Connectors Overview
Connectors are lightweight edge devices that use Linux native networking to provide site connectivity. Unlike dedicated edges and Shared Gateways, connectors do not run VPP — they rely on standard Linux tools (WireGuard, iptables, ip route) for packet processing.
What Is a Connector?
A connector is designed for smaller sites, branch offices, or remote locations where full VPP performance is not required. It connects to a hub edge (dedicated edge or MTGE) via a WireGuard backbone tunnel, extending your network to locations that need simple, reliable connectivity.
Key characteristics:
- Linux native networking — WireGuard CLI, iptables, standard routing
- Hub-and-spoke model — each connector links to an edge or MTGE that serves as its hub
- Lightweight footprint — runs on minimal hardware without DPDK or hugepage requirements
- Managed via MQTT — same batch configuration protocol as dedicated edges
- E2E peering support — connectors can participate in edge peering groups (single tunnel, no hub role)
- Tunnel status monitoring — WireGuard tunnel health published every 60 seconds
Connectors are automatically filtered to your tenant, so you only see devices belonging to your organization.
Connectors Page
Stat Cards
| Card | Description |
|---|---|
| Total Connectors | Total number of registered connectors |
| Online | Connectors actively connected and reporting |
| Offline | Connectors that have stopped sending heartbeats |
| Pending | Newly registered connectors awaiting activation |
Table Columns
| Column | Description |
|---|---|
| Name | Display name assigned during creation |
| Serial | Unique serial number identifying the device |
| Region | Geographic region or site label |
| Hub Edge | The dedicated edge or MTGE this connector tunnels to |
| Status | Current device state |
| Last Seen | Timestamp of the most recent heartbeat |
Status Lifecycle
Connectors progress through the following states:
pending_approval → approved → provisioned → active → offline → decommissioned
| Status | Meaning |
|---|---|
| pending_approval | Registered but not yet approved |
| approved | Approved by an administrator |
| provisioned | Bootstrap complete, initial config received |
| active | Online and sending regular heartbeats |
| offline | Heartbeats have stopped (device unreachable or powered off) |
| decommissioned | Permanently removed from active service |
Hub Edge Assignment
Each connector connects to a hub edge via a WireGuard backbone tunnel. On the connector's detail page, the Hub Edge field shows the current assignment and can be changed:
- Dedicated Edge — Standard hub-spoke topology
- MTGE — Connector connects to a shared gateway; App VPN routes from the connector's LAN subnets are automatically injected into the MTGE tenant's wg1 allowed IPs, making connector-side networks reachable by VPN clients
- None (standalone) — No hub connection
E2E Peering
Connectors can participate as members of Edge Peering groups. Connector peering has the following constraints:
- Single tunnel only — No dual-tunnel redundancy (connectors don't support wg2/wg3)
- No hub role — Connectors cannot be the hub in a hub-spoke peering topology
- Protocol choice — WireGuard (default) or IPSec (xfrm-based, distinct from App VPN IPSec)
Click on any connector row to open its detail page, where you can view configuration, monitor tunnel status, and manage the device lifecycle.