FireSight OT OT remote access

Cloud Connectors

A Cloud Connector sits in a machine network and connects out to your Cloud Hub. Every device runs the same generic image; a one-time enrollment code decides which company and site it belongs to.

Add a site

In the Hub, open Companies and add the company if it isn't there yet.
Open Cloud Connectors, choose New connector, and pick the company. Give it a name and site. If the site's machine subnet is used at other sites too, enter it as the real subnet; the Hub gives it its own virtual subnet.
You get an enrollment code. It works once and expires (72 hours by default; see Security and audit).

Set up the device

With the SD card (most sites)

Flash the FireSight OT Cloud Connector image onto the card. Staff download it from the Hub under Cloud Connectors → SD card image, with step-by-step instructions. Use Raspberry Pi Imager's Use custom option, and don't use its OS customisation: the connector manages its network itself.
The card shows up as a drive called bootfs on any computer. In the Hub, open the connector, choose New enrollment code, then Download firesight.txt (use Set network details… first for a fixed address or Wi-Fi). Copy the file onto the card, replacing the one there.
Put the card in the device, cable it and power it.

Within a minute the device enrolls and shows Online in the Hub. The enrollment code and any Wi-Fi password are wiped from the card.

With the setup page

Leave firesight.txt alone, connect a laptop to the same network and open http://<device-address>:8080 (or http://firesight-connector.local:8080). Set a setup password, then enter the network settings, the Hub address and the enrollment code.

On your own Debian-based device

curl -fsSL https://hub.example.com/dl/install-connector.sh | sudo bash -s -- --code XXXX-XXXX-XXXX-XXXX

firesight.txt

Uncomment a line to change it; anything left commented keeps its default.

Setting	Meaning
`hub=`	The Hub's address. Several addresses, comma-separated, are tried in order.
`code=`	The enrollment code. Wiped after enrollment.
`proxy=`	An outbound HTTP proxy at the site, for example `http://proxy.site.local:3128`.
`license=`	A device license this connector carries: the part between the BEGIN and END lines of the `.lic` file.
`layout=`	`single`, `dual` or `wifi` (below).
`uplink_ip=`, `uplink_gateway=`, `dns=`	`dhcp` (the default), or a fixed address such as `192.168.10.50/24`.
`machine_ip=`	The address on the machine network, for the `dual` and `wifi` layouts.
`wifi_ssid=`, `wifi_password=`, `wifi_country=`	Wi-Fi settings. The password is wiped after it's applied.
`wifi_failover=yes`	Use Wi-Fi as a backup when the Ethernet uplink fails.
`setup_password=`	Password for the setup page (10 characters or more). If left out, the first person to open the page sets it.
`local_allow=`	The machine addresses the Hub may ask this device to reach, for example `192.168.1.0/24`. The Hub can't widen this.
`serial_consoles=off`, `ntp_server=off`, `threat_detection=off`, `mqtt_bridge=off`	The site refuses that feature on this device, whatever the Hub asks: serial consoles, the time server for the machines (0.4.0), Detect (0.4.0) or the MQTT bridge (0.4.0). The setup page has the same switches.

Ports on the machine side

Nothing listens on the uplink. On the machine network and VLANs, a Cloud Connector only answers for the features you switch on:

Port	Used for
UDP 123	Time server for the machines (NTP), 0.4.0
TCP 1883, TCP 8883 (TLS)	MQTT bridge: machines publish to it, 0.4.0

Network layouts

Layout	Ports	Use it when
`single`	Built-in Ethernet	One network reaches both the internet and the machines.
`dual`	Built-in Ethernet to the uplink, USB Ethernet to the machines	You want the plant network kept apart from the uplink.
`wifi`	Wi-Fi to the uplink, Ethernet to the machines	There's no cabled uplink near the machines.

Reaching machines without routes

By default the connector masquerades: machines see traffic coming from the connector's own address, so nothing at the site needs a route back. Turn masquerade off for a connector only if the site routes the virtual subnet to it.

Remote management

Open the connector's Remote management tab, or use fsot-hub connectors cmd:

Action	What it does
Status, diagnostics, logs	Connection, network and service details from the device.
Network diagnostics, Test port	Ping or test a TCP port from the site, for example `192.168.1.20:502`.
Update software	Install a signed software update.
Renew certificate	Get a new device certificate now.
Restart service, Reboot	Restart the software or the whole device.
Revoke	Cut the device off. It needs a new enrollment code to come back.

Changing the device's network from the Hub is off unless someone on site allows it (fsot-connector set remote-network on). A change that loses the Hub is rolled back automatically.

On the device

At the device's console, sudo fsot-connector shows and changes its settings:

sudo fsot-connector status              # connection, enrollment and network
sudo fsot-connector test 192.168.1.20:502
sudo fsot-connector net static 192.168.10.50/24 192.168.10.1 192.168.10.1
sudo fsot-connector set proxy http://proxy.site.local:3128
sudo fsot-connector set allow 192.168.1.0/24
sudo fsot-connector set license connector.lic

fsot-connector status also shows the device's serial (CC-XXXX-XXXX-XXXX), which is printed on its label too. It comes from the board, so it stays the same if the card is re-flashed.

Self-healing

If a Cloud Connector loses the Hub, it recovers by itself in stages: first it renews its network, then it restarts its software, then it reboots. The stages and their limits can be configured.

Alerts and maintenance mode

The Hub emails the right team when a Cloud Connector is offline, or a machine stops answering, for a set number of minutes, with reminders and a "back" email. When a whole site drops you get one line, not one email per machine, and the Hub tells you if it may have lost its own internet connection.

Put a site in maintenance mode for 1 hour to 1 week, with a note, to hold its alerts while people work on it. If something is still down when maintenance ends, the alert goes out then. Alert rules can also be snoozed.

4G/5G mobile data

A Cloud Connector can use a USB modem or modem HAT with a data SIM, as its main connection or as a backup for Ethernet or Wi-Fi. Choose mobile data when you create the Cloud Connector, and enter the APN and SIM PIN.

To save data on pay-as-you-go SIMs, a connector on mobile data stays on standby and only sends a small signed "I'm alive" message every 30 seconds, about 15 MB a month. Its tunnel opens within seconds when someone opens one of its machines, and closes again when idle. On standby it still reports which machines are answering, so status and alerts keep working. Each connector shows its data used this month. The Hub needs UDP 443 open for this (see Install a Cloud Hub).

Serial consoles

Plug USB console cables or USB-to-RS232 adapters into the Cloud Connector to reach routers, switches, firewalls, drives and PLC service ports from anywhere. Publish the console as a resource like any other machine.

People open it in a browser terminal from My access, or through the client with PuTTY or SecureCRT.
Only one person can use a console at a time.
Send break supports router password recovery.
A site can turn serial consoles off on its own device.

Models and hardware

Cloud Connectors are based on Raspberry Pi, so there's no hardware lock-in: buy ready-made units from us, or build your own with parts from any local store.

Model	Notes
CC-3, CC-4, CC-5	Standard Cloud Connectors.
CC-4i, CC-5i	Industrial versions on a compute module with built-in eMMC storage. Step-by-step setup is supported for the CC-5i (Compute Module 5 with eMMC).

All models run the same software. The console and the command line show the model; administrators also see the exact board, for support.

To build your own: at least a 64-bit ARM or x86 board, 512 MB RAM and one Ethernet port. We recommend two Ethernet ports, 1–2 GB RAM, eMMC storage and a 12–24 V DIN-rail housing.