Setup Guide for Administrators

This guide covers user management, infrastructure setup using Siemens Industrial Edge, deploying the Asset Gateway, and verifying the connection to industrial devices.

1. User Management and Security

Add users via the Xcelerator Admin Console to grant them access to the IAH application.

Roles and Permissions

First User: The very first user to access the IAH application is automatically assigned the Administrator role.
Subsequent Users: Any subsequent users logging in are granted the least permissive privileges by default.
Role Management: The IAH administrator can reassign roles to expand or restrict user functionality. For further information, see Configure Access Management.

Securing Server Credentials

Manage credentials for a Server user (used for API access) in the Xcelerator Admin Console. Because these credentials grant broad access, handle them with extreme care:

Security Best Practices for Server Credentials

Always encrypt credentials during transfer.
Store them in a secure, centralized secrets manager.
Strictly enforce the principle of least privilege regarding who can access them.

2. Infrastructure Setup: Industrial Edge

IAH provides transparent, centralized status for field devices discovered by apps like the SIMATIC Automation Tool and Asset Gateway running on Industrial Edge Devices (IED).

Preparing the Industrial Edge Environment

Set up your Industrial Edge Management (IEM) and Industrial Edge Devices (IED) following the official Setup Guidelines and Recommendations. Validate that endpoints listed in the Network security guide are reachable.

Onboarding the IED to the IEM

Register your IED with your IEM and connect it to a network capable of reaching the IEM, the IAH cloud, and your local assets.

Note

Use Google Chrome when accessing Edge Management UIs to avoid compatibility issues.

Gather Device Info: Obtain the IP address and MAC address of your IED (often visible on an attached monitor during IED startup or via a switch management console).
Access IEM: Log in to your Industrial Edge Management UI (https://<IEM_Address>).
Add Device: Navigate to Edge Devices and click the + (New Edge Device) button.
Configure Device: Provide a name, a local username, and a password for the device.
Finalize Network: Click Next, add the network configuration, and input the MAC address.
Import Config: Take the resulting onboarding file and import it onto the physical IED.

Configuring the IED Network (Layer 2)

Configure Layer 2 network access on the IED to discover assets effectively (e.g., using the SIMATIC Automation Tool) on the target subnet.

Note

Layer 2 configuration is only required for Asset Links that use broadcast-based discovery protocols: SIMATIC Automation Tool, PROFINET Asset Service, and Ethernet IP Connector. When using only Asset Link SNMP or the Default IP Scanner, skip this step. See Asset links for details.

Connect to the IED's local UI (https://<IED_IP>).
Complete the network configuration by enabling and assigning the Layer 2 interface that bridges to your asset network.

uml diagram

Network configuration of the IED

Figure: Network configuration of the IED

3. Deploying the Asset Gateway

Deploy the Asset Gateway in two steps: first create the logical gateway in the IAH cloud to get a configuration file, then install the application on your physical IED.

Assign the Asset Gateway application to your IEM from the Industrial Edge Marketplace before proceeding.

Step 1: Create the Gateway in IAH

Log in to the IAH application.
Go to the Gateway configuration page.
Click the Add Gateway button at the top right.
Provide a name and optional description. (Duplicate names are allowed; the system uses a unique ID).
(Optional) Specify an Access group. If left blank, it defaults to your standard group.
Click Add and download.

Secure the Configuration File

The downloaded gateway-config.json contains a registration token valid for only 30 minutes. This token authenticates the physical device to your cloud tenant. Treat this file like an admin password. Do not share it.

If the token expires before you finish installation, generate a new one by opening the Gateway details in IAH and clicking Create new.

Step 2: Install the Gateway on the IED

In your IEM, go to the Catalog and click Asset Gateway.

Figure: Applications in the catalog of the IEM
Click Install.
Check the box next to gateway-config.json.
Click the Edit (pencil) icon.

Paste the entire contents of the file you downloaded from IAH into the editor. See the example below for the expected structure.

{
   "gatewayId": "<gateway_id>",
   "xfUrl": "https://gateway.<region>.sws.siemens.com/...",
   "registrationToken": "<jwt>",
   "httpsProxy": "https://proxy.example.com:8080",
   "httpProxy": "",
   "noProxy": "",
   "appConfig": {
     "defaultIPScanner": {
       "passiveScan": {
         "enabled": false,
         "networkInterface": "eth0"
         }
      }
   }
}

Figure: Example of a gateway-config.json file

Optional: If your network requires a proxy, manually add the required values to the respective proxy fields before saving.
Optional: If you want to enable passive scanning via the Default IP Scanner, set passiveScan.enabled to true. For further information see Default IP Scanner.
Click Update.
Click Next.
Select your target IED.
Click Install Now.
Check the IAH web interface to verify the gateway has connected. Once connected, the hourglass icon will disappear. If the gateway does not connect, restart the app on the IED.

Update the Asset Gateway version

To deploy a newer version of the Asset Gateway:

In the IEM Catalog, click Asset Gateway and press Install.
Do not check the gateway-config.json box. Just click Next.
Select your Edge Device and click Install Now.

Update the Asset Gateway configuration

To update the configuration of an already installed Asset Gateway (e.g., to change proxy settings or enable passive scanning):

In the IEM select My Installed Apps.
Find your Edge Device and click at the three dots of the IAH Asset Gateway app.
Select Update configuration.
Check the box next to gateway-config.json and click the Edit (pencil) icon.
Paste the adapted configuration as needed and click Update.
Select Operation - Restart in the dropdown and click Update Now.

(For deleting a gateway, see Deleting gateway.)

4. Deploying Asset Links

Asset Links act as the protocol-specific middleware (e.g., PROFINET, SNMP, Ethernet IP) between the gateway and your field devices. Install them via the IEM catalog.

General Installation Steps

Follow this installation pattern for all Asset Links:

In the IEM Catalog, click the Asset Link you want to install.
Click Install.
If the Asset Link has a configuration file, edit it as described in the link-specific sections below.
Click Next, select the target IED, and click Install Now.

gRPC Registry Configuration

Configure Asset Links communicating with the Asset Gateway on the IED with the following gRPC registry settings:

Host name: grpc-server-registry
Port: 50051

SIMATIC Automation Tool

No additional configuration is required. Follow the general installation steps.

Asset Link SNMP

During installation, edit snmp.json by clicking the pencil icon.
Define your SNMP profiles (defaults to V1/V2c with 'public' community string if left blank).
Click Update and continue with device selection.

PROFINET Asset Service

During installation, edit connector-config.json.
Find the registryHost field and replace the default value cssvcregistry with grpc-server-registry.
Click Update and continue with device selection.

Ethernet IP Connector

During installation, select the Edge Device.
Configure the Discovery Broadcast parameter to match the subnet of your Ethernet IP devices and click the icon to activate the configuration.

Figure: Discover Broadcast Configuration
Click Next, select the devices, and click Install Now.

5. Verification and Next Steps

After deploying the gateway and links, verify that everything communicates correctly.

Check Local Connectivity (IED to Assets)

Log in to the local UI of your IED (https://<IED_IP>).
Open the SIMATIC Automation Tool app.
Click RESCAN to force a local broadcast. Your local network assets should appear in the list.

Figure: Assets shown by SIMATIC Automation Tool

Note

If the scan hangs, restart the SIMATIC Automation Tool application from the IED management page.

Run Your First Cloud Discovery Scan

Open the IAH application and navigate to the Inbox.
Click Scan.
Select your onboarded Asset Gateway and the desired Asset Link (e.g., SIMATIC Automation Tool).
Click Scan to initiate the process.

Once the scan completes, your discovered assets appear in the Inbox. Each entry shows the asset name, IP address, and the Asset Link that discovered it. If no assets appear, verify that the Asset Link is running on the IED and that the gateway status on the Gateway configuration page shows as connected.

Any questions left?

Ask the community