Changelog

v1.4.264 Tuesday 13 October 2026

Widget tiles for the NOC screen

• New Two widget tiles on the dashboard. Impacted Services and Agents Online only showed something where Orb sensors run. They are now two tiles an admin sets with the gear in the corner: the bandwidth in and out of an interface on a switch or firewall, with your own title such as Internet uplink, the wireless clients on all controllers or one, or the sessions of your firewalls. Each tile shows the current figure and the last six hours. Every user and every screen sees the same two tiles.
• Improved A wall screen says when its data stops. When Aegis does not answer for two minutes, a red bar across the top says since when the data is not fresh. When the screen was logged out, it says so at once, with a link to log in. After an update an open page reloads by itself once nobody has used it for two minutes.
• Improved A NOC dashboard account. Mark a read-only account as NOC dashboard under Admin → Settings → Local Users and the inactivity timeout skips it, so the timeout can stay on for everyone else.
• Improved The alert history opens on the last 24 hours.
• Improved Troubleshoot is for admins. Read-only accounts no longer see Troubleshoot in the menu or the Client Lookup link on the Wireless page.
• Fixed Client data for admins only. The client searches behind Troubleshoot, a client's history and the list of tracked clients still answered read-only accounts. They now answer admins only. The totals on the dashboard and the Wireless page stay visible to everyone.

v1.4.259 Tuesday 13 October 2026

Edge gateways that report from the start

• Improved New Cambium devices show up at once. An onboarded device appears on the Cambium page straight away and is polled within seconds, instead of after the next round. The round itself now runs every five minutes from start to start.
• Fixed Enable SNMP on an NSE. The NSE keeps a change waiting until it is applied, so SNMP stayed off after Enable SNMP. Aegis now applies each step, and the NSE answers right away. The stored NSE password is no longer lost when you use the form, and a device that was guessed to be an access point but refuses that login is tried with the NSE and switch accounts.
• Improved Edge gateways report from the start. The router block now also adds the key Aegis logs in with, so the gateway's CPU, memory and LTE signal show up without a manual step. Give the gateway a LAN address and the block places the router in the site network at that address, with its own DHCP off. Setup explains how to log in on a new router, and Test from here pings the devices behind the gateway.
• Fixed The logo on Windows. On Windows the Aegis logo was cut off at the end of its name, in every browser. It now looks the same everywhere.

v1.4.251 Monday 12 October 2026

ACI faults in full, and a browser check before every release

• Fixed Every ACI fault, not the first hundred. On a large fabric Aegis showed only part of the active faults, so a leaf with a lowered health score could show none at all, while a leaf at 100 showed critical faults. All faults are read now, and the switch detail keeps two kinds apart: faults on the switch itself, which count in its health score, and configuration faults of tenant policy on its ports, such as an EPG on a port that is shut, which the APIC counts against the tenant. Both come with their numbers per severity and the port.
• Improved Checked in a real browser before release. Every release is now opened in Chrome and Firefox before it is published, page by page, so a layout fault that shows in only one browser is caught before it reaches you.

v1.4.240 Friday 9 October 2026

The sidebar fills the window again

• Fixed The sidebar in Chrome and Firefox. Aegis shows its pages at 80% so more fits on one screen. Recent versions of Chrome and Firefox measure the window height differently under that zoom, which left the sidebar at 80% of the window, with the page colour showing under the menu and a scrollbar in it once the menu got longer. The pages now measure what the browser does and correct for it, so the sidebar fills the window again in every browser.
• Fixed The logo fits its box. In Chrome the Aegis logo could run past the edge of the sidebar, with the ® mark pushed out of view. The logo now keeps to its box, and a sidebar that scrolls vertically no longer grows a horizontal scrollbar.
• Improved Topology at the same scale as the rest. The Topology page did not apply the 80% view and so looked larger than every other page. It now uses the same scale, and fills the window the same way.

v1.4.237 Wednesday 7 October 2026

Who has standby duty

• New The On-Call card shows who has duty. Choose your standby team under Admin → SIGNL4 and the card says who has duty in that team right now, with the week's hand-overs and stand-ins in its tooltip, read from the SIGNL4 roster once an hour. Aegis only reads; the roster stays in SIGNL4.

v1.4.234 Wednesday 7 October 2026

Alerts that count, and warnings that alert to SIGNL4 once

• New Acknowledged and closed in the alert history. Each acknowledgement and close is recorded once, at the time it happened in SIGNL4 and with the name, so the history of an alert now reads raised, acknowledged, closed, cleared. Kept for 90 days like the rest.
• Improved The Active Alerts figure counts what you can act on. Only the Alerts tab counts on the dashboard card; the line under the figure says how many insights there are and how many alerts on-call has closed. An acknowledged alert still counts and stays on the Alerts tab, greyed, because someone is on it but it is not done.
• Improved High 5 GHz utilization has to last. A radio that is busy for one poll no longer shows up. The insight appears once the AP has been above the threshold in two polls at least 30 minutes apart, and starts over when the radio calms down in between. The site health score and the RF service line follow the same rule, so a one-poll spike no longer costs a site points. The clocks survive a restart of the appliance.
• Improved One administration for on-call status. The On-Call Alerts card, the alert list and the history all read the same record, which the alert loop keeps up to date every couple of minutes.
• Improved Discovery says why it cannot log in. When a switch answers but refuses SSH, the result now gives the reason under the device, such as an access list on the VTY lines or SSH not being enabled, instead of only listing it as discovered.
• Fixed A warning alerts to SIGNL4 once. A warning that was still open when its window closed in the evening came back as a new alert the next morning, every morning until the problem was solved. It now goes to SIGNL4 once and is closed when the problem clears. An update or restart of the appliance no longer sends open warnings again either.

v1.4.227 Tuesday 6 October 2026

Stack monitoring and fixed on-call counter

• New Data stack and power stack monitoring. Every stacked Catalyst switch is checked once an hour. A data stack whose ring is no longer redundant warns before the next failure splits the stack, a StackPower cable that drops warns, and a stack member in a bad state is a critical alert. The switch tile colours along, so a degraded stack is orange on the site overview, and the switch detail gains a Stack card with the members, their roles, the ring state and the power stack.
• Improved It knows what a stack is. A switch with a pre-provisioned member slot that was never filled counts as a single switch, and StackWise Virtual pairs on the core are left alone: neither can raise a false stack alert. A power stack that simply has no StackPower cabling stays silent too.
• Fixed The on-call counter cleans itself. The On-Call Alerts card on the dashboard could keep showing alerts that had long been handled, when a Signl had already been closed on the SIGNL4 side. The administration behind the counter now releases those entries right away, so the number on the card matches what is actually open.

v1.4.219 Sunday 4 October 2026

Which switch ports are really in use

• New Port usage report. The Reporting page has a second tab that shows which access ports have not been used for 3 months, or for 6, 12, 24 or 36 months or a number you choose. Per switch you see the ports in use, the unused ones and when each port was last used, and the report points out the switches and stack members where every port is unused: the hardware and licences you can save on.
• New A record that survives a reboot. A switch forgets its counters with every reboot, so Aegis keeps its own record of when each port was last up or carried traffic, including a device that was plugged in and out between two polls.
• New Unused ports from day one. When Aegis first sees a switch it asks, once, about the ports that are down. A port whose counters are still zero has carried nothing since the switch last restarted, and the switch knows when a port went down. The report counts from that moment, so a port that has been dark for a year shows as unused right away, with the real number of days without use. The record is also filled in with the traffic history the appliance still holds.
• New One switch, a few, or the whole estate. Pick sites or search and select switches, and follow the number of ports in use per month over the years. Download the selection as CSV or print it to PDF.
• New Leave a port or a whole switch out. A spare you keep on purpose, a port reserved for an emergency, a lab switch or one that is being phased out: none of them is something to save on. Leave out on a port, or Leave this switch out on a switch, takes it out of the count with a reason you give. It stays listed as left out and counts in no total. Count again brings it back.
• New Cambium in the availability report. Cambium access points, switches and NSEs have their own category in the availability report while the Cambium integration is switched on. With the integration off they are not in the report.
• Improved The availability mail is a covering note. The scheduled mail now holds a few lines with the period, the number of devices and the overall figure. The report itself is the PDF attachment, with the score per category and per device.
• Improved Honest about what it has measured. A port is only called unused once it has been observed for the whole period. Until then it is listed as too early to say, with the date since when it is measured. Dates from a switch are only used when they fit its uptime, and use that Aegis sees later always wins.
• Improved In the backup. The record and everything you left out travel with the configuration backup. A restore merges the record with what the appliance has seen since, so nothing is lost and nothing is counted twice. Every port or switch you leave out or count again is in the audit log with who did it.

v1.4.203 Saturday 3 October 2026

Availability reporting, and calmer nights for on-call

• New Availability report. A new Reporting page shows per device a score up to 100% over the previous month, the last 30 or the last 7 days, with an average per category and one overall figure, lowest scores first. Time inside a maintenance window does not count against a device. When the appliance has not been measuring for the full period, the report says from which date it measures instead of pretending the quiet days were perfect.
• New Compose your own report. Pick the sites and filter the device names, and the scores follow your selection. A print button turns the page into a clean document, so saving it as PDF is one click.
• New The report in your inbox. Send it automatically, monthly or weekly, to its own list of recipients: the category averages plus only the devices that dropped below 100%, so it stays readable on any fleet size.
• Improved One mail per site outage. When several devices of one site go offline together, the mail folds them into one message that names the devices, how many switches of that site still answer, and whether the site firewall answers at that very moment. The dashboard and escalations keep seeing every device on its own.
• Fixed A switch that answers is not offline. Something in a network path can swallow ping for minutes while the switch keeps responding to its monitoring. The poll now takes its own answer as proof of reachability, so those minutes no longer wake anyone up.
• Fixed Two devices down in one site are two alerts. For ISE nodes, Infoblox members, servers, firewalls, load balancers and Cambium devices, two alerts of the same kind in one site counted as one: one Signl and one mail for both, closed as soon as the first device recovered. Each device now has its own alert, its own Signl, its own line in the mail and its own duration. Two expiring certificates on one ISE node are two alerts as well.
• Improved Wireless alerts belong to their controller. AP not joined, 100 Mbps uplink, high 5 GHz utilization and backbone connectivity name the controller they come from. Two controllers in one site no longer share an alert, a maintenance window on the controller covers them, and the alert opens that controller on the Wireless page.
• Improved Open alerts survive the update. An alert that is open while you update keeps its start time and is not mailed again. In SIGNL4 the Signl that was open is closed after the update and the alert comes in again, one per device.

v1.4.197 October 2026

Maintenance for an ISE node

• New Put an ISE node in maintenance. Every node on the Identity (ISE) page has the maintenance button you know from switches and sites. While the window runs, that node's alerts are suppressed on the dashboard, in mail and towards SIGNL4; the node keeps being polled and the row shows until when the window runs.

v1.4.192 October 2026

SIGNL4: the team name in the alert, and a test per tag

• Improved The team name of a tag is in the alert itself. It stands in front of the title and in the text, "Campus: [SITE] Switch offline", so a keyword rule or category in SIGNL4 can match on it. Before, it only travelled in a separate field.
• New A Test button per tag. It sends a test alert the way a Critical on a device in that tag travels: with the tag's team name, over the tag's own webhook when it has one. It also sends outside the tag's alert window.
• Improved The test says what SIGNL4 answered. You see the HTTP status and the event id of SIGNL4 and which team name went along. A refused webhook and an unreachable SIGNL4 are named as such.

v1.4.187 September 2026

No device slips past on-call without an alert tag

• New Devices without an alert tag are listed. A device without a SIGNL4 tag is monitored but never alerts to SIGNL4. Admin → SIGNL4 now lists those devices under the tags, with "Add to tag" per device, and the panel header counts them while it is closed. A tag set to Never counts as a deliberate choice.
• New Visible where it matters. The on-call card on the dashboard says "3 devices don't have an alert tag" and links to the SIGNL4 panel; an alert from such a device carries a "No alert tag" marker.
• Improved Cambium devices and the RMS and Edge gateways can be tagged. They raise alerts, and the tag device picker now offers them too.
• Improved A missing webhook is flagged. SIGNL4 switched on without any webhook sends nothing; the panel header now says "No webhook" instead of "Enabled", and the webhook field says nothing is sent yet.

v1.4.183 September 2026

VPN status per RMS gateway

• Improved Every RMS gateway tunnel shows its own status. Instead of one "Connected", the Aegis RMS page lists each gateway with its site, tunnel IP, status (Connected, No handshake or No key yet), last handshake and traffic. The header shows how many tunnels are up, for example 3 / 4 connected.

v1.4.181 September 2026

Filter the NSE sessions with a click, and offline means offline

• New Add Filter. Pick a field (source or destination IP, port, service, application, direction, state, host), then a value from the sessions on screen, counted and searchable. Each pick becomes a chip, chips combine with AND, and the search field still takes free text.
• Improved An unreachable switch shows "Device offline" and nothing else. The Wired page no longer lists the poller's timeouts under it; they stay available in the switch detail.

v1.4.176 September 2026

The NSE shows its sessions, live

• New The live connection table of a Cambium NSE, one click away. Click the NSE on the Cambium page and every session appears: source and destination with ports, direction (LAN to WAN or WAN to LAN), TCP state, application, bytes both ways and the firewall's own TTL.
• New Filters. Source IP=10.0.0.5 AND Service=tcp/443, comma or AND separated; bare text searches every field. The table is the connection tracker, so every session in it is allowed traffic.

v1.4.175 September 2026

Cambium discovery that works on filtered networks, and a site per device

• Improved A host with SSH open counts as alive, ping or no ping. Discovery skipped every host that did not answer ping, so it came up empty where ICMP is filtered between VLANs. Port 22 open is just as alive; only a host with neither answer is skipped.
• New The SNMP test explains a silent device. When Test SNMP gets no answer, the result shows what the appliance can see: the route the probes take (and whether that is the WireGuard tunnel of an Edge gateway, with the remedy spelled out), whether a gateway claims the address, and whether ping and SSH answer.
• New A site per locally discovered device. A device behind an Edge gateway inherits that gateway's site; a local device gets an editable Site column in the discovery table, and the Cambium page shows a tab per site label. Local devices without a label sit under "Default local site".

v1.4.174 September 2026

Alerts that name the failing path, and an update you can watch

• New One mail per path failure, with the site correlation in it. When an uplink or a site path goes down, the devices behind it stop answering too. Instead of a mail per device, one mail names the failing path and lists what it takes down with it, so the on-call engineer reads the cause, not thirty symptoms.
• Improved A switch that answers SNMP is reachable, whatever ping says. Some networks filter ICMP between VLANs; a switch that still answers its polls is no longer called offline for it.
• Improved The collection ping is retried before a switch is called offline, and when a device comes back, the all-clear is mailed to the same addresses that got the alert.
• Improved The update modal shows a progress bar instead of raw container output while an application update runs.
• Improved Cambium XE series verified. The wireless support that covered XV now stands verified against the XE series as well, including the 6 GHz radio: radios, channels, clients per radio and per SSID, and the wired uplink.

v1.4.169 September 2026

Updates from the panel, and the findings of an external code scan

• New Install the system updates from the panel. Where Admin → Configuration says updates are waiting, an admin can now install them there. No SSH, no command line: you type the confirmation word, the panel shows the output while it runs, and the log stays available afterwards. The reboot is still yours to plan, and the banner keeps saying so until you have done it.
• Improved The update count adds up again. The panel counts every waiting package, including the ones that bring a new kernel with them. Those are exactly the packages a plain upgrade leaves behind, which is why the number on screen used to be higher than what the command line reported. The panel now installs the full set and says which packages needed it.
• Security Reviewed from the outside. The whole codebase went through an external security scanner. Everything it rated critical or high is fixed in this release. What is left over is written down with a reason, and the items below are the part of it you can see from your side.
• Security Stricter directory login. An empty password is refused before it ever reaches your directory server, and the server's certificate is checked the same way on every path, including the one that looks up which group you are in.
• Security Viewer accounts are read-only everywhere. The Infoblox screens now pass the same administrator check as the rest of the dashboard, and a test fails the build if a screen added later forgets it.
• Security The build pipeline is tighter. What you hand a build no longer reaches a command on its own, the outside build steps we use point at fixed releases instead of a moving branch, and the toolchain is on supported versions.
• Security Session cookies. On a hosted instance the session cookie travels over HTTPS only.
• Security Dependencies brought up to date for published vulnerabilities in the libraries behind the live updates in the browser.

v1.4.158 September 2026

Infoblox DDI, standby controllers, and down means critical

• New Standby controllers. Mark a controller as the standby of another one in its site, when you add it or afterwards under Managed Devices. It no longer shows up as a controller of its own: the primary's row says which controller backs it up and whether it is ready, and the detail panel shows the standby's version, reachability and the access points on it. N+1 and SSO pairs are both understood; an SSO chassis takes no licence slot.
• New Reboot from the admin panel. When the appliance reports that a reboot is needed to finish security updates, an admin can start it from that banner: two confirmations, an audit entry, and the page reconnects when the appliance is back.
• New Audit log to syslog. Under Admin → Audit you can forward every audit entry to a syslog server as an RFC 5424 message, over UDP or TCP, with a switch per result (info, ok, fail) and a test button that shows the message it sent.
• Improved Alert escalation routes in your own order. Route tags can be moved up and down, like the uplink rules, and the standby role of a controller has an Apply button in Managed Devices.
• New Alerts for the standby. Unreachable, APs moved to it, a different software version, or an SSO peer that is not ready.
• New Infoblox support. Add NIOS grid members under Add / Discover and they appear on the Wired page under their site: HA and grid state, CPU and memory, the service checks of both nodes, DNS query rate and latency, DHCP counters and subnet utilisation. A member that stops answering is a critical alert; a failed check, a broken HA pair or a DHCP subnet above 90% is a warning. See the docs.
• Fixed Firewalls and load balancers that go down now raise a critical alert. Until now only an HA cluster out of sync or a monitored VIP raised a hand; a firewall that stopped answering altogether did not.
• Fixed Chart tooltips follow the mouse again. With the page zoom the tooltip on the client trend and the other charts lagged behind the cursor and stopped partway across; it now tracks the mouse to the right edge.

v1.4.154 September 2026

One tab per site on the Cambium page, shadow prefix without onboarding again

• Improved Devices move along. Switching Shadow on or off for an Edge Monitor Gateway now moves every Cambium device and switch of that site to its new address, keeping name, site and real address. No second discovery round; the page says how many moved and the audit log lists them.
• New Sites side by side. As soon as a second Edge Monitor Gateway is added, the Cambium page gets a tab per gateway, plus "All sites". Every tab has the full page: the figures at the top, the access points, the switches and gateways, all limited to that site. The chosen tab is remembered in your browser.
• Fixed Router block before the public address. The Setup panel of a router now shows the block as soon as the tunnel server has a keypair; without a public address it carries a placeholder and says what is still missing.

v1.4.151 September 2026

Routers dial the appliance directly, and two sites may share a subnet

• New Shadow prefix for Edge Monitor Gateways. Branch sites that all use 192.168.1.0/24 can now hang off one appliance. Switch Shadow on for a gateway and Aegis reaches that site on a prefix of its own (10.95.1.0/24 for the first site, 10.95.2.0/24 for the next); the router translates it one-to-one to the real network. The pages show the address the site uses, with the shadow address next to it. See the docs for the wire map.
• Improved Discover behind a gateway. Cambium discovery and Add Switch(es) let you pick the Edge gateway a site sits behind; you type the addresses as the site knows them.
• Improved Cambium history under the device. Click the CPU or memory bar and the chart opens under that row, like the shell.
• New No hub in the path. The Teltonika routers of Aegis RMS and the Edge Monitor Gateway now connect straight to your appliance over WireGuard: one hop from the site to the dashboard, nothing hosted in between. On premises you forward one UDP port; a cloud-hosted instance already has a public address.
• New One block to paste, one key to paste back. Add a router, open its Setup, paste the generated block on the router; it makes its own keypair, prints the public key, and the row turns green on the first handshake. A preshared key made by Aegis rides along as a second factor, and "Test from here" pings the site through the tunnel.
• Improved Addresses assigned for you. Tunnel address and web-interface VIP come from the appliance's own plan; routers can never reach each other through the appliance.

v1.4.141 September 2026

Cambium: history and a shell

• New CPU and memory history for Cambium access points and NSE gateways. Every poll is kept, and clicking a CPU or memory bar on the Cambium page opens a chart with a two-hour window you can step through or jump to a day. cnMatrix switches expose no CPU, memory or temperature over SNMP, so they have no history.
• New Open a shell from the Cambium page. Admins get a Shell button per access point, cnMatrix switch and NSE gateway; it opens right under the device. Aegis logs in with the account from the Cambium settings, so no password leaves the appliance; the browser only carries keystrokes and screen output. Every session goes into the audit log and is recorded, and it closes after 15 minutes without typing.
• Improved NSE gateways have their own SSH account in the Cambium settings, since their login differs from the switches and access points.

v1.4.138 September 2026

Switch temperature judged by the right sensor

• Improved Temperature judged per sensor, the way Cisco does it. A Catalyst 9300 reports an inlet, an outlet and a hotspot, and the hotspot normally runs 20 to 30 degrees above the outlet. The gauge now shows the outlet judged by the outlet limits (65 and 75 °C), and a hotspot is judged by Cisco's own limits of 105 and 125 °C, as its own alert next to the outlet one.
• Improved Sensor history in a two-hour window. Below Switch Performance the CPU, memory and temperature history shows a fixed two-hour window that you step through with ‹ › or jump with a date. The gauge also reads over a full reporting cycle, so it no longer blinks out between the five-minute sensor pushes.
• Improved Switches without uplink data still get resource alerts for CPU, memory and temperature.

v1.4.136 September 2026

Firewalls, load balancers and ISE nodes in SIGNL4 tags

• New Firewalls and load balancers can be tagged. The device picker under Admin, SIGNL4 Integration now lists them next to switches and wireless controllers, so a firewall cluster that is out of sync or a monitored VIP that goes down can be escalated to SIGNL4 like any other device.
• New Cisco ISE nodes can be tagged. ISE has no site of its own, so the nodes and the PAN appear in the route-tag device picker under the site label you set in the ISE integration settings. Tag a node for its own alerts (disconnected, certificate expiring) and the PAN for deployment-wide ones (PAN unreachable, stale data, failed backup, licence).
• Improved Long tag lists scroll. The tag list has its own scrollbar and the tag editor always opens below it, so the Save button stays in reach however many tags you have.
• Improved Alert windows have a colour each. Always is red, Daytime only green, Custom window orange and Out of hours only blue, so you can see at a glance when a tag escalates.

v1.4.134 September 2026

Added support for Cambium Networks Enterprise

• New Cambium Networks integration. Access points, cnMatrix switches and NSE gateways are monitored directly over SNMP, so the monitoring that came with cnMaestro does not go with it. Aegis discovers the devices on the site subnets, switches SNMP on over SSH where it is off, and shows per access point the radios, clients and uplink, per switch the ports, PoE and LLDP neighbours, and per NSE its health. Sites without an appliance work through the Edge Monitor Gateway. Own switch under Admin, own poller, own inventory.
• New Cambium alerts in the same list as everything else: device offline, reachable but not answering SNMP, access point uplink at 100 Mbit, restricted SNMP view, stale data.

v1.4.133 September 2026

Cisco ISE on the dashboard

• New Identity (ISE) page. Aegis now reads a Cisco ISE deployment from the Primary PAN: every node with its role and whether it is connected, the ISE version and patches, the certificates in use per node and when they expire, the last configuration backup and the smart-licensing registration. Set it up under Admin, Cisco ISE Integration with a read-only account; the page appears in the sidebar once it is on.
• New ISE alerts in the same list as everything else. A node that leaves the deployment, a certificate that expires within 30 days (critical at 7), a backup that did not reach its repository, a licence that is not registered, or a PAN that stops answering. Clicking the alert opens the ISE page.
• Improved A failed backup is reported as failed. ISE marks a backup as completed even when the copy to the repository failed; Aegis reads the message and shows the real result.
• Improved Every ISE node counts as one device on the licence, and the License tab lists them as their own source.

v1.4.128 September 2026

Support access without handing over credentials, and figures that match the device

• New Support access. Under Admin, Support you can let MetaWiFi look at your Aegis for a period you choose, without a screen-sharing session and without handing over your credentials. The appliance opens an outbound tunnel to the MetaWiFi support hub; MetaWiFi can reach this appliance only, through a support account that works through the tunnel alone and is removed when you switch support off. Turning it on asks three things and pairing happens underneath: addresses and keys are never shown and never typed. A banner shows while it is on; everything is in the audit log, and every support connection needs a second key on top of the first one.
• New Alert history. Under Active Alerts on the dashboard, a history panel lists every alert that was raised, cleared or mailed, with the time and how long it lasted, filterable on device or site over 24 hours to 90 days. A switch's detail on the Wired page shows its recent alerts.
• Improved Figures match what the switch and the controller themselves report. Switch CPU is judged on the five-minute average instead of the five-second spike, memory is the processor pool rather than an always-full buffer pool, and the wireless client count follows the controller's own client table. The readings now line up with "show" commands on the device.
• Improved Repeat outages mail again. A device that goes offline a few minutes after coming back raises a new alert and a new mail instead of folding into the old one, and alert mails name the switch rather than its address.
• Improved Switches work without DNS records. A switch onboarded through streaming telemetry is reached on the address its telemetry comes from, and the DNS domain configured under Admin, SSH is the one that gets used.

v1.4.115 September 2026

Backups off the box, a trend per controller, and offline within the minute

• New Backups to an SFTP or TFTP server. Under Admin, Backup you can add an SFTP server; every scheduled or manual backup is then uploaded next to the local file. A manual backup can also go to a TFTP server, the one you already use for switch images. Test buttons check ping, port, login and write access step by step, so you know it works before you rely on it.
• New A connected-clients trend per controller. Open a controller under Wireless and the same trend chart as on the Wireless page appears under the gauges, with 6 hours to 30 days and the week-earlier line.
• Improved A switch that stops answering shows offline within about a minute, and back within a minute of returning. Every switch is pinged once a minute, so a reboot no longer waits for the next collector round. A switch is offline when it does not answer ping and sends no data; missing telemetry on a reachable switch stays a warning, and a switch keeps its status until it really goes quiet.
• Improved The Business Overview is the same in every browser and is part of the backup. Marker positions and background images are stored on the appliance next to the map configuration, so a second browser shows the same map and a config backup restores it.
• Improved A quieter first boot and patient onboarding. The first-boot wizard keeps the console to itself instead of being overprinted by boot messages, onboarding retries switches that refuse a quick second SSH login, and the topology reaches telemetry switches on the address their telemetry comes from, so SD-Access fabric links draw again.
• Improved The AP health panels on the Wireless page are collected every hour: 100 Mbit uplinks, sustained 5 GHz utilisation and radio issues refresh on a schedule instead of on demand.
• Improved The version number in the top bar links to these release notes. When you are up to date, clicking the version shows what the version you run contains.

v1.4.99 September 2026

The wired overview scales to hundreds of switches

• Improved SNMP switches refresh every 5 minutes, also on networks with hundreds of them. A switch that does not answer no longer slows down the rest, switches appear in the overview as soon as their poll finishes, bandwidth history comes from the database, and the charts show 30 days instead of one.
• Improved Opening the topology collects the site you choose, instead of gathering the whole estate first, and the collection reports its progress: switches finished against the total, the site name, and elapsed seconds.
• New Firewall HA shows whether the pair is keeping up, and raises an alert when it is not. The mode says how a cluster is meant to work and nothing about whether it currently does. Every cluster member's sync state is read, the badge turns red when one falls behind, and the alert list carries it as a warning: traffic still passes, but the standby can no longer take over cleanly. The FortiGate HA mode table also reads active-passive as active-passive.
• New Finding things on the Wired page. A filter above the site overview takes a site name or a device: hq-core-01 leaves the site that switch lives in and hides the rest. Sites with critical or offline devices sort first, the device tiles have their own filter, and clicking an alert opens the device it is about.
• Improved Telemetry subscriptions coexist with Catalyst Center. Aegis uses ids 21001 and up, so a Catalyst Center provisioning run no longer takes them over, and uplink status updates about every minute instead of waiting for the SNMP round. Uplink rules match how switches are actually wired: a rule for one switch wins over the fleet rule for its model.
• Improved The alert list accounts for itself. The table says "showing 12 of 61" with a button for the remainder, the card above it counts what someone can act on, and a release clears the browser cache by itself so every fix reaches the screen.

v1.4.61 August 2026

The signal reading that was there all along

• Fix 4G routers now report RSRP, not only RSSI. The modem answers a block of four values and only the first was read, which happens to be RSSI, so nothing looked wrong — but RSRP never arrived, and RSRP is the figure the health thresholds prefer. The two measure different things: RSSI counts everything in the channel, RSRP only the cell the router is actually attached to. A router can read a comfortable RSSI on a cell edge, which is exactly the situation this makes visible. Expect routers on a weak cell to move to a warning; they were always there.
• Improved Times are shown on your own clock. Containers run on UTC unless told otherwise, so log lines and audit entries read two hours out in summer. Audit records stay stored in UTC, which is the only sane thing for a trail that has to survive a daylight-saving change, and are displayed in local time with the original in the tooltip.

v1.4.58 August 2026

A stuck poll no longer waits to be noticed

• New The router poller is watched by a second thread. A cycle that hangs raises nothing and logs nothing: it simply stops coming back, the dashboard keeps serving the last good reading until it ages out, and the IoT endpoints page then reports an unknown status without saying why. The watchdog reports in the log once the dashboard has started showing stale status, and restarts the poller if it stays stuck — a blocked cycle cannot be interrupted from the inside, so a restart is the only lever, and it is a safe one because every cache is written atomically.

v1.4.56 August 2026

Operators can operate

• New Read-only accounts can now work with IoT endpoints. Moving the local Wi-Fi link between the two machines of a docking station, and opening a machine's own page, are things an operator does to the network rather than changes to how it is configured. They were administrator-only, which left the IoT-endpoints-only mode — built precisely to give a non-admin that page and nothing else — with a page they could look at but not use. Adding routers, endpoints and VPN settings stays administrative.
• New Moving a link and opening access are written to the audit log, with the machine, its docking station and which machine the router was on before. These are physical acts on a site, and now that more people may perform them, the log answers afterwards who did what.
• Improved The audit log reads as sentences throughout. Robot, two-factor and account entries were stored as identifiers such as robot_switch and shown that way; they now read Moved Wi-Fi link alongside the entries that always did.
• Fix The two-factor, password-change, topology and account-setup screens still carried the old Cisco Network Visibility logo. The sign-in page had moved to the current mark; the pages around it had not, including the first screen an invited user sees.

v1.4.55 August 2026

Accounts by invitation, and edge gateways that know their site

• New Users are invited rather than created. An administrator enters a name, an email address and a role; the person sets their own password through a link that works once and expires in 72 hours. A password is no longer chosen on someone else's behalf, and never travels through an inbox or a chat message. The link is shown in the admin panel as well, so an appliance with no mail server, or mail that lands in a spam folder, is never a dead end.
• New Two-factor authentication is required for administrators. The requirement sits on the account, not on the sign-up form: an invitation abandoned halfway simply resumes at the next sign-in, where the account reaches the enrolment page and nothing else. It cannot be switched off again either; a lost phone is an administrator reset, which forces a fresh enrolment instead of dropping the requirement. Viewers may still skip it.
• New A second factor replaces password rotation. Accounts with an authenticator enrolled no longer expire after 90 days and stop receiving reminders: rotation guards against a password quietly ageing into someone else's hands, which is exactly what the second factor covers. The original date is kept, so turning the authenticator off again exposes the real age of the password rather than granting a fresh 90 days.
• New Account mail can use its own relay, separate from the one that carries alerts. Alerts are the volume and belong on your own mail server; invitations and password resets have to arrive before anything else is configured, because they are how people get in. Each relay can be tested on its own.
• New An Edge Monitor Gateway now carries its site subnets, and the Setup panel walks all three legs of the connection: the router block includes forwarding and a source-scoped masquerade so polled equipment can answer, the hub registration is generated ready to send, and Aegis checks its own tunnel and adds any missing subnet with one click.
• New Teltonika routers on the Wired page carry a role badge: EDGE GW for a gateway, RMS for a docking station, so the two are distinguishable at a glance even within the same site.
• Fix Creating the first user could lock everyone out. The built-in install login was switched off by the presence of any account, so adding a read-only user left the appliance with no administrator, and an invitation nobody had accepted yet left it with nobody who could sign in at all. It is now retired only by a local administrator who can actually sign in, and deleting the last one brings it back.
• Fix Password expiry reminders no longer arrive daily. The reminder ran every day of the warning window, and an expired password stays inside that window, so an account nobody touched again was emailed every day for as long as it existed. Reminders now go out at 14, 7, 3 and 1 days, on the day itself, and weekly after that.
• Fix The VPN gateway now heals itself. Proxy ports and the WireGuard tunnel are applied independently and re-applied when either changes or drops: a newly added router's management port no longer waits for a manual reload, and a failed tunnel start cannot take the proxy ports down with it.

v1.4.53 August 2026

Edge Monitor Gateway

• New Edge Monitor Gateway: bring a whole remote location into the dashboard through a Teltonika router on the Aegis VPN hub. The gateway dials out, so it works behind carrier-grade NAT on 4G just as well as on a wired uplink, and appears on the Wired page with CPU, memory, uptime and LTE signal, next to your switches. This is the building block for sites without their own appliance and equally useful as a branch-office add-on to an on-prem install.
• New A dedicated admin section with a Setup panel that generates the complete router configuration as one paste-ready block. Keys follow a strict flow: the keypair is generated on the router and the private key never leaves it.
• Improved Gateways need no endpoint definitions: the management path to every router now follows the router inventory itself, so a gateway without IoT endpoints is monitored all the same.

v1.4.52 August 2026

Appliance health and alert alignment

• Fix Container logs can no longer fill the disk. A leftover telemetry debug output wrote a second copy of every metric into the log; it is removed on update, log sizes are capped at the Docker level, and the appliance service unit no longer duplicates container output into the system log. Existing appliances converge automatically on their next update.
• Improved CPU and memory alerts now use the same 70/85 thresholds as the dashboard status, so a switch that shows a warning tile also produces an alert, and the tile names the actual cause instead of falling back to "no specific cause identified".
• Improved Re-pushing telemetry configuration to a controller shows its progress and the resulting subscription count on the button, with a clear error when the push fails.

v1.4.51 August 2026

Aegis Remote Management System

• Improved The VPN hub integration is now Aegis RMS, the Aegis Remote Management System, throughout the dashboard and documentation, since it does rather more than carry a tunnel: it monitors the routers, reaches the equipment behind them and records who went where.
• Improved IoT endpoints no longer consume a licence slot. Aegis polls the 4G router; the equipment behind it is a proxy target, not a monitored device. Only the routers count, so a site with two machines per router costs what one device costs. An endpoint becomes unavailable only when its own router is over the limit.

v1.4.50 August 2026

IoT endpoints: paired view and instant status

• Improved Endpoints sharing a docking are now shown as a pair with the connection control between them, so it reads as moving one link rather than acting on a single device. The connected endpoint carries a green highlight, the other amber.
• Improved Plain wording throughout, Local Wi-Fi connected / not connected, and Open is available only on the endpoint that actually has the link, keeping "move the connection" and "open the page" clearly apart.
• Improved The page renders immediately. Association status now rides along with the router poll and is served from cache instead of a live SSH round-trip per router on every page load.
• Fix History charts for LTE routers. Devices without switch ports were skipped before their gauges were built, so CPU, memory, temperature and signal had nothing to click; the signal chart was also limited to the temperature code path.
• Fix The router gauge prints the real signal figure in dBm instead of the value used to draw the arc.

v1.4.49 August 2026

Two-factor authentication for local accounts

• New Two-factor authentication (TOTP) for local accounts: scan a QR code with Google or Microsoft Authenticator and sign in with a code from your phone on top of your password. Optional per user; LDAP and SAML accounts keep using the second factor of your directory or identity provider.
• New Enrollment hands out ten single-use recovery codes, and two-factor only switches on once you have typed a working code: a mis-scanned QR can never lock you out. Administrators can clear a user's two-factor setup when a phone is lost.
• New Change your own password from the sidebar. Until now only administrators could reach the password screen, leaving read-only users with no way to change theirs.
• New A reminder to switch two-factor on appears after signing in without it, dismissible for the rest of the session.
• Improved Local user overview shows per account whether two-factor is active.

v1.4.48 August 2026

AEGIS VPN HUB: remote access to IoT endpoints over 4G

• New AEGIS VPN HUB: the appliance joins a WireGuard hub as a spoke, so sites reachable only over 4G, robots, AGVs and other IoT endpoints behind a Teltonika RUT241, can be opened straight from the dashboard.
• New IoT Endpoints page grouped per docking station, showing the live Wi-Fi link state of every endpoint. Where one router serves several endpoints, a single click switches the Wi-Fi link over and reports progress while it re-associates.
• New RUT241 monitoring under Wired: LTE signal and operator, Wi-Fi signal, CPU, memory, modem temperature, uptime and firmware, with history graphs and site health hexagons, next to the switches.
• New Aegis login in front of the endpoint ports, so a device's own web page is only reachable after signing in to the dashboard, with the source IP of every visit recorded in the audit log.
• New IoT-endpoints-only mode for appliances used purely for remote access: the network pages are hidden for non-admin users.
• New Guided three-step onboarding, VPN hub, then the routers, then the endpoints, with inline editing throughout.
• Improved Sign-in name in the sidebar no longer overflows when it is an email address; the full address stays visible on hover.
• Fix Endpoint ports now follow the HTTPS settings, so enabling TLS also secures them.

v1.3.50 June 2026

Advanced operator settings & OVA setup wizard

• New Advanced admin tab for Tier 1 operator settings, poll intervals (firewall, load balancer, switch SNMP, switch traffic), 5 GHz utilisation threshold, AP name history window and WLC trend source, all live without a restart.
• New Configurable sessions_max per firewall so the concurrent-sessions gauge scale matches the actual platform capacity (e.g. 3 000 000 for a FortiGate 4200F).
• Improved OVA setup wizard: Stargate-themed install progress, 7 chevrons lock one-by-one as each component is pulled, ending with "Wormhole established, Aegis components on board."
• Improved SNMP switch polling parallelised with a configurable worker pool, dramatically reducing collection time on sites with many devices.
• Fix Admin reboot banner no longer flashes for one second on every page load. Banner re-polls every 60 s and auto-hides when the pending-reboot flag clears.

v1.3.49 June 2026

F5 BIG-IP load balancer: VIP monitoring & favorites

• New Per-user VIP favorites: star any VIP or SNAT pool and pin it to the top of the table. Favorites are stored per logged-in user.
• New Favorites comparison pane showing all starred VIPs and SNAT pools with current availability state, monitor status and concurrent connections.
• New Monitor toggle (eye icon) per VIP: when a monitored VIP transitions to down, an alert fires to the dashboard and SIGNL4.
• New Live search/filter on VIP and SNAT pool tables.
• New SNAT pool name shown per VIP row, resolved from the F5 virtual server configuration.
• Fix VIP connections now show concurrent connections instead of the cumulative counter (was showing billions of total packets).
• Fix SNAT pool connections corrected to concurrent sessions instead of the cumulative total.
• Fix VIP list no longer disappears when the F5 bulk-walk times out on large tables: walks are retried up to 3 times before falling back to the last known state.

v1.3.39 June 2026

SNMP, licensing & appliance refinements

• New Per-device-type SNMP credentials with an individual v2c/v3 version toggle per type, so switches, firewalls and load balancers can each use their own community string or SNMPv3 profile.
• New F5 BIG-IP load balancer monitoring over SNMP, surfaced alongside switching, wireless and ACI data.
• Improved Signed license keys are now bound to a stable hardware ID, preventing accidental trial resets and making license validation more reliable.
• Fix SNMP v2c community no longer silently inherits from the Switches type: a blank community now correctly defaults to public.
• Improved OVA appliance specification set to 4 vCPU / 16 GB / 100 GB, with build-time QEMU resources decoupled from the declared spec to resolve out-of-memory failures during image builds.

v1.3.19 June 2026

Platform stability

• Fix Update status and progress messages are now consistently displayed in English throughout the dashboard.
• Improved Update workflow reliability, the update trigger mechanism is more robust under various deployment configurations.

v1.3.18 May 2026

Ubuntu deployment & OVA improvements

• New Fully automated Ubuntu 22.04 and 24.04 installation via a single install command. The installer configures all services, nginx, HTTPS readiness and update tooling without manual steps.
• New OVA setup wizard now automatically configures SNMP and telemetry settings and sets the correct dashboard URL after deployment.
• Fix Dashboard not reachable after fresh deployment due to an nginx upstream port misconfiguration. Affected both OVA and Ubuntu installs.
• Improved Admin panel streamlined: license management is now handled via the Aegis portal, reducing clutter in the dashboard admin section.
• Improved Dashboard UI cleaned up: removed placeholder text and unused status messages from the overview page.

v1.3.17 April 2026

Security hardening

• Security Rate limiting added to the dashboard login endpoint to protect against brute-force attempts.
• Improved OVA build process is now significantly faster and more reliable. Disk preparation was reworked to eliminate a step that occasionally caused build timeouts on GitHub Actions.

v1.3.16 March 2026

HTTPS, LDAP and Cisco ACI

• New HTTPS support with automatic Let's Encrypt certificate provisioning. Certificates renew automatically and the dashboard reconfigures itself without a restart.
• New LDAP authentication with role mapping. Users can now log in with their corporate directory credentials. Supports multi-group mapping to Admin or Monitor roles.
• New Cisco ACI integration. Fabric health, tenant state and endpoint data from the APIC are now visible directly in the dashboard alongside traditional switching and wireless data.
• New SIGNL4 alerting integration. Critical alerts are forwarded to SIGNL4 for mobile notification and on-call escalation. Alerts resolve automatically when the condition clears.
• Fix License key no longer lost after a container rebuild or service restart.
• Improved OVA build migrated from VirtualBox to QEMU/KVM and base OS upgraded to Ubuntu 24.04 LTS for improved performance and longer support lifecycle.