and stay at the login shell. The enable password comes from the device (Config) or the global one in Settings. A single device can override this on its Config dialog.
Waits this long before sending every command. A device that is still printing its banner, or one that pages slowly, otherwise receives the next command in the middle of that output and never runs it. Leave at 0 for devices that keep up. Applies to TFTP-push scripts too, which usually need a second or two after the transfer command.
The address ranges your network hands to subscribers, one per line — public pools and CGNAT ranges alike. A CPE whose STUN binding shows a public address outside all of them is online through someone else's network, and is shown as lost. A device that has reported no public address is never judged. Leave empty to turn the check off.
Walks every CPE's data model (TR-098 and TR-181) once a day, re-reads the facts the pages show every hour, keeps the connected-device tables fresh on every inform, and — if enabled below — points every CPE at a STUN server so the ACS can reach it between informs.
Overrides for this device only. Empty fields fall back to the global credentials in Settings.
Login used for every device of this vendor/OS. Order is device → vendor → global default: a device's own Config still wins, and any field left blank here falls back to the global credentials in Settings.
| Device | IP | Result |
|---|
Applied now if the CPE answers a connection request, otherwise queued until its next inform.
A time-based filter answers "what is happening now"; an all-time filter answers "has this ever happened". Both are available — save one of each if you want.
A span runs from a port on one switch to a port on the next. Type part of a device's name or IP and pick it; the port is spelled exactly as the device's CLI spells it (GigabitEthernet0/0/25, Gi1/0/25, sfp-sfpplus1, xe-0/1/0).
A port is compared with its own baseline, the median of its first day of readings. The figures below are decibels of loss from that baseline.
The CLI command that prints a transceiver's readings on each vendor, with {port} where the interface goes, a one-off command run first (paging off), and the parser that reads the output. A command may list alternatives separated by ; for a vendor that changed the syntax between releases — each is tried until one gives a reading. Use a span's Test button to see the raw output beside what was parsed.
| Vendor | OS | Before | Command | Parser | On |
|---|
An allocation needs a customer, a service/circuit ID, or both.
You are connected over plain HTTP on port 8080, which is open only to your management network. Enter the hostname this server should be reachable on and an e-mail address for expiry notices — Plexus will configure the reverse proxy and obtain a certificate for it.