Frequently Asked Questions
Frequently Asked Questions
Section titled “Frequently Asked Questions”Short, practical answers to the questions that come up most often about ARROW: the platform, device requests, VPN, VMs, and how the pieces fit together.
General
Section titled “General”What is ARROW?
Section titled “What is ARROW?”ARROW is a device management platform for requesting, provisioning, and running remote hardware and virtual machines. In one place you can order a device or spin up a VM, get it onto a secure VPN, and manage it for the length of an engagement. Shipping, billing, and support integrations run in the background so the logistics take care of themselves.
What are the main parts I will use?
Section titled “What are the main parts I will use?”Three things, each with a clear job:
- ARROW Console: the web app where you request devices and VMs, manage users, and monitor everything.
- ARROW Manager: the app that runs on each physical device, handling authentication, configuration, and VPN connectivity locally.
- ARROW Control: the web app on each deployed VM, giving you a file manager, terminal, remote desktop, monitoring, and a security tool catalog, all over the VPN.
Who is ARROW for?
Section titled “Who is ARROW for?”Organizations that manage distributed devices for security testing, consulting engagements, or remote operations. In practice that means cybersecurity firms, IT consultancies, and managed service providers who need boxes in the field they can reach securely.
Users and sign-in
Section titled “Users and sign-in”How does signing in work?
Section titled “How does signing in work?”ARROW uses single sign-on through your organization’s identity provider. When you click Sign In, you are handed off to your organization’s login page and use your normal work credentials. There is no separate ARROW password to remember or reset.
How do I reset my password?
Section titled “How do I reset my password?”Because ARROW uses SSO, your password lives with your identity provider, not with ARROW. Use your provider’s self-service reset, or ask your organization’s IT administrator. Once your password works for your other work apps, it works for ARROW.
What roles are there, and what can each do?
Section titled “What roles are there, and what can each do?”Three roles, assigned by your organization administrator:
| Role | What it can do |
|---|---|
| Admin | Everything: user management, organization settings, and billing |
| Manager | Device management, client creation, and device requests |
| User | View assigned devices and reach them over the VPN; read-only on admin functions |
The short version: Admins run the organization and see billing, Managers handle devices and clients, and both can manage devices. Users get access to what they are assigned.
Can one person belong to more than one organization?
Section titled “Can one person belong to more than one organization?”Yes. ARROW is multi-tenant, so each organization keeps its own data, VPN infrastructure, and users completely separate. If you need an organization set up or need access to another one, talk to your administrator.
Device requests
Section titled “Device requests”How far ahead do I need to request a physical device?
Section titled “How far ahead do I need to request a physical device?”Get physical device requests in at least 72 business hours before your project start date. That window covers imaging, quality checks, and shipping. Cutting it closer is sometimes possible but may add a $100 logistics charge for Next Day Air Early delivery.
Can I request several devices at once?
Section titled “Can I request several devices at once?”Physical devices are requested one at a time, which keeps each configuration accurate. Virtual appliances are more forgiving: you can request up to 10 VMs in a single submission.
Physical device or virtual appliance, which do I want?
Section titled “Physical device or virtual appliance, which do I want?”It comes down to whether you need real hardware in a real location or just a machine to run somewhere:
| Physical device | Virtual appliance | |
|---|---|---|
| Provisioning | Imaged and shipped | Automated, downloadable |
| Delivery | 3-5 business days | 10-15 minutes |
| Hardware | Dedicated Linux computer with cellular | Runs on your own infrastructure |
| Return | Return shipping required | Instant cleanup, nothing to send back |
How do I track a shipment?
Section titled “How do I track a shipment?”Once your physical device request is approved and shipped, tracking shows up on the Device Requests page, and you also get an email with the details.
Can I change my request dates after submitting?
Section titled “Can I change my request dates after submitting?”Yes. Go to the Devices page, click the […] button for the device, and choose Edit Request Details to adjust the start or end date. See Device Requests for the specifics.
What happens when my request period ends?
Section titled “What happens when my request period ends?”For a physical device, ARROW generates a return shipping label and sends you instructions for returning it. For a VM, cleanup is automatic: the VM is torn down, VPN access is removed, and the resources are released. Nothing lingers.
Do I have to catalog device hardware myself?
Section titled “Do I have to catalog device hardware myself?”No. During provisioning, ARROW reads each device’s hardware details (serial number, network interfaces, cellular modem, and specifications) straight off the device, so every device has a correct identity with no effort on your part. You see this information on the Devices page, under a device’s Details.
Virtual machines
Section titled “Virtual machines”How long does a VM take to come up?
Section titled “How long does a VM take to come up?”Hosted VMs typically provision in 15-30 minutes. Downloadable appliance images are usually ready 10-15 minutes after the build finishes.
What VM formats can I get?
Section titled “What VM formats can I get?”Whatever your platform expects:
| Format | Extension | Where it fits |
|---|---|---|
| OVA | .ova | VMware and VirtualBox |
| QCOW2 | .qcow2 | QEMU/KVM and Proxmox |
| VHD | .vhd | Microsoft Azure |
| VMDK | .vmdk | Amazon Web Services (AWS) |
How do I get into a VM once it is provisioned?
Section titled “How do I get into a VM once it is provisioned?”Three steps:
- Connect your VPN client and confirm you are online.
- Find the VM’s hostname or IP on its device details page.
- Connect over SSH or remote desktop with the credentials shown there.
See VPN Management for connection setup.
How do I watch a build?
Section titled “How do I watch a build?”Open the Device Requests page in the console and click your request to see its current state: approved, provisioning, or ready. If it sits somewhere unexpected for a while, reach out to support.
Virtual appliance or hosted VM, what is the difference?
Section titled “Virtual appliance or hosted VM, what is the difference?”A virtual appliance is a downloadable image you run on your own infrastructure (VMware, VirtualBox, and the like). A hosted VM runs on ARROW’s managed infrastructure, comes connected to the VPN, and has its full lifecycle managed for you. Pick the appliance when you want to run it yourself, the hosted VM when you would rather ARROW handle the hosting.
VPN and networking
Section titled “VPN and networking”How does the VPN work?
Section titled “How does the VPN work?”ARROW gives you a secure VPN so you can reach your devices from anywhere. Devices and VMs are set up for VPN access automatically as they are provisioned, and which ones you can actually reach depends on the projects you are assigned to.
How do I connect?
Section titled “How do I connect?”- Download the VPN client from your organization’s VPN management page in the console.
- Install and open it.
- Sign in with your organization credentials when prompted.
- Once connected, your assigned devices and VMs are reachable.
For the full walkthrough, see VPN Management.
What is network access control?
Section titled “What is network access control?”It is what decides which users can reach which devices over the VPN. When you are added as a consultant on a device or project, ARROW grants you access to the right devices automatically. See Network Access Control.
Why can’t I reach a device over the VPN?
Section titled “Why can’t I reach a device over the VPN?”Usually one of a handful of things:
- Your VPN client is not actually connected. Check that it shows you online.
- You have not been assigned to the device. Ask your manager to add you as a consultant.
- The device is offline. Check its status in the console.
- The device has not finished provisioning yet. Give the request time to complete.
See Troubleshooting for step-by-step diagnostics.
Integrations
Section titled “Integrations”What does ARROW integrate with?
Section titled “What does ARROW integrate with?”A set of services that handle the logistics around your devices:
| Area | What it does |
|---|---|
| Shipping | Creates labels and tracks packages |
| Billing | Invoicing and customer management |
| Support | Support ticket management |
| Monitoring | Device metrics and performance |
| Location | GPS tracking for devices |
| Notifications | Email notifications and communications |
Your organization administrator manages these through the ARROW Portal.
How do I set up an integration?
Section titled “How do I set up an integration?”You usually do not need to. Integrations are configured by your organization administrator, and once they are set they work automatically in the background. If you need one turned on, ask your administrator.
Are integration credentials safe?
Section titled “Are integration credentials safe?”Yes. They are stored encrypted, used only server-side, and never exposed to users.
Can two organizations use different integration settings?
Section titled “Can two organizations use different integration settings?”Yes. Each organization keeps its own integration configuration, so everyone can use their own shipping, billing, and support accounts while sharing the same platform.
ARROW Manager
Section titled “ARROW Manager”What is ARROW Manager?
Section titled “What is ARROW Manager?”The app installed on every physical ARROW device. It handles authentication, device configuration, VPN connectivity, software updates, and VM management right on the device.
How is it different from the Console?
Section titled “How is it different from the Console?”The Console is the web interface at /console for submitting requests, managing users, and monitoring. ARROW Manager runs locally on the device and handles the device-level work: authentication, configuration, and keeping the VPN up. The Console is where you plan; the Manager is where the device lives.
How do I install it?
Section titled “How do I install it?”You do not, and you cannot install it separately. ARROW Manager comes pre-installed on every physical ARROW device. If you want to manage VMs on your own infrastructure, use virtual appliances instead. See ARROW Manager Overview for more.
Troubleshooting
Section titled “Troubleshooting”How do I check a device request’s status?
Section titled “How do I check a device request’s status?”Open the request on the Device Request Details page to see its current state and any messages. If you spot an error there and it does not clear on its own, note it and contact support.
My device request failed. Now what?
Section titled “My device request failed. Now what?”- Check the Device Request Details page for an error message.
- Confirm your request details are right (dates, configuration options).
- Contact support with the error and your request details.
See Troubleshooting for more.
How do I report a bug?
Section titled “How do I report a bug?”Reach out to your organization’s ARROW administrator, or email VTEM Labs support at [email protected]. It helps to include:
- What went wrong
- How to reproduce it
- Any error messages
- Your organization and user
Where do I get help?
Section titled “Where do I get help?”- Documentation: start at Getting Started
- Email: [email protected]
- Troubleshooting: the Troubleshooting guide
Billing and licensing
Section titled “Billing and licensing”How does licensing work?
Section titled “How does licensing work?”ARROW includes license management for software deployment. Your organization administrator assigns licenses to devices and tracks them through the console.
How are device requests billed?
Section titled “How are device requests billed?”That depends on your organization’s service agreement with VTEM Labs. Physical device requests may cover imaging, shipping, and rental. For pricing, ask your administrator or email [email protected].
Export compliance
Section titled “Export compliance”Are there country restrictions on shipments?
Section titled “Are there country restrictions on shipments?”Yes. Every device request is subject to U.S. export control regulations, and some countries need extra review or cannot receive ARROW products at all. Contact support for country-specific restrictions.
What is the export compliance policy?
Section titled “What is the export compliance policy?”ARROW devices fall under U.S. export laws, including EAR and ITAR. Shipping to restricted countries can require export licenses, incur legal review fees, and take longer to process.
Do international shipments need special approval?
Section titled “Do international shipments need special approval?”Shipments to countries outside the standard export zones may need extra documentation and review. Your device request will flag it if approval is needed. For guidance on a specific destination, contact VTEM Labs.
Still have a question?
Section titled “Still have a question?”If you did not find your answer here:
- Browse the full Documentation
- Check the Troubleshooting guide
- Email support at [email protected]