Quick start

With two Ethernet cables, connect the Access Gate to two ports of your existing router.

First connection: the overlay

The first connection creates the overlay, the dedicated route that assets will later use to secure their communication. We recommend:

1. Create a network 100.65.0.1/29 on your router, with the gateway (your existing router) at 100.65.0.1 and the Access Gate overlay port at 100.65.0.6.
2. Add a route for IPs in the 100.64.0.0/16 range with a gateway of 100.65.0.6. This route pushes all overlay packets to the Access Gate for proxying and routing.
3. Connect an Ethernet cable between the port you configured and the overlay port of the Access Gate (most often port 1).

That reserved 100.64.0.0/16 range is your Secure Twin: a parallel address space where you bring assets under secure communication one at a time, with no change to production. You give each asset a DNS name so it is reachable by URL (see Configuring Access Gate DNS).

Second connection: the admin interface

The second connection attaches the Access Gate admin interface to your admin network.

1. Connect an Ethernet cable between a port on your router (or switch) tied to the admin network and the admin port of the Access Gate (most often port 5).
2. If that network hands out DHCP leases, the admin interface receives an IP automatically. Otherwise it defaults to 10.0.0.1 after about a minute.

What you achieved at this step

Access the admin interface

1. Open a web browser and navigate to the Access Gate admin IP: https://{ip} (the one tied to the second cable above).
2. Accept the self-signed certificate warning (we'll configure proper TLS later).
3. Log in with the default credentials: Username: admin, password: hello.

Secure the account

1. Once connected, head to Settings → Accounts.
2. Change the admin password.
3. Create a dedicated user for yourself with the adequate permission levels.

Now comes the interesting part: seeing what is actually on your network.

The Access Gate discovers assets passively from the traffic on the port span you monitor. It observes flows and builds a live picture of your devices, their protocols, and how they talk to each other, with no active scanning that could disturb fragile OT equipment.

Register assets

1. From the Monitor tab, click Register Asset on an unknown device to add it to your inventory.
2. Fill in the name of the asset.
3. Head to the Asset tab to see the inventory populate.

For each asset you can add more detail, name, serial, risk level, and more, by clicking the pencil icon.

The overlay and the Secure Twin are already in place from Step 1, so you can go straight to creating the enclave that will protect your sensitive assets.

Create the enclave

1. Navigate to Enclaves → Create Enclave.
2. Give your enclave a descriptive name: Production Floor or CUI Systems Sales Access.
3. Fill in the Description and Security Level.
4. Click Save.

Add assets and principals

1. Navigate to your newly created enclave, Enclaves → [Your Enclave].
2. Add assets and principals by clicking Edit Principals.
3. Select the entities you want to manage in this enclave.

At this point the enclave exists, but you still need to grant access.

Now define permissions within the enclave.

1. In the table view, click a Blocked tile.
2. Use the toggle to grant access.
3. The Advanced drop-down exposes deeper access-control capabilities: TLS, VPN, Access Screen.
4. Click Save.

This is the moment the Access Gate begins actively controlling access.

See Protecting an asset with enclaves for the full walkthrough.

Let's test access through the enclave and the proxy.

1. From your computer, check that you now resolve the asset:

   nslookup {asset_name}.{DNS_name}
   # for example: nslookup cui_server.acme.tr-sec.net
   

1. Check that you can ping the IP that was returned.
2. Test that the intended protocol is reachable:

   curl http://cui_server.acme.tr-sec.net
   # for example, for an HTTP server
   

The Access Gate proxy transparently intercepts and forwards traffic based on permissions.