Preview: under engineering review. This documentation is a working draft prepared from the security packet and reference architecture. Items marked to confirm are placeholders for REAP engineering to verify before publication. Not indexed by search engines.

Documentation

Connector cluster: components, sizing, high availability

Agent and proxy virtual machines behind a load-balanced virtual IP inside your network: the only REAP components that touch devices.

Components

ComponentRoleNotes
Connector (agent + proxy)Pulls configurations and polls metrics (CLI, SNMP); receives telemetry (syslog, SNMP traps, gNMI (opens in a new tab) subscriptions) and flow records (NetFlow or IPFIX) where you configure them; brokers credentials from your PAM; forwards to the platformDeploy at least two per site or domain for availability
Virtual IP (VIP)Single address to which devices publish telemetry, load-balanced across connectorsLets a connector be replaced without touching device configuration
Platform servicesDiscovery, config tracker, monitoring, topology, reasoningRun in REAP Cloud, your cloud account or your data center per the deployment model

Sizing

ScaleConnectorsvCPU / RAM / disk per connectorNotes
Pilot: 50–250 devices, one or two sites2e.g., 4 vCPU / 16 GB / 200 GBOne VIP
Production: up to N devices per cluster2–4One cluster per site group or security zone
Telemetry rateevents/s and metrics/s per connectorSize disk for local buffering during outages buffer duration

High availability

  • Two or more connectors behind the VIP; loss of one connector does not interrupt collection.
  • Local buffering and replay when the platform is unreachable: whether supported, and for how long.
  • Connector health is visible in the console and alertable.

Lifecycle

  1. Provision VMs per sizing; open the firewall rules on the network requirements page.
  2. Install the connector package; register it with the platform using a one-time enrollment token enrollment procedure.
  3. Configure the VIP; point device syslog, SNMP trap and (where used) gNMI (opens in a new tab) dial-out destinations at it.
  4. Attach the credential source (PAM safe or vault path) and the read-only device account.
  5. Verify: discovery reaches all in-scope devices; telemetry rate is as expected; health is green.
  6. Upgrades: rolling, one connector at a time; rollback by reinstalling the previous package.
Engineering to confirm
  • Connector VM sizing and supported hypervisors / container hosts
  • Buffering duration and disk sizing rule
  • Enrollment procedure and token lifetime
  • Maximum devices per connector cluster

Last reviewed: October 7, 2026 (draft) · Owner: solutions engineering · Corrections: security@reapnet.ai