FireSight docs

What FireSight OT is

FireSight OT gives engineers, maintenance staff and machine builders secure remote access to machine networks: PLCs, HMIs, engineering PCs and anything else on a plant floor. It's built for manufacturers whose lines are copies of each other, where every site uses the same machine addresses.

Nothing at the site accepts connections from outside. A small device in each machine network dials out to your Hub, and people are brokered through it to exactly the machines they've been granted.

 engineer ── browser / fsot client ──► Cloud Hub ◄── outbound TLS ── Cloud Connector ── PLC / HMI
                                                                     site A 192.168.1.0/24  → 10.200.3.0/24
                                                 ◄── outbound TLS ── Cloud Connector ── PLC / HMI
                                                                     site B 192.168.1.0/24  → 10.200.4.0/24

The parts

Part What it is
Cloud Hub The head-end server, on Debian 12 or 13. People sign in here, in the web console or with the client. It holds the customers, sites, machines, people and the audit log. See Install a Cloud Hub.
Cloud Connector A small device (models CC-3, CC-4 and CC-5) in each machine network. It only ever connects out to the Hub, over TLS on port 443, and publishes the machines it's been told about. See Cloud Connectors.
fsot client For Windows, macOS and Linux. Tunnels RDP, VNC, SSH, Telnet and any TCP tool (Modbus, OPC UA, S7, vendor engineering software) to a port on the engineer's own computer. Web HMIs need no client at all. See The FireSight OT client.

Ideas worth knowing

Resources. A resource is one thing people can reach through a Cloud Connector: a web page (an HMI), an RDP or VNC desktop, an SSH or Telnet console, any TCP port, or a whole subnet. Nobody sees a resource until it's granted to them.

Duplicated networks and 1:1 mapping. When two sites both use 192.168.1.0/24, the Hub gives each one its own virtual subnet from a pool (by default 10.200.0.0/16). Address .20 at site A becomes 10.200.3.20, and at site B 10.200.4.20. People and resources can use either the real or the virtual address; the connector a resource belongs to decides which site it reaches.

Customers, divisions and vendors. A Hub can serve one company or many. Each customer can be split into divisions (plants, lines, maintenance) and external vendors (machine builders, integrators), and access is granted to those groups or to individual people. See People and access.

Outbound only. Cloud Connectors work through the site's NAT and firewall with only outbound HTTPS, and through an HTTP proxy if the site needs one. There is a fallback Hub port (8443) for sites that block 443.

What it does

Area What you get
Access Per machine by default. An optional full-network WireGuard VPN per connector, still limited to granted networks.
Resource types Web page (HTTP/HTTPS, opens in the browser), RDP, VNC, SSH, Telnet, any TCP port, a whole subnet.
NAT options Outbound-only through the site's firewall, HTTP proxy, fallback Hub port, masquerade (machines see the connector's address, so no routes are needed at the site), source-restricted static port forwards on the Hub.
Connector networking One port, two ports (uplink and machines kept apart), or Wi-Fi uplink with Ethernet to the machines; Wi-Fi as a backup uplink. Remote changes are opt-in on site and roll back automatically if the Hub is lost.
Provisioning One generic SD card image for everyone. A one-time enrollment code ties a device to its customer and site. See Cloud Connectors.
File transfer Machines and engineers at the site upload logs and recipes over SFTP or FTP; staff download them on the Hub, and the Hub can keep copies for the customer's backup software. See File storage and Hub files.
Remote management Status, diagnostics, logs, ping and port tests from the site, signed software updates, certificate renewal, restart, reboot and revoke.
Security Mutual TLS with a certificate per device, two-factor sign-in, source-network limits, session and idle limits, vendor working hours, and a full audit log. See Security and audit.
Licensing Through this portal, like FireSight: a Hub license for a number of connectors, or a device license for one connector. See FireSight OT licenses.

Roles on the Hub

Role What they can do
Admin Everything: customers, connectors, resources, people, security settings, licenses, the audit log.
Operator Their customers' Cloud Connectors, resources and people. An operator placed in a division manages only that division.
User Reach the resources granted to them, from My access or the client.

Where to go next

← Licensing Install a Cloud Hub →