01
An account
A trial covers 30 days, up to ten servers and fifty workstations. Ten is enough to see the shape of a network — pick the noisiest server and its neighbours. Evaluating a larger estate? Talk to us and we'll size the trial to it.
Docs
One command per host.
Nothing enforced until you say so.
The agent installs in about a minute and spends its first days doing nothing but watching. You get a map of what your network actually does before you are ever asked to change it.
Before you begin
Three things, and only one of them is on you.
There is no collector to stand up, no appliance to rack and no span port to beg for. The agent dials out; everything else is already running.
02
An enrolment token
Generated in the console under Fleet → + Add device. Single-use for one host, or multi-use for a fleet rollout where each host is approved as it arrives.
03
Outbound 443
The agent opens one outbound connection and holds it. Nothing listens, nothing is forwarded, and no inbound rule is needed on the host or at your edge.
Install
Four steps, three of which are waiting.
The console builds the command with your token already in it, so in practice you copy one line and paste it into a shell.
Generate a token
In the console, open Fleet and choose + Add device. Pick single-use or multi-use, pick how long it stays valid, and the install command appears with the token substituted in. The examples below use seg-your-token where yours will be.
Run it on the host
As root on Linux, or from an elevated PowerShell on Windows. The installer generates a keypair on the host, exchanges the token for a certificate issued to that host alone, lays everything down and starts the service.
Linux
run as root
curl -sSL https://segmenta.softmail.co.za/downloads/install-agent.sh | sudo SEGMENTA_TOKEN='seg-your-token' SEGMENTA_SERVER='https://segmenta.softmail.co.za' bash
Windows
elevated PowerShell
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; $r = iwr https://segmenta.softmail.co.za/downloads/install-agent.ps1 -UseBasicParsing; $s = if ($r.Content -is [byte[]]) { [Text.Encoding]::UTF8.GetString($r.Content) } else { $r.Content }; & ([scriptblock]::Create($s)) -Server 'https://segmenta.softmail.co.za' -Token 'seg-your-token'The private key is generated on the host and never leaves it. What travels is a certificate signing request; what comes back is a certificate scoped to that one host in your tenant.
Approve it, if you used a multi-use token
A multi-use token does not enrol a host on its own. The installer prints a six-character code and waits — up to thirty minutes — while you approve that code in the console. A single-use token skips this entirely and enrols immediately.
Watch it connect
The host appears in Fleet within a minute of the service starting, and begins reporting listeners and connections straight away. The installer waits for that first connection before it returns, so a clean exit means it worked.
Day one
It watches. That is all it does.
A newly installed agent is in Learning. It has no rules, it blocks nothing, and installing it does not alter the host's firewall in any way. Enforcement is a decision you make later, per host, in the console — and you make it after the map has shown you what would break.
SRV-APP-01 · Learning
observing · 0 rules installed
SRV-APP-01 → SQL-01 tcp/1433observed
SRV-APP-01 → DC-01 tcp/389observed
WKS-114 → SRV-APP-01 tcp/443observed
everything elseobserved, not blocked
Nothing is denied in Learning — the host firewall is untouched
What lands on the host
Where everything goes.
One service, one config file, one state directory. No kernel module, no reboot.
| Linux | Windows | |
|---|---|---|
| Program files | /opt/segmenta — the agent and its own Python virtualenv | C:\Program Files\Segmenta |
| Configuration | /etc/segmenta/agent.env, alongside the host's certificate and key | C:\ProgramData\Segmenta\agent.env, alongside its certificate and key |
| State | /var/lib/segmenta — policy state and the rendered ruleset | C:\ProgramData\Segmenta |
| Service | segmenta-agent under systemd, restarted on failure | SegmentaAgent, automatic start with recovery actions |
| Also installed | Python, nftables and conntrack from your distribution's packages | Nothing — the MSI is self-contained |
Installing nftables does not change your firewall. The package has to be present before the agent can ever enforce, so the installer puts it there on day one rather than at the moment you first switch enforcement on.
Requirements
What the host needs.
| Linux | Windows | |
|---|---|---|
| Operating system | Any distribution using nftables, with systemd. Debian, Ubuntu, RHEL, Rocky, Alma and their derivatives are covered by the installer's package handling. | 64-bit Windows Server and Windows desktop editions. |
| Privilege | Root. Socket ownership and firewall changes both require it. | Administrator to install; the service then runs as a system account. |
| Network | Outbound TCP 443 to the Segmenta endpoint, held open. No inbound rule, no port forward, no VPN. | |
| Footprint | Capped by the service unit at 1 GB of memory and half a core, enforced by the kernel. | A single service process. |
| Containers | If Docker is present it is picked up automatically — containers become peers on the map, at no extra cost. | Not applicable. |
Check it worked
And what to look at if it didn't.
The host appearing in Fleet is the real test. These are how you see the same thing from the host itself.
Linux
follow the service log
systemctl status segmenta-agent
journalctl -u segmenta-agent -f
Windows
check the service
Get-Service SegmentaAgentThe host never appears. Almost always outbound 443 being blocked or intercepted. The agent authenticates with a client certificate, so a proxy that terminates TLS on the way out will break the connection even though the host can reach the internet perfectly well.
The installer sat waiting, then gave up. That is a multi-use token whose six-character code was never approved. Approve it in the console and re-run, or issue a single-use token instead.
The token was rejected. Tokens expire, and a single-use token is spent once a host has used it. Issue a fresh one from Fleet → + Add device.
Afterwards
Updates, and getting rid of it.
It updates itself
New agent versions are delivered from the console and verified by digest before they are installed. There is no separate patching exercise, and you can opt a host out if you would rather drive it from your own tooling.
Removing it, Linux
Stop and disable segmenta-agent, then delete /opt/segmenta, /etc/segmenta and /var/lib/segmenta. If the host was enforcing, revert it in the console first so its ruleset is removed cleanly.
Removing it, Windows
Uninstall from Apps & features like any MSI. The configuration and the host's certificate are deliberately left behind, so a reinstall keeps its identity — delete C:\ProgramData\Segmenta if you want it truly gone.
Questions
Install questions.
The ones worth answering before you run anything as root.
Will installing the agent change my firewall?
No. A new agent is in Learning: it observes and reports, and it installs no rules. Your existing firewall configuration is untouched until you switch that host to enforcing yourself, in the console.
Does it need an inbound firewall rule?
No. The agent makes a single outbound connection on TCP 443 and keeps it open. Nothing listens on the host for Segmenta's benefit, and nothing needs to be forwarded to it.
What happens when I do turn enforcement on?
On Linux the agent installs its own nftables table and applies later changes as a delta, so rules you manage yourself are not clobbered and unchanged rules keep their live connections. On Windows it compiles the same policy into Windows Defender Firewall rules.
Can I roll it out with my existing tooling?
Yes. The install is a single non-interactive command, so it drops into Ansible, Intune, Group Policy or an RMM as-is. Use a multi-use token for a fleet rollout and approve the hosts as they arrive.
Does the private key ever leave the host?
No. The private key is generated on the host during install and stays there. Only a certificate signing request is sent, and the certificate returned is scoped to that single host in your tenant. Certificates last 90 days and renew the same way over the agent's live session, with a fresh key that also never leaves the host.
How do I connect a Kubernetes cluster?
Not with the agent. In Settings → Integrations → Kubernetes clusters, name the cluster and apply the manifest it gives you. That runs a read-only connector in a segmenta-system namespace, which dials out and reports the cluster's workloads within a minute. On Cilium, connections are read from Hubble, with its relay enabled; a relay that requires TLS needs its public CA certificate copied into a ConfigMap, with the command Segmenta shows. Without Cilium (Calico, OpenShift's OVN-Kubernetes, Amazon EKS's VPC CNI or Azure AKS), and on Google GKE, an optional DaemonSet reads each node's connection table instead. On EKS, switch on the VPC CNI's network policy agent first: Segmenta won't protect a cluster where nothing enforces. It needs host networking and NET_ADMIN, so adding it is your choice. For OpenShift, tick the box when you create the cluster, and the manifest fits OpenShift's security constraints. The connector writes nothing until you grant it network-policy writes and protect a workload.
What about hosts I can't install anything on?
They do not need the agent. An un-agented host is seen and fenced by the managed hosts around it — you allow the flows it needs and every managed neighbour denies the rest. Nothing is installed on it, and it is not billable.
Install it on a handful of servers and look at the map.
It takes about twenty minutes to start finding out what your network actually does. Nothing is enforced until you decide it should be.