When devices that an administrator may want to add to a network management system are behind a NAT device (relative to the network management system), such as a firewall, the network management system may not be able to sweep through a range of IP addresses or a subnet because network management system may not have access to the private IP addresses of the network devices behind the firewall and thereby may not be able to add them for further management. In this example, an administrator may have to manually add each of the network devices behind the firewall to the network management system. For example, an administrator could model a network device on the network management system. The network management system could generate an activation configuration for the network device. The network management system could commit the activation configuration on the network device. The network management system could then wait for an outbound ssh connection from the network device. This process could be repeated to add each network device behind the NAT device. If the number of network devices behind the firewall is large, adding each of the network devices manually may be a time-consuming and tedious task. The techniques of this disclosure enable a network management system to add network devices behind a NAT device without requiring an administer to manually add all of the network devices behind the NAT device onto the network management system.