--- title: "Connecting to Kepware OPC-UA" --- # Connecting to Kepware OPC-UA > OPC-UA makes connecting to third party OPC servers quick and easy without all the headaches associated with COM. This is a detailed step-by-step guide to connecting to KEPServerEX from Ignition using OPC-UA. ## To Connect to KEPServerEX from Ignition using OPC-UA 1. In the **Configure** section of the Gateway, go to **OPC Connections > Servers**. The OPC Server Connection page is displayed showing the OPC-UA servers your Ignition is connected to. 2. Find the blue arrow, and click on **Create new OPC Server Connection…**. The **Add OPC Server Connection Step 1: Choose Type** page is displayed. 3. Choose **OPC-UA** as the connection type, and click **Next**. 4. On the **Discover OPC-UA Endpoints** page, type in the endpoint of the OPC-UA server Ignition should connect to. The format should be as follows: ``` opc.tcp://IpAddress:Port #Examples #If KepServer is installed on the same server as Ignition and uses the default port, #the following endpoint could be used: opc.tcp://localhost:49320 #If KepServer is installed on a different server from Ignition, then the IP address would be used: opc.tcp://10.1.1.10:49320 ``` Once an endpoint has been entered, click the **Discover** button. A list of available Security Policies and Message Security options will appear. 5. Select a Security Policy and Message Security configuration to use when connecting to the endpoint. Both **Basic256** and **SignAndEncrypt** offer a higher level of security. ![](Select-Security-Policy-and-Message-Security.png) Once an endpoint configuration has been selected, click the **Next** button. 6. On the **New OPC UA Connection Settings** page, give the connection a name, and click the **Create New OPC Server Connection** button. A Username and Password do not need to be given, and should be left blank. 7. The connection will appear as **Faulted**. This is expected because KEPServerEX is denying access to the Ignition OPC-UA Client. The next step is to have KEPServerEX trust the Ignition OPC-UA Client. 8. Right-click on the **KEPServerEX** icon on the desktop KEPServerEx is installed on, and from the menu select **OPC UA Configuration**. The **OPC UA Configuration Manager** will appear. 9. On the **OPC UA Configuration Manager** window, go to the **Trusted Clients** tab, click on **Ignition OPC-UA Client**, click the **Trust** button, and click **Close**. Now the **OPC Server Connections** page shows the **Status** of **Kepware** to be **Connected**. :::note Troubleshooting If **Status** does not read **Connected**, click the **edit** link next to the server connection, scroll down to the bottom of the connection configuration page, and click **Save**. If **Status** is still reading something other than **Connected**, click the **OPC Connection Status** link at the bottom of the **OPC Server Connections** page and see if there are any useful messages to help troubleshoot the issue. Also, ensure your firewall is not blocking traffic on the port that KEPServerEX is using to communicate. ::: 10. Go to the **OPC Connections > Quick Client** in the Configure section of the Gateway, under the **Kepware > Channel1 > Device1** folder, you will see the **Tag** folders. ### Failover The failover Kepware OPC-UA server works the same as the OPC-UA server with the exception that you need to have two copies of Kepware setup, preferably on different servers. The failover Kepware OPC-UA server will be used in the event the primary Kepware server goes down. To enable failover, check the box to **Show advanced properties** in the New OPCUA Connection Settings, set the **Failover Enabled** property to 'true,' and specify the **Failover Endpoint**. The **Backup** properties should be used when a pair of redundant Ignition Gateways are trying to look at the same Kepware OPC-UA server. Both the **Backup Discovery URL** and **Backup Endpoint URL** properties need to be configured. For additional information on Failover, refer to [OPC-UA Connections and Settings](opc-ua-and-device-connections\opc-ua-connections-and-settings\opc-ua-connections-and-settings.md). ### No Anonymous Token Policy Found When connecting to KepServer, some versions may not allow anonymous connections by default. This typically means you need to specify user credentials for Ignition to use in the OPC-UA server connection. Alternatively, individual Kepware Projects can allow anonymous login. For more information, take a look at KepServer's documentation. ## Other UA Servers While the above example is specific to KEPServerEX, the same concepts apply to connecting to any other third party OPC server that accepts OPC-UA client connections. The only difference may be in the way that the certificates are accepted on the server. The Ignition OPC-UA server sends the client certificate to the third party OPC server when it tries to make the connection, however if the OPC server is not designed to expect these certificates then there may not be a straight forward way to accept them. In these cases you can manual download a client ticket from Ignition and supply it to the OPC server in the appropriate manner. ### To Download a Client Certificate Manually 1. Go to **Configure** section in the Gateway. 2. Select **OPC-UA > Certificate** from the left side of the page. The **Manage Certificates** page is displayed. 3. In the **This Gateway** tab, click the download link under **Ignition OPC-UA Client**, and save the certificate somewhere to disk. This certificate is then supplied to your third-party OPC server in a way specific to that server. For more information, check the respective server's documentation.