Architecture and server roles

Management plane

The Management Server is the only role administrators need to browse directly. It stores policy and reputation data, registers data-plane nodes, receives telemetry, and provides the combined SMB and DNS operational view.

When an administrator saves policy, Management actively pushes the update to the relevant node. The application payload and reply are encrypted with ChaCha20-Poly1305 and authenticated with the enrollment secret. Nodes also pull periodically as a recovery path.

The Management role does not proxy SMB traffic and does not resolve production DNS traffic in the recommended topology.

SMB data plane

Clients connect to the SMB Proxy Node on TCP 445. The node opens a separate TCP 445 connection to the real file server and relays SMB2/SMB3 frames in both directions.

During client-to-server write flows, Axiom can collect file name and SMB metadata, count bytes, inspect signatures and archive indicators, calculate entropy, and stream SHA-256 and MD5 state without loading the complete file into memory. Completed hashes can be checked against the centrally managed reputation feed.

The strongest topology rule is external to the process: firewall policy must deny client networks direct access to the real file server and allow TCP 445 to that server only from the SMB Proxy Node. Otherwise clients can bypass inspection.

DNS data plane

The DNS Security Node listens on UDP and TCP 53. It evaluates local allow, monitor, and block policy, serves configured local A/AAAA records, uses its response cache, and forwards approved queries to the selected upstream resolvers.

Threat-feed URLs are optional and administrator-controlled. A clean deployment should not begin blocking broad domain lists until explicit policy has been reviewed and applied.

Air-gapped and restricted environments

Axiom core enforcement does not require cloud connectivity. Offline license activation uses an .axact request exported from Management and a signed .axlic response imported back into Management.

An SMB Proxy Node normally needs no internet access. A Management Server needs no internet access for core control-plane operation. A DNS Security Node needs only the network access required to reach its selected upstream resolvers and optional threat-feed sources. In a fully isolated environment, use internal upstream DNS and import policy data through controlled procedures.

Lab role

standalone_lab runs Management with optional SMB and DNS services on one machine. It is useful for demonstrations but can introduce routing and port ownership complexity. Do not treat it as the default production design.