FireSight docsCloud Connectors
A Cloud Connector sits in a machine network and connects out to your Cloud Hub. Every device runs the same generic image; a one-time enrollment code decides which customer and site it belongs to.
Add a site
- In the Hub, open Customers and add the customer if it isn't there yet.
- Open Cloud Connectors, choose New connector, and pick the customer. Give it a name and site. If the site's machine subnet is used at other sites too, enter it as the real subnet; the Hub gives it its own virtual subnet.
- You get an enrollment code. It works once and expires (72 hours by default; see Security and audit).
Set up the device
With the SD card (most sites)
- Flash the FireSight OT Cloud Connector image onto the card. Staff download it from the Hub under Cloud Connectors → SD card image, with step-by-step instructions. Use Raspberry Pi Imager's Use custom option, and don't use its OS customisation: the connector manages its network itself.
- The card shows up as a drive called
bootfson any computer. In the Hub, open the connector, choose New enrollment code, then Download firesight.txt (use Set network details… first for a fixed address or Wi-Fi). Copy the file onto the card, replacing the one there. - Put the card in the device, cable it and power it.
Within a minute the device enrolls and shows Online in the Hub. The enrollment code and any Wi-Fi password are wiped from the card.
With the setup page
Leave firesight.txt alone, connect a laptop to the same network and open http://<device-address>:8080 (or http://firesight-connector.local:8080). Set a setup password, then enter the network settings, the Hub address and the enrollment code.
On your own Debian-based device
curl -fsSL https://hub.example.com/dl/install-connector.sh | sudo bash -s -- --code XXXX-XXXX-XXXX-XXXX
firesight.txt
Uncomment a line to change it; anything left commented keeps its default.
| Setting | Meaning |
|---|---|
hub= |
The Hub's address. Several addresses, comma-separated, are tried in order. |
code= |
The enrollment code. Wiped after enrollment. |
proxy= |
An outbound HTTP proxy at the site, for example http://proxy.site.local:3128. |
license= |
A device license this connector carries: the part between the BEGIN and END lines of the .lic file. |
layout= |
single, dual or wifi (below). |
uplink_ip=, uplink_gateway=, dns= |
dhcp (the default), or a fixed address such as 192.168.10.50/24. |
machine_ip= |
The address on the machine network, for the dual and wifi layouts. |
wifi_ssid=, wifi_password=, wifi_country= |
Wi-Fi settings. The password is wiped after it's applied. |
wifi_failover=yes |
Use Wi-Fi as a backup when the Ethernet uplink fails. |
setup_password= |
Password for the setup page (10 characters or more). If left out, the first person to open the page sets it. |
local_allow= |
The machine addresses the Hub may ask this device to reach, for example 192.168.1.0/24. The Hub can't widen this. |
Network layouts
| Layout | Ports | Use it when |
|---|---|---|
single |
Built-in Ethernet | One network reaches both the internet and the machines. |
dual |
Built-in Ethernet to the uplink, USB Ethernet to the machines | You want the plant network kept apart from the uplink. |
wifi |
Wi-Fi to the uplink, Ethernet to the machines | There's no cabled uplink near the machines. |
Reaching machines without routes
By default the connector masquerades: machines see traffic coming from the connector's own address, so nothing at the site needs a route back. Turn masquerade off for a connector only if the site routes the virtual subnet to it.
Remote management
Open the connector's Remote management tab, or use fsot-hub connectors cmd:
| Action | What it does |
|---|---|
| Status, diagnostics, logs | Connection, network and service details from the device. |
| Network diagnostics, Test port | Ping or test a TCP port from the site, for example 192.168.1.20:502. |
| Update software | Install a signed software update. |
| Renew certificate | Get a new device certificate now. |
| Restart service, Reboot | Restart the software or the whole device. |
| Revoke | Cut the device off. It needs a new enrollment code to come back. |
Changing the device's network from the Hub is off unless someone on site allows it (fsot-connector set remote-network on). A change that loses the Hub is rolled back automatically.
On the device
At the device's console, sudo fsot-connector shows and changes its settings:
sudo fsot-connector status # connection, enrollment and network
sudo fsot-connector test 192.168.1.20:502
sudo fsot-connector net static 192.168.10.50/24 192.168.10.1 192.168.10.1
sudo fsot-connector set proxy http://proxy.site.local:3128
sudo fsot-connector set allow 192.168.1.0/24
sudo fsot-connector set license connector.lic
fsot-connector status also shows the device's serial (CC-XXXX-XXXX-XXXX), which is printed on its label too. It comes from the board, so it stays the same if the card is re-flashed.
Models
The CC-3, CC-4 and CC-5 run the same software. The console and the command line show the model; administrators also see the exact board, for support.