Network Security
Choose how your Captic system connects to the Captic cloud, from open internet to no internet access at all.
A Captic system connects to the Captic cloud for software and AI model updates, data storage and remote support. How much network access it gets is your choice. We support five connectivity tiers, from most open to most locked down.
Outbound to listed domains
Firewall rules, wildcards allowed
Teleport
Most sites; quickest setup
Outbound to exact hostnames
Firewall rules or an HTTPS proxy
Teleport
Stricter IT policies
As tier 3
As tier 3, without Teleport
Your own remote access tool
Sites that require their own remote access
None
Private connection through your Azure network
Your own remote access tool
Sites where OT devices may never reach the internet
Whichever tier you choose, the device needs a static IP, a DNS server and an NTP server on your network. See Required preparation.
You can check the connection from the device itself in the Product UI under Details > Networking.
Tier 1: Open internet
Not recommended. This tier gives the device more network access than it needs. Use it at most temporarily, for example during testing.
The device has unrestricted outbound internet access. Nothing needs to be configured on your firewall, so it works straight away.
The device only makes outbound connections; you never need to open inbound ports from the internet. Even so, unrestricted outbound access is broader than necessary and is not allowed by most industrial security policies. For production, use tier 2 or stricter.
Tier 2: Firewall rules with wildcards
The device may only reach the domains below. Wildcard domains keep the list short and stable, which makes this the quickest tier to set up.
123 (UDP)
- ntp.ubuntu.com, or your own NTP server
53 (UDP)
- your DNS server
443 (TCP) to:
- mcr.microsoft.com
- archive.ubuntu.com
- *.data.mcr.microsoft.com
- *.cdn.azcr.io
- global.azure-devices-provisioning.net
- docker.io
- *.azurecr.io
- *.blob.core.windows.net
- *.ods.opinsights.azure.com
- *.oms.opinsights.azure.com
- *.azure-devices.net
- aka.ms
- raw.githubusercontent.com
- captic-com.teleport.sh
5671 (TCP) to:
- *.azure-devices.net
8883 (TCP) to:
- *.azure-devices.netcaptic-com.teleport.sh is used for remote support. See Remote Access.
Tier 3: Firewall rules without wildcards
If your firewall policy doesn't allow wildcard domains, the device can work with a list of exact hostnames instead. Some of these hostnames are specific to your Captic tenant.
Through an HTTPS proxy
Instead of opening the firewall, you can route the device's traffic through an HTTPS forward proxy on your network, for example Squid on a jump host.
The device can send all cloud traffic over port 443, so a standard web proxy is enough. Ports 5671 and 8883 aren't needed.
DNS and NTP run over UDP and can't go through an HTTPS proxy. Provide them locally on the device's network.
Tell us the proxy address and port, and we'll configure the device for it.
Tier 4: Without Teleport
Some sites require every vendor to use the site's own remote access solution. In this tier, we remove Teleport from the device and support it through your tool instead.
The firewall rules or proxy are the same as in tier 3, without
captic-com.teleport.sh.You give the Captic team access through your own remote access solution, for example a Citrix portal with a jump host, BeyondTrust or FortiClient.
Remote access lets us change device settings, such as camera exposure, and investigate issues without a site visit. With your own tool this works the same way; it just follows your access process. See Remote Access.
Tell us before delivery if you want this tier, so we can prepare the device and arrange accounts with your team in time.
Tier 5: No internet access
For sites where devices on the OT network may never reach the internet, not even through a proxy. The device has no internet access at all. Instead, it reaches the Captic cloud over a private connection through your own Azure network.
How it works
The Captic device sits on your OT network. Your network routes its cloud traffic to Azure Private Endpoints in your own Azure virtual network. Those endpoints connect privately, Azure to Azure, to the Captic cloud services the device needs:
IoT Hub: device management and messaging
Blob Storage: images and results
Container Registry: software and AI model updates
The traffic stays on your network and the Microsoft backbone, and never crosses the public internet.
What you set up
Private Endpoints in your Azure virtual network for the Captic IoT Hub, Blob Storage and Container Registry. We send you the resource IDs.
Private DNS zones, so these services resolve to their private addresses, including for the device on the plant floor.
Network connectivity from the device's OT network to your Azure virtual network.
DNS and NTP available locally on the device's network.
Remote access for the Captic team through your own solution, as in tier 4.
What we set up
We mirror all container images the device needs into the Captic Container Registry, so the device never has to reach public registries.
We approve the cross-tenant Private Endpoint connection requests on our side.
We configure the device to use the private endpoints.
Last updated