en de

Connecting a gateway without the agent

Previous

Connecting a gateway without the agent

Not every gateway can or should run the Pallax Agent. This guide walks you through manually provisioning a gateway and connecting it without the agent, step by step.

What you end up with — and what you don't

A gateway without the agent still connects securely to the platform, and certificates and monitoring both work. Two things are missing compared to a gateway with the agent:

  • No remote command and no live console on the gateway detail page — both require a running agent.
  • No CPU, memory, disk, or uptime values on the Monitoring tab. These tiles permanently show "awaiting agent telemetry" — that's the expected state for a gateway without the agent, not an error. The radio-technology-specific activity (e.g. uplinks) still appears on the Monitoring tab, because it doesn't come from the agent.

Step 1: Provision the gateway, skip the agent connection

Start the wizard for provisioning a new device in your workspace, choose the radio technology (LoRaWAN or Mioty) and Gateway as the type. On the Agent Connection step, click Skip Agent Connect. The platform confirms: "Manual mode — enter your gateway ID on the next step."

Step 2: Enter the gateway ID

On the next step you enter the gateway ID in EUI-64 format — 16 hexadecimal characters. For LoRaWAN the field is labeled "Gateway ID (EUI-64)"; for Mioty it's labeled "Base Station EUI". Both expect the same format, without separators.

Finish the wizard via Review & Create. The summary shows the connection type as "Manual Entry".

Step 3: Download the certificate

Open the newly provisioned gateway and switch to the Certificates tab. The platform has already issued a certificate for the gateway — you don't need to request one. Click Download certificate, then Download bundle (.zip).

The download dialog offers two formats:

  • Public certificate + CA chain (default) — contains client.crt and the certificate chain, no private key. This bundle is safe to share.
  • Full bundle incl. private key (PKCS#8) — additionally contains the gateway's private key and is intended only for actual device provisioning. The platform requires explicit confirmation for this, because anyone holding this key can impersonate the gateway to the broker.

For most purposes the default format is enough. Export the private key only if you actually need to install it on the gateway — and delete it from your machine afterward.

Step 4: Enter the broker endpoint

On the same page, the platform shows you the endpoint of the broker responsible for your radio technology (LoRaWAN broker or Mioty broker), with a button to copy it. Enter this endpoint together with the downloaded certificate files into your physical gateway's connection settings — exactly how depends on your device's firmware and isn't part of this guide.

Step 5: Checking whether the connection is up

Since no agent is running, the platform shows you the connection status via the radio-technology-specific activity on the Monitoring tab (e.g. incoming uplinks) once your gateway starts sending data. The CPU/memory/uptime tiles deliberately stay empty during this — that's not a sign of a problem.

Renewing certificates

If an agentless gateway's certificate expires or is rotated, nobody installs it automatically. The platform issues the new certificate right away, but your gateway keeps using the old one until you download the new bundle again via Step 3 and install it on the device by hand. Nothing goes offline in the process — the old certificate stays valid until it expires, so you can plan calmly when to install the new one.

  • Devices — the Certificates tab at a glance.
  • Pallax Agent — the alternative where certificates arrive automatically.
Cortex in depth