Gateways
On the Assets page, you can also configure a Virtual Asset, a Subnet, or an Exit Node, all of which require a Linux Asset running the XTNA-agent to provide access. We call this Linux asset the gateway asset.
Virtual Asset
A virtual asset is a device that doesn't have an XTNA-agent running on it, but is made available by the gateway asset.
The virtual asset must have an IP that is reachable from the gateway asset (usually from the same local area network), this IP goes into the public IP field of its configuration.
Access to services provided by a Virtual Asset is granted based on policies.
Typical use cases are devices where you can't install our XTNA-agent but still want to make them available to clients, e.g. printers, NAS, IP cameras or industrial devices.
Subnet
Instead of specifying a single IP you can also make a whole network range available, this is done by configuring a Subnet.
Also for the Subnet the traffic will be routed through the gateway asset. However, if the accessing client/asset already has an IP in the configured network range, it will not route through the gateway asset, but will use its local interface to reach it.
Access to services located on a Subnet is granted based on policies.
Single destinations inside the range can be excluded from this routing, see Exceptions.
Managed Subnet
A Managed Subnet extends the regular Subnet with a built-in DHCP server running on the gateway asset. This allows the gateway asset to manage an entire network segment — assigning IP addresses, DNS servers, and gateway settings to devices that connect to it.
For detailed configuration options, see the Managed Subnets configuration guide.
Exit Node
An Exit Node can be used as the default target for all traffic that is not designated for any Asset, Virtual Asset, Subnet, or a local network of the Clients.
This covers IPv6 as well: where the gateway asset has IPv6 and the client has an
IPv6 default route, the Exit Node becomes the default for ::/0 alongside
0.0.0.0/0. Clients without IPv6 simply have their IPv4 default redirected.
For configuration options, see the Exit Nodes configuration guide.
Access to services located on an Exit Node is granted based on policies.
Individual destinations can be excluded from the Exit Node, see Exceptions.
Exceptions
An Exception names a destination that should not be routed through the gateway. Traffic to it leaves through the client's own internet connection instead, while everything else keeps using the gateway as configured.
The typical reason is performance. Services such as Microsoft Teams and Google Meet send you to a server close to where you are, so sending their traffic through an Exit Node in another city or country means arriving from there instead, and the call quality suffers on exactly the traffic least able to absorb the delay. Excepting those destinations keeps them on the short path.
Exceptions can be configured on both a Subnet and an Exit Node, on the Exceptions tab of the gateway. Each exception must lie inside the network the gateway serves and be more specific than it, since it carves a hole in that one route — on an Exit Node, which serves all destinations, any network can be excepted.
On an Exit Node you can also choose from ready-made presets for common vendors, so you do not have to track their address ranges yourself:
| Preset | Covers |
|---|---|
| Microsoft 365 (all) | Everything in the three entries below |
| Exchange Online | Outlook and Exchange Online: mail, calendar and contacts |
| SharePoint & OneDrive | SharePoint and OneDrive, including file sync |
| Microsoft Teams | Teams calls and meetings: audio, video and screen sharing |
| Google Meet | Google Meet calls and meetings |
| Zoom | Zoom meetings: audio, video and screen sharing |
| Cisco Webex | Webex meetings audio, video and screen sharing |
These preset ranges are automatically updated by the vendors, so they stay current without you having to edit anything.
For configuration details, see the Subnets and Exit Nodes configuration guides.