Terms and Definitions

The Conductor or Airwall Gateway that is set to be used by default in a high-availability configuration. Also called primary or master.

A command-line interface that allows you to deploy and configure Airwall Gateways. See Airshell Command Line.

Software that runs on a laptop or mobile device that allows that device to connect securely to resources on an Airwall secure network according to trust policies set up by an administrator of an Airwall Conductor.

A term that refers to all of the hardware and software that manages trust policies on an Airwall secure network, including Airwall Agents and Servers, Airwall Gateways, and Airwall Relays.

A physical, virtual, or cloud gateway that protects the devices connected to it, and manages the devices' communication according to the trust policies set up by an administrator of an Airwall Conductor.

Physical Airwall Gateways, depending on the model, can have built-in Ethernet, Wi-Fi, and Cellular (2G, 3G, 4G LTE modems), as well as Serial-over IP for the flexible link connectivity options. You can also deploy virtual and cloud Airwall Gateways.

Airwall Invitations provide a simpler way to add people’s mobile phones, tablets, and computers to your Airwall secure network. At a minimum, sending invitations automatically provisions and manages people as they connect. You can also set up the invitation to place people into overlays to define what resources they can reach on the network, access windows when they can connect, and other settings.

An Airwall Relay routes encrypted communications between resources and Airwall Edge Services. Relays reduce network complexity and enable complete connectivity between disparate systems. An Airwall Relay provides a private identity namespace that eliminates the need for public IP addresses and inbound firewall rules to connect devices.

A virtual air-gap solution that ensures your devices are completely invisible, where you can secure and micro-segment network communication and remote access between devices over your existing network.

Software that runs on a server computer that allows that server to connect securely to resources on an Airwall secure network according to trust policies set up by an administrator of an Airwall Conductor.

List of assets that are allowed access on your network.

Sending bypass traffic through a designated Airwall Gateway set up to handle traffic out of and into the Airwall secure network. The Airwall Gateway that is handling bypass traffic is called a bypass egress gateway.

Traffic leaving the Airwall secure network (for example, traffic to and from the Google DNS servers or the Internet). See also seamless bypass or backhaul bypass.

Hiding or making invisible endpoints on an overlay (secure) network. Cloaking is a unique function of HIP and the Airwall Solution.

The physical, virtual, or cloud service that centrally manages connections and trust for an Airwall secure network. The Conductor provides one centralized location for you to set up and manage Airwall Edge Services and trust policies between them to create, manage, and monitor your Airwall secure network. It is not involved in the data that is exchanged between Airwall Edge Services and the devices they protect.

List of assets that are denied access on your network.

A setting on an Airwall Agent or Server that forces all traffic on the device to go through the secure HIP tunnel.

Host Identity Protocol

HIP is the secure protocol used by the Airwall Solution to provide secure networks. HIP is an open standard that separates the role of an IP address as both host identity and location within a network, such that hosts are instead identified using cryptographic identities in the form of public keys. You can then define device-to-device trust relationships based on the host identity instead of the IP address.

An Airwall Conductor that's installed in an isolated (or "dark") environment, with no access outside of the private network. See License a Conductor and Airwall Edge Services in an Isolated Environment.

A setting on an Airwall Agent or Server that only allows HIP traffic on the device.

The interface to Metadata Access Points. Airwall Edge Services use this client/server protocol to communicate with the Conductor, which provides authentication keys and communication policy to them.

Compartmentalizing your network into isolated segments in which devices are only exposed to each other when they have a need to communicate.

Overlays are virtual networks that make up your Airwall secure network that connect and establish trust between two or more Airwall Edge Services and the devices they protect.

The secured communications channels you create with an overlay are encrypted HIP tunnels that allow trusted devices to communicate securely with each other across the network. These communication channels are controlled by the Airwall Edge Services deployed throughout the underlay and administered by the Conductor.

Seamless Bypass allows you to separate traffic (split tunnel) going through your Airwall Gateway, where you selectively encrypt and tunnel some traffic, while allowing other traffic to pass through the Airwall Gateway unchanged. This ability also allows protected devices to securely communicate with devices or network locations that are not protected by Airwall Edge Services, such as software update servers on the Internet.

Configuring an Airwall Gateway for seamless bypass permits traffic between the secure overlay network and an insecure underlay network, where the Airwall Gateway acts similarly to an SNAT (Source Network Address Translation) gateway. Connections initiated from the underlay network are still blocked, but connections initiated from a protected device to a permitted bypass destination are allowed.

The Conductor or Airwall Gateway that is standing by to take over if the active one fails in a high-availability configuration. Also called secondary.

Encapuslating network traffic in an encrypted connection between two points (for example, similar to a VPN). A tunnel refers to the encrypted connection that is passing traffic.

Your existing Layer 2 networks, including the internet if your Airwall secure network traverses it. Airwall Edge Services (Gateways, Agents, and Servers) and the Conductor connect to the underlay over which you establish the Airwall secure network.