diff --git a/files/ansible-playbooks/sot-updater.yml b/files/ansible-playbooks/sot-updater.yml
index dba4abf..bd2634a 100644
--- a/files/ansible-playbooks/sot-updater.yml
+++ b/files/ansible-playbooks/sot-updater.yml
@@ -516,7 +516,7 @@
       set_fact:
         dev2_passfile_used: "{{ (dev2_auth.rc == 0)|ternary(dev2_auth.stdout|trim,'NONE') }}"
 
-    # ------ New: LLDP candidate IP when Dev2 login failed (tunnel up but Dev2 unreachable) ------
+    # ------ LLDP candidate IP when Dev2 login failed (tunnel up but Dev2 unreachable) ------
     - name: Dev1 | Try LLDP-derived Dev2 IP (auth to Dev2 failed)
       when:
         - tunnel_ok | default(false)
@@ -541,7 +541,45 @@
         msg:
           - "LLDP-derived Dev2 IP (best-effort): {{ (lldp_ip_raw.stdout | default('') | trim) if ((lldp_ip_raw.stdout | default('') | trim | length) > 0) else '<none>' }}"
 
-    - name: Dev2 | Read firmux
+    # ------ NEW: Try direct SSH to LLDP IP from localhost (no extra tunnel) ------
+    - name: Set LLDP IP fact
+      when:
+        - tunnel_ok | default(false)
+        - dev2_passfile_used == 'NONE'
+      delegate_to: localhost
+      set_fact:
+        lldp_dev2_ip: "{{ lldp_ip_raw.stdout | default('') | trim }}"
+
+    - name: Try DEV2 login via direct LLDP IP
+      when:
+        - tunnel_ok | default(false)
+        - dev2_passfile_used == 'NONE'
+        - lldp_dev2_ip | length > 0
+      delegate_to: localhost
+      shell: |
+        for f in basicpass basicpass2; do
+          if sshpass -f "$f" ssh -o StrictHostKeyChecking=no -o PubkeyAuthentication=no \
+               -o ConnectTimeout=15 \
+               "{{ dev2_ssh_user }}@{{ lldp_dev2_ip }}" "echo ok" >/dev/null 2>&1; then
+            echo "$f"; exit 0
+          fi
+        done
+        exit 1
+      register: dev2_auth_lldp
+      changed_when: false
+      failed_when: false
+      ignore_errors: true
+
+    - name: Set dev2_passfile_used_lldp
+      when:
+        - tunnel_ok | default(false)
+        - dev2_passfile_used == 'NONE'
+        - lldp_dev2_ip | length > 0
+      delegate_to: localhost
+      set_fact:
+        dev2_passfile_used_lldp: "{{ (dev2_auth_lldp.rc | default(1)) == 0 | ternary(dev2_auth_lldp.stdout | default('') | trim, 'NONE') }}"
+
+    - name: Dev2 | Read firmux (primary tunnel)
       when: tunnel_ok|default(false) and dev2_passfile_used != 'NONE'
       delegate_to: localhost
       shell: |
@@ -555,6 +593,34 @@
       failed_when: false
       ignore_errors: true
 
+    - name: Dev2 | Read firmux (direct LLDP IP)
+      when:
+        - tunnel_ok | default(false)
+        - dev2_passfile_used == 'NONE'
+        - lldp_dev2_ip | length > 0
+        - dev2_passfile_used_lldp != 'NONE'
+      delegate_to: localhost
+      shell: |
+        sshpass -f "{{ dev2_passfile_used_lldp }}" ssh \
+          -o StrictHostKeyChecking=no -o PubkeyAuthentication=no \
+          -o ConnectTimeout=15 \
+          "{{ dev2_ssh_user }}@{{ lldp_dev2_ip }}" \
+          "cat /usr/lib/release/firmux 2>/dev/null || true"
+      register: dev2_firmux_lldp
+      failed_when: false
+      ignore_errors: true
+
+    # ------ Mux: choose whichever firmux output succeeded ------
+    - name: Dev2 | Choose firmux output (tunnel or LLDP)
+      delegate_to: localhost
+      set_fact:
+        dev2_firmux_text: >-
+          {{
+            (dev2_firmux.stdout | default('') | trim)
+            if ((dev2_firmux.stdout | default('') | trim | length) > 0)
+            else (dev2_firmux_lldp.stdout | default('') | trim)
+          }}
+
     - name: Dev2 | Extract firmware version line
       delegate_to: localhost
       run_once: true
@@ -562,11 +628,11 @@
         indoor_fw_norm: >-
           {{
             (
-              (dev2_firmux.stdout|default('')|regex_replace('\r',''))|split('\n')
+              (dev2_firmux_text | default('') | regex_replace('\r',''))|split('\n')
               | map('trim') | select('truthy') | list
             ) | select('match','(?i).*\\brev\\s*[0-9]+.*')
               | list | first | default(
-                  ((dev2_firmux.stdout|default('')|regex_replace('\r',''))
+                  ((dev2_firmux_text | default('') | regex_replace('\r',''))
                    | split('\n')|map('trim')|select('truthy')|list|first|default(''))
                 ) | trim
           }}