Vector agent connectivity
Outbound by default, two-way when needed. Every Vector Agent can run on an outbound connection alone. Bidirectional connectivity is optional and adds hub-initiated features on top of the core backup and change capability.
The two modes
| Secure unidirectional (internet) | Bidirectional (VPN, MPLS or private WAN) | |
|---|---|---|
| Transport | The agent opens an outbound, encrypted connection to its Vector Server over HTTPS. All connections are agent initiated | The routed path the customer already has into the MSP: VPN, MPLS or private WAN. The Vector Server can also initiate sessions |
| Firewall requirements | No inbound rules at the customer edge. The agent needs outbound access to the Vector Server on HTTPS (port 443 or the configured port), and the server needs a valid certificate | A routed path from the Vector Server into the customer network, on top of the agent’s outbound access |
| Supported operations | Scheduled backups and configuration changes | Scheduled backups and changes, plus hub-initiated real-time backups, live interrogation and proxy jump to end devices (Vector Access) |
| Best fit | Onboarding new customers quickly, and customers with no private link to the MSP | Customers already on a VPN or MPLS link to the MSP, and operations that need real-time or hands-on access |
The agent-side requirements are in Adding agents: the Vector Server must expose an HTTPS port to the agent, self-signed certificates are not supported, and the agent authenticates with its source IP and an API token.
Mixing modes on one server
A single Vector Server can mix both modes across its customers. A common pattern is to start every customer outbound-only, then move a customer to bidirectional when a routed link exists and operations need it. Nothing changes on the server’s side of the design: Figure 2 shows both modes on one hub.
Figure 3 uses bidirectional connectivity throughout: agent to server over the MSP backbone, and access node to each customer over a VRF or tunnel. Figure 5 is bidirectional over the provider’s own management network. Figure 6 is outbound only, through each zone firewall.
Vector Hub and the live channel
Vector Hub is an optional service on the rConfig server. Agents dial in to it over an outbound WebSocket (WSS on port 8443), and once connected the server can push commands to them in real time: Vector Access sessions, remote agent restarts and near-instant job pickup. The live channel is enabled per agent and is off by default.
Vector Access requires bidirectional mode: a VPN, MPLS or a private WAN between the Vector Server and the agent’s site. It does not run over an agent’s outbound-only connection, so internet-only customers do not get Vector Access. See the Vector Access guide.