Skip to content
English
Submit Support Ticket Customer Support Portal
Contact us
  • There are no suggestions because the search field is empty.

Orbalux - Integration & connectivity

A high-level connectivity overview of how on-site systems publish secure outbound telemetry to Orbalux.

Purpose

On-site systems connect to Orbalux by sending outbound-only, encrypted telemetry through either a software gateway or a hardware gateway appliance. Both options authenticate via client certificate or token and publish to a managed cloud broker over MQTT over TLS or HTTPS. This article is a connectivity summary, not a configuration guide. For setup instructions, refer to the Orbalux Gateway Configuration Guide.

Connectivity model summary

  • How does Orbalux receive data from on-site systems?

    Orbalux receives data from on-site systems via outbound-only, encrypted connections initiated by a software or hardware gateway on the customer network. The supported transport protocols are MQTT over TLS (primary) and HTTPS (alternate ingestion). Orbalux never initiates inbound connections to site hosts. Client authentication is certificate-based or token-based and is managed per gateway instance. The cloud broker runs as a managed service in a certified cloud region with redundancy, monitoring, and logging under WISE Group control. Private peering or VPN options are available for customers who require traffic to remain off the public internet.

    Cellular (mobile) connectivity is also supported for sites where fixed internet access is unavailable or undesirable. In this case, a SIM-equipped gateway device connects to the cloud broker over a carrier APN; data volume estimates and APN configuration should be agreed with the carrier and WISE Group during integration planning.

Gateway options

Software gateway

  • An integrated software gateway runs on the on-site host or a designated gateway host; it accepts structured messages from the on-site data acquisition system and publishes securely to the cloud broker.

  • Suitable when the host has controlled outbound internet access.

Hardware gateway

  • A dedicated gateway appliance provides physical and network isolation. The on-site data acquisition host connects to the appliance over an isolated interface (for example serial using JSON messages); the appliance publishes outbound to the cloud broker.

  • Preferred for stricter isolation or high-security deployments.

Both approaches keep the primary data acquisition host isolated from direct inbound network access while allowing secure outbound cloud publishing.

Protocols, endpoints and authentication

  • Primary transport: MQTT over TLS; HTTPS supported for alternate ingestion.

  • Connections are outbound-only from site; the cloud broker does not open inbound sessions to site hosts.

  • Authentication: client certificate and key pair per gateway instance (or an agreed equivalent).

  • Broker: managed broker service with redundancy and operational monitoring; private peering or VPN is available where required.

Resilience and operational behaviour

  • Resilience and Operational Behaviour

    The managed broker service provides redundancy and endpoint failover automatically. Edge systems buffer telemetry during outages and forward cached data when connectivity is restored; buffering policy and acceptable replay latency must be agreed before integration.

  • Edge systems buffer telemetry during outages and forward cached data when connectivity is restored. Buffering policy and acceptable replay latency should be agreed.

  • The hardware gateway option is used in high-security deployments to provide serial isolation and remove direct IP communication from the main data acquisition host.

Security posture

  • Transport encryption (TLS) and client authentication are standard on all connections. The managed cloud tenancy is operated with logging and monitoring controls.

  • Private peering or VPN arrangements are available where required for compliance or security.

Systems preparation checklist

  • Choose gateway approach and confirm interface (serial or IP).

  • Agree authentication and certificate lifecycle.

  • Record required outbound firewall rules and broker endpoints.

  • Define buffering and acceptable replay latency.

  • Estimate data volumes and plan carrier/APN details for cellular links.

  • Define and agree acceptance tests for cloud ingestion and central monitoring.

Key takeaway

Orbalux accepts secure, outbound-only telemetry from on-site systems via software or hardware gateways, using managed broker services that preserve on-site isolation. Before integration, agree on the gateway approach, authentication method, certificate lifecycle, buffering policy, and acceptance tests to ensure predictable and secure cloud ingestion.