Device Management
Overview
Section titled “Overview”The Devices page is your control center for everything you have deployed. It is where you check whether a device is healthy and online, grab credentials, adjust request details, and jump into ARROW Manager to do hands-on work like deploying VMs. If a device goes quiet mid-engagement, this is the first place you look.
Device Lifecycle
Section titled “Device Lifecycle”A device moves from a request you submitted, through provisioning and shipping, to on-site and operational, and finally back to the warehouse when your engagement ends. The status on each device tells you exactly where it sits in that journey.
Device lifecycle from request to return
Device lifecycle from request to return
| Status | What it means | What you can do |
|---|---|---|
pending | Request awaiting approval | View details, edit the request |
provisioning | Device being prepared | Monitor progress |
shipping | Device ready for pickup | View tracking info |
in-transit | Device with the carrier | Track the shipment |
on-site | Delivered and operational | Full device management |
returned | Back at the warehouse | View archived details |
Viewing Your Devices
Section titled “Viewing Your Devices”Once a device is provisioned it shows up on the Devices page as a card, with a total count under the page title. Use the toggle in the page header to switch between the card view and a compact list view, which is handy when you are managing a lot of devices at once. The refresh icon beside it pulls live status.
1 2 3 - 1 Filter by status, type, or client to find a device fast when you have a lot of them.
- 2 A physical device card: client, hostname, NetBird IP, and a shortcut into ARROW Manager on the device.
- 3 A virtual machine card. Once the image is built, Download and Copy URL let you grab it, and the ARROW Control badge shows the on-device tooling.
When the list gets long, the collapsible filter rail between the sidebar and the cards narrows it down without leaving the page. You can search by device name, client, or serial number, and filter by Status (All Devices, Online, Offline, Maintenance, Returned, Decommissioned, Completed (Historical), Overdue Returns, and Offline & Overdue), by Type (All Types, ARROW Device, or Virtual Machine), and by Opportunities or Consultants. A Show completed toggle at the bottom pulls finished engagements back into view. The Status and Type filters show a count next to each option so you can see the shape of your fleet at a glance.
Reading a Device Card
Section titled “Reading a Device Card”Physical Device Cards
Section titled “Physical Device Cards”A physical device card leads with the client logo, the hostname, and a row of status icons, then gives you the facts you check most often:
| Field | What it tells you |
|---|---|
| Client | The client organization for this engagement |
| Location | Physical or IP-based location (shows “Locating…” while it resolves) |
| Hostname | The device hostname |
| NetBird IP | The VPN IP you use to reach the device remotely |
| Engagement | The engagement state derived from your request dates, such as Pending, Active, or Completed |
Below the facts, an ARROW Manager button (labeled with the on-device Manager version) launches the local dashboard. The opportunity number and assigned consultants sit underneath as tags, and Show Details expands the card in place to reveal the rest without leaving the page.
Show Details expands a device card in place for the fuller picture
Show Details expands a device card in place for the fuller picture
The status icons in the top-right corner are the fastest way to spot trouble without opening anything:
| Icon | Status | What it means |
|---|---|---|
| Heartbeat | Health Monitor | Device metrics health, updated every minute |
| Ethernet Port | Primary Adapter | Connected via Ethernet, the primary connection |
| Signal Bars | Failover Adapter | Running on cellular failover |
| Shield Check | VPN Status | The VPN connection is stable |
| Cube | VM Status | A virtual machine is deployed and healthy |
Virtual Machine Cards
Section titled “Virtual Machine Cards”VMs get their own cards. Alongside the client, location, hostname, and NetBird IP, a VM card adds a VM Image row with Download and Copy URL buttons for the image, a Built date showing when the image was created, the Engagement state, and an ARROW Control button (labeled with its version) that opens the on-device control interface.
Browsing Available Images
Section titled “Browsing Available Images”Before you request or deploy anything, it helps to know what your images actually contain. The Images section lists the operating system images your organization can deploy and the security tooling baked into each one, showing the base OS, version, visibility (public or private), and a tool count.
The Images page listing an available image with its OS, version, visibility, and installed tool count
The Images page listing an available image with its OS, version, visibility, and installed tool count
Use the filter rail to narrow images by status, operating system, and visibility. Open an image to see the full list of installed tools in its App Library, so you can confirm a build has what your engagement needs before you commit to it.
Device Actions
Section titled “Device Actions”The […] menu on any device card is where the per-device actions live:
Opening the actions menu on a device card
Opening the actions menu on a device card
| Action | What it does |
|---|---|
| View Details | Opens full device details with metrics, network info, and history |
| Access ARROW Manager | Launches the ARROW Manager dashboard for this device |
| Edit Tags | Adds or removes organizational tags |
| Edit Request Details | Updates dates, consultants, or notes |
| Copy ARROW Password | Copies the ARROW Manager login password |
| Copy Root Password | Copies the device root credential |
| Request VPN Setup Token | Generates a one-time token for VPN enrollment |
The two password actions copy the credential straight to your clipboard with no confirmation dialog, so treat them carefully: use the value right away and avoid leaving it in plaintext.
Edit Tags opens a small dialog for labeling a device. Type a tag name, pick a color (or set a custom hex value), and click Add. Tags are your own organizational labels, so use them however helps your team, for example marking a device by project, site, or owner. Save when you are done.
The Edit Device Tags dialog, where you add colored tags to organize a device
The Edit Device Tags dialog, where you add colored tags to organize a device
VPN setup tokens come up when you deploy VMs. To get one, open the […] menu, choose Request VPN Setup Token, and copy the value to use during VM deployment in ARROW Manager. Tokens are single-use and expire after 7 days.
The VPN Setup Token Generated dialog, with the copyable token and the NetBird command to enroll the device
The VPN Setup Token Generated dialog, with the copyable token and the NetBird command to enroll the device
The dialog also spells out the enrollment steps: install NetBird on the device, run netbird up --setup-key <token>, and the device connects to your VPN automatically. Copy the token with the button next to it, since it is shown only once.
Device Details View
Section titled “Device Details View”View Details opens the full panel, organized into tabs. The Overview tab shows real-time CPU, RAM, and disk metrics, running VMs and containers, location on a map, and the client and engagement details.
The device details panel, open on the Overview tab, with metrics, location, and contact
The device details panel, open on the Overview tab, with metrics, location, and contact
The Metrics and Network tabs go deeper into resource history and connectivity: interface status for Ethernet, cellular, and WiFi, VPN connection details, IP addresses and routing, and VM network configuration. The Details tab holds the original request information, hardware specifications, serial number and model, and credential access.
The Details tab, with the original request, hardware specifications, and credentials
The Details tab, with the original request, hardware specifications, and credentials
Working in ARROW Manager
Section titled “Working in ARROW Manager”ARROW Manager is the local management interface running on every physical ARROW device. It is where you set up encryption, deploy VMs, and configure networking on the device itself.
Signing In
Section titled “Signing In”Click the ARROW Manager button on a device card, or choose Access ARROW Manager from the […] menu. A new browser tab opens and connects to the device. ARROW Manager defaults to Sign in with Arrow SSO. To sign in directly on the device instead, choose Use local login instead and enter the manager credentials:
- Username: manager
- Password: the ARROW Password from the device card (via the action menu)
The ARROW Manager local login screen, where you enter the manager username and password
The ARROW Manager local login screen, where you enter the manager username and password
Getting a New Device Ready
Section titled “Getting a New Device Ready”Once you are in, four steps take a fresh device to ready-for-testing: set the LUKS encryption key, deploy a virtual machine from your App Library, configure network settings (a static IP if the site needs one), and optionally attach USB devices such as wireless cards to your VMs.
Setting LUKS Encryption
Section titled “Setting LUKS Encryption”VMs live on an encrypted storage partition, so this comes first. In ARROW Manager, open the Proxmox tab. You will see an “Encrypted Storage Setup Required” message; click Setup Encryption, enter a strong key, and click Create Encrypted Storage. It takes 15 to 30 seconds.
Important Store your LUKS Encryption Key somewhere safe, following your organization’s policy. If the device loses power or reboots, you need this key to restart your virtual machines, and VTEM Labs cannot recover a lost one.
The Virtual Machines page shows an Encryption Setup Required banner before you can deploy
The Virtual Machines page shows an Encryption Setup Required banner before you can deploy
Enter a strong LUKS encryption key, then click Create Encrypted Storage
Enter a strong LUKS encryption key, then click Create Encrypted Storage
Deploying a Virtual Machine
Section titled “Deploying a Virtual Machine”With encryption in place, go to the App Library, pick the image you want, and click Deploy. The Configure VM Deployment window asks for:
| Field | Required | What it does |
|---|---|---|
| Root Password | Yes | Password for the VM root account |
| ARROW User Password | Yes | Password for the arrow user account |
| SSH Public Key | No | Enables passwordless SSH access |
| NetBird Device Name | No | VPN device name (defaults to pvm-[host-suffix]) |
| Enable ARROW Control | No | Installs ARROW Control on the VM, with an optional beta-version toggle |
| MAC Address | No | A pre-assigned MAC for NAC or DHCP reservation |
| Static IP Configuration | No | For networks that do not use DHCP |
You no longer enter a VPN setup key here. It is provisioned automatically and tied to your device request.
Click Create VM (roughly 50 seconds). The Virtual Machines page shows deployment progress, and the VM appears under Your Machines once it is running.
Network Configuration
Section titled “Network Configuration”Most of the time, DHCP is the right call. Use it when the client’s network hands out IPs automatically, you have no specific IP requirements, and outbound VPN connections are allowed.
Reach for a static IP when the client requires specific addresses for firewall rules, DHCP is not available, or network security expects pre-registered IPs. Even then, the cleanest option is to have the client assign a static IP via DHCP reservation. If you do need to set one manually, open Network Settings in ARROW Manager, select the Static IP radio button, and enter the IP address, subnet mask, gateway, and DNS servers. Save the changes; no reboot is required.
After a network change, the device tries to establish the VPN connection on its own. If the settings are wrong or network security blocks it, the device fails over to cellular or a WiFi hotspot rather than going dark.
Important Do not edit
/etc/network/interfacesby hand. Make every network change through ARROW Manager so the device stays in a known state.
Reviewing Metrics
Section titled “Reviewing Metrics”The Metrics section turns your activity into analytics you can actually use, like how long devices take to deploy and how long they stay on site. Service Metrics summarize your request volume, delivery timelines, and deployment durations, with a date range selector and a per-client filter at the top.
Service Metrics summarizing total requests, average time to deploy, average time on site, and trends over time
Service Metrics summarizing total requests, average time to deploy, average time on site, and trends over time
The summary cards report totals such as Total Requests, Avg / Month, the Hardware and VM request counts, Avg Time to Deploy (request to deployment), and Avg Time On Site (average deployment duration). Below them, the Requests Over Time and Deployment Duration Trend charts show how those numbers move month over month.
Troubleshooting
Section titled “Troubleshooting”A device shows offline. This usually comes down to connectivity at the site, a firewall blocking the VPN, or the device being powered off. Check with your on-site contact about network status, confirm the required VPN ports are open (support can tell you which), and make sure the device has power.
You cannot reach ARROW Manager. Almost always this is the VPN or the credentials. Confirm the VPN status icon is green, use Copy ARROW Password to get the exact login, and refresh the page.
A VM will not deploy. The common culprits are LUKS encryption not being set up, an invalid VPN setup token, or not enough disk space. Complete LUKS setup first, generate a fresh VPN setup token, and check available space in the Proxmox tab.
Related Documentation
Section titled “Related Documentation”- Device Requests - Creating and managing device requests
- Device Shipments - Tracking shipments and delivery
- ARROW Manager Overview - Detailed ARROW Manager documentation
- USB Devices - Attaching USB devices to VMs
- VPN Management - VPN configuration and troubleshooting