VIGIL MESH
LoginCréer un compte

Documentation

A modern industrial network: workshops and sites linked, nothing exposed

A modern industrial network has to hold two worlds together: shop-floor equipment — PLCs, robots, supervision — designed for a closed LAN, and a reality made of several buildings, several sites, machine builders to let in and 4G links. VIGIL-MESH extends the shop-floor LAN instead of replacing it: a software agent on the machines or the gateways, zero inbound ports, post-quantum end-to-end encryption — and multicast that actually crosses, so device discovery and real time work between sites just like on the floor.

Linking what produces: PLCs, robots, supervision

The industrial network is no longer an island: supervision must see several workshops, maintenance must reach machines on other sites, and production data must flow up. Three topologies come up everywhere.

Workshops of the same site

Two buildings, two machine networks, one supervision: the equipment must see each other without pulling fibre or merging the existing VLANs.

Sites of the same group

Plants, branches, warehouses: the line in plant A and the one in plant B report to the same supervision — see one LAN across several sites.

Machines at customer sites

The machine builder monitors and fixes its installed base, site by site, without touching its customers' firewalls — see industrial remote maintenance.

The OT constraints a corporate network ignores

Connecting industrial equipment is not connecting office computers: shop-floor protocols have requirements that classic VPNs do not meet.

  • Latency and jitter matter: a supervision that refreshes, a control loop that responds — traffic must take the most direct path, not a detour through a concentrator.
  • Discovery relies on multicast and broadcast: mDNS, SSDP, DDS/ROS 2, vendor tools that “scan” the network — exactly the traffic most VPNs drop. See the broadcast domain over the mesh.
  • The plant firewall opens nothing: no inbound port is negotiable, and rightly so — the solution must work outbound-only.
  • Isolated sites sometimes only have a 4G or satellite link, behind CGNAT: no public address to reach.
  • Legacy is the rule: Modbus TCP, RS-232/RS-485 serial links, equipment nobody wants to touch — see Modbus, SCADA and PLCs.

Why a mesh, and how it is deployed

The mesh answers these constraints by construction: no hub everything transits through, no port to open, and a transport that also replicates broadcast traffic. Deployment takes a few steps.

  1. 1
    Place the agent at the edge of the workshopOn the machines that embed a PC (HMI, supervision), or on a gateway of the machine network: industrial PC, Linux box, NVIDIA Jetson. Nothing changes on the existing network.
  2. 2
    Enroll each machine with a single-use keyFrom the console, the assistant hands you a key that expires on its own; one command on the machine, and it joins the network with its own identity.
  3. 3
    Let the paths pick themselvesBetween two sites, the agent establishes a direct path whenever NAT traversal allows it; otherwise traffic goes through vigies — structurally blind relays that do not hold the keys.
  4. 4
    Write least-privilege ACLsDeny by default: supervision reaches the lines, maintenance reaches its machines, and nothing else flows — see policies and ACLs.
  5. 5
    Name the equipmentA stable overlay address and a MagicDNS name per machine: the supervision points at “line-3.workshop-b”, not at an IP that will change.

What runs over the mesh

Supervision and SCADA

OPC UA, Modbus TCP, historians, web HMIs: each flow reaches its machine at its overlay address — see remote Modbus and SCADA.

PLCs

Programming consoles and diagnostics, ecosystem by ecosystem, through the gateway that carries the agent — see remote PLC access.

Multicast and discovery

mDNS, SSDP, vendor tools: the broadcast domain extends to the authorised machines — see a switch on top of the mesh.

Remote serial port (beta)

RS-232 and RS-485 mounted remotely as a virtual COM port (Windows, beta driver) or /dev/ttyVIGIL (Linux) — see the remote serial port.

What the mesh does not claim to do

A modern industrial network is also a matter of clear boundaries. Three things stay out of the mesh's scope — deliberately.

  • The agent does not install inside a PLC: a bare PLC is reached individually, through an industrial PC or a gateway of the same workshop that carries the agent.
  • Machines join host by host: you do not route a whole shop-floor subnet at once — every reachable device is declared, which is what makes access auditable.
  • The mesh does not inspect industrial frames: it replaces neither an industrial firewall, nor the physical segmentation of the machine network, nor a compliance programme.

Frequently asked questions

Where does the agent install on a shop floor?
On anything that runs an operating system: HMI PC, supervision workstation, industrial PC, Linux gateway, NVIDIA Jetson, Android terminal. A bare PLC does not run the agent: it is reached individually through a machine of the same workshop that carries it — see the Remote PLC access page.
Does multicast really cross between two sites?
Yes, it is a native capability of the mesh: broadcast and multicast frames are replicated, encrypted end to end, to the machines of the same broadcast domain. mDNS, SSDP and ROS 2's DDS discovery work across sites just like on the shop floor — where most VPNs drop them.
Do we need to open a port on the plant firewall?
No, none. Each agent only makes outbound connections and traverses NAT, CGNAT and 4G/5G links. There is no port forwarding, no DMZ, no inbound rule to negotiate with the site's IT.
Can we connect a site that only has a 4G link?
Yes. The agent traverses the CGNAT of mobile networks; when no direct path can be established, traffic goes through relays that do not hold the keys and only see opaque packets. A Linux or Jetson gateway with a 4G dongle is enough to connect the workshop.
And tomorrowOperate these machines with an AI assistant →

The same network that connects them lets each software announce its capabilities — and an MCP assistant see and operate them, under your control, machine by machine.

Read nextIndustrial VPN (OT/SCADA) and remote sites →