Connectivity details

This topic details the connectivity details between CONNECT, a PI to CONNECT Agent, and PI Server.

Connection

• All communication sessions are initiated outbound from the PI to CONNECT Agent to CONNECT. This architecture eliminates the need to open inbound ports on the corporate firewall, simplifying network security configurations.

• The agent fully supports corporate proxy configurations and integrates seamlessly with AVEVA’s DMZ Secure Link technology, providing an additional layer of isolation for customers operating within segmented or restricted network environments.

• The agent is typically installed on a separate machine from PI Server. It pulls data internally from PI (port 5450) and handles the external transmission.

• For enhanced security, the agent can be deployed on a dedicated host located in a demilitarized zone (DMZ).

• PI Server itself maintains a complete air-gap from the internet. All communication is managed through the agent, ensuring that the PI System remains isolated and internally contained.

• All communications between the agent and CONNECT utilize TLS 1.2 or higher, ensuring transport-level encryption of all transmitted data. At present, the agent does not implement payload-level encryption or encryption-at-rest for locally stored information.

• The agent uses the following authentication methods:

  • Agent to PI System: The agent authenticates with the PI System by using Windows Integrated Security, supporting Kerberos and service account configurations.

  • Agent to CONNECT: Authentication relies on secure, token-based client credentials issued at the time of initial registration with CONNECT. These credentials are managed through controlled provisioning workflows to ensure traceability and secure access.

Payload

• The following data is exchanged:

  • Outbound: Time-series data (PI points), Asset metadata (AF elements), and health diagnostics.

  • Inbound: Strictly limited to lightweight configuration control messages targeting the agent itself—such as start, stop, or retry operations. No inbound commands can modify or influence the configuration or operation of PI Server.

• No configurations can be sent from CONNECT to PI Server. CONNECT sends configuration commands to the agent (such as start transferring tag X), but it cannot modify the configuration of PI Server itself.

• All payloads are fully encrypted in transit.

Application

• The agent maintains a continuous connection for streaming, pushing data approximately every 30 seconds (or when buffers fill).

• If the agent is not connected, it buffers data locally. Upon reconnection, it automatically triggers a backfill process to retrieve and upload the missing historical data from Data Archive.

• We do not recommend letting the agent connect only periodically, such as once a month. The system is architected for streaming. While it can backfill, connecting only once a month would introduce massive latency and is not a supported operating mode.

• The agent supports transferring from Data Archive and optionally one PI Asset Framework (AF) Server.

API access and control

• The PI to CONNECT Agent does not expose a public API interface for external programmatic control or data retrieval.

• Certain cloud-side management APIs exist to perform administrative actions, such as initiating or halting the agent service remotely. These APIs are restricted to authorized AVEVA services, and related documentation is available upon request.

Usage reporting mode

The Usage-Reporting-Only mode within the PI to CONNECT Agent provides a controlled, secure, and compliant method for reporting license usage data to CONNECT. It is specifically designed to:

• Limit data transfer to essential licensing information.

• Ensure all communication is outbound-only from the customer environment.

• Prevent any operational or real-time PI System data from leaving the premise.

• Maintain compliance with AVEVA Flex licensing and corporate data protection standards.

Data scope and payload

• The following fields represent the complete set of outbound data transmitted in Usage-Reporting-Only mode:

  • PI Server name (optional). Customers have the ability to set any alternative display name in the agent's configuration utility to hide the real server name.

  • Licensed tag count (total number of PI points under license).

  • Basic usage metrics necessary for AVEVA Flex licensing validation.

• If the agent is configured only to send usage information it will only use the following API from Data Archive:

  • Connect to Data Archive and get basic information (ID, name, version, collective structure, and so on).

  • Get license information.

  • Get snapshot statistic (to get total number of points).

• License usage reporting involves retrieving the PI point count from the connected Data Archive:

  • For installations using the aggregate PI point licensing model, the agent transmits the actual active PI point count from Data Archive.

  • For systems licensed under a traditional point count limit, the agent reports the maximum licensed PI point total as the official usage value.

• No time-series records, tag names, timestamps, values, or AF attributes are included in the transmitted payload in Usage-Reporting-Only mode mode. Operational data remains entirely within the on-premises environment.

Connection behavior

• Usage data is transmitted automatically once per day in a small, resource-efficient payload.

• A temporary loss of connectivity between the agent and CONNECT has no effect on the operation of PI Server or any associated PI System components. However, if disconnection persists for an extended period, it may lead to potential non-compliance with AVEVA Flex licensing terms. AVEVA monitors license reporting activity daily and may identify prolonged inactivity for follow-up.

Compliance and governance

• Customers maintain full administrative control over the activation and configuration of Usage-Reporting-Only mode, including the ability to enable, disable, or reconfigure reporting options as needed.

• The destination configuration for outbound usage data is also under customer control, ensuring transparency and flexibility in governance and compliance management.