narrowin OT Connect — One secure design, deployed to every site.

[ Walkthrough ]

Watch a site go from name to deployed.

[ The reality ]

Every site needs the same secure network. Truck rolls don't scale.

The energy transition is building networks fast: hundreds of distributed sites, each one needing the same secure connection. Hand-configuring a snowflake at every station, and proving it's secure, doesn't scale.

20–2,000+ substations, heat centres, PV and EV sites to connect securely
No IT technician on site, so zero-touch provisioning is mandatory
Proprietary SD-WAN: hidden licensing, short hardware life, high overhead
Mixed use cases per site, all on one network: heat, metering, solar, charging
B3S Fernwärme, IKT-Minimalstandard, NIS2: security that must be proven

[ Use cases ]

One infrastructure, every use case.

One OT Connect design covers every use case, often several at the same site, cleanly segmented, centrally secured, operated as one.

01 · DISTRICT HEATING

Heat networks

Control systems, sensors and actuators at producers, storage and transfer stations across a growing heat grid.

Outcome: every station on one segmented design.

02 · METERING

Smart metering

Meter infrastructure, head-end systems and data collection. Connectivity for thousands of measurement points.

Outcome: metering data, securely backhauled.

03 · SOLAR

Solar / PV

Distributed solar plants, inverters and monitoring. Remote sites that have to reach the control centre reliably.

Outcome: PV sites online without a truck roll.

04 · E-MOBILITY

EV charging

Charging infrastructure, backend connectivity and billing. A use case that has to stay isolated from the rest.

Outcome: charging on its own clean VLAN.

[ Capabilities ]

What OT Connect does.

A proven template, a generator that stamps it into sites, and one encrypted network to run.

Design oncethe site template

Proven architectures

Reference OT-WAN architecture● proven

Site profiles per type● defined

VLAN-per-use-case plan● mapped

IP & addressing scheme● set

Start from OT designs proven in production. Customize IP, VLANs and site parameters, don't design from zero.

One template, every use case

One port template carries heat, metering, solar and charging: each use case its own VLAN, cleanly segmented.

Fiber or 4G/5G, one design

The same design uses fiber where it exists and 4G/5G where it doesn't. Primary or backup, no redesign.

Generatethe Site Generator

Pick a template, name the site

SITE TEMPLATE

LargeSiteFiber✓

Remote4G

…

SITE NAME

Oberruntigen Trafo

Generate & create →

Pick a proven site template and name the site. The generator builds the full configuration: no manual setup, no error sources.

Full configs, not snippets

Router configuration● generated

IP addressing● generated

WireGuard keys● generated

Firewall rules● generated

VLAN assignments● generated

Complete device configs (router, switch and VPN concentrator), consistent across every site, guaranteed.

Zero-touch provisioning

Hardware ships with a bootstrap config. Plug it in; the full config pulls on first boot. No technician on site.

Operatethe network

WireGuard, end to end

Every tunnel between sites is WireGuard-encrypted. Modern cryptography, minimal overhead, no VPN licensing.

Dual-uplink failover

Health checks and automatic failover keep critical sites online when a link drops. Fast convergence, no manual switchover.

Central policy & logging

L3 segmentation · per site & use case

Central east-west policy

Syslog / NetFlow

IDS / SOC integrationready

East-west traffic routes through central security policy. Logging, NetFlow and IDS/SOC integration, managed from one place.

Across the portfolio

The network doesn't run blind. Every site and link OT Connect deploys shows up in narrowin Explorer's topology, and site syslog flows to narrowin Log Analytics. Connectivity, visibility and observability on one foundation.

[ How it works ]

From a proven design to deployed sites.

A repeatable process that scales: the design is done once, the rest is generated and shipped.

1

Start from a proven design

Begin with a reference OT-WAN architecture, customized to your environment: IP plan, VLANs and site profiles.

2

Define your site types

Monitoring station, heat centre, substation. Define each profile once and reuse it for every location.

3

Generate the configs

The Site Generator builds complete device configs from a site name: router, switch and VPN concentrator.

4

Ship & deploy

Hardware ships with a bootstrap config. Zero-touch provisioning brings each site live on first boot.

[ Details ]

The specifics.

Technical specifications

Site hardware	Vendor-agnostic: supported routers and switches (MikroTik, Garderos and others); long lifecycle, no lock-in
Encryption	WireGuard: modern, high-performance encryption for all transit traffic
Uplinks	Fiber and 4G/5G: dual-uplink with health checks and automatic failover
Segmentation	Layer 3 separation; VLAN per use case; central east-west policy
Site Generator	Full device configs from a site name: router, switch, VPN concentrator
Provisioning	Zero-touch: bootstrap config, full config pulled on first boot
Management	Central web platform: Site Generator, central policy and logging
Scale	Tested to 2,000+ sites, no architecture change as you grow
Compliance	Designed to B3S Fernwärme, IKT-Minimalstandard, NIS2, IEC 62443 and ISO 27001 principles
Licensing	Site-count tiers, no per-device fees
Documentation	/docs/ot-connect (login) →

Frequently asked

What does the Site Generator generate?

Complete device configurations, not snippets. Full router, switch and VPN concentrator configs, IP addressing, WireGuard keys, firewall rules and VLAN assignments, ready to deploy.

Do we design the network from scratch?

No. OT Connect starts from pre-built OT architectures proven in production. You customize the baseline (IP addressing, VLANs, site parameters) rather than designing from zero.

What hardware does it run on?

It is vendor-agnostic. The design runs on supported routers and switches such as MikroTik and Garderos, chosen for long lifecycle and low total cost of ownership, with no proprietary lock-in.

How does zero-touch provisioning work?

Devices ship with a bootstrap configuration that connects to your management hub on first boot. The full config, already generated, is pulled automatically. No on-site expertise required.

How does it scale, and how is it licensed?

Templates per site type, the config generator and central management scale from tens to 2,000+ sites with no architecture change. Licensing is by site-count tier, with no per-device fees.

How does it meet B3S, IKT-Minimalstandard and NIS2?

The architecture implements the core security principles directly: defense in depth, least privilege, the zone trust model, redundancy and segmentation. The network design itself supports the required standards.

[ Proof ]

Already running in production.

“

Consistent segmentation and central management keep the network secure and manageable. With zero-touch provisioning and the template-based architecture, it scales as the heat networks grow.

Paul KempfManaging Director · Zweckverband Breitbandversorgung Landkreis Lörrach

In production today

OT Connect runs in district-heating and smart-metering networks in Switzerland and Germany, including IBB Brugg and Breitband Lörrach, where the design scales from the first stations toward thousands.

IBB BruggBreitband LörrachCH + DE

[ Related work ]