FireSight OT · serial consoles
Remote serial console access for routers, switches and PLCs
When a router loses its configuration or a switch stops answering on the network, the console port is often the only way back in. New in FireSight OT 0.3.0, the Cloud Connector gives you remote serial console access: plug in a USB console cable, and reach the device's console from a browser or your usual terminal, with the same grants and audit as every other machine.
Out-of-band management
Why remote serial console access matters
Remote access over the network only helps while the network works. A console port doesn't depend on the device's IP configuration, so it still answers when a bad change, a failed update or a lost password has cut the device off.
- Recover from a bad change to a router, switch or firewall without sending someone to site.
- Reach devices with no IP address yet, or whose management address is wrong.
- Get to service ports on drives and PLCs that only offer a serial connection.
- Recover a lost router password with a break signal at boot, from anywhere.
Hardware
What you can connect to the Cloud Connector
Serial consoles use ordinary USB serial adapters plugged into the Cloud Connector's USB ports. Each one becomes a console you can publish and grant like any other machine.
USB console cables
The vendor's own USB console cable, or a USB-to-RJ45 console cable for network equipment.
USB-to-RS232 adapters
For devices with a DB9 or terminal-block RS-232 port, such as older equipment and service ports.
What's on the other end
Routers, switches and firewalls, drives, and PLC service ports: anything with a serial console you would otherwise reach with a laptop on site.
Two ways in
Serial console in the browser, or in PuTTY and SecureCRT
A terminal window in the browser
Open the console from My access and a terminal opens in the browser. No client, no PuTTY and no drivers on your laptop. A Send break button sends a break signal, for router password recovery.
Your own terminal program
Prefer your own tools? The FireSight OT client, for Windows, macOS and Linux, connects PuTTY, SecureCRT or another terminal program to the console.
The same browser terminal also opens SSH and Telnet sessions, so one window covers the device's console and its network management.
Control
Remote console access with the same controls as everything else
A console port is powerful access. FireSight OT treats it that way.
- One person at a time. Only one person can use a console at once, so two engineers never type over each other.
- Granted like any machine. Nobody sees a console until it's granted to them, their division or their vendor account, with access hours and end dates for vendors.
- Session transcripts. Every browser console session is recorded as text, kept for 90 days and linked from the audit log for administrators.
- The site can switch it off. Sites can turn serial consoles off on their own Cloud Connector, whatever the Hub says.
- Outbound only. The Cloud Connector dials out to the Hub, so nothing at the site listens for connections from outside.
Putting it together
Out-of-band access for sites without a spare link
The whole point of out-of-band access is that it still works when the main network doesn't. A Cloud Connector with its own 4G/5G modem gives the console a path that doesn't depend on the router you are trying to fix.
Pair consoles with mobile data. See industrial remote access over 4G/5G, with mobile data saving for pay-as-you-go SIMs.
For PLCs on the network rather than the console, see secure PLC remote access. Questions about your equipment? Talk to us.
FAQ
Questions people ask
How do I get remote access to a serial console port?
Plug a USB console cable or a USB-to-RS232 adapter into the Cloud Connector at the site. The console then opens in a browser terminal, or in PuTTY or SecureCRT through the FireSight OT client.
Can I send a break signal for router password recovery?
Yes. The browser terminal has a Send break button.
Can two people use the same console at once?
No. Only one person can use a console at a time.
Are serial console sessions recorded?
Yes. Browser console sessions are recorded as text transcripts, kept for 90 days and linked from the audit log for administrators.
Can a site turn serial console access off?
Yes. Sites can switch serial consoles off on their own Cloud Connector.
See it on a test line
Tell us about your sites and who needs to reach them. We'll show you FireSight OT in a live demo Hub, with real machines behind a Cloud Connector.
