Skip to content

XoT-Bridge Configuration

Prerequisites

In order to configure an XoT-Bridge you must first haven an XoT enrolled.

To learn more about general XoT configuration see the configuration guide.

Bridge Configuration

First navigate to the XoT you want to configure as an XoT-Bridge and then click on the Brige tab.

From the Bridge tab you can assign XoT-Locks to Bridge Groups or configure XoTs as XoT-Bridges.

If you want to configure the XoT as an XoT-Bridge, start by assigning your bridge to the bridge group you created and enabling Bridge Mode.

Creating Bridge Groups

Access through XoT-Bridges are managed with something called Bridge Groups, which are just groupings of devices and bridges. Devices can be assigned to Bridge Groups and then access can be given to those devices through any bridges in a matching Bridge Group.

To create a Bridge Group, navigate to Infrastructure and then Bridge Topology in the main menu. Click the pencil icon in the top right and then the Add Bridge Group button that appears.

Enter your desired group name and click CREATE.

A new Bridge Group should now appear in the Bridge Topology diagram.

You may want to revisit this diagram after you have set up your XoT-Bridge and assigned devices to it.

Bridge Mode

In order to configure an XoT as an XoT-Bridge, you must navigate to the Bridge tab of an XoT page and enable Bridge Mode

The XoT-Bridge has two different modes of operation, which are determined by whether Rendezvous mode is enabled or not. The mode controls which party initiates the connection and may have a considerable impact on what needs to be configured in firewalls surrounding the XoT-Bridge.

With the default setting, Rendezvous mode, the XoT-Locks' initiate the connection to the XoT-Bridge. This usually simplifies firewall configuration considerably and the XoT-Bridge has more flexibility in where it may be located. It does not need to be located on-premise where it can route traffic to the XoT-Locks, and can instead be hosted on a public cloud if so desired.

One way of looking at it is that in this mode, both clients and XoT-Locks call into the bridge.

If Rendezvous mode is disabled, the XoT-Bridge works in a more traditional way, where clients initiate a connection to the XoT-Bridge, and the bridge initiates the connection to XoT-Locks. This typically involves more firewall configuration as ingress of traffic into a network is typically more restricted than egress, but this mode of operation may be preferable for some setups.

Client Lock

The Bridge tab also contains the Client Lock setting.

Client Lock is a special XoT deployment mode where a XoT is placed physically between a computer and the upstream network. The XoT creates a small local network on its device-side interface, hands out the computer's IP configuration over DHCP, and becomes the controlled network edge for that computer. The computer still runs the regular XoT-Desktop Client for authentication and tunnel establishment.

This is useful when access should depend not only on the desktop client, but also on possession of a local XoT appliance. Typical examples include work-from-home deployments where the organization wants remote access to require both the technician's computer and a dedicated XoT at the home site, and shared or weakly protected terminals in industrial or OT environments where the computer itself is not sufficiently trusted but a nearby XoT appliance can be physically secured.

Client Lock is configured on top of Bridge Mode, so Bridge Mode must be enabled first. It does not replace the XoT-Desktop Client. The desktop client still receives tickets and policies from XMS and establishes access in the normal way, while the Client Lock XoT forms the local appliance-controlled hop between the computer and the upstream network.

To configure Client Lock:

  1. Enroll the XoT in XMS if it is not already enrolled.
  2. Open the XoT page in XMS and go to the Bridge tab.
  3. Enable Bridge Mode.
  4. Enable Client Lock.
  5. Enter a Device Side Interface IP (CIDR) for the XoT device-side interface. The subnet must have room for at least two hosts, and the configured address must be a host address rather than the network or broadcast address. A /30 is a common choice for a single attached computer.
  6. Enter a DHCP Lease Time.
  7. If this Client Lock should participate in remote access through bridges, assign it to the required Bridge Group.
  8. Connect the computer to the XoT device-side interface and renew DHCP if needed.
  9. Start the XoT-Desktop Client on the computer and verify that the expected policies and resources appear.

Client Lock is intended for a directly attached computer on the XoT device-side interface. External Address Override should not be used together with Client Lock, and regular device-side address configuration for protected assets should not be combined with Client Lock on the same XoT.

Port Configuration

You now need to assign a port range for encrypted traffic WireGuard Port Range Start and WireGuard Port Range End. The port ranges can be freely defined but keep in mind that they also need to be accessible through the firewall over UDP.

The other ports may be changed or left at their default values, but make sure to configure any firewall in front of the XoT-Bridge to allow UDP traffic to Access Request and WireGuard ports, as well as the Access Request port configured in the Advanced tab (default 25006).

Setting external address

The XoT-Bridge will report its external IP to XMS, but if network address translation (NAT) is performed on traffic to the XoT-Bridge then this self-reported IP cannot be used by clients to reach the XoT-Bridge. In these situations, the routable external IP will have to be manually specified so clients and XoT-Locks can reach the bridge.

To set this value, navigate to the Advanced tab, and set the externally routable IP of the XoT-Bridge in the External Address Override field.