[rancid] Bouncing a connection off an accessible front-end device to something behind it

[Justin Shore]

I'm pretty sure I've read at some point in the past that RANCID can do 
this but my Google-fu is failing me tonight.  I need to be able to 
relay/bounce a connection through a publicly-accessible device to a 
device that's behind it.  The scenario is that the user's managed CE 
router is accessible to the our NOC via SSH but the managed switches and 
managed APs behind it are not.  I need to be able to SSH into the router 
and then establish a second connection from that device onto a device 
behind it (the secondary connection is telnet since that's all the 
Adtran CLI permits).

Like I said I'm pretty sure I read about that being a possibility with 
RANCID before.  I just can't come up with a search string to find what 
I'm looking for.  Can anyone give me an idea what I need to search for 
so I can do some reading up on the solution?  I could do something with 
PAT too I suppose and specify the public ports and restrict them with 
ACLs.  Personally I'd rather just have one publicly-accessible host on 
the Internet per site.

Thanks
  Justin