Secure connectivity
Zero trust access with WireGuard, managed from the cloud
Firecradle is in development. Zero trust access (ZTNA) over WireGuard is in preview. When you turn on the cloud management relay, the firewall dials out to the console, so cloud management needs no inbound firewall rule. Firecradle runs fully on its own without it.
How each connection works
Optional - off by default
Cloud management relay
- The firewall opens an outbound WebSocket to the cloud console. The cloud never connects in.
- It runs only when the appliance is paired to your cloud account and the relay is turned on. The relay setting is off by default.
- When enabled, no inbound firewall rule or port forward is needed for cloud management.
- The relay is a transport, not an authority. The appliance login and roles still apply.
- The relay carries management requests. It is not end-to-end encrypted.
- An unpaired appliance opens no cloud connection.
Customer-approved
Support sessions
- Takelan support requests a session. An owner or admin of your organization must approve it.
- Default length is 60 minutes. The maximum is 4 hours.
- A request nobody answers stays open for up to 24 hours. That is the request, not an access window.
- A session covers one organization and one device.
- You can ban support access for your organization.
- Support session activity is audited.
Preview
Roaming endpoint tunnel (ZTNA)
- The endpoint agent connects over WireGuard to the firewall itself. The firewall listens inbound on a WireGuard UDP port. This path is not outbound only.
- The cloud brokers short-lived grants of 5 minutes, each gated by a posture check. The cloud holds no private keys and does not carry the traffic.
- Preview: the code is complete but has not yet been exercised against a live firewall, and the macOS backend is unobserved.
Firecradle connects to the Takelan platform only if you choose to. Read how the Cradle products stay connected on the platform page.
Secure connectivity on takelan.com