{"id":6392,"date":"2026-05-04T12:10:38","date_gmt":"2026-05-04T12:10:38","guid":{"rendered":"http:\/\/docs.connexite.co.uk\/index.php\/docs\/connexite-documentation\/connexgate-documentation\/connexgate-core-functional-modules\/"},"modified":"2026-05-04T12:19:11","modified_gmt":"2026-05-04T12:19:11","slug":"connexgate-core-functional-modules","status":"publish","type":"docs","link":"https:\/\/docs.connexite.co.uk\/index.php\/docs\/ot-security\/connexgate-documentation\/connexgate-core-functional-modules\/","title":{"rendered":"Core Functional Modules"},"content":{"rendered":"<h2 class=\"connexite-doc-h2\">Dashboard<\/h2>\n<p>This is the welcoming page and provides a high-level overview of system status, device information, and key metrics. In cases you browsed to other pages and need to return the dashboard, simply click &quot;Dashboard&quot; in the sidebar navigation.<\/p>\n<figure class=\"connexite-doc-figure wp-block-image\"><img decoding=\"async\" src=\"https:\/\/support.connexite.co.uk\/connexgate_images\/image6.png\" alt=\"Documentation figure\" loading=\"lazy\" \/><\/figure>\n<p>There are different cards with key informations:<\/p>\n<p>Key Information Displayed:<\/p>\n<ul class=\"connexite-doc-nested-list\">\n<li>Device Information:<\/li>\n<ul class=\"connexite-doc-nested-list\">\n<li>SKU (Stock Keeping Unit)<\/li>\n<li>Serial Number<\/li>\n<li>Hardware Version<\/li>\n<li>FID (Factory ID)<\/li>\n<\/ul>\n<li>System Overview:<\/li>\n<ul class=\"connexite-doc-nested-list\">\n<li>System Status (Running\/Stopped)<\/li>\n<li>Active Protocol (Modbus\/Profinet)<\/li>\n<li>Deployment Model (Proxy\/NAT)<\/li>\n<li>Shadow Servers count<\/li>\n<\/ul>\n<li>License Information:<\/li>\n<ul class=\"connexite-doc-nested-list\">\n<li>License Type<\/li>\n<li>License ID<\/li>\n<li>Device ID<\/li>\n<li>Enabled Models<\/li>\n<li>Enabled Protocols<\/li>\n<li>Expiry Date<\/li>\n<li>Validity Status<\/li>\n<\/ul>\n<li>Devices Summary:<\/li>\n<ul class=\"connexite-doc-nested-list\">\n<li>Total devices configured<\/li>\n<li>Shadow device status overview<\/li>\n<\/ul>\n<\/ul>\n<h2 class=\"connexite-doc-h2\">Device Management<\/h2>\n<p>ConnexGate allows collection of data from any real device and protecting them from attacks that may be harmful for operational purposes.<\/p>\n<p>Think about a real PLC device providing information to an HMI screen, without any security measures applied due to mismanagement, protocol nature or subjected to administrative abuse. Any harmful attack may take the PLC out of service, change its parameters or apply some write commands that would eventually interrupt or broke operation, or disturb machine configuration or calibration.<\/p>\n<p>ConnexGate is positioned in front of the PLC\/Sensor\/RTU devices, and serves as the shadow of the actual device, providing same registers\/tags. This makes any attack would be defended and absorbed by connexGate, preventing any operational loss and trigger alarms to inform administrators.<\/p>\n<p>Shadow devices are here to reflect and update the real values read from actual devices. You can use the same register\/datablock or start from zero for each shadow. Also it is possible to create more than one shadow per real device, spreading different information on separate shadows.<\/p>\n<p>**Shadow Architecture**<\/p>\n<p>To create a shadow device, first click &quot;Devices&quot; in the sidebar navigation. Proxy model must be enabled in license.<\/p>\n<p>Shadow module implements a server architecture for protocol-aware proxying. Each configured device has a corresponding server that:<\/p>\n<ul class=\"connexite-doc-nested-list\">\n<li>Listens on OT Network: Each shadow server binds to a unique port (starting from 5020) on the OT interface, appearing as a virtual PLC to clients on the OT network.<\/li>\n<li>Protocol Translation: The shadow server understands the protocol semantics (Modbus or Profinet) and transfer requests between the OT network and the actual PLC on the PLC network.<\/li>\n<li>Request Flow:<\/li>\n<li>Client on OT network connects to &lt;connexGate_OT_IP&gt;:&lt;Shadow_Port&gt;<\/li>\n<li>Shadow server receives and parses the protocol request<\/li>\n<li>Security checks are applied (IP ACL, command filtering)<\/li>\n<li>Request is replied by the information collected from actual PLC. Information collection is continuous and refresh in configured intervals.<\/li>\n<li>Protocol Support:<\/li>\n<ul class=\"connexite-doc-nested-list\">\n<li>Modbus TCP: Supports read\/write operations with function codes 1-4 (read), 5-6, 15-16 (write). Each device can have register intervals configured for polling and caching.<\/li>\n<li>Profinet (S7): Supports ISO-on-TCP protocol on port 102. Implements tag-based data management with polling and caching capabilities.<\/li>\n<\/ul>\n<li>Security Integration: Each shadow server integrates with:<\/li>\n<ul class=\"connexite-doc-nested-list\">\n<li>Command Filter: Validates read\/write permissions before forwarding requests<\/li>\n<li>IP ACL: Checks client IP against allow\/deny lists before accepting connections<\/li>\n<li>Request Logger: Logs all connection attempts and operations for audit<\/li>\n<\/ul>\n<li>Protocol Switching: The system supports single-protocol mode (default) or multi-protocol mode (if enabled in license). In single-protocol mode, all devices must use the same protocol. Protocol switching requires stopping all shadow servers and restarting with the new protocol.<\/li>\n<\/ul>\n<p>**Adding a Shadow Device**<\/p>\n<ul class=\"connexite-doc-nested-list\">\n<li>Click &quot;Add Device&quot; button<\/li>\n<\/ul>\n<figure class=\"connexite-doc-figure wp-block-image\"><img decoding=\"async\" src=\"https:\/\/support.connexite.co.uk\/connexgate_images\/image7.png\" alt=\"Documentation figure\" loading=\"lazy\" \/><\/figure>\n<ul class=\"connexite-doc-nested-list\">\n<li>Fill in device information:<\/li>\n<ul class=\"connexite-doc-nested-list\">\n<li>Name: Descriptive name for the device<\/li>\n<li>Protocol: Select Modbus or Profinet<\/li>\n<li>Backend IP: IP address of the actual PLC<\/li>\n<li>Backend Port: Port number (Defautl to 502 for Modbus and 102 for Profinet)<\/li>\n<li>Shadow Port: Port on OT side (auto-assigned starting from 5020)<\/li>\n<li>Select Allow Read and\/or Allow Write to interact with shadow device<\/li>\n<li>For Profinet devices only:<\/li>\n<li>Rack: S7 rack number (default: 0)<\/li>\n<li>Slot: S7 slot number (default: 1)<\/li>\n<li>Depending on the protocol selected user should add register or tags information to be read from actual device and served from the shadow device<\/li>\n<li>For Modbus:<\/li>\n<li>Click \u201cAdd Register Interval\u201d<\/li>\n<li>Select Register type<\/li>\n<li>Type Start Register number, count of register to be read and polling interval from actual device<\/li>\n<\/ul>\n<\/ul>\n<figure class=\"connexite-doc-figure wp-block-image\"><img decoding=\"async\" src=\"https:\/\/support.connexite.co.uk\/connexgate_images\/image8.png\" alt=\"Documentation figure\" loading=\"lazy\" \/><\/figure>\n<ul class=\"connexite-doc-nested-list\">\n<ul class=\"connexite-doc-nested-list\">\n<li>Repeat same actions to add more registers to the same shadow configuration<\/li>\n<li>Click add device to create shadow device<\/li>\n<li>For Profinet<\/li>\n<li>Fill all the informations needed, respectively, tag name, area, number (if DB area is selected) byte offset, data type and polling type.<\/li>\n<\/ul>\n<\/ul>\n<figure class=\"connexite-doc-figure wp-block-image\"><img decoding=\"async\" src=\"https:\/\/support.connexite.co.uk\/connexgate_images\/image9.png\" alt=\"Documentation figure\" loading=\"lazy\" \/><\/figure>\n<ul class=\"connexite-doc-nested-list\">\n<ul class=\"connexite-doc-nested-list\">\n<li>Click add tag. Tag would be shown on top, and an empty tag form will be shown.<\/li>\n<li>Once you add all the tags, click add device to create shadow device<\/li>\n<\/ul>\n<li>Devices will be listed by cards.<\/li>\n<li>Each card shows information about shadow devices status and its interacted real devices.<\/li>\n<li>Data button is used to show the latest data read from real device.<\/li>\n<\/ul>\n<figure class=\"connexite-doc-figure wp-block-image\"><img decoding=\"async\" src=\"https:\/\/support.connexite.co.uk\/connexgate_images\/image10.png\" alt=\"Documentation figure\" loading=\"lazy\" \/><\/figure>\n<ul class=\"connexite-doc-nested-list\">\n<li>Filter button is used to define IP addresses that would interact with shadow device<\/li>\n<\/ul>\n<figure class=\"connexite-doc-figure wp-block-image\"><img decoding=\"async\" src=\"https:\/\/support.connexite.co.uk\/connexgate_images\/image11.png\" alt=\"Documentation figure\" loading=\"lazy\" \/><\/figure>\n<ul class=\"connexite-doc-nested-list\">\n<li>You can add allowed and denied IP subnets to allow remote command access to the shadow servers.<\/li>\n<li>Clicking add button on either side, would open a text box to enter a single ip address, a subnet or an interval of IP addresses<\/li>\n<\/ul>\n<figure class=\"connexite-doc-figure wp-block-image\"><img decoding=\"async\" src=\"https:\/\/support.connexite.co.uk\/connexgate_images\/image12.png\" alt=\"Documentation figure\" loading=\"lazy\" \/><\/figure>\n<p>Delete button is self explained, and show a confirmation dialog to delete a shadow server<\/p>\n<p>Devices display status indicators shows either<\/p>\n<ul class=\"connexite-doc-nested-list\">\n<li>Running: Shadow server is active and accepting connections<\/li>\n<li>Stopped: Shadow server is not running<\/li>\n<\/ul>\n<p>Device Limits<\/p>\n<p>The system enforces license-based device limits. If the maximum number of devices is reached, you should delete an existing device before adding a new one.<\/p>\n<h2 class=\"connexite-doc-h2\">Forwarding Rules (NAT Mode)<\/h2>\n<p>Another deployment model of ConnexGate is to forward requests without any connection termination. This method allows sessions to be forwarded to backend PLC\/Sensor\/RTU device. Although this method is not providing same level of security with shadow servers, its easy of deployment helps real devices to be reachable within seconds. Even there is no session termination in this mode, ConnexGate still logs the requests and information returned from real device, providing detailed logs for remote collection and analysis.<\/p>\n<p>**Forwarding Architecture**<\/p>\n<p>To create rules for backend device forwarding, you should click the \u201cForwarding Rules\u201d menu item. NAT model must be enabled in license in order to configure new rules.<\/p>\n<p>Forwarding engine implements stateless port forwarding for transparent traffic flow between networks. Current implementation is configured to forward traffic from OT side to  PLC side, allowing any SCADA or similar systems to be able to retrieve data as they are usually running.<\/p>\n<p>Forwarding policy requires an IP address from the OT network interface IP range, to accept connections, and forward this request to any device on the PLC networks. Translation makes the requester IP seen as the ConnexGate PLC interface IP. Users can create separate translation rules, no matter backend real device is single or more.<\/p>\n<p>To configure a forwarding rule, click on the \u201cAdd Forwarding Rule\u201d button on the top right of the forwarding rules page.<\/p>\n<figure class=\"connexite-doc-figure wp-block-image\"><img decoding=\"async\" src=\"https:\/\/support.connexite.co.uk\/connexgate_images\/image13.png\" alt=\"Documentation figure\" loading=\"lazy\" \/><\/figure>\n<p>This would open a configuration modal, to enter all information needed for traffic flow. Users should fill all fields where only description is optional:<\/p>\n<figure class=\"connexite-doc-figure wp-block-image\"><img decoding=\"async\" src=\"https:\/\/support.connexite.co.uk\/connexgate_images\/image14.png\" alt=\"Documentation figure\" loading=\"lazy\" \/><\/figure>\n<ul class=\"connexite-doc-nested-list\">\n<li>Rule Name: Descriptive name for the rule<\/li>\n<li>OT Destination IP: IP address on OT side. This is the IP address where clients would connect and establish connections.<\/li>\n<li>PLC Destination IP: Actual PLC device IP address. All packets destined to OT destination IP, would be forwarded to this IP address.<\/li>\n<li>Protocol: TCP or UDP. Both modbus and profinet uses TCP protocol.<\/li>\n<li>Port: Port number to be forwarded. This would define which port client would send the requests.<\/li>\n<li>Description: This field is optional but highly encouraged to help distinguish rules<\/li>\n<li>Click &quot;Add Forwarding Rule&quot; to create the rule<\/li>\n<ul class=\"connexite-doc-nested-list\">\n<li>!!! It is important to have both OT and PLC links is up before configuring any forwarding rules. Please make sure that both network interface is up and ready for packet exchange. You can use ping tools to validate network connections. Once both side network is up, rules can be configured and applied.<\/li>\n<li>Rules are persistent and would be available in case of any power reset or reboot.<\/li>\n<\/ul>\n<\/ul>\n<p>**How NAT Rules Work**<\/p>\n<figure class=\"connexite-doc-figure wp-block-image\"><img decoding=\"async\" src=\"https:\/\/support.connexite.co.uk\/connexgate_images\/image15.png\" alt=\"Documentation figure\" loading=\"lazy\" \/><\/figure>\n<p>A typical forwarding scenario is running with the following steps:<\/p>\n<p>Requester initates the connection with its own IP as source and ConnexGate OT side IP as destination.<\/p>\n<p>Upon receiving ConnexGate translate the source IP to its PLC side interface IP and destination IP to PLC address.<\/p>\n<p>ConnexGate sends out packets from PLC side interface.<\/p>\n<p>PLC receives the packets as if they arrive from ConnexGate, and reply to ConnexGate PLC IP<\/p>\n<p>ConnexGate receives the reply, change the source IP to its OT side interface IP, desination IP to original requester IP, and sends out from OT side interface.<\/p>\n<p>This scenario is mostly applied where actual PLC IP address cannot be changed or where there are many PLC with the same IP addresses. Using ConnexGate would allow packet transmissions, without requiring any change on PLC configuration. Which is often very hard if not impossible.<\/p>\n<h2 class=\"connexite-doc-h2\">Network Configuration<\/h2>\n<p>There are two physical interfaces on ConnexGate (some devices may have different port configurations). Usually these two interface would face to OT network and PLC network. ConnexGate also support VPN configuration (currently only Wireguard is supported) that would allow it to be accessible from remote sites.<\/p>\n<p>Clicking &quot;Network&quot; in the sidebar navigation would open the network settings page.<\/p>\n<figure class=\"connexite-doc-figure wp-block-image\"><img decoding=\"async\" src=\"https:\/\/support.connexite.co.uk\/connexgate_images\/image16.png\" alt=\"Documentation figure\" loading=\"lazy\" \/><\/figure>\n<p>OT and PLC side configuration should be properly configured first, before creating any shadow device or forwarding rules. Any change in network configuration is instantly applied when clicked to \u201cSave Network Configuration\u201d button.<\/p>\n<p>!!! Administration interface is accessible from interface addresses. If you change interface addresses, you should reconnect to administration interface using new ip address. New URL would be https:\/\/&lt;new_ip_address&gt;:8080<\/p>\n<p>**Network Configuration**<\/p>\n<p>Network configruation fileds in the network page are mostly self-explained<\/p>\n<p>OT Side Configuration:<\/p>\n<ul class=\"connexite-doc-nested-list\">\n<li>IP Address: Static IP address for OT interface<\/li>\n<li>Subnet Mask: Network mask<\/li>\n<li>Gateway: Default gateway (this is the gateway to other networks)<\/li>\n<\/ul>\n<p>PLC Side Configuration:<\/p>\n<ul class=\"connexite-doc-nested-list\">\n<li>IP Address: Static IP address for PLC interface<\/li>\n<li>Subnet Mask: Network mask<\/li>\n<\/ul>\n<p>DNS Configuration:<\/p>\n<ul class=\"connexite-doc-nested-list\">\n<li>DNS Servers: Comma-separated list of DNS server IP addresses<\/li>\n<\/ul>\n<p>**VPN Configuration**<\/p>\n<p>ConnexGate is supporting Wireguard as VPN connectivity. OpenVPN and IPSec support would be added in the upcoming releases.<\/p>\n<p>VPN connectivity would be important, if backend PLC devices would be managed remotely. Since many OT protocol lacks proper encryption, VPN usage would be very important on remote connections.<\/p>\n<p>Users should copy their Wireguard configuration into the \u201cWireguard Configuration\u201d box. Clicking \u201cSave Configuration\u201d would install the wireguard configuration for permanent use.<\/p>\n<p>Configuration is not activated automatically. User should click \u201cConnect\u201d button to activate the tunnel. There is an \u201cAuto Connect\u201d button to restore the connection in case of any failure, such as remote server failure, power shortage or wide area access.<\/p>\n<h2 class=\"connexite-doc-h2\">System Status<\/h2>\n<p>System Status page show raw system information, network interface status, protocols, active shadows and system health. This page is showing raw data, retrieved from core modules directly. These information is important while troubleshooting or opening a service request. .<\/p>\n<p>Information Displayed:<\/p>\n<ul class=\"connexite-doc-nested-list\">\n<li>System Information:<\/li>\n<li>Deployment Model<\/li>\n<ul class=\"connexite-doc-nested-list\">\n<li>Status (Running\/Stopped)<\/li>\n<li>Active Protocols<\/li>\n<li>Shadow Servers<\/li>\n<\/ul>\n<li>Network Interfaces (Raw Data):<\/li>\n<ul class=\"connexite-doc-nested-list\">\n<li>OT Interface: Name, IP address, status<\/li>\n<li>PLC Interface: Name, IP address, status<\/li>\n<\/ul>\n<\/ul>\n<h2 class=\"connexite-doc-h2\">Logging<\/h2>\n<p>ConnexGate provides detailed logs of all requests to shadow servers and requests forwarded to backend devices.<\/p>\n<p>The Logging system provides multi-layered logging capabilities<\/p>\n<p>**Firewall Logs**<\/p>\n<ul class=\"connexite-doc-nested-list\">\n<ul class=\"connexite-doc-nested-list\">\n<li>Tracks all connection attempts to shadow servers. Each log entry includes:<\/li>\n<li>Timestamp, device ID, client IP, action (allowed\/denied), protocol, and reason<\/li>\n<li>Logs are stored in memory with configurable limits and can be cleared<\/li>\n<li>Integration with IP ACL and command filtering for security event logging<\/li>\n<\/ul>\n<\/ul>\n<p>Firewall log table consist of following items with filtering options<\/p>\n<ul class=\"connexite-doc-nested-list\">\n<li>Filtering: Filter by device ID, client IP, action (allowed\/denied), protocol<\/li>\n<li>Real-time Updates: Logs refresh automatically<\/li>\n<li>Statistics: Total logs, allowed count, denied count, unique IPs, unique devices<\/li>\n<li>Clear Logs: Button to clear all firewall logs<\/li>\n<li>Log Information<\/li>\n<ul class=\"connexite-doc-nested-list\">\n<li>Timestamp<\/li>\n<li>Device ID<\/li>\n<li>Client IP<\/li>\n<li>Action (Allowed\/Denied)<\/li>\n<li>Protocol<\/li>\n<li>Details<\/li>\n<\/ul>\n<\/ul>\n<p>**Request Logs**<\/p>\n<ul class=\"connexite-doc-nested-list\">\n<li>These are forwarding logs, that are not terminated on the ConnexGate but only forwarded through it. ConnexGate uses intelligent packet inspections, to identify the requests and create logs for each of them.<\/li>\n<ul class=\"connexite-doc-nested-list\">\n<li>Modbus\/TCP Parsing: Parses Modbus Application Data Units (ADU), extracting transaction IDs, unit IDs, function codes, and register addresses. Correlates requests with responses using transaction IDs.<\/li>\n<li>S7\/Profinet Parsing: Parses ISO-on-TCP protocol (TPKT\/COTP layers) and S7 protocol, extracting function codes, data block numbers, and offsets. Handles fragmented packets and correlates requests\/responses using PDU references.<\/li>\n<li>Flow Tracking: Maintains bidirectional flow tracking (client \u2194 server) to match requests with responses<\/li>\n<li>Protocol Decoding: Decodes register values (Modbus) and data block values (S7) for human-readable display<\/li>\n<\/ul>\n<\/ul>\n<p>Request log table consist of following items with filtering options<\/p>\n<p>Features:<\/p>\n<ul class=\"connexite-doc-nested-list\">\n<li>Pagination: Limit and offset for large log sets<\/li>\n<li>Real-time Updates: Logs refresh automatically<\/li>\n<li>Clear Logs: Button to clear all request logs<\/li>\n<li>Log Information:<\/li>\n<ul class=\"connexite-doc-nested-list\">\n<li>Timestamp<\/li>\n<li>Source IP<\/li>\n<li>Destination IP<\/li>\n<li>Protocol<\/li>\n<li>Request\/Response details<\/li>\n<li>Parsed protocol information<\/li>\n<\/ul>\n<li>Logs are stored in a rotating file-based storage in addition to in-memory buffer. Current log storage is 100MB which is very large for OT protocol traffic.<\/li>\n<\/ul>\n<p>**Remote Logging**<\/p>\n<p>Logs created in ConnexGate would be sent out to a remote collector using syslog or mqtt protocols.<\/p>\n<ul class=\"connexite-doc-nested-list\">\n<li>Syslog feature sends out logs via UDP to syslog servers. Supports configurable severity levels for different log types.<\/li>\n<li>MQTT is used to connect any broker using asynchronous MQTT publishing. It supports;<\/li>\n<ul class=\"connexite-doc-nested-list\">\n<li>TLS\/SSL encryption (port 8883) with certificate-based authentication<\/li>\n<li>Username\/password authentication<\/li>\n<li>Automatic reconnection with exponential backoff<\/li>\n<li>Connection status tracking and statistics<\/li>\n<li>JSON-formatted log messages published to configurable topics<\/li>\n<\/ul>\n<\/ul>\n<p>**Logging Settings**<\/p>\n<p>Purpose: Configure remote logging to Syslog and MQTT brokers.<\/p>\n<p>Syslog Configuration:<\/p>\n<ul class=\"connexite-doc-nested-list\">\n<li>Enabled: Enable\/disable Syslog logging<\/li>\n<li>Host: Syslog server IP address or hostname<\/li>\n<li>Port: Syslog port (default: 514)<\/li>\n<li>Severity Levels: Configure severity for firewall allowed, denied, and request logs<\/li>\n<\/ul>\n<figure class=\"connexite-doc-figure wp-block-image\"><img decoding=\"async\" src=\"https:\/\/support.connexite.co.uk\/connexgate_images\/setting-syslog.png\" alt=\"Syslog configuration\" loading=\"lazy\" \/><figcaption>Syslog configuration<\/figcaption><\/figure>\n<p>MQTT Configuration:<\/p>\n<ul class=\"connexite-doc-nested-list\">\n<li>Enabled: Enable\/disable MQTT logging<\/li>\n<li>Broker: MQTT broker IP address or hostname<\/li>\n<li>Port: MQTT port (1883 for non-TLS, 8883 for TLS)<\/li>\n<li>Topic: MQTT topic for log messages<\/li>\n<li>Username\/Password: Authentication credentials (optional)<\/li>\n<li>TLS Certificates: CA certificate, client certificate, and key files (for TLS)<\/li>\n<li>Connection Status: Real-time connection status and statistics<\/li>\n<li>Manual Connect\/Disconnect: Buttons to manually control MQTT connection<\/li>\n<\/ul>\n<figure class=\"connexite-doc-figure wp-block-image\"><img decoding=\"async\" src=\"https:\/\/support.connexite.co.uk\/connexgate_images\/settings-mqtt.png\" alt=\"MQTT configuration\" loading=\"lazy\" \/><figcaption>MQTT configuration<\/figcaption><\/figure>\n<p>MQTT Status Information:<\/p>\n<ul class=\"connexite-doc-nested-list\">\n<li>Connection status (Connected\/Disconnected)<\/li>\n<li>Broker and port<\/li>\n<li>Client ID<\/li>\n<li>Last connect\/disconnect times<\/li>\n<li>Last error and error time<\/li>\n<li>Connection attempts<\/li>\n<li>Messages sent\/failed<\/li>\n<li>TLS status<\/li>\n<\/ul>\n<p>Saving Settings:<\/p>\n<ul class=\"connexite-doc-nested-list\">\n<li>Configure Syslog and\/or MQTT settings<\/li>\n<li>Click &quot;Save Remote Logging Settings&quot;<\/li>\n<li>Settings are applied immediately<\/li>\n<li>MQTT connection is established automatically if enabled<\/li>\n<\/ul>\n<h2 class=\"connexite-doc-h2\">License Management<\/h2>\n<p>Purpose: View license information, activate licenses, and manage device keys.<\/p>\n<p>Access: Click &quot;License&quot; in the sidebar navigation.<\/p>\n<figure class=\"connexite-doc-figure wp-block-image\"><img decoding=\"async\" src=\"https:\/\/support.connexite.co.uk\/connexgate_images\/license.png\" alt=\"License management\" loading=\"lazy\" \/><figcaption>License management<\/figcaption><\/figure>\n<p>Technical Implementation<\/p>\n<p>The License Management system implements a cryptographic license validation system:<\/p>\n<ul class=\"connexite-doc-nested-list\">\n<li>License Structure: Licenses are JSON files containing:<\/li>\n<li>License metadata (ID, type, expiry date)<\/li>\n<li>Feature flags (enabled models: proxy\/nat, enabled protocols: modbus\/profinet)<\/li>\n<li>Resource limits (max devices, max shadow servers)<\/li>\n<li>Cryptographic signature for tamper detection<\/li>\n<li>Device Keys: Each device has a unique RSA key pair:<\/li>\n<li>Private Key: Stored securely at \/etc\/connexgate\/license\/device_private_key.pem (not transmitted)<\/li>\n<li>Public Key: Used for license generation, can be shared with license server<\/li>\n<li>Keys are generated based on device serial number for device binding<\/li>\n<li>License Activation:<\/li>\n<li>HMAC-based: Simple license keys with HMAC signature validation<\/li>\n<li>Device-specific encrypted: Licenses encrypted with device public key, decrypted with private key<\/li>\n<li>License server generates licenses based on device public key and requested features<\/li>\n<li>Feature Gating: The LicenseManager class validates licenses on:<\/li>\n<li>System startup<\/li>\n<li>Configuration changes<\/li>\n<li>Periodic intervals (hourly)<\/li>\n<li>API endpoint access (returns 403 if feature not licensed)<\/li>\n<li>Service Integration: When licenses are activated:<\/li>\n<li>NAT engine automatically starts if NAT model is enabled<\/li>\n<li>Packet capture service initializes if NAT is enabled<\/li>\n<li>Proxy engine starts if proxy model is enabled<\/li>\n<li>UI elements are enabled\/disabled based on license features<\/li>\n<\/ul>\n<p>License Information<\/p>\n<figure class=\"connexite-doc-figure wp-block-image\"><img decoding=\"async\" src=\"https:\/\/support.connexite.co.uk\/connexgate_images\/license-current.png\" alt=\"License information and activation\" loading=\"lazy\" \/><figcaption>License information and activation<\/figcaption><\/figure>\n<p>Displayed Information:<\/p>\n<ul class=\"connexite-doc-nested-list\">\n<li>License Type (tier1, tier2, tier3, tier4)<\/li>\n<li>License ID<\/li>\n<li>Device ID (Serial Number)<\/li>\n<li>Enabled Models (proxy, nat)<\/li>\n<li>Enabled Protocols (modbus, profinet)<\/li>\n<li>Expiry Date<\/li>\n<li>Validity Status (Valid\/Invalid\/Expired)<\/li>\n<\/ul>\n<p>Device Keys Status<\/p>\n<p>Status Indicators:<\/p>\n<ul class=\"connexite-doc-nested-list\">\n<li>\u2713 Factory Keys Loaded: Device keys are present and loaded<\/li>\n<li>\u2717 Factory Keys Not Loaded: Device keys are missing<\/li>\n<\/ul>\n<p>Reload Keys: Button to reload device keys from disk (useful if keys were generated after application startup).<\/p>\n<p>Activating a License<\/p>\n<p>Method 1: Request from License Server<\/p>\n<ul class=\"connexite-doc-nested-list\">\n<li>Ensure device keys are loaded (generate if needed)<\/li>\n<li>Click &quot;Request License from Server&quot;<\/li>\n<li>Enter license server URL (default: http:\/\/192.168.255.191:8001)<\/li>\n<li>Enter required information:<\/li>\n<li>License Type: tier1, tier2, tier3, or tier4 (REQUIRED)<\/li>\n<li>Enabled Models: Array of models (e.g., [&quot;proxy&quot;, &quot;nat&quot;])<\/li>\n<li>Enabled Protocols: Array of protocols (e.g., [&quot;modbus&quot;, &quot;profinet&quot;])<\/li>\n<li>Max Devices: Maximum number of devices (optional)<\/li>\n<li>Max Servers: Maximum number of shadow servers (optional)<\/li>\n<li>Expiry Date: License expiration date in YYYY-MM-DD format (optional)<\/li>\n<li>Click &quot;Request License&quot;<\/li>\n<li>License is automatically received and activated<\/li>\n<\/ul>\n<p>Method 2: Activate with License Key<\/p>\n<ul class=\"connexite-doc-nested-list\">\n<li>Obtain encrypted license key from license provider<\/li>\n<li>Paste license key into &quot;License Key&quot; field<\/li>\n<li>Click &quot;Activate License&quot;<\/li>\n<li>License is validated and activated<\/li>\n<\/ul>\n<p>After Activation:<\/p>\n<ul class=\"connexite-doc-nested-list\">\n<li>NAT engine and packet capture service are automatically started if NAT model is enabled<\/li>\n<li>Enabled features become available in the UI<\/li>\n<li>License information is updated<\/li>\n<\/ul>\n<h2 class=\"connexite-doc-h2\">Troubleshooting<\/h2>\n<p>ConnexGate troubleshooting options provide tools to check network connectivity and packet flows, to diagnose network related issues and control proper delivery of packets for detailed analysis.<\/p>\n<p>Clicking &quot;Troubleshooting&quot; in the sidebar navigation would show two tab for ping and packet capture tools.<\/p>\n<p>**Ping Tool**<\/p>\n<p>Ping tool is used to test network connectivity to hosts. This is the default tab for troubleshooting section:<\/p>\n<figure class=\"connexite-doc-figure wp-block-image\"><img decoding=\"async\" src=\"https:\/\/support.connexite.co.uk\/connexgate_images\/image3.png\" alt=\"Documentation figure\" loading=\"lazy\" \/><\/figure>\n<p>To start a ping test;<\/p>\n<ul class=\"connexite-doc-nested-list\">\n<li>Enter target host (IP address or hostname)<\/li>\n<li>Select network interface (optional, default: OT interface)<\/li>\n<li>Configure:<\/li>\n<ul class=\"connexite-doc-nested-list\">\n<li>Count: Number of ping packets (1-100, default: 4)<\/li>\n<li>Timeout: Timeout per packet in seconds (1-60, default: 5)<\/li>\n<\/ul>\n<li>Click &quot;Ping&quot;<\/li>\n<li>Ping results will be shown on the text box right belowe the configuration card with detailed informations such as success status, packet transmitted\/received, loss percentage, statistics, and full linux like ping output<\/li>\n<\/ul>\n<figure class=\"connexite-doc-figure wp-block-image\"><img decoding=\"async\" src=\"https:\/\/support.connexite.co.uk\/connexgate_images\/image4.png\" alt=\"Documentation figure\" loading=\"lazy\" \/><\/figure>\n<p>**Packet Capture**<\/p>\n<p>This tab is used to capture network packets for analysis:<\/p>\n<figure class=\"connexite-doc-figure wp-block-image\"><img decoding=\"async\" src=\"https:\/\/support.connexite.co.uk\/connexgate_images\/image5.png\" alt=\"Documentation figure\" loading=\"lazy\" \/><\/figure>\n<p>To start a capture session<\/p>\n<ul class=\"connexite-doc-nested-list\">\n<li>Select network interface<\/li>\n<li>Configure filter (optional tcpdump filtering format, e.g., &quot;tcp port 502&quot; for Modbus)<\/li>\n<li>Set packet count (default: 10) or duration (seconds)<\/li>\n<li>Click &quot;Start Capture&quot;. Captured packets would be shown in real time<\/li>\n<li>Click &quot;Stop Capture&quot; to end capture<\/li>\n<li>Note: Packet capture may impact system performance. Administrators should use it for limited time period when necessary.<\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>OT\/ICS \u203a Security<\/p>\n","protected":false},"author":1,"featured_media":0,"parent":6387,"menu_order":5,"comment_status":"open","ping_status":"closed","template":"","doc_tag":[118,115,120],"class_list":["post-6392","docs","type-docs","status-publish","hentry","doc_tag-connexgate-documentation","doc_tag-connexite","doc_tag-ot-security","no-post-thumbnail"],"acf":[],"_links":{"self":[{"href":"https:\/\/docs.connexite.co.uk\/index.php\/wp-json\/wp\/v2\/docs\/6392","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/docs.connexite.co.uk\/index.php\/wp-json\/wp\/v2\/docs"}],"about":[{"href":"https:\/\/docs.connexite.co.uk\/index.php\/wp-json\/wp\/v2\/types\/docs"}],"author":[{"embeddable":true,"href":"https:\/\/docs.connexite.co.uk\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/docs.connexite.co.uk\/index.php\/wp-json\/wp\/v2\/comments?post=6392"}],"version-history":[{"count":1,"href":"https:\/\/docs.connexite.co.uk\/index.php\/wp-json\/wp\/v2\/docs\/6392\/revisions"}],"predecessor-version":[{"id":6440,"href":"https:\/\/docs.connexite.co.uk\/index.php\/wp-json\/wp\/v2\/docs\/6392\/revisions\/6440"}],"up":[{"embeddable":true,"href":"https:\/\/docs.connexite.co.uk\/index.php\/wp-json\/wp\/v2\/docs\/6387"}],"wp:attachment":[{"href":"https:\/\/docs.connexite.co.uk\/index.php\/wp-json\/wp\/v2\/media?parent=6392"}],"wp:term":[{"taxonomy":"doc_tag","embeddable":true,"href":"https:\/\/docs.connexite.co.uk\/index.php\/wp-json\/wp\/v2\/doc_tag?post=6392"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}