Give your machines easy names

Simple

Give each machine a name in Access Gate, like plc-line-1, that leads to its twin address. People reach it by name, and you change an address in one place.

4 min read · Last updated 2026-10-20

You give each machine a name in Access Gate, like plc-line-1. The name leads to the machine's twin address, so anyone who uses it goes through Access Gate. Nothing changes on the machines or your existing network.

Names are the base for protecting a machine you reach by its name, one of the ways to move machines one at a time. The recommended way to protect a whole subnet is still one rule on your router; names help with either.

Why names help

People remember them. plc-line-1 is easier than an address.
You change an address in one place. When a machine's address changes, you update one entry instead of hunting through settings across the site.
They allow certificates. SSL/TLS certificates are issued for a name, not an address.

Many plants do not use DNS for machines, because fixed addresses are easier to reason about. Here Access Gate runs the names itself, from the same inventory, so there is no extra server to set up.

1. Give a machine a name

Go to Asset → [Asset] and select the pencil icon.
Enter the prefix: the machine's name.

Configuring an asset's DNS prefix in Access Gate

The name now leads to the machine's twin address, so traffic sent to it goes through Access Gate rather than straight to the machine.

Asset details showing the resolved DNS name

2. Set the suffix once per zone

The end of the name comes from the machine's zone: its DNS name, under Settings → Zones. It is set once, when the zone is created, and every machine in that zone uses it. See Configure Zones for how to choose it.

The DNS name of a zone, set when the zone is created

3. Let people use the names

Computers need to ask Access Gate for these names. Either forward one subdomain from your company DNS to Access Gate, as in Protect a machine you reach by its name, or give a VLAN the Access Gate DNS server over DHCP, as in the Cisco Catalyst guide.

When names do not resolve

Access Gate answers DNS on its protection port, the interconnect to your router (100.65.0.6 in the examples). It has two ports in use: one admin, one interconnect. If a computer cannot reach the interconnect address, names do not resolve there: check that your router routes to it and that no firewall blocks DNS (port 53) on the way.

DNS servers Access Gate uses

The names above are the ones Access Gate answers. Access Gate also needs to ask a DNS server for its own needs: the NTP server name (time.google.com by default), the name of your directory server (for example ldaps://dc01.example.com), and update servers.

List those DNS servers under Settings → Networking → Integrated Services:

The change applies right away, without a reboot.
Access Gate asks all the listed servers at once, so list only servers that can answer for your internal names.
The lookups leave from the overlay port address (100.65.0.6 in the examples). Allow UDP 53 from that address to these servers.
With no server listed, Access Gate cannot resolve any name. The logs then show lookup <name> on [::1]:53: … cannot assign requested address, for example when it tries to reach its NTP server or a directory.

On a network without internet access, these DNS servers are also how Access Gate finds a local time source, see Configure NTP.