Continuum Local

Continuum Local is an agent you run inside your own network. It sweeps the network for SNMP devices, and Blueprintr draws a finished sweep as a blueprint: a Physical view of the switches, routers, firewalls and other network devices the sweep reached and the LLDP and CDP links between them, and a Routing view of the route next hops between them and, from agent 0.3.0, their BGP sessions and OSPF and IS-IS adjacencies. Drawing your network has the details. The same agent lets Continuum Link read monitoring systems that are never exposed to the internet.

It sits behind the same gate as Continuum Link: the organisation that owns the agent needs an Enterprise plan (a team's agent uses its parent organisation's plan), and you need continuum_integrations.manage on that organisation or team.

Continuum Local is separate from Continuum Cloud. It draws the network inside your estate from SNMP sweeps, serves connector panels on strata, and discovers no cloud resources.

Installing

Prerequisites, sizing, each platform, and enrolling the agent.

Network requirements

Outbound connections, ports, proxies and TLS inspection.

Configuration reference

Every setting in config.json, secret references and the check command.

Security model

What the agent enforces, and what Blueprintr stores, who sees it and for how long.

Network discovery

What an SNMP sweep reads, its limits, and running and reviewing sweeps.

Drawing your network

A sweep drawn as a blueprint: the Physical and Routing views, what is drawn, and redrawing.

Releases and verification

Versions, signatures, SBOMs and which releases are supported.

Upgrading and removing

Upgrades, rollbacks, credential rotation and uninstalling.

Troubleshooting

Logs, error codes and common failures.

Questions and limitations

Air-gapped networks, redundancy, a lapsed plan and other limits.

What it serves

It serves SolarWinds Orion, Zabbix, PRTG Network Monitor, Checkmk, Icinga 2, ManageEngine OpManager, WhatsUp Gold, NetBox, Infoblox and Veeam Backup & Replication, whose fields and panels the connector reference lists. Each appears in the connector list but stays disabled until an agent that can serve it is online. The label says why: set up an agent, your agent is offline, or upgrade your agent. An agent counts as online when it has checked in within about ninety seconds.

Each one needs a dedicated account that can only read. The credential parts are the names you use under credential in the agent's configuration, or in the send credentials form.

Connector	Credential parts	Least-privilege account	Default port	Certificate
SolarWinds Orion	`username`, `password`	An Orion account with no administrator, node management or unmanage rights	17774 (SWIS)	Self-signed on install
Zabbix	`token`	A user whose role type is User, in a group with Read on the host groups to show (Zabbix 6.0 LTS and later)	443	Depends on the install
PRTG Network Monitor	`token`	An API key with Read access for a Read-only user (PRTG 22.3.79 and later)	443	Self-signed on install
Checkmk	`username`, `password`	An automation user whose role is copied from Guest, plus Read access to all hosts and folders	443	Depends on the install
Icinga 2	`username`, `password`	An ApiUser with only `objects/query/Host` and `objects/query/Service` (and `filter-expression` where enforced)	5665	Icinga's own CA
ManageEngine OpManager	`token`	An API key with Read access only, or on builds before 12.8.721 a read-only Operator's key	8060. Write it in the URL: without a port, the connector uses 443	Self-signed on install
WhatsUp Gold	`username`, `password`	A read-only user that can read the Entire Network device group	9644	Depends on the install
NetBox	`token`	A user whose only permission is view on devices, interfaces, IP addresses, virtual machines and VM interfaces, with Write enabled off on the token (NetBox 4.0 and later)	443	Depends on the install
Infoblox	`username`, `password`	A NIOS admin in its own group that may use the API, with read-only permission on the networks, DNS views, host records and DHCP data to show and no superuser rights	443	Issued to www.infoblox.com: replace it first
Veeam Backup & Replication	`username`, `password`	An account with only the Veeam Backup Viewer role, marked as a service account if multi-factor authentication is on (version 12 and later)	9419	Self-signed on install

A port you give in the connector's URL replaces the default, including 443 for a reverse proxy. WhatsUp Gold and Veeam Backup & Replication trade the username and password for an access token, which the agent keeps: Blueprintr only sees a stand-in for it. They need agent 0.2.0 or later, and the connector list says to upgrade an older agent.

How it reaches Blueprintr

The agent dials out over HTTPS on port 443. Nothing connects inward, so no inbound firewall rule is needed. Allow outbound HTTPS from the agent's host to blueprintr.io and agents.blueprintr.io. The agent keeps a connection open to agents.blueprintr.io when Blueprintr offers it, polls at least once a minute, and falls back to polling blueprintr.io directly if that connection stops answering. A proxy for this traffic is set with proxy and noProxy in the agent's configuration.

It is for private and firewalled estates, not air-gapped ones. A host with no outbound path to Blueprintr cannot run it.

There is no schedule of its own for connectors. A job is created when an editor refreshes a linked tab, and a queued job expires if no agent claims it.

Blueprintr's suggestion index never covers these connectors, so nothing about your on-premise systems is copied to Blueprintr ahead of time. Suggest Continuum Links reaches them only when an editor chooses Check live, and then through the agent, like any other request.

Getting the agent

Download it from the Continuum Local download page while signed in to an account on an Enterprise plan. The Continuum Local panel links there too. The page offers the current release and a few earlier ones, so you can install the version your change control approved or roll back to one.

Installing covers packages for Debian and Ubuntu, RHEL, Rocky and Alma, and Windows Server, each with its own runtime, plus a container image, a Helm chart and a single file for a host with Node.js 24. Every release is signed, and Releases and verification gives the signing identity to check it against.

Registering an agent

Add an agent

Name it, and Blueprintr issues an enrolment token.

Copy the token now

It is shown exactly once, can be used once, and expires after 24 hours. There is no way to retrieve it afterwards. An expired, spent or revoked token fails enrolment with the same message: rather than diagnosing it, issue a new token, or for a revoked agent create a new agent.

Put it in the agent's configuration

Set it as enrollmentToken in the agent's config.json, run continuum-local check to test the file, start the agent, then delete that line. It is spent once used.

Copy the connector configuration

The panel prints a configuration block for each on-premise connection, keyed by the connection's ID. The ID is shown only in this panel.

New token and Re-enroll issue a replacement token and cancel the previous unused one. Neither works on a revoked agent: create a new agent instead. Revoke cuts an agent off at once, including a connection it has open.

If the organisation's plan has lapsed, enrolment is refused with a message that says so, and the token is not spent. Once an owner renews the plan, restart the agent and it enrols with the same token while the token is still valid.

After a lapse the panel still lists the agents, marked as paused, so you can take them out of service: Revoke, Delete (which also deletes the agent's network sweep results) and remove from agent for credentials sent from Blueprintr. Nothing else is offered until the plan is active again. A paused agent's polls are refused, so remove from agent usually reports it offline. Remove those credentials on the agent's machine instead, by deleting its state as described under Uninstall.

Credentials

Blueprintr never stores a credential for an on-premise system. The security model lists where the agent keeps each kind. Blueprintr cannot read, export or recover a credential, and cannot help you rotate one. Rotation happens in the agent and in the monitored system.

Where you set it	How
In the agent's configuration	Edit `config.json` on the agent's own machine. The values never leave your network. This is the default.
From Blueprintr	Set `"allowRemoteCredentials": true` in the agent's configuration and restart it. The agent needs version 0.2.0 or later. The Continuum Local panel then offers send credentials for each on-premise connection.

A credential sent from Blueprintr passes through Blueprintr over an encrypted connection to the running agent, which keeps it in its own state directory. Blueprintr keeps no copy, so nothing is queued: the agent has to be online and connected to agents.blueprintr.io at the time, and the panel shows it as "connected through the gateway". An agent that is only polling cannot receive a credential, and where Blueprintr does not offer the gateway, the panel says sending credentials is not set up. In either case, put the credential in config.json.

remoteCredentialScope in the agent's configuration limits which hosts Blueprintr may configure. Certificate settings sent from Blueprintr are refused unless that scope sets allowTlsOverrides.
A connection set in config.json always wins. Blueprintr can neither replace nor remove it.
remove from agent deletes a credential Blueprintr sent. Deleting the connection in Blueprintr removes it from the agent too. Both need the agent online and connected to the gateway, so remove credentials before you revoke or delete an agent.

Revoking or deleting an agent in Blueprintr, or uninstalling it, does not delete what is on its machine: config.json and any credentials sent from Blueprintr stay there until you delete the agent's configuration and state, as Uninstall describes for each platform.

Wherever the credential is set, Blueprintr runs the connector with unguessable placeholder values standing in for it, and tells the agent which parts to replace with local values. The agent refuses to send a request if a placeholder survives into it, and for a credential set from Blueprintr it will only reach the host that integration is configured for.

Read-only by default

The agent sends only requests it recognises as reads for that product, by the rules of its read-only guard. Anything else is refused with operation_not_allowed, and nothing is changed. Blueprintr's message says which check refused the request, and Operation not allowed gives the fix for each.

Setting "allowWriteOperations": true on one integration in config.json lifts the guard for that integration only. Blueprintr can never set it. Upgrade the agent first, and turn it on only for a write you have confirmed you want to allow.

Network sweeps

With a discovery block in its configuration, an agent can sweep your network for SNMP devices. Start one from Network sweeps below the Continuum Local panel, or schedule one daily or weekly. The agent sweeps only the ranges in its own discovery block: Blueprintr can narrow a sweep to some of them but never widen it, and the SNMP credentials stay on the agent. An agent runs one sweep at a time.

Create Blueprint, on a finished sweep's results page, draws the sweep as a blueprint with a Physical view and a Routing view, and each drawn device gets a stratum. Blueprintr redraws it when a later sweep of the same ranges finishes, usually within 15 minutes, keeping your layout and marking what changed, so a scheduled sweep keeps the drawing current. A new blueprint can also scan a network and draw it by itself: choose Document a real system using Continuum when you start one, or + Add tab and then Continuum (live data) in a blueprint you are editing, pick the subnets, and choose when it scans again. Drawing your network covers both ways, the views and what they show.

Blueprintr keeps the devices, ports and links each sweep finds for 90 days from when the sweep starts, apart from each agent's latest complete sweep, which is kept until a newer one completes.

Certificates

The agent refuses a certificate it cannot verify. Orion, PRTG, OpManager and Veeam Backup & Replication install with a self-signed certificate, and Icinga 2 uses its own certificate authority (ca.crt in /var/lib/icinga2/certs). For Checkmk, Zabbix, WhatsUp Gold and NetBox it depends on how they were installed; NetBox serves no HTTPS of its own, so it is whatever sits in front of it. Give the agent that certificate, or your internal authority's, as caFile rather than disabling certificate checking.

Infoblox NIOS is the exception. It installs with a certificate issued to www.infoblox.com, so caFile alone cannot verify it for your grid's address. Replace the grid's certificate first: in Grid Manager, go to Grid > Grid Manager > Members, select the Grid Master, and choose Certificates > HTTPS Cert > Generate Self-signed Certificate for the address the agent uses (an IP address goes in as a subject alternative name; on an HA pair, use the address of the VIP), or install one from your own certificate authority. Then give the agent that certificate as caFile. Turn checking off with allowInsecureTls only as a last resort.

Compatibility

The agent advertises what it can do, and Blueprintr sends only work that matches. A newer kind of job is invisible to an older agent rather than breaking it, so agents upgrade on your schedule rather than Blueprintr's. The panel shows Update available when a newer release exists. Before version 1.0 only the latest release is supported.

Troubleshooting

When an agent has not been heard from for 15 minutes, Blueprintr emails the owners and admins of the organisation that owns it, and of the team for a team's agent. On the agent's host, run continuum-local check, then read the agent's log and look up any error code in Troubleshooting, which also says where each install writes its log.