Fleet operations11 min
Topology and access policy
Separate the network you observe from the paths you intend to allow.
Outcome
A readable live topology and explicit management paths matching real roles.
Before you start
- Connected devices
- A tenant/group model
- Known operational roles
Use the right topology view
- Real topology shows observed live relationships.
- Configured topology represents intended policy.
- Geographic placement is approximate unless supplied by the device or administrator.
Operational note: Do not turn every observed link into an allowed path. Observation and authorization differ.
Create access from the job backwards
- 1Name the user/team performing the job.
- 2Select the exact device group.
- 3Allow only Winbox, SSH, web or routing needed.
- 4Test with a non-owner account.
- 5Remove temporary paths after the work window.
Operational note: Keep routine controls parent-oriented. Do not expose radio or mesh choices that the endpoint did not advertise.
Read live state before changing policy
- 1Check online counts and recent handshakes.
- 2Compare observed and configured graphs.
- 3Investigate missing nodes before broadening access.
- 4Use one sanitized graph for counts and status summaries.
Verify the result
Counts match the graph.
Permitted users reach only intended workflows.
Non-permitted users are denied.
Removing a temporary rule closes the path.
Common issues
A device is absent from the expected branch.
Likely cause
Parent/group assignment or telemetry is stale.
Fix
Refresh real topology, verify ownership and wait for a current snapshot before editing policy.
A rule looks right but access is denied.
Likely cause
User, device and protocol scopes do not intersect, or the service is down.
Fix
Check each scope, then target-service reachability, before widening the rule.
Continue with
Teams, accounts and auditGive each operator the smallest durable access they need and keep actions attributable.Security modelReduce public exposure, credential sprawl and lateral reach while keeping operations practical.WUSP device managementUse authenticated telemetry and supported remote operations without exposing low-level transport choices.