SiteManager
Working with Subnet AgentsThis guide explains how to setup Subnet Agents on a SiteManager and also
talks about pros and cons of these compared to the Vendor-specific Device
Agents.

Version: 2.0, June 2016
Applicable to SiteManager version 7.0 or newer

Table of Contents
Version History

2

Introduction - What is a Subnet Agent?

3

Subnet Agent (SiteManager 3xxx / SM-E Extended only)

3

2.1.

Advantage of Subnet Agent vs regular Ethernet Agents

3

2.2.

Disadvantages of Subnet Agent vs regular Ethernet Agents

3

2.3.

Using the Subnet Agent

4

Auto Subnet agent (SiteManager hardware models only)

5

3.1.

Advantages of Auto Subnet Agent vs Subnet Agent

5

3.2.

Disadvantages of Auto Subnet Agent vs Subnet Agent

5

3.3.

Using Auto Subnet Agent (only)

6

3.4.

Using Auto Subnet Agent together with Regular Agents

7

Reasons for starting Subnet Agent together with Regular Agents

8

Notices

9Version History•

1.2 First official version, only including Auto-Subnet Agent referred to as“Subnet Agent” (document title: Setting up Tunnel Agent on a SiteManager Auto Subnet Agent)•2.0 - Revised according to release 7.0 Introducing the GENERIC > Subnet Agent. Changed document title to “Working with Subnet Agents”

Working with Subnet Agents

Page 2 of 9

Introduction - What is a Subnet Agent?
A Subnet Agent will provide access for a LinkManager to a range of IP addresses
defined by a “subnet”, rather than individual addresses as defined by e.g. Vendorspecific Device Agents.
It is a well-known fact that the Secomea remote access solution is not based on
VPN and routing.
Therefore, you will not find the terminology “Tunnel Agent” in the SiteManager,
but rather “Subnet Agent”, although the result may be similar to a tunneled VPN
connection to entire subnets of a local network.

Subnet Agent (SiteManager 3xxx / SM-E Extendedonly)
2.1. Advantage of Subnet Agent vs regular Ethernet Agents
1. The Subnet Agent provides access to the entire network of a Network Interface port, and only consumes a single Agent on the SiteManager.
2. You do not have to configure dedicated agents for all devices in the network.
3. The Subnet Agent can be configured for smaller subnets, masking out theSiteManager web GUI.

2.2. Disadvantages of Subnet Agent vs regular Ethernet Agents
1. Supported only on SiteManager 3xxx models and SiteManager EmbeddedExtended. For SiteManager 1xxx you only have the option to use the Auto
Subnet agent (see section 3)
2. The Subnet Agent will not provide access to Ethernet equipment using certain search protocols (UDP multicast is not supported but Subnet Broadcast is), or certain special protocols (such as Beckhoff AMS). Also FTP
Active mode can have limitations.
3. The Subnet Agent does not provide access from LinkManager Mobile.
4. Vendor-specific Device Agents limit access to a specific device. With theSubnet Agent, all LinkManager users will have access to all IP devices andtheir services of the entire subnet, which may not be desirable security
wise.
5. Configuring IP subnets properly does require some network knowledge.
6. The Subnet Agent assumes the LinkManager user to remember the IP addresses of all devices; there will be no indication in the LinkManager about
which devices actually exists in the device network.
7. You will not be able to point and click to connect to a device with the “GoTo Device” feature. The LinkManager user must manually start e.g. a web
browser or a VNC session towards the device.
8. The status of a particular device is neither shown in the LinkManager northe GateManager console. You will only find out if it is available when youattempt to connect to it.
9. When using the Subnet Agent to access devices, you will not be able tocreate Alerts on the device status on the GateManager.
10. The Access Log on the GateManager will not indicate which specificdevices a LinkManager user has accessed using the Subnet Agent.

Working with Subnet Agents

Page 3 of 9

2.3. Using the Subnet Agent
Select the Device Type GENERIC > Subnet agent

Some useful notes about this screen:
The subnet mask is written by the notation /xx. E.g. a standard Class C network is written as e.g. 10.0.0.0/24, and provides access to the IP range
10.0.0.0-10.0.0.255.
Within the DEV network you can limit (divide) the Subnet Agent to specific IP
ranges like: 10.0.0.16/29, which provides access to the addresses 10.0.0.1610.0.0.23 only.
One Subnet Agent will have to be created for each Network interface port, IPmask must match the port, you cannot “Supernet” IP ranges. Although creating smaller subnets are allowed.
You can configure multiple Subnet Agents that can be accessed individuallyor grouped (see online help for more information on Device Groups).
By default, all TCP ports are open for the selected subnet from LinkManager
to the devices. You can narrow the services to access by specifying single
ports or ranges like this: 23,80,5000-5010.
Refer to the help text in the configuration screen for details on more specificsetup with regards to UDP broadcasts. Note that this may require more detailed knowledge of the specific protocols, and you should consider if a dedicated Agent wouldn’t be a better choice.

Working with Subnet Agents

Page 4 of 9

Auto Subnet agent (SiteManager hardware modelsonly)
3.1. Advantages of Auto Subnet Agent vs Subnet Agent
1. It works for all SiteManager hardware models including the 1xxx series.
2. It works for SiteManagers with firmware older than 7.0.
3. It is default active on a virgin SiteManager HW model, which means noAgent configuration is needed for connecting to the DEV network with aLinkManager.
4. In addition to access to the subnet of the DEV port, the Auto Subnet Agentcan be configured to enable forwarding to the subnets specified in StaticRoutes (menu Routing > Static Routes), which have a gateway on DEVport.

3.2. Disadvantages of Auto Subnet Agent vs Subnet Agent
1. The Auto Subnet Agent will not show as an agent in the LinkManager.
The Auto Subnet Agent is started by a selecting <Connect all> on theSiteManager itself, thus requiring the LinkManager user to have access tothe SiteManager, and subsequently the user will also have access to theweb GUI of the SiteManager.
2. The Auto Subnet Agent can be combined with Vendor-specific Device
Agents, but since the Subnet Agent can only be started by selecting <Connect all>, it will also start all the Vendor-specific Device Agents (includingSerial and USB agents) and potentially prevent other LinkManager user’s
access to specific equipment.
3. You only have one Auto Subnet Agent, while the Regular Subnet Agentscan define smaller subnets and the different Subnet Agents can be organized into domains on the GateManager for differentiated LinkManager
access.
4. The Auto Subnet Agent does not allow for specifying TCP/UDP ports butwill always open for access to all services on all devices in the subnet.
5. The Auto Subnet Agent does not allow specifying a Subnet Mask for limiting the IP range within the DEV network.

Working with Subnet Agents

Page 5 of 93.3. Using Auto Subnet Agent (only)
By default, (before any specific agents are configured) clicking on a SiteManager
Hardware model (<Connect all>) in the LinkManager will activate the Auto-subnet
agent, due the “Auto Subnet Agent” default value being “Enabled”.
1. Enter the SiteManager web GUI and select System  DEV(1). Ensurethat the Auto Subnet Agent is set to Enabled:

2. Make sure that there are no Agents defined, or that any defined agentsare Disabled under menu GateManager  Agents (otherwise the Subnet Agent will not start).

3. Locate the SiteManager in the LinkManager, and select <Connect all>:

4. You will notice the tunnel icon, and the subnet that is made available tothe PC of the LinkManager.

In this case the address is indicated as 172.24.2.0/24, which is the official notation of a subnet of 254 hosts (also indicated with the subnet
mask 255.255.255.0 aka Class C network)

5. If you know an IP address in the subnet, you can try to ping it.

Working with Subnet Agents

Page 6 of 9

3.4. Using Auto Subnet Agent together with Regular Agents
1. If you want to use the Subnet Agent combined with Vendor-specific Device Agents, you will need to set the Auto Subnet Agent to Always or
Always + Static Routes (Check the SiteManager online help for more
info on the latter option).

2. Locate the SiteManager in the LinkManager, and select <Connect all>:

3. You will notice that both the Subnet Agent and the other Agents areconnected simultaneously.

Working with Subnet Agents

Page 7 of 9

Reasons for starting Subnet Agent together withRegular Agents
You can start a Subnet Agent together with e.g. Vendor-specific Device Agentsby configuring a Device Group including the Subnet Agent and the relevant regular agents (Check the SiteManager online help for more info on Device Groups).
An Auto Subnet Agent will, when configured to “Always” (see previous section)and choosing <Connect All>, automatically start all agents including itself.
There may be the following reasons for starting Vendor-specific Device Agents
together with the Subnet Agent: You may have a requirement to access more IP addresses in the DEV
network that you have free agents for. As described in section 2.2, there
are services that require a Vendor-specific Device Agent. If you have asingle or a few devices in the DEV network that require such specific services, you can create Vendor-specific Device Agents for the IP addressesof these, and leave other devices to be accessed by normal Subnet
Agent communication. When activating the Auto Subnet agent by <Connect All> or starting a group of agents including a Subnet Agent and one
or more Vendor-specific Device Agents, the Vendor-specific Device
Agents will take precedence over Subnet Agent communication. So devices being associated with the Vendor-specific Device Agents will besupported by the special services of these agents.

 You may want to connect to the subnets in the DEV network, while concurrently connecting to one or more devices on the Uplink side. Such devices could be a SCADA system or similar that typically are located on
the corporate network.

Working with Subnet Agents

Page 8 of 9

Notices
Publication and Copyright© Copyright Secomea A/S 2011-2016. All rights reserved. You may downloadand print a copy for your own use. As a high-level administrator, you may use
whatever you like from contents of this document to create your own instructions
for deploying our products. Otherwise, no part of this document may be copiedor reproduced in any way, without the written consent of Secomea A/S. We would
appreciate getting a copy of the material you produce in order to make our own
material better and – if you give us permission – to inspire other users.

Trademarks
LinkManager™, GateManager™ and SiteManager™ are trademarks of Secomea A/S. Other trademarks are the property of their respective owners.

Disclaimer
Secomea A/S reserves the right to make changes to this publication and to theproducts described herein without notice. The publication of this document does
not represent a commitment on the part of Secomea A/S. Considerable effort has
been made to ensure that this publication is free of inaccuracies and omissions
but we cannot guarantee that there are none.
The following paragraph does not apply to any country or state where such provisions are inconsistent with local law:
SECOMEA A/S PROVIDES THIS PUBLICATION "AS IS" WITHOUTWARRANTY OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING,BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITYOR FITNESS FOR A PARTICULAR PURPOSESECOMEA A/S SHALL NOT BE LIABLE FOR ANY DIRECT, INDIRECT,INCIDENTAL, CONSEQUENTIAL, OR OTHER DAMAGE ALLEGED INCONNECTION WITH THE FURNISHING OR USE OF THIS INFORMATION.

Working with Subnet AgentsPage 9 of 9