Protect a machine with an enclave

An enclave is a group of machines plus the people and systems allowed to reach them. You add your machines to the inventory, put them in an enclave, and allow only the flows they need. Nothing is blocked until you approve: Access Gate starts in a dry run.

In this example, we protect a picking robot. Two flows must keep working:

1. The CAM server sends jobs to the robot.
2. The robot sends progress data to the historian.

Before you start

Access Gate gives each machine a twin address beside its real one. Check that its address ranges match your network: open the Settings page, then the Networking tab.

In this example, your machines use 10.0.0.0/16 (for example 10.0.0.1 or 10.254.23.45), and the twin addresses use 100.64.0.0/16. If your addresses are different, the steps are the same, as long as this screen matches your network.

Subnets in Access Gate settings

1. Add your machines to the inventory

Find the machine in Monitor if you need its address, then register it in Assets. See Build your asset inventory.

1. Open the Assets page in the left bar.
2. Click Create Asset, top right.
3. Give it a name you recognize, for example CUI Server, PLC32, HMI.
4. Add its IP address.
5. If other systems connect to it, add the services it runs.
6. Click Save.

Open the machine to add more detail.

• Edit overview: location, installation date, description, risk level.
• Edit network: DNS name, other IPs or services, and remote access methods.

2. Create the enclave

1. Open the Enclaves page and create an enclave. Name it Robot Picking Workshop, set the security level to Important, and add a description.
2. Click Save.

3. Add machines and people

1. Open the enclave and click Edit principals.
2. Add the CAM server, the robot's modbus/tcp service and the historian's mqtt service. Add users here too if people need to reach these machines.

To secure the historian's MQTT broker further, with sign-in, topic limits and encryption, see Configure MQTT flows.

4. Allow the flows you need

In the enclave's table, allow the two flows: from the CAM server to the robot, and from the robot to the historian. Everything you do not allow stays blocked.

The CAM server now sends jobs to the robot at kuka.fabcore.tr-sec.net.

5. Write down why

For your team and for auditors, note why these flows are allowed. Click Edit Overview and fill in the Description, for example:

Robot picking on the loading bay. Rules allow for: 1. Job submission from the CAM server 2. Data logging to historian

What you have now

• Your machines are in the inventory, and Access Gate watches their traffic.
• An enclave says who may reach them, and the reason is written down.

Enclaves are lightweight, so create as many as your plant needs: one per production cell, or one for your CUI systems. Access Gate keeps watching the traffic, so you quickly see how people use these machines.