# Deploying SAMURAI in air-gapped environments

> A single docker load, an offline IEEE OUI database, and TLS that assumes self-signed certificates: everything you need to run SAMURAI without internet access.

**Operations** · 2026-03-11 · 4 min read · By Beyrak A., Founder & Security/System Engineer at SAMURAI

**Key takeaways**

- Air-gapped means zero external connectivity after install: no license server, no telemetry, no update checks.
- Every lookup ships in the image, including a 39,000-entry IEEE OUI database resolved locally in microseconds.
- Credentials are AES-256-GCM encrypted at rest; the only traffic SAMURAI generates is to the devices you point it at.

## Why air-gapped matters

Many networks that need monitoring the most (government, defense, financial, critical infrastructure) operate in air-gapped or severely restricted environments. No internet access. No SaaS. No cloud APIs. No calling home for license validation. If your monitoring tool requires an internet connection for anything beyond the initial install, it is unusable in these environments.

SAMURAI is designed from the ground up for offline operation. Once deployed, it requires zero external connectivity. Every dependency is bundled. Every database is embedded. Every lookup table ships with the image.

## The deployment stack

The full stack runs from [a single docker run](https://nometa.az/en/docs/): data store, API server, and the web dashboard served by the same binary. The entire deployment fits on a single mid-tier VM: no Kubernetes, no microservices, no distributed coordinator. For a true air gap, pull the image on a connected machine, move it across with `docker save` and `docker load`, and run it inside the enclave; nothing in the container ever needs to reach out.

Configuration lives in a single environment file: the database URL, the application port, and the sync interval (default: 3600 seconds). Runtime-tunable settings (CORS origins, syslog forwarding, sync schedule, branding) are hot-reloaded without restart.

## Offline OUI database

Vendor identification for [endpoint discovery](https://nometa.az/en/blog/endpoint-correlation-without-cmdb/) relies on the IEEE OUI (Organizationally Unique Identifier) database. Most tools fetch this from the IEEE website at runtime. SAMURAI ships a 39,000-entry OUI database embedded in the binary. No HTTP call. No DNS resolution. The lookup is a local map access that resolves a MAC prefix to a manufacturer name in microseconds.

## TLS and self-signed certificates

Air-gapped networks almost universally use self-signed certificates or internal CAs that are not in any public trust store. SAMURAI disables TLS verification on all device connectors: APIC, FMC, NDO, Palo Alto, ISE, vCenter. This is a deliberate design choice for the target environment, not a security shortcut. In a network where every certificate is self-signed and there is no path to a public CA, strict TLS verification is not security; it is a deployment blocker. (For SAMURAI's own HTTPS, you can bring your own PKI: generate a CSR and install your certificate from Settings.)

> Where every certificate is self-signed, strict TLS verification is not security. It is a deployment blocker.

## Encryption at rest

Device credentials are encrypted at rest with AES-256-GCM under an operator-supplied key. Encrypted fields include device passwords and secrets, SMTP credentials, the LDAP bind password, and notification tokens. Decryption happens at the service layer, never inside a device connector.

## No cloud dependencies

There is no license server. No telemetry. No update check. No analytics beacon. Authentication runs locally with short-lived access tokens and role-based permissions resolved per-request, not fetched from an external identity provider.

The monitoring dashboard, the sync engine, the change detection pipeline, the endpoint aggregation, the traffic simulation: everything runs on that one VM behind your firewall. The only network traffic SAMURAI generates is to the devices it monitors, on ports you explicitly configure.

---

Canonical page: https://nometa.az/en/blog/air-gapped-deployment/
Part of SAMURAI, a self-hosted, multi-vendor network monitoring & security platform. Overview: https://nometa.az/llms.txt
Contact: info@nometa.az · Docker Hub: https://hub.docker.com/r/beyrak44/samurai