Keep Meraki for IT. Give the plant floor its own gate.
Meraki is a great IT tool, hard for operation teams to run. Access Gate adds the OT layer your operators manage: visibility, access control and compliance in one place.
Last updated:
Trusted by leading companies
- InternetVendors, remote staff
- Meraki MXIT perimeter, run by IT
- Access GateOT layer, run by the plant floor
- MachinesPLCs, HMIs, CNCs, production cells
Why OT is hard to run on Meraki
The Meraki dashboard is built for IT admins. A line operator who needs to give a vendor one machine for one hour still has to open an IT ticket. Vendors keep a standing VPN, and nobody sees who touched the line.
Meraki stays with IT, and the plant floor runs Access Gate.
Access Gate sits in front of the machines and covers what the plant floor needs every day.
- 01
Simple for IT to connect and manage
From the Meraki Dashboard, IT adds one VLAN for the gate, one static route and one source-based route, in about 20 minutes. Nothing changes on the machines, and deleting the source-based route undoes it.
- 02
OT operates without gaps
Operators grant and revoke access to their own machines without an IT ticket. Every vendor session goes through the gate, so vendors have no other way in.
- 03
Visibility of every machine and flow
Access Gate builds the asset inventory from the traffic it sees: which machines exist, who talks to them and over which protocol. It needs no agent and does not actively scan fragile controllers.
- 04
Access control and compliance in one place
Sign-in, MFA, per-machine access, session recording and logs are all on the gate. The same records answer audit questions for CMMC, NIST 800-171 and IEC 62443, so you do not have to rebuild evidence from VPN logs.
IT sets it up in the Meraki Dashboard in about 20 minutes.
You add one VLAN and two routes, then switch in under a minute. You keep your existing admin VLAN.
- 01
Add the Protection LAN.
One new VLAN gives Access Gate its own small subnet on the MX. The gate's admin port goes on the admin VLAN you already have.
- 02
Add one static route.
One static route sends traffic for the protected machines to the gate. This changes nothing until you switch.
- 03
Switch with one source-based route.
One source-based route sends the machine VLAN through Access Gate. Delete it and traffic goes back to how it was.
Read the Meraki setup guide
How do I give a vendor one machine behind a Meraki MX?
Vendors keep the VPN or 4G link they already use, and that link ends at Access Gate. They sign in through the browser with MFA and reach one approved machine over one protocol, inside a time window. The session is recorded and closes on time, and an operator can cut it at any moment. Vendors install nothing, and they never get an address on your network.
See secure OT remote accessWhat about Cisco Cyber Vision?
It does a different job. Cyber Vision shows the assets and risks on Cisco industrial networks. Access Gate controls who reaches each machine, with MFA and session recording, and works on a plain Meraki network. You can use both.
A running line on a Cisco and Meraki network, protected in under a minute.
A large manufacturer in North Carolina wanted to secure its production lines and the connections from engineering workstations to PLCs. They connected Access Gate to their existing Cisco and Meraki network for asset inventory and access control. They moved a running production line behind the gate with one route on their Cisco switch, while production ran.
- to move a running line behind the gate
- <1 minto move a running line behind the gate
- assets managed
- 1,300assets managed
- users managed
- 660users managed
Access Gate Starter covers one plant of up to 200 machines.
$399 per month
$780 for the appliance, then $399 per month for license and support. The first 30 days of license are free. It includes asset inventory, vendor remote access, MFA and session recording, and it is installed, configured and operating in a day.
For more plants, more machines or enterprise support, talk to us. Tell us how your Meraki networks are laid out and which vendors reach your machines today. We will show where Access Gate sits next to each MX.
Questions about OT security on Meraki
Meraki protects the network perimeter and is managed by IT. Access Gate adds a second layer in front of the machines, and OT operators manage it themselves. It gives them visibility, access control and compliance evidence in one place.
Vendors connect through Access Gate. Each session is tied to a named user, limited to approved machines, recorded and closed on time. Operators can cut a session at any time. If vendors already use the Meraki client VPN or a 4G link, it simply ends at the gate.
IT adds one VLAN for the gate (the Protection LAN), one static route and one source-based route in the Meraki Dashboard. You keep your existing admin VLAN. After that, operators grant and revoke access in Access Gate, and the MX does not change. See the Meraki setup guide.
Most Meraki alternatives replace the Wi-Fi, switches or firewall for IT. On the plant floor, you can keep Meraki for IT and add an OT layer that operators run. Access Gate is that layer, with asset inventory, access control, session recording and compliance evidence.
No, they do different jobs. Cyber Vision gives OT visibility on Cisco industrial network equipment. Access Gate controls who reaches each machine, with MFA and session recording. It builds its own inventory from traffic, so it also works on a Meraki network. You can use both.
Running OT access on the Meraki MX means writing and maintaining rules for every machine and every vendor, which is hard for a small team. With Access Gate Starter, one plant of up to 200 machines gets its own OT layer for $399 per month after the $780 appliance. It is installed, configured and operating in a day.
Delete the source-based route on the MX and traffic goes back to how it was. Nothing on the machines was changed.
See it on your network
See where Access Gate connects to your Meraki MX.
We also show how a vendor session looks from the plant floor.