Supported MQTT brokers and CloudVPN hardware

Supported MQTT brokers include, but are not limited to:

• Azure IoT Hub
• Azure Event Grid
• Amazon Web Services (AWS) IoT Core
• Eclipse Mosquitto broker
• HiveMQ

Supported CloudVPN hardware:

• CloudVPN router, firmware 3.24 and up
• CloudVPN Agent (unsupported)

Introduction

With Data logging to MQTT broker, you log your machine data directly to a 3rd party MQTT broker instead of the CloudVPN Portal. As such, it's an alternative to the feature Historical data, where the machine data is logged to the CloudVPN Portal. The MQTT broker can either be self-hosted or it can be run at an online service like Azure or Amazon Web Services (AWS). From there, you can process, analyze, visualize, and use the data in any way that your project requires.

If there is no internet connection available for the CloudVPN router, your data is not lost. The CloudVPN router will then continue logging data and can store it locally for months at a time, depending on how much data you log. This data is locally not accessible. Once the internet connection has been restored, the logged data will be sent to your MQTT broker.

• Read machine data
• Add an MQTT broker
• Send machine data to the MQTT broker
• Troubleshooting
• Frequently asked questions

Read machine data

The machine will need to be added as a data source in the CloudVPN Portal and its variables will also need to be added.

Several communication protocols are supported. This is the protocol that the CloudVPN router will use to locally communicate with your machine. If you're unsure whether your machine supports one of these protocols, please check with the manufacturer.

1. Add a new data source with variables, or use an existing one. Follow the instructions in one of the articles below to create a new one and come back here once you have.
   • BACnet/IP
   • Digital Input (GPIO)
   • EtherNet/IP
   • MELSEC
   • Modbus TCP
   • OPC UA
   • Plain-text TCP
   • Siemens S7
   • SMTP

Add an MQTT broker

First you'll need to set up an MQTT broker for the CloudVPN router to send data to.

2. Set up an MQTT broker.
   • You can host one yourself or run it at an online service like Azure or AWS. For instructions, please consult the service provider's documentation.
   • The MQTT broker needs to support encrypted connections. Unencrypted connections are not supported by Data logging to MQTT broker.
   • The MQTT Client ID in the MQTT broker (sometimes called Device ID) needs to be equal to the CloudVPN router's public ID. You can find the CloudVPN router's public ID in the URL by going to the device in the CloudVPN Portal Fleet Manager. For example: cloudvpn.acirroplus.com/fleet-manager/device-configurator/mxLCEyXfR5Lx/.....

Router's Public ID

Once you have an MQTT broker available, it needs to be added to the CloudVPN Portal.

3. Go to Admin > MQTT and add a custom broker.
4. Enter the requested information (details below) and click on Confirm.

   Field	Description / instructions
   Name	Enter a name for the MQTT broker.
   Host	Enter the hostname or IP address of your MQTT broker.
   Port	Enter the port of your MQTT broker.
   CA certificate	(optional) If your MQTT broker provider also provides a CA certificate or if you added one yourself, upload it here. Publicly trusted certificates generally don't need to be uploaded manually.
   Message format	The message format determines the format of the data message sent to your MQTT broker. JSON (default) The JSON representation of the Sparkplug B payload format (example below, details in chapters 6.4.5 and 6.4.6 of the Sparkplug B specification). Less data efficient, but human readable. { "timestamp": 1697611645, "metrics": [{ "name": "Machine state", "alias": "machine-state", "timestamp": 1697611511, "dataType": "String", "value": "Emergency stop" }], "seq": 2 } Sparkplug B A binary encoded message format that uses protocol buffers to (de)serialize data. More data efficient and recommended for cellular connections. The data message will need to be decoded using protocol buffers (see chapter 6.4.1 of the Sparkplug B specification below). Online service providers may have a built-in feature to decode Sparkplug B messages. Only the payload format of the Sparkplug B specification is implemented (chapter 6).
   Clients	The MQTT client is the authorization to communicate with your MQTT broker. Multiple clients can be added to a single MQTT broker. Supported authorization methods: no authentication (leave all fields empty), username/password, certificate, key file. Azure IoT Hub With Azure IoT Hub, the username needs to be the following format. The API version is optional, but recommended for long-term stability. Replace {IOT_HUB_HOSTNAME} and {IOT_HUB_DEVICE_ID} with your IoT Hub Hostname and Device ID. {IOT_HUB_HOSTNAME}/{IOT_HUB_DEVICE_ID}/?api-version=2021-04-12 With Azure IoT Hub, the password needs to be a SAS token, which you can generate within Azure IoT Hub. For more instructions, please consult the Azure documentation.

You have now made the changes in the CloudVPN Portal, but these are not yet active in your device. These will automatically be applied to your device later at step 9.

If you make any changes to the MQTT broker and client configuration afterwards, these will need to be manually applied by rebooting the device (either locally or remotely in the CloudVPN Portal) or pushing a configuration to the device (if available).

Send machine data to the MQTT broker

Now that your data source is configured and your MQTT broker has been added to the CloudVPN Portal, you can start sending your machine data to your MQTT broker.

5. Go to Fleet Manager > Devices and click on your device name.
6. In the left menu, under Services, click on the data source you previously created.
7. At the bottom, under MQTT, enable Use custom broker.
8. Select your MQTT broker and client, and enter a topic.
   • Don't see your MQTT broker and client? Go to Admin > MQTT and make sure that a client is added to your MQTT broker. A client is required. More information at step 4.
   • Some MQTT broker providers require data to be sent to a specific topic. If you're unsure, please consult the service provider's documentation.
     • With Azure IoT Hub, the topic needs to be the following format. Replace {IOT_HUB_DEVICE_ID} with your IoT Hub Device ID.
       

       devices/{IOT_HUB_DEVICE_ID}/messages/events/

You have now made the changes in the CloudVPN Portal, but these are not yet active in your device. You will need to push your changes to your device for them to take effect.

9. Click on Push config to device in the top right corner.

Your CloudVPN router will now start sending machine data to your MQTT broker, according to how you configured the tags in the data source. Please note that only Historical data is sent to your MQTT broker. The Run test feature, Live data, and Alarming still work via the CloudVPN Portal.

Troubleshooting

This chapter contains information and tips to help troubleshooting if Data logging to MQTT broker doesn't work.

• Double check the instructions in this article. Do not skip this step, because the instructions may contain the solution to your problem. Some examples:
  • The MQTT broker needs to support encrypted connections. Unencrypted connections are not supported by Data logging to MQTT broker.
  • The MQTT Client ID (sometimes called Device ID) in the MQTT broker needs to be equal to the CloudVPN router's public ID. You can find the CloudVPN router's public ID in the URL by going to the device in the CloudVPN Portal Fleet Manager. For example: cloudvpn.acirroplus.com/fleet-manager/device-configurator/mxLCEyXfR5Lx/....
  • When selecting the MQTT broker and client at your data source: Don't see your MQTT broker and client? Go to Admin > MQTT and make sure that a client is added to your MQTT broker. A client is required. More information at step 4 of this article.
  • Some MQTT broker providers require data to be sent to a specific topic. If you're unsure, please consult the service provider's documentation.
• Test if your MQTT broker is accessible and working.
  • There are numerous MQTT client applications available for testing (e.g. MQTT Explorer). Have a look under "Tools and Applications" at mqtt.org/software for a complete list.
• Unsure what the status is of the MQTT connection?
  
  • In your MQTT broker (environment) you should be able to see if there is an active MQTT connection and also if data is being received.

Frequently asked questions

Can you send data to an MQTT broker on the LAN side of the CloudVPN router?

Yes. However, note that it's still required for the MQTT broker to support encrypted connections. Unencrypted connections are not supported by Data logging to MQTT broker.

What if the MQTT broker certificate has expired?

You'll need to upload a new, valid, certificate to your MQTT broker settings at Admin > MQTT in the CloudVPN Portal.

The CloudVPN router will automatically download the latest configuration from the CloudVPN Portal, which includes your uploaded certificate. So long as the MQTT connection fails, the CloudVPN router will repeat this process every few minutes, but it can also be manually triggered by rebooting the device (either locally or remotely in the CloudVPN Portal).

While the CloudVPN router has no MQTT connection, the CloudVPN router will continue logging data and can store it locally for months at a time, depending on how much data you log. This data is locally not accessible. Once the MQTT connection has been restored, the logged data will be sent to your MQTT broker.

What if the certificate has not expired, but is replaced?

If a new certificate has been uploaded to your MQTT broker settings at Admin > MQTT in the CloudVPN Portal, these will need to be manually applied by rebooting the device (either locally or remotely in the CloudVPN Portal) or pushing a configuration to the device (if available).