How XoT works
What happens when something stops working?
A Lock sits between the network and the equipment. So you need to know how production is affected if the Lock fails. You also need to know how the Lock affects the traffic when everything works. Here are the answers.
A Lock fails
If a Lock fails or loses power
The connection through that Lock is then broken. There are two ways to reduce the risk of production stops.
Several Locks
You can use several Locks for the same equipment. If one Lock stops working, the traffic moves to the Locks that still work.
Fallback to unencrypted traffic
If a Lock disappears, traffic can switch to ordinary, unencrypted traffic to a device or IP address you have chosen in advance. The traffic then continues, but it is not protected in the meantime.
Which option fits depends on how critical the equipment is. We will help you choose.
Other parts fail
If the XMS or the Bridge cannot be reached
The XMS
Connections that are already open keep working as long as the access tickets are valid. This also applies when the XMS cannot be reached for a while. New policies and changes require the XMS.
The XoT-Bridge
Bridges can be arranged in Bridge Groups. If one Bridge stops working, traffic goes through another Bridge in the same group.
The internet
XoT does not need the internet. All of XoT can run in your own data centre, completely isolated from the internet.
When everything works
How the Lock affects traffic
Traffic through the Lock is encrypted. That takes a moment. The XoT-S1 adds the following latency:
| Measurement | Latency |
|---|---|
| Lowest | 3.19 ms |
| Average | 6.27 ms |
| Highest | 42.8 ms |
The size of the packets that fit in the tunnel, the MTU, can be configured.
Protocols
Protocols through the Lock
The Lock passes traffic over TCP and UDP, per port and protocol according to the policy in the XMS. Layer 2 traffic does not pass the Lock.
| Protocol | Status |
|---|---|
| RDP, VNC, SSH, HTTP and HTTPS | Verified by us |
| SMB, FTP, NTP and DNS | Verified by us |
| OPC UA and MQTT | Verified by us |
| Other protocols over TCP and UDP, for example Modbus TCP, S7, IEC 60870-5-104 and DNP3 | Should work, but we have not verified them |
| Layer 2 protocols, for example PROFINET RT and GOOSE | Do not pass the Lock |
Devices that talk to each other at layer 2 should therefore sit behind the same Lock. Tell us which protocols your equipment uses, and we will check them with you.
Power and maintenance
Power, mounting and updates
Power
The XoT-S1 is powered over USB-C and uses 5 W, at most 10 W. For control cabinets with 24 V DC we have an adapter from 24 V to USB-C.
Mounting
The XoT-S1 mounts on a DIN rail. It operates from −28 to 75 °C.
Updates
A software update of the Lock takes less than 2.5 minutes. A restart takes less than 33 seconds. No traffic passes the Lock during that time, so plan the update for a maintenance window.
Common questions
Does production stop if a Lock fails?
Traffic through that Lock stops. With several Locks or with fallback to unencrypted traffic, the traffic continues.
Is traffic between machines affected if the XMS cannot be reached?
No, not as long as the access tickets are valid. Connections between Locks keep working.
Do we need to install anything on the machines?
No. The Lock sits outside the equipment.
Questions about your particular site?
Tell us what equipment and which protocols you have. We will then go through how XoT affects operations for you.