For Live data, Historical data logging, Datalogging to MQTT broker, and Alarms & Notifications you'll need to set up a data source and add variables. This article shows you how to do this for communication via OPC UA.

Manufacturers that support OPC UA: B&R, Beckhoff, Beijer, Fanuc, Lenze and more.

For help and solutions with issues, see OPC UA data source issues and solutions.

• Prepare the machine
• Add a data source
• Find the address of your OPC UA variables
• Add variables
• Client and server certificates
• Live data, Historical data logging, Alarms & Notifications

• Remove a data source

Prepare the machine

The edge gateway supports the following methods of authentication with the OPC UA server on your machine. Make sure your OPC UA server is configured to support at least one of these.

(1) Only supported on SecureEdge and SecureEdge Pro firmware 2026.06 and up (upgrade). Not supported on older firmware or other models.

1. Set up the OPC UA server on your machine to support one of the above methods.
   • If you're looking to set Security mode and Security policy to None, see below for machine-specific instructions. If your machine is not listed, please contact the manufacturer of the machine or the developer of the OPC UA server for instructions.
     Beckhoff OPC UA server

     During the installation of the OPC UA server for Twincat 3 (TF6100), you need to turn on Enable none/none endpoint. If you already have the OPC UA server installed, reinstall it with this option turned on.

     
     PLCnext OPC UA server

     Deactivate the general user authentication to be able to set the Security mode and Security policy to None.

     
   • If instead you're looking to use Security mode Sign or Sign & encrypt, the precise instructions differ per machine or OPC UA server. Please consult the manufacturer of the machine or the developer of the OPC UA server for instructions. IXON is unable to provide assistance in this step.

In the next chapter, when you add the data source, you need to select which authentication method you want to use. Regardless of your choice, communication between the edge gateway and the IXON Cloud is always secure (more info).

Add a data source

The machine will need to be added as an OPC UA data source.

2. Go to Fleet Manager > Devices and click on your device name.
3. In the left menu, go to Data sources.
   • Tip: You can switch between the Card view , with useful data source information at a glance, and the List view . For more information, see Data sources overview FAQ.
4. Click onAdd data source and select OPC UA.
5. Enter the requested information (details below) and click on Add.

   Field	Description
   Name	Enter a name for the data source.
   Identifier	The identifier is entered automatically and ensures that every data source remains unique, even if they share the same name.
   IP address	Enter the IP address of your machine. Leave empty for localhost, if you're using an IXagent, or if you're adding this data source for a Docker container on a SecureEdge Pro.
   Port	The port number will be entered automatically (port 4840 for OPC UA).
   Authentication type	Select an authentication method that your OPC UA server supports and enter your credentials if required. For more information, please view Prepare the machine.
   Security mode	The security mode determines whether the communication between the edge gateway and the OPC UA server is signed or signed and encrypted. Make sure that your OPC UA server supports the selected Security mode. For more information, please view Prepare the machine. If the OPC UA server does not support the Security mode and Security policy configured in the data source, the data source will fall back to Security mode and Security policy None. Option Description None The communication between the edge gateway and the OPC UA server is not signed or encrypted. Sign Supported hardware SecureEdge and SecureEdge Pro, firmware 2026.06 and up (upgrade) IXrouter3 (unsupported) IXrouter2 (unsupported) The communication between the edge gateway and the OPC UA server is signed, which ensures the integrity of the communication by authenticating the origin of each message. Sign & encrypt Supported hardware SecureEdge and SecureEdge Pro, firmware 2026.06 and up (upgrade) IXrouter3 (unsupported) IXrouter2 (unsupported) The communication between the edge gateway and the OPC UA server is signed and encrypted, which both ensures the integrity of the communication by authenticating the origin of each message and the confidentiality of the communication by encrypting it.
   Security policy	The security policy determines how the communication between the edge gateway and the OPC UA server is signed or signed and encrypted, when Security mode Sign or Sign & encrypt is selected. If you did not select a Security mode, leave the Security policy to None. Make sure that your OPC UA server supports the selected Security policy. For more information, please view Prepare the machine. If the OPC UA server does not support the Security mode and Security policy configured in the data source, the data source will fall back to Security mode and Security policy None. Option Description None Select this if you did not select a Security mode. Other Supported hardware SecureEdge and SecureEdge Pro, firmware 2026.06 and up (upgrade) IXrouter3 (unsupported) IXrouter2 (unsupported) If you did select a Security mode, select a Security policy that your OPC UA server supports.
   Polling sleep time	The edge gateway will continuously request data from the machine. This then enables you to log aggregated values, like the average value or the maximum value that occurred, and to trigger alarms when certain conditions are met. The polling sleep time is the time that the edge gateway waits before asking data again, after it just received data from the machine. A polling sleep time of 100ms is recommended to minimize CPU load on the edge gateway and machine. In the rare case that you are experiencing a high CPU load on the machine, you can increase this setting to reduce the load. Make sure it's shorter than your shortest logging interval to prevent missing data.
   Error grace period	Supported hardware SecureEdge and SecureEdge Pro, firmware 5.0 and up (upgrade) IXrouter3, firmware 3.25 and up (upgrade) IXrouter2 (unsupported) In rare situations, mainly during the startup period of a PLC, the PLC might already accept communication attempts from the edge gateway, but it may not be fully ready yet. It might then return errors or 0-values instead of the actual values. This may result in no data (missing data) or incorrect data being read. The error grace period can be configured to bridge this moment and only start polling variables after the configured time, granting the PLC sufficient time to fully start up and maintaining the reliability of the machine data. An error grace period of 0 seconds (Off) is recommended. In the rare case that you are experiencing no data (missing data) or incorrect data during startup you can increase this setting to bridge that period.
   Use custom broker	Leave this unchecked unless you are following instructions for Datalogging to MQTT broker.

Find the address of your OPC UA variables

You'll need to know your variable's data type and address.

Data type
The following table shows an overview of all equivalent data types in the IXON Cloud.

Address
The variable's address consists of a namespace index, identifier type, and identifier. Below we'll be using UaExpert to find these attributes.

6. Open UaExpert, go to Server and select Add.
7. Enter a Configuration Name, go to the Advanced tab, enter "opc.tcp://" followed by the IP address and port number (default 4840) separated by a colon (e.g. opc.tcp://192.168.140.10:4840), and press OK.
   
8. Go to Server and select Connect.
9. In the Address space window, find and select your variable.
10. The variable's NamespaceIndex, IdentifierType, and Identifier will appear in the Attribute window in the top right.
    

Add variables

Once you've added a data source and have your OPC UA addresses, you can start adding variables.

11. Go back to the IXON Cloud.
12. The Variables tab of your data source should have automatically opened.
    • If it didn't: Go to Fleet Manager > Devices, click on your device name, go to Data sources, click on your data source, and go to the Variables tab.
13. Click onAdd variable.
14. Enter the requested information (details below) and click on Add.

    Field	Description
    Name	Enter a name for the variable.
    Identifier	This identifier is a computer-friendly rewrite of the "Name" and ensures that every variable remains unique, even if they share the same name. This identifier is not the same as your OPC UA variable's Identifier (value "20001" in the top-right corner of the example image shown above). That, instead, needs to be entered in the field Value.
    Type	Select the variable's data type (bool, int, float, etc). UINT64 is supported up to a value of 9.223.372.036.854.775.807 (263-1).
    Length	(for String data types only) The String length.
    Namespace	The namespace index is the first part of the variable's address. Find the address of your OPC UA variables.
    Identifier type	The identifier type is the second part of the variable's address. Find the address of your OPC UA variables.
    Value	The identifier value is the third part of the variable's address. Find the address of your OPC UA variables. Enter the identifier value exactly as you see it. If it contains quotes, include the quotes as well. If you are reading data from an array, append the identifier value by ;ir=<index>. For example, if the identifier value would be 20001 and the array index that you want to read is 5, then you enter: 20001;ir=5 . This syntax is only compatible with identifier type String.
    Factor	Multiplies the value. Leave empty if the data type is boolean. For information on where this factor is and isn't used, see How to use factors in Live Data and Historical data.
    Unit	Displayed behind the value (e.g. kg).

15. Repeat the previous steps for every variable you want to add or click Import from CSV-file near the top right corner to add variables in bulk instead.
    • The structure of the CSV file is explained here: Import variables: CSV file structure.
    • Using Export to CSV-file and Import from CSV-file enables you to easily copy variables from one device to another device. Alternatively, you can also use device templates.

You have now made the changes in the IXON Cloud, but these are not yet active in your device. You will need to push your changes to your device for them to take effect.

16. Click on Push device config in the top right corner.

Client and server certificates

If you have set up your OPC UA server and data source to work with Sign or Sign & encrypt, you'll need to make sure that the certificates are in order or it will simply not function. The client certificate from the edge gateway needs to be added to the OPC UA server, and the server certificate from the OPC UA server needs to be added to the edge gateway, so both trust each other. If you did not choose to work with Sign or Sign & encrypt, you can skip this certificates chapter.

17. Connect locally to one of the LAN ports of the edge gateway or set up a VPN connection.
    • The local web interface is not accessible from the WAN side (Cloud port and also OT/LAN port when it's configured as WAN2).
18. Open a new browser tab, go to the edge gateway's LAN IP address, and log in.
    • The default LAN IP address is 192.168.140.1.
    • If you're connecting locally, make sure that your laptop has an IP address in the same range. You may need to configure this manually. There are many online guides on this if you need a step by step guide.
    • The default username is admin.
    • The default password (PW) is printed on the side of the edge gateway.
    • The number of login attempts is limited per time window, in compliance with cybersecurity standard IEC 62443-4-2. By default, the number of login attempts is limited to 5 per 1 minute, replenishing a login attempt every 1 minute. We recommend you configure this to align with your corporate security policy. Do so by logging in and going to Administration > Authentication.
    • You can change the password by logging in and going to Administration > Change password.
19. Go to Certificates and find the correct data source. Certificates are organized per data source.

Client certificate

The edge gateway's client certificate needs to be trusted by the OPC UA server.

20. Some OPC UA servers may automatically trust the edge gateway's client certificate and do not require any manual steps. That depends on the OPC UA server.
    • If that is the case, you can skip this client certificate chapter.
    • It is not possible to see in the IXON Cloud or the edge gateway's local web interface whether this is the case.
    • For more information, please contact the manufacturer of the machine or the developer of the OPC UA server. Alternatively, you can also try to proceed without manually trusting the client certificate on the OPC UA server. If in the end it doesn't work, you will need to follow the steps in this chapter.
21. Under Client certificate, you can find anddownload the client certificate.
    • A client certificate is automatically generated after you've pushed a valid data source configuration with at least 1 variable to the edge gateway. This may take a moment.
    • If no client certificate is listed, the data source is incomplete. Please make sure that the data source configuration is correct and that at least 1 variable is added.
22. Go to your OPC UA server settings on your machine and add the edge gateway's client certificate as a trusted certificate. For specific instructions, please contact the manufacturer of the machine or the developer of the OPC UA server.
23. Set a reminder for yourself to generate a new client certificate and add that new certificate to the OPC UA server before it expires, to prevent loss of data.
    • The certificate is valid for ~2 years (730 days). This duration cannot be configured. It is fixed.
    • It is recommended to not wait until the very last moment, to prevent unnecessary loss of data.
    • To generate a new client certificate, click on Renew certificate and repeat the previous steps to make the OPC UA server trust the edge gateway's client certificate. If the client certificate expires, the edge gateway will automatically generate a new client certificate. After making the OPC UA server trust the new client certificate, you may need to restart the OPC UA server (or entire machine) or the edge gateway to make it reconnect the OPC UA connection.
    • If the client certificate expires before a new certificate has been arranged, data logging will stop until the expired certificate is resolved. Data that occurred during the time that the certificate was invalid, cannot be logged retroactively. It is gone forever.

Server certificate

The OPC UA server's certificate needs to be trusted by the edge gateway.

24. Some OPC UA servers may automatically share their server certificate with the edge gateway. That depends on the OPC UA server.
    • If this is the case, you'll notice a certificate appear under Rejected server certificates. You may need to refresh the page if you already had it open. Rejected server certificates are not used by the edge gateway when communicating with an OPC UA server.
    • Server certificates are not automatically trusted. You'll need to manually Trust the certificate. The OPC UA connection between the edge gateway and the OPC UA server is automatically restarted, using the trusted certificate.
25. If no server certificate has automatically appeared, you'll need to manually upload a server certificate from the OPC UA server.
    • Supported certificate formats: DER, PEM.
    • The precise instructions differ per machine or OPC UA server. Please consult the manufacturer of the machine or the developer of the OPC UA server for instructions. IXON is unable to provide assistance in this step.
    • Once you have the server certificate, upload the server certificate at Trusted server certificates. The OPC UA connection between the edge gateway and the OPC UA server is automatically restarted, using the trusted certificate.
26. Set a reminder for yourself to arrange a new server certificate and add that new certificate to the edge gateway before it expires, to prevent loss of data.
    • The certificate's expiration date depends on the OPC UA server and is visible under Trusted server certificates.
    • It is recommended to not wait until the very last moment, to prevent unnecessary loss of data.
    • To generate a new server certificate, consult the manufacturer of the machine or the developer of the OPC UA server for instructions. IXON is unable to provide assistance in this step. If the server certificate was previously shared automatically with the edge gateway by the OPC UA server, you may need to restart the OPC UA server (or entire machine) or the edge gateway to make this happen again, if it doesn't automatically. Once you have a new server certificate, make sure the edge gateway trusts the certificate by repeating the previous steps.
    • When the server certificate expires, it will automatically be moved to Rejected server certificates. Expired server certificates cannot be moved to trusted.
    • If the server certificate expires before a new certificate has been arranged, data logging will stop until the expired certificate is resolved. Data that occurred during the time that the certificate was invalid, cannot be logged retroactively. It is gone forever.

Live data, Historical data logging, Alarms & Notifications

Now that the data source and variables have been set up, you can continue below.

27. Click below to continue in the feature specific articles.
    • Live data
    • Historical data logging
    • Datalogging to MQTT broker
    • Alarms & Notifications

Remove a data source

Deleting a data source is permanent and cannot be undone. All logged data that is linked to this data source or its variables will also be permanently removed.

1. Go to Fleet Manager > Devices and click on your device name.
2. In the left menu, go to Data sources.
3. Click on the data source you wish to remove.
4. In the top right, open More optionsand select Remove data source.