The Marathon tab displays the status of the Marathon application running on the SC//AcuVigil™ edge security device (ESD). Marathon enables secure POS connections to Fiserv Marathon infrastructure for both payment processing and loyalty program transactions via TLS relay tunnels. Use this tab to verify relay health, review per-terminal connection data, and configure the service.
Application description: Enables secure POS connections to Fiserv Marathon infrastructure for payments and loyalty via the Merchant Gateway.
Supported ESD models: MG3, SG1v1, SG2v1, XG1v1, VG
Layout
The Marathon tab has a standard app header and two sub-views: Status and Settings. The default sub-view is Status.
Header
| Element | Description |
|---|---|
| App icon | Marathon brand icon. Decorative. |
| Marathon | App name / block title. |
| Subtitle | "Enables secure POS connections to Fiserv Marathon infrastructure..." Static descriptor. |
| Version | Package version string (for example, Ver.QCPG69). |
| Status | Link. Switches to the Status sub-view. |
| Settings | Link. Switches to the Settings sub-view. |
Status sub-view
The default sub-view. Contains these sections: Firewall, VPN Status, FQDNs, and TLS Relays with per-terminal Connections tables.
Status banner
When a problem is detected, a banner appears at the top of the sub-view. For example, when the POS devices on the CDE segments aren't tagged with a device type:
WARNING: No device tagging detected for CDE segments (PassportEPS | CommanderNICA). Please ensure device tagging is set in the devices list.
To clear this warning, set the device type for the site's Gilbarco Passport EPS or Verifone Commander device in the devices list.
Firewall rules table
A table of iptables rules managed by the Marathon application. Read-only. Documents the INPUT, OUTPUT, and PREROUTING rules used to intercept and relay Marathon POS traffic.
| Column | Description |
|---|---|
| Category | The iptables chain the rule belongs to: INPUT, OUTPUT, or PREROUTING. |
| Chain | Internal chain name. |
| Packets | Count of packets matched by this rule since last reset. |
| Bytes | Count of bytes matched by this rule since last reset. |
| Target | Rule action: ACCEPT or REDIRECT. |
| Protocol | Network protocol: TCP. |
| In | Incoming network interface filter. * means any. |
| Out | Outgoing network interface filter. * means any. |
| Source | Source IP or subnet. |
| Destination | Destination IP or subnet. |
| Notes | Additional match criteria, such as tcp dpt:<port>, tcp spt:<port>, or redir ports <port>. |
VPN Status
Shows the state of the CDE VPN that carries Marathon payment traffic.
| Field | Description |
|---|---|
| VPN Enabled | Whether the CDE VPN is turned on for this site. Set by CDE VPN Enabled on the Settings sub-view. |
| VPN Status | The current state of the VPN. |
| Tunnels Present | The number of VPN tunnels that are up. |
| Tunnels Expected | The number of VPN tunnels the site should have. |
| Current Active Tunnel | The tunnel currently carrying traffic. |
If Tunnels Present is lower than Tunnels Expected, one or more tunnels are down.
FQDNs table
Lists the live Marathon relay hostnames and their currently resolved IP addresses.
| Column | Description |
|---|---|
| FQDN | The hostname of a Marathon relay endpoint, for example us-east-1.tls.cde-pdi.acumera.net. These are live Scale Computing relay hostnames, not site data. |
| Addresses | One or more IP addresses currently resolved for that FQDN. |
A status line at the bottom of the FQDNs section: fqdnd running: Yes confirms the FQDN daemon is operational.
TLS relays section
One relay block per configured Marathon terminal. Each block contains a relay header table and a Connections table.
Relay header table
| Field | Description |
|---|---|
| Intercept IP | The local IP address on the ESD that intercepts POS traffic destined for the Marathon server. |
| Intercept Port | The local TCP port on which the ESD intercepts POS traffic. |
| Relaying IP | The upstream Marathon endpoint IP address to which the ESD forwards intercepted traffic. |
| Relaying Port | The upstream Marathon TCP port. |
| Relaying Host | The FQDN of the upstream Marathon endpoint (for example, us-east-1.tls.non-cde-pdi.acumera.net). |
| Allow | The local LAN segment(s) the relay accepts traffic from (for example, 192.168.32.11/24). |
| Keepalive | Whether TCP keepalive is enabled: Yes or No. |
| Mode | Process mode: forking. |
| Start Date | Timestamp when this relay was last started (format: MM/DD/YY HH:MM:SS). |
| TLS Cipher | The TLS cipher suite negotiated for this relay session (for example, TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256). |
Connections table
Per-relay hourly connection counts. Rows are oldest-first.
| Column | Description |
|---|---|
| Date | Timestamp of the hour bucket in MM/DD/YY HH:MM:SS format. |
| Primary Connections | Count of connections successfully relayed through the primary path. |
| Primary Connection Failures | Count of connection failures on the primary path. |
| Secondary Connections | Count of connections successfully relayed through the secondary path. |
| Secondary Connection Failures | Count of connection failures on the secondary path. |
Settings sub-view
Note: Scale Computing manages these settings as part of the managed service. You can view them here. To request a change, contact Scale Computing Support: open a ticket in the SC//AcuVigil dashboard, email team@scalecomputing.com, or call (512) 687-7401. |
| Field | Type | Options | Description |
|---|---|---|---|
| Mode | Dropdown | Production, Test | Whether the site connects to the Marathon production or test environment. |
| CDE VPN Enabled | Checkbox | Checked / Unchecked | Turns on the CDE VPN for Marathon payment traffic. |
| PSK | Text | — | The pre-shared key for the CDE VPN. Treat it as a secret. |
| Update Settings | Button | — | Saves the settings and applies them to the ESD. |
| Delete Config | Link | — | Deletes the Marathon configuration for this site. |
Note: A settings change applies to the live site right away. Switching Mode to Test sends the site's Marathon traffic to the test environment. |
TLS relay naming
Marathon relays are named using the terminal ID assigned during site configuration:
Marathon-<terminal_id>
Examples: Marathon-23356, Marathon-25680, Marathon-41762, Marathon-49566. Each terminal at a site has its own relay entry.
CDE vs. non-CDE paths
Marathon relays are grouped into two paths based on cardholder data environment (CDE) requirements. The relay hostname identifies the path. These are the live relay hostnames:
| FQDN pattern | Path type |
|---|---|
*.tls.cde-pdi.acumera.net |
CDE path. Used for cardholder data that requires PCI-scoped routing. |
*.tls.non-cde-pdi.acumera.net |
Non-CDE path. Used for loyalty and other non-payment transactions. |
The PREROUTING rules in the Firewall section perform the traffic interception that routes POS traffic onto the correct path.
What to look for
- WARNING about device tagging — set the device type for the POS devices on the CDE segments.
- Tunnels Present lower than Tunnels Expected — one or more CDE VPN tunnels are down.
fqdnd running: Yes— ifNo, Marathon cannot resolve relay endpoints and all relays will fail.- Start Date on each relay — a very recent start date indicates the relay restarted. Normal after a reboot; investigate if it repeats.
- Primary Connection Failures > 0 — indicates relay path errors. Check the corresponding relay host's TLS session in the Network Info TLS Relays block.
- Packets = 0 on all rules for a site that should be processing — indicates no traffic is being intercepted.