XoT-Lock

The XoT-Lock, which terminates the WireGuard traffic tunnel, protects single assets or multiple assets across different subnets and VLANs.

The XoT-Lock is deployed using the XoT Software, which can be installed on any Intel64/ARM64-based compute node—whether on bare metal, a virtual machine on-premises, or in a cloud service.

XoT-Lock operational modes

The XoT-Lock has two primary operational modes and in addition, NAT functionality that be used depending on design.

The selected XoT-Lock mode does not affect the configuration or operation of other components within the XoT Technology™ solution.

Single Device mode

This mode of operation supports protecting a single device behind an XoT-Lock. It is inserted inline between a switch port and a single device that needs protection while the protected device retains it current IP address and subnet membership. One could say that the XoT-Lock is IP transparent. The protected device may keep using DHCP for IP assignment or have a statically configured IP. No VLAN tagging is supported in the mode.

Before XoT-Lock

After XoT-Lock deployed

Multi Device Mode

This mode protects one or more entire IP subnets with or without VLAN tagging support. Support for:

• Multiple subnets
• VLAN tagging
• IP route with next hop for router-hop behind XoT-Lock
• Destination NAT
• Source NAT
• Gateway for Protected Device
• DHCP Server for single untagged subnet (v3.6.x)

Source NAT

The default mode is Source NAT, where the source IP for all client traffic destined for protected devices is translated in the XoT-Lock to use the XoT-Lock's IP on the protected side. This is useful where:

Add secure access to a subnet with existing gateway

No re-configuration needed.

Add secure access to an air gapped subnet with no prior access

No re-configuration needed.

Add secure access replacing existing gateway

No re-configuration needed.

Virtual IP

Solving overlapping subnets is easy with Virtual IP. Each subnet behind the XoT-Lock is configured with a Virtual IP subnet that will be exposed to the client. The XoT-Lock will translate the Virtual IP to the real subnet suing Destination NAT (DNAT). The XoT-Lock can optionally be configured as a gateway or SNAT.

XoT-S1

Xertified also offers a compact hardware platform called the XoT-S1, specifically designed for running XoT software.

Specifications

• 2x 10/100/1000M Ethernet ports auto-sensing.
• Dimensions: 92x98x30 mm.
• Weight: 120 g.
• Temperature range: 0–40 *C.
• Powered by USB-C connector: 5 W normal load / 10 W max load.
• Boot time 33 s.
• Mounting: DIN rail brackets.
• Latency: min 3.19, avg 6.27, max 42.8 ms.
• Cold boot time: ~42s - 50 s.
• Reboot time: ~33 s.
• Firmware upgrade time ~2:30 min