What Cenovel may change on a device
Reading stays read-only by construction. Opal adds three named kinds of change, each behind its own switch, and the safeguards every change goes through.
ConceptReviewed against the application source on October 12, 2026
Reading stays read-only
Everything Cenovel reads is still a read: each SSH line is checked against the show commands for that platform and a deny list that wins over everything; SNMP cannot send SET; Redfish and the controllers are read with GET only. If Cenovel ever tries to send anything else on a read, nothing is sent and device communication stops until an Administrator EX releases it. Scripts and automations go through the same read list.
The changes Opal can make
| Action | Switch in Settings › System › Features | Default |
|---|---|---|
| Blink a locator light (Locate) | Let Cenovel blink locator lights | On |
| Change switch ports: on or off, description, access and voice VLAN, PoE off and on, bounce a port, edge port and BPDU guard; a switch’s name, VLANs and trunks | Let Cenovel change switch ports | Off |
| Change configuration through Juniper Mist or ExtremeCloud IQ, with a second, write-capable token kept apart from the read-only one | Change configuration through the controllers | Off |
A change is a separate, named path, never a read that goes further. Cenovel never changes a switch’s management address, gateway, access lists or SSH settings.
How a change is kept safe
- Dry run. Review shows the commands and the configuration after, and a verdict: Safe for reachability, Could cut off or Will cut off.
- Warning accepted. A change with a warning is applied only with Apply anyway, which records your name, the time and the warning on the change and in the audit log.
- Before and after. Cenovel checks how it reaches the switch, the port’s link and the hardware before sending, and again after.
- A maintenance window. Cenovel opens one for the change so it raises no alert, and sends only inside it. If it can’t open one, nothing is sent.
- Automatic undo. The change goes under the switch’s own revert timer. If any check after is worse, or Cenovel loses the switch, the change is undone.
Only Administrators apply switch changes. During a K-12 testing window, a change at an affected school carries a warning that its person accepts.
See also: Change a switch port · Locate a switch or access point · Security & data
Describes the release being prepared for deployment. Check the behavior on your installed release.