# On-prem connectors

Most Mesh connectors reach your source systems directly from the cloud. But some
systems live inside your own network — behind a firewall or VPN, with no public
endpoint. **On-prem connectors** let Mesh collect from those systems by running a
small piece of software, the **Axiad edge agent**, inside your environment.

The agent makes only **outbound** connections to Mesh. You never open an inbound
port, and your internal systems are never exposed to the internet.

## Who does what

Setting up an on-prem connector involves two roles. They can be the same person,
but they often aren't.

- **Mesh administrator** — works in the Mesh dashboard. Registers an agent, hands
  its install command to whoever runs your servers, then configures and tests
  connectors once the agent is online.
- **Agent operator** — works on a host inside your network (often your IT or
  infrastructure team). Runs the agent and keeps it running.

The two roles hand off exactly once: the administrator issues a **one-time
enrollment token**, and the operator uses it to bring the agent online.

## How it fits together

1. The **administrator** registers an agent in the dashboard and gets a one-time
   token plus a ready-to-run command.
2. The **operator** runs that command on a host in your network. The agent enrolls
   and connects — outbound only.
3. The **administrator** sees the agent turn **Enrolled**, adds one or more
   connectors to it, and tests each connection.
4. Mesh collects from your internal systems through the agent, on the schedule you
   set.

## What you'll need

- A host inside your network running **Linux with Docker** (or a compatible
  container runtime) that can reach your internal systems and make outbound
  **HTTPS (443)** to Mesh.
- A **Mesh administrator** account with permission to manage connectors.

> **note**
The edge agent is **outbound-only**. It opens no inbound ports, so there's no
firewall rule to add for incoming traffic — only outbound HTTPS to Mesh.

## Start here

- **[Set up an on-prem connector](./set-up-on-prem-connector.md)** — for Mesh
  administrators: register an agent, then add and test connectors.
- **[Run the edge agent](./run-the-edge-agent.md)** — for agent operators: install,
  run, and verify the agent on a host in your network.