FireSight

FireSight OT · secure remote access for machine networks

Reach every machine. Open nothing at the site.

FireSight OT gives engineers, maintenance teams and machine builders remote access to PLCs, HMIs and engineering PCs on the plant floor. A small Cloud Connector in each machine network dials out to your Cloud Hub, and people are brokered through to exactly the machines they've been granted. It's built for lines that are copies of each other, where every site uses the same addresses.

Talk to us about OT Read the OT guides

Early access  Ask us about a pilot site.

The engineer's Modbus tool talks to 127.0.0.1. The site's firewall never accepts a connection from outside.

FireSight OT architecture, wide viewPeople (an engineer in a browser, a machine builder and a maintenance technician with the fsot client) connect to the Cloud Hub over HTTPS. The Hub handles sign-in and two-factor, grants per person, 1:1 subnet mapping, port forwards and VPN, a file store for backups and the audit log. Three sites each have a Cloud Connector that dials out to the Hub over TLS. Sites A and B both use 192.168.1.0/24 and are mapped to 10.200.3.0/24 and 10.200.4.0/24; site C reaches the Hub through its HTTP proxy. PEOPLE CLOUD HUB MACHINE NETWORKS Engineerbrowser · Line 3 HMI Machine builderfsot client · Mon–Fri 07–18 Maintenancefsot client · RDP, Modbus HTTPS 443 Cloud Hub hub.example.com Sign-in and two-factorTOTP Grants per machinenone by default 1:1 subnet mapping10.200.0.0/16 Port forwards and VPNoptional File store for backupsSFTP · S3 Audit logevery session outbound TLS outbound TLS via site proxy Site A · Milan192.168.1.0/24 Cloud ConnectorCC-4 PLC .20:502 · HMI .30:80→ 10.200.3.0/24 Site B · Brno192.168.1.0/24 Cloud ConnectorCC-5 PLC .20:502 · HMI .30:80→ 10.200.4.0/24 Site C · Lyon10.50.0.0/24 Cloud ConnectorCC-3 Robot cell .15:22 · PC .10:3389unique, real addresses FireSight OT architecturePeople connect to the Cloud Hub over HTTPS. The Hub handles sign-in and two-factor, grants per machine, 1:1 subnet mapping, port forwards and VPN, a file store for backups and the audit log. Every site's Cloud Connector dials out to the Hub. Sites A and B both use 192.168.1.0/24 and are mapped to 10.200.3.0/24 and 10.200.4.0/24; site C uses 10.50.0.0/24 and reaches the Hub through its proxy. Peopleengineers, machine builders, maintenance HTTPS 443 Cloud Hubhub.example.com Sign-in and two-factorTOTP Grants per machinenone by default 1:1 subnet mapping10.200.0.0/16 Port forwards and VPNoptional File store for backupsSFTP · S3 Audit logevery session outbound from every site Site A · Milan192.168.1.0/24Cloud ConnectorCC-4PLC .20:502 · HMI .30:80→ 10.200.3.0/24 Site B · Brno192.168.1.0/24Cloud ConnectorCC-5PLC .20:502 · HMI .30:80→ 10.200.4.0/24 Site C · Lyon10.50.0.0/24Cloud ConnectorCC-3 · via proxyRobot cell .15:22 · PC .10:3389unique, real addresses

Every arrow points at the Hub. Cloud Connectors only ever connect out, over TLS on port 443 (or 8443, or through the site's HTTP proxy), so no site needs an inbound firewall rule or a public address.

The problem

Remote access to the plant floor is usually the weakest link

01

Every line looks the same

Machine builders ship identical lines, so plant after plant uses 192.168.1.0/24. A normal VPN can't route to two networks with the same addresses.

02

Vendors need in, briefly

The machine builder needs one PLC, during working hours, for a week. Shared VPN accounts and remote desktop tools left running give them far more, for far longer.

03

Sites won't open firewalls

OT networks sit behind NAT, plant firewalls and proxies, often with nobody on site to change them. Inbound rules and port forwards to machines are exactly what security teams refuse.

Duplicated networks

Same addresses at every site. No renumbering.

Each site's real subnet gets its own virtual subnet on the Hub, from a pool you choose. Address .20 in Milan and .20 in Brno stay as they are on the plant floor, and become two different addresses on the Hub.

  • People and resources can use the real or the virtual address; the connector decides which site it reaches.
  • Masquerade by default: machines see the Cloud Connector's own address, so no PLC or HMI needs a route back.
  • The full-network VPN uses the same mapping, and is still limited to the networks a person has been granted.
1:1 subnet mappingSite A in Milan and site B in Brno both use 192.168.1.20 for the PLC, .30 for the HMI and .10 for the engineering PC. On the Hub, Milan becomes 10.200.3.20, .30 and .10, and Brno becomes 10.200.4.20, .30 and .10. AT THE SITE ON THE HUB Milan 192.168.1.20PLC 192.168.1.30HMI 192.168.1.10PC Milan 10.200.3.2010.200.3.3010.200.3.10 1:1 Brno 192.168.1.20PLC 192.168.1.30HMI 192.168.1.10PC Brno 10.200.4.2010.200.4.3010.200.4.10 1:1

What it does

Everything a plant needs from remote access, and nothing more

Access per machine

Nobody sees anything until it's granted: one machine, or everything on a Cloud Connector, to a division, a vendor or one person.

Web HMIs in the browser

Open an HMI or a machine's web page straight from My access. No client, no plug-in, no VPN.

Any TCP tool

The fsot client tunnels RDP, VNC, SSH, Telnet, Modbus, OPC UA, S7 and vendor engineering software to a local port, on Windows, macOS and Linux.

Divisions and vendors

Split each customer into plants, lines and outside vendors. Vendor accounts need two-factor, can have an end date and working hours, and are cut off when time is up.

Files off the plant floor

Machines upload logs and recipes over SFTP or FTP to their Cloud Connector, upload only. Staff download them on the Hub, and the customer's backup software collects copies over SFTP or S3.

Remote management

Status, diagnostics, logs, ping and port tests from the site, signed software updates, certificate renewal, restart and revoke, from the console or the command line.

One image for every site

Flash the same SD card image for everyone. A one-time enrollment code in firesight.txt ties the device to its customer and site, then wipes itself.

Fits the site's network

One port, two ports to keep the plant apart from the uplink, or Wi-Fi uplink with Ethernet to the machines, with Wi-Fi as a backup. Remote changes roll back if the Hub is lost.

Every session recorded

Sign-ins, sessions, grants, file transfers and remote commands go to the audit log with the person's division or vendor, exportable as CSV.

A new site

From the box to online in about a minute

The installer at the site needs no network knowledge beyond an IP address, and nobody has to change the site's firewall.

  1. Add the connector

    In the Hub, add a Cloud Connector for the customer and site, with its machine subnet if it's used elsewhere too.

  2. Drop in firesight.txt

    Download firesight.txt with the enrollment code (and a fixed address or Wi-Fi if needed) and copy it onto the SD card.

  3. Power it up

    Cable the Cloud Connector to the machine network and the uplink, and power it. It makes its own key and gets its certificate.

  4. Publish and grant

    It shows Online. Publish the HMI, the engineering PC and the PLC port, and grant them to the people who need them.

For engineers

Your own tools, pointed at 127.0.0.1

Double-click the client and pick a machine. Remote Desktop and VNC open by themselves; for everything else, point your engineering software at the local port the client gives you.

  • A full-screen terminal view, or fsot ui for a point-and-click window.
  • Save the connections you use every day as port forwards and start them all at once.
  • Web HMIs need nothing installed at all.
# sign in once
$ fsot login https://hub.example.com
$ fsot ls
  Line 3 HMI            web    Milan
  Line 3 engineering PC rdp    Milan
  Press 4 PLC           tcp    Milan  192.168.1.20:502

# Remote Desktop opens by itself
$ fsot connect "Line 3 engineering PC" --open

# your Modbus tool talks to the local port
$ fsot connect "Press 4 PLC" --local 127.0.0.1:15020
  Press 4 PLC  →  127.0.0.1:15020

Security

Built so the plant floor stays closed

  • Outbound only. Cloud Connectors never accept a connection from outside.
  • Mutual TLS with a certificate per device from the Hub's own authority, renewed automatically. TLS 1.3 only by default.
  • The site has the last word. A list on the device caps which machines the Hub may reach, and the Hub can't widen it.
  • Signed updates (Ed25519); a connector refuses anything unsigned.
  • Two-factor for everyone if you choose, and always for vendors. Source networks, session and idle limits, and tunnels per person.
  • Revoke a lost or stolen device and its certificate stops working at once.

Licensing

Licensed through the same portal as FireSight

LicenseCovers
Hub licenseA number of Cloud Connectors on your Hub. On a shared Hub it can be meant for one customer.
Device licenseOne Cloud Connector, on any Hub, bound to its serial. Ideal for machines sold with remote support built in.
Evaluation30 days, up to 3 Cloud Connectors.

A lapsed license never strands a device: remote management, updates, certificate renewal and file storage keep working.

Bring your first site online

Tell us about your plants, your machine builders and how they get in today. We'll show you FireSight OT on a test line and talk through a pilot.

Talk to us about OT Read the OT guides