Compliance
Service checks for Telnet, SSH, HTTP and HTTPS, and your own config rules.
Compliance answers "does every device follow our rules?" It has two parts.
Service checks
For each of Telnet, SSH, HTTP and HTTPS, a group can say Must be off, Must be on or leave it Not set. Inner groups and single devices can override it; a device can also be Not checked for a service.
Retivo decides whether a service is on by reading the saved configuration where it understands the platform (Cisco, FortiOS, RouterOS, TP-Link, Aruba, Junos, Huawei, EdgeOS). Where the configuration gives no answer, it checks whether the port answers from the node.
Caution
A port check sees what the node can reach. A firewall between the node and the device can make a service look off when it is on, or the other way round.
Config rules
Rules that a configuration must contain or must not contain, as plain text or a regular expression checked line by line. Each rule has a severity and can be limited to one platform or one group. Examples:
| Rule | Kind |
|---|---|
logging host 10.0.0.50 |
Must contain |
^ntp server |
Must contain (regex) |
snmp-server community public |
Must not contain |
transport input telnet |
Must not contain |
Where to see the results
The Compliance page lists every device against its requirements. The device page shows where each requirement comes from (which group, or the device itself). Compliance is also part of the status report.
What's next
Last modified October 15, 2026