Network requirements

CNA needs very little from your network. Everything connects outbound and is started by the device, nothing needs an inbound firewall rule, and the sensors join your Wi-Fi like any user device.

At a glance

Outbound only

• Sensors and agents send their data outbound over TLS to the Cloud Unit dedicated to you.
• They fetch their configuration and updates the same way: the device asks, the Cloud Unit answers.
• Management sessions are encrypted and started by the device, so no inbound firewall rules are needed.
• Nothing listens on the sensors.

Firewall allowlist

Allow these outbound connections from the networks your sensors and agents use. The addresses of your Cloud Unit are supplied at onboarding.

All of these are outbound, started by the device. Nothing needs to reach in.

See Architecture for every connection that crosses your boundary.

Wi-Fi

Sensors join enterprise Wi-Fi like any user device. Each Wi-Fi network is configured in the portal.

Several networks per profile

Sensors connect through network profiles. Each profile can hold up to three Wi-Fi networks and one wired network, and a sensor can use any network in its profile.

• Failover. Give a disaster-recovery SSID a higher priority, and sensors prefer it whenever it is broadcast.
• Several offices. One profile can serve several offices with different SSIDs, so a sensor works at any of them.
• Priority. Where several SSIDs are available at one location, the higher-priority one is tried first.

25 network profiles are available by default; more on request.

Wired and addressing

• ModelB and ModelC need a live wired port on the user network, at the desk where the sensor is mounted.
• ModelA is wireless only and needs no wired port.
• Addressing is DHCP or static, per network. For static addressing you provide the IP address, subnet mask, default gateway and two DNS servers.
• DNS lookup times are measured against the DNS server configured on the sensor or issued by DHCP.

Choose the desk with your wired-port plan in hand: see placement principles.

WAN circuits

• Cloud WAN probes test each site's public WAN address from the cloud. Give us one or two circuits per site.
• Probes use ping by default. If a circuit blocks ping, the probe switches to trace mode.
• Packet-loss alerts use a fixed 10% threshold; the latency threshold is yours to set.

Environments CNA works with

Servers and end-user devices

• The server and VM agent runs on Linux and Windows; the end-user device agent on Windows.
• Both connect outbound over TLS, like the sensors.
• Agents keep themselves up to date, and new versions are proved on reference servers before the estate takes them.

Server agent: Linux with systemd (Ubuntu, Debian, Amazon Linux, CentOS, Red Hat or SUSE) on x86-64 or ARM64, and 64-bit Windows Server. End-user device agent: Windows 11.

Power

ModelB and ModelC are powered over USB-C from the supplied power supply (5.1 V, 3 A).

Portal access

What we ask for at onboarding