Guides
Guides

Networking

How the Connect+ Edge reaches devices at the IP level — routing, multiple NICs, isolated VLANs and DMZ deployments.

How the Edge reaches devices

The Connect+ Edge talks to every monitored device over plain IP. It addresses each device by IP address and speaks the device's own management protocol (HTTP(s), SNMP, IPMI or a vendor protocol) — see Requirements for the port list.

Five rules govern every Edge deployment:

  1. Devices are reached by IP address. There is no discovery protocol, no broadcast or multicast, and no agent installed on the device. Nothing has to be on the same switch or subnet as the Edge, and devices keep their existing addresses — nothing is reconfigured on the device.
  2. The Edge uses the host machine's network stack. It runs in Docker host network mode, so it sees the host's interfaces, IP addresses and routing table directly — there is no Docker bridge, no NAT and no port mapping to configure.
  3. "Can the Edge reach the device?" is the same question as "can the host machine reach the device?" Anything you can reach from a shell on the Edge host, the Edge can reach. This makes every routing problem testable without involving Xyte.
  4. All connections are outbound from the Edge. The Edge opens connections to devices and to the Xyte servers. It never listens for inbound connections — not from devices, not from Xyte, not from anywhere.
  5. The Edge never routes between its own interfaces. Traffic arriving on one NIC is never forwarded out another. This is the property that makes the multi-NIC and DMZ topologies below safe.
📘

Because rule 2 puts routing entirely in the hands of the host OS, everything on this page is configured on the machine, not in the Edge itself. There are no network settings inside the Edge to change.

⚠️

Running the Edge inside a virtual machine? Then the VM is the Edge host. Every device network the Edge should reach must be attached to the VM as its own virtual adapter — a Hyper-V External switch, a VMware port group, a Proxmox bridge. The hypervisor's physical NICs and routing table are not visible to the VM, so a NIC added to the hypervisor alone does nothing for the Edge.

How many Edges do I need?

One Edge per site — a physically separate location with its own network — not one per room, VLAN or switch. A single Edge host attached to several isolated networks (the Separate VLANs topology below) monitors all of them, and where rooms are routed back to a central network the Edge only needs to sit on that network. Each Edge monitors up to 500 devices on the minimum spec, or up to 1,000 on a 2 vCPU / 4 GB machine; see Requirements for sizing. An Edge hosted in a cloud or central data center can also serve several sites, as long as each site's network is routed to it (for example over Site-to-Site VPN or Direct Connect), latency stays low and the device count stays within these limits — see Running on AWS EC2.

Choosing a topology

TopologyEdge host NICs in use (including NIC1)Use when
Basic setup1Devices are on the same LAN, or on a subnet the site router already routes to.
Connected VLANs2Device VLANs are routed to each other but kept off the internet-facing network.
Separate VLANs3+Device VLANs must stay isolated from each other as well as from the internet.
DMZ2The device network must be fully sealed and the Edge is the only crossing point.
📘

Devices never connect to the internet.

In every topology below, the Edge host is the only thing that connects out — on TCP 443, to the Xyte Edge endpoint (and to Docker Hub for container updates). The devices themselves need no internet access, no outbound firewall rules and no NAT.

NIC1 is always the internet-facing NIC. It is the only interface that carries the Edge's outbound connection to Xyte, and it holds the host's default route. Any additional NICs (NIC2, NIC3…) face device networks only and never reach the internet. In the basic setup, the single NIC does both.

All four are equally supported. The Edge behaves identically in each — only the host's addressing and routing differ.

Deployment topologies

The four patterns below cover essentially every site. They differ only in how many networks the Edge host is attached to and whether those networks are allowed to reach each other.

Basic setup

Basic setup — the Edge host uses one NIC; the site router reaches both the Xyte servers on the internet and the device LAN.

The Edge host uses a single NIC. Through the site router, the Edge connects out to the Xyte servers and connects to the devices on the LAN. The devices themselves never reach the internet.

This is the simplest and most common deployment. It suits any site where the devices sit on the same LAN as the Edge host, or on another subnet that the site router already routes to.

What the network has to provide

  • A default route from the Edge host to the internet, with eu1.edge.xyte.io:443 reachable.
  • A route from the Edge host's subnet to each device subnet, permitted by any firewall or ACL in between.

Connected VLANs

Connected VLANs — NIC1 faces the internet-facing router; NIC2 faces a router that serves LAN 1 and routes onward to LAN 2.

The Edge host uses two NICs. NIC1 faces the internet-facing router. NIC2 faces a router that serves LAN 1 and also routes onward to LAN 2.

Use this when device VLANs are routed to each other but are kept off the internet-facing network. The Edge only needs to be attached to one of them — the router on NIC2 handles the rest.

What the network has to provide

  • The default route on NIC1 only.
  • A static route on the Edge host for LAN 2's subnet, via the router on NIC2. LAN 1 is directly attached and needs no route; LAN 2 is not, and will otherwise be sent out the default gateway.
  • Routing between LAN 1 and LAN 2 permitted on the router serving NIC2.

Separate VLANs

Separate VLANs — NIC1 to the internet, NIC2 to LAN 1 and NIC3 to LAN 2; the two device VLANs have no route to each other.

The Edge host uses three NICs, one per network: NIC1 to the internet, NIC2 to LAN 1, NIC3 to LAN 2. LAN 1 and LAN 2 have no route to each other and no route to the internet.

Use this when device VLANs must stay fully isolated — from each other and from the outside — while still being monitored. The Edge host is multi-homed and reaches each VLAN directly on its own interface, so no traffic ever has to cross between them.

What the network has to provide

  • One IP address for the Edge host on each VLAN, static or reserved.
  • The default route on NIC1 only — LAN 1 and LAN 2 are directly attached and need no routes of their own. Only subnets sitting behind a router inside those VLANs need static routes.
  • IP forwarding left disabled on the host, so the Edge host does not become a path between the isolated VLANs.
👍

Adding another isolated VLAN is just another NIC. The pattern scales as far as the host has interfaces.

DMZ

DMZ — NIC1 sits in the internet-facing segment and NIC2 in an isolated device network; the Edge is the only crossing point.

The Edge host straddles a security boundary. NIC1 sits in the internet-facing (DMZ) segment. NIC2 sits in a device network that has no internet access of its own. The Edge is the only thing touching both networks — and because it never forwards between its interfaces, the device network stays unreachable from outside.

This is the strictest posture, and usually the one security teams ask for:

  • The device network needs no internet access, no outbound firewall rules and no NAT. Devices never leave their own segment.
  • Only the Edge host is permitted outbound, and only on 443 to the Xyte endpoints.
  • Nothing on the internet can reach the devices. The Edge accepts no inbound connections at all, so there is no path in even if the DMZ segment is compromised.

What the network has to provide

  • An address for the Edge host in the DMZ segment (NIC1) and one in the device network (NIC2).
  • The default route on NIC1, pointing at the DMZ router.
  • IP forwarding left disabled on the host — this is what keeps the boundary intact.

Updated 6 days ago

What’s Next

Did this page help you?