✨ AI
Sign inBook a demo
Back to rConfig Vector

MSP network configuration management architecture

Vector, built the way MSPs really work

Your devices are in your customers' networks. You do not own those networks, and you cannot always open their firewalls. Some customers are in countries with their own rules on where data can live. So Vector puts an agent in each customer network and one server in the middle. When you grow into many countries, you add a Central Manager.

Book a demoRead the Vector docs
The Vector architecture, light: agents in four customer networks reporting to one Vector ServerOne Vector Server for every customer network, with an optional Vector Central Manager above it for many countries. Vector Agents in four customer networks connect to it: two over the internet using outbound TLS by default, and two over a customer VPN or MPLS link in the optional bidirectional mode.Central ManagerOptional, for many countriesVector ServerCentral platformCUSTOMER AVector AgentInternetCUSTOMER BVector AgentInternetCUSTOMER CVector AgentVPN or MPLSCUSTOMER DVector AgentVPN or MPLSOutbound TLSby defaultOptionalbidirectionalmodeThe Vector architecture, light: agents in four customer networks reporting to one Vector ServerOne Vector Server for every customer network, with an optional Vector Central Manager above it for many countries. Vector Agents in four customer networks connect to it: two over the internet using outbound TLS by default, and two over a customer VPN or MPLS link in the optional bidirectional mode.Central ManagerOptional, for many countriesVector ServerCentral platformCUSTOMER AVector AgentInternetCUSTOMER BVector AgentInternetCUSTOMER CVector AgentVPN or MPLSCUSTOMER DVector AgentVPN or MPLSOutbound TLS by defaultOptional bidirectional mode over VPN or MPLS
View full size
View the full architecture
The problem

Three Questions
Every MSP Gets Asked

  • What do we need to open?

    Every new customer starts with a firewall change request. Weeks disappear before the first backup runs.

  • Where does our data live?

    Customers and regulators want to know exactly where their network configurations are stored, and who can reach them.

  • What happens when you grow?

    One more customer, one more region, one more country. Most NCM tools answer with another server to patch and license.

The Vector architecture answers all three by putting each job where it belongs.

The layers

Three Layers.
Most MSPs Need Two.

Vector splits the work into layers. Each layer can grow on its own, and you can put it wherever your rules say it must go. Most MSPs only need a Vector Server and its agents.

  1. LAYER 1 · CUSTOMER EDGE

    Vector Agent

    A lightweight Go collector deployed inside each customer network. It connects to routers, switches, firewalls and more over SSH, collects configurations close to the devices and applies changes. Stateless and horizontally scalable.

    • Backups
    • Config retrieval
    • Command execution
    • Policy checks
    Secure connectivity
  2. LAYER 2 · SERVER

    rConfig V8 Vector Server

    The heart of the deployment. It stores configurations, backups and change history, schedules jobs through its agents and provides the full V8 Pro feature set: search, diff, rollback, compliance, reporting and notifications. Hosted in your data centre or private cloud.

    • Storage
    • Jobs
    • Compliance
    • Reporting
    • Customer separation
    Intelligence layer
  3. LAYER 3 · OPTIONAL

    Vector Central Manager

    For multi-server and multi-country estates. Holds the global inventory, users and roles, and orchestrates work across every Vector Server over a RabbitMQ message bus. Deployed with rConfig Professional Services.

    • Global inventory
    • Orchestration
    • RabbitMQ
    • Central user management
    Inventory and scale layer
Vector architecture for MSPs: one rConfig V8 Vector Server connected to Vector Agents in four customer networks, over secure unidirectional internet and bidirectional VPN or MPLS links
Figure 1. One Vector Server for every customer network. Internet and VPN customers sit side by side on the same server.

View full sizeOpen interactive diagram

Contact us for a demo
Connectivity

Outbound by Default.
Two-Way When You Need It.

Every customer network is different. Some will never open a port. Others are already connected to you over MPLS. Vector supports both, and a single Vector Server can mix them across customers.

Secure unidirectional and bidirectional connectivity compared
Secure unidirectionalBidirectional
TransportInternetVPN, MPLS or private WAN
Who connectsThe agent opens an outbound, encrypted connection to the Vector ServerEither side. Through the Vector Hub, the Vector Server can also start sessions into the customer network
Customer firewallNo inbound rules. An outbound-only agent is all that is neededUses the routed path you already have
Backups and changesScheduled backups and configuration changes, fully supportedScheduled backups and configuration changes, fully supported
AddsBaseline, nothing extra to configureReal-time backups triggered from the Vector Server · Live interrogation of devices · Vector Access to end devices through the agent
Best forNew customers, small offices, locked-down networksLarger accounts already on your WAN, NOC-driven operations

Start every customer outbound only. Move them to bidirectional when the link exists and the operation calls for it. Nothing about the agent changes.

Adding agents to Vector

Bidirectional mode

What Two-Way Mode Adds

Outbound only is the default, and it covers scheduled backups and configuration changes. When a customer is already on your VPN, MPLS or private WAN, you can turn on bidirectional mode. The Vector Hub, a service that runs alongside the Vector Server, then holds a two-way connection to the agent.

Vector Access to customer devices

With bidirectional mode on, your team can log in to a device in the customer's network through the agent, using Vector Access, without leaving Vector.

How it works

  • A user opens Vector Access in Vector.
  • The session passes through the Vector Hub to the customer's Vector Agent.
  • The agent connects the user to the device in the customer network.
The Vector Agent runs the job on local devices, and a user can use Vector Access through itInside the customer site, the Vector Agent runs the job against the local devices over SSH. In the optional bidirectional mode, a user can log in to a device through the agent with Vector Access.UserOpens a terminalCUSTOMER SITEVector AgentRuns the jobLocal devicesSSHOptional: a user logs in to a devicethrough the agent with Vector Access.The Vector Agent runs the job on local devices, and a user can use Vector Access through itInside the customer site, the Vector Agent runs the job against the local devices over SSH. In the optional bidirectional mode, a user can log in to a device through the agent with Vector Access.UserOpens a terminalCUSTOMER SITEVector AgentRuns the jobSSHLocal devicesOptional: a user logs in to a devicethrough the agent with Vector Access.
View full size

  • Real-time backups

    Start a backup from the Vector Server the moment you need one, instead of waiting for the schedule.

  • Live device interrogation

    Ask a device for its current state, right now, from the Vector Server.

  • Mix the modes

    Scheduled backups and configuration changes work in both modes. Each customer can use the mode that suits them, on the same Vector Server.

Onboarding

From Signed Contract
to First Backup

  1. Add the customer

    Add the customer to your Vector Server with its own inventory, jobs, policies and audit history.

  2. Deploy the agent

    Install the Vector Agent on a Linux or Windows host inside the customer network, by hand or automated through the REST API.

  3. Choose the connection

    Outbound only over the internet, or bidirectional through the Vector Hub over the customer's existing VPN, MPLS or private WAN link.

  4. Import devices and attach policies

    Reuse the global policies and reports you have already defined for every other customer.

  5. Back up, change, prove

    Scheduled backups start immediately. Changes, compliance checks and per-customer reports run from one console.

  6. First backup, done

    About 1 hour

    In most cases, once your Vector Server is running and the agent can reach the customer's devices. Firewall changes, device access and approvals can add time.

A first MSP customer typically goes from installation to working backups in one to two weeks. Once your customer template is stable, new customers usually take one to three days.

Choosing an agent deployment methodVector Server installation

Data sovereignty

Central Control.
Data Stays In-Country.

Your customers may be in many countries, and each country has its own rules on where data can live. With Vector, you run a Vector Server in each country, inside its own border. The Central Manager gives you one list of devices and one set of users across all of them.

  • A Vector Server per country. Configurations, backups and change history are stored in the country they came from.
  • One Central Manager. Global inventory, users and roles. Each device is assigned to its home region and work is dispatched to the right server.
  • RabbitMQ between them. Queues per region carry jobs down and status back over AMQP with TLS. Only orchestration data and job messages cross borders.
Multi-country Vector architecture: Vector Central Manager and RabbitMQ orchestrating Vector Servers in Ireland, Germany and Australia, each inside a sovereign data boundary
Figure 2. Vector Servers in Ireland, Germany and Australia, each inside its own sovereign boundary, orchestrated by the Vector Central Manager over RabbitMQ.

View full sizeOpen interactive diagram

Every multi-country estate can start as Figure 1. Add the Central Manager and regional servers when the business needs them.

Vector Central Manager overviewMessage queuing with Vector CM

The Vector Suite

The Vector Suite

The server, the agents and the portal work as one. Running a large, global MSP or enterprise? Our Professional Services team can help you build it with robust support and full control.

Security

Self-Hosted,
Inside Your Perimeter

  • No SaaS dependency

    Every layer runs on infrastructure you control. rConfig has no access to your data unless you grant it.

  • Encrypted in transit

    Agent to server over TLS. Server to Central Manager over AMQP with TLS.

  • Customer separation

    Each customer has its own inventory, jobs and audit history, with hierarchical RBAC across your NOC and scoped access for customers.

  • Built for resilience

    Central tiers support active or warm-standby HA pairs. Agents are stateless, so a failed agent hands work to a peer instead of losing scheduled backups.

NIS2 complianceDORA complianceHA options

Deployment

Pick the Shape
That Fits Today

  • Single Vector Server

    One Vector Server, agents at each site or customer. The standard model for small and mid-size MSPs and single-region enterprises. See Figure 1.

  • MSP with many customers

    One Vector Server hosted by the MSP, one agent per customer network, internet and VPN customers side by side, customer separation and reporting for each customer. Add Vector Prism for branded customer portals.

    Explore Vector Prism

  • Multi-country

    A Vector Server per country or region with the Vector Central Manager on top. For global MSPs and enterprises with data residency obligations. Delivered with Professional Services. See Figure 2.

    Explore Professional Services
Documentation

Read the
Vector Documentation

Vector Architecture, Frequently Asked Questions

Do I need the Vector Central Manager?

Most MSPs and enterprises do not. A Vector Server and its agents cover the vast majority of deployments, including MSP operations with many customers. The Central Manager is for estates with multiple Vector Servers, usually across countries, and is deployed with rConfig Professional Services.

What do customers need to open on their firewall?

Nothing inbound. In outbound-only mode, the default, the Vector Agent makes an outbound, encrypted connection to your Vector Server. If the customer is already on your VPN, MPLS or private WAN, you can add bidirectional mode through the Vector Hub.

What does bidirectional connectivity add?

Bidirectional mode runs through the Vector Hub, a service that runs alongside the Vector Server. It needs a routed path into the customer network, such as VPN, MPLS or private WAN. It adds real-time backups triggered from the Vector Server, live interrogation of devices, and Vector Access, which logs an engineer in to a device through the agent.

Can one Vector Server mix both connection modes?

Yes. Each customer can use whichever mode suits their network, on the same Vector Server.

Where is configuration data stored in a multi-country deployment?

On the Vector Server in each country. The Central Manager holds global inventory, users and orchestration state, and exchanges job and status messages with each server over RabbitMQ. Where no metadata may leave a region, Vector can run as fully separate deployments per jurisdiction.

Can I start small and grow into multiple countries later?

Yes. Start with one Vector Server and agents. When you add countries, deploy regional Vector Servers and the Central Manager. Your agents, policies and workflows carry on as before.

Map Your Customers Onto Vector

Bring your customer list, your connectivity mix and any data residency requirements. We will walk through a working Vector demo in both connection modes and sketch the architecture that fits, from one server to many countries.

Book a demoRead the docs

Back to rConfig Vector