Agent Deployment
Every plant has its own Mirox-Agent. The agent runs in the Mirox-Cloud at a certified data-center location and reaches the plant's equipment through a dedicated VPN tunnel. Nothing of Mirox runs inside your plant network; the plant side only needs a VPN endpoint.
Self-Service Activation
Activating a plant deploys its agent automatically. Mirox-Cloud assigns the plant to the healthy location with the lowest load and brings the agent up for that plant — no site visit, no provisioning step. You can activate a plant the moment you create it.
Where the Agent Runs
- One agent per plant. Each plant gets its own isolated set of agent services. Agents never share a service, a memory region or a tunnel, and an agent cannot reach any plant but its own.
- Certified locations. Agents run in Mirox-operated clusters in German data centers, under the same security measures as the rest of the platform.
- Supervised. An orchestration layer verifies continuously that each agent exists and is ready. If an agent, its host or its whole location fails, the agent is re-placed automatically — in another region if necessary — within a few minutes, and data collection resumes with at most one polling period of gap.
How the Agent Reaches the Plant
The agent and the plant router are the two ends of a dedicated tunnel. You choose the direction that fits your network:
| Direction | Who connects | What the plant side needs |
|---|---|---|
| Plant router dials out (hosted by Mirox) | The plant router connects to the agent's VPN endpoint — a per-plant address and port published by Mirox. | Outbound connectivity only. No inbound port on the plant side. |
| Agent dials in (server at the plant) | The agent connects to a VPN server the plant router already runs. | A reachable VPN endpoint at the plant and credentials for the agent. |
Supported protocols: WireGuard (recommended), IPsec (IKEv2) and OpenVPN for routers that cannot do WireGuard. Each plant's tunnel has its own keys. Set-up, protocol choice and switching the direction later are described in Direct Plant VPN.
What is exposed
In both directions, the tunnel endpoint is the only thing involved. No device inside the plant is exposed to the internet, and nothing other than the plant's own agent can initiate traffic toward the plant network.
What the Agent Does Through the Tunnel
- Collects data from loggers, inverters, meters and batteries with the device-specific adapters — reading only, never writing to a device
- Maps and watches the plant network (Local Network Inspector)
- Terminates the plant side of the VPN and Proxy remote-access paths, with every access audited
- Runs the plant's analytics and digital twin
Recommendations for the Plant Network
- Put the data loggers and inverters in their own network segment and allow the tunnel to reach only that segment.
- Prefer the plant router dials out direction: it needs no inbound rule on your side.
- Keep the tunnel's routes limited to the logger addresses the agent actually needs.
Related
- Mirox-Agent Overview — what the agent does
- Direct Plant VPN — configuring the plant tunnel
- Remote Access FAQ — who can reach the plant and how it is logged
- Mirox-Cloud Overview — where the agents and the platform run