For most companies the answer is "connected, but on a short leash". A DGX Station GB300 can run fully offline: NVIDIA documents air-gapped OS updates from a local mirror and offline NIM model serving. But full isolation makes patching, model updates and remote support slower and more manual. The more common design is controlled access. That means no inbound exposure, outbound traffic limited to known update and model sources, the BMC management port on its own network, and named, multi-factor accounts for anyone connecting remotely. Go fully air-gapped only when the data or regulation demands it, and budget the extra admin work if you do. The HP ZGX Fury G1n, MSI XpertStation WS300, ASUS ExpertCenter Pro ET900N G3, GIGABYTE W775-V10-L01 and Supermicro ARS-511GD-NB-LCC are price on request at SourceIT.
What are the connection options?
| Setup | How updates arrive | Main risk | Suits |
|---|---|---|---|
| Fully connected | NVIDIA's over-the-air repository updates; models pulled from NGC and Hugging Face | Widest attack and data-leak surface | Development teams working only with public or low-sensitivity data |
| Controlled egress (recommended default) | Same sources, through an outbound allow-list; no inbound ports opened | Allow-lists need upkeep; an agent can still misuse allowed destinations | Most businesses handling internal documents |
| Air-gapped | ISO reimage or a local apt mirror (up to about 250GB) carried in; NIM models pre-cached on a connected machine | Slower patching; manual model updates; harder vendor support | Regulated data, classified projects, research under strict data rules |
Sources: NVIDIA DGX OS 7 air-gapped installation guide (27 Oct 2026), NVIDIA NIM air-gap deployment guide (23 Oct 2026), and CSA's "Securing Agentic AI" addendum (17 Jun 2026). The air-gap documentation is written for DGX OS 7, and NVIDIA's DGX OS release notes do not list the DGX Station by name, so confirm the procedure with the OEM. The comparison of trade-offs is our own analysis. We have not tested these systems ourselves.
Why not just unplug it?
Because an air gap moves work rather than removing it. NVIDIA's guide offers two ways to update an offline DGX OS 7 system. One is a full reimage from removable media. The other is an apt mirror of the Ubuntu, CUDA and DGX repositories for ARM64, which NVIDIA says may need up to 250GB, copied in and pointed at by the system. That method only covers updates within the same major release. Models have to be downloaded on a connected machine and carried in too. NVIDIA's NIM guide describes pre-caching a model, mounting the cache offline, and not setting NGC or Hugging Face keys in the air-gapped phase.
Every one of those steps is manual. On a system where NVIDIA ships repository-based updates and the OEM issues firmware separately, patches can lag. Singapore's CSA Cyber Essentials mark asks for critical updates "as soon as feasible", so an air-gapped Station needs a written patch routine to meet that.
An air gap is a security control with a running cost. If nobody owns the update routine, the isolated system slowly becomes the least-patched machine in the building.
What does "controlled" connectivity look like in practice?
CSA's "Securing Agentic AI" addendum (version 1.0, June 2026) gives a useful checklist even for systems that are not running agents. It recommends outbound allow-lists and protective DNS to limit data exfiltration, least privilege with no admin or sudo by default for agent roles, sandboxing AI-generated code, and logging agent actions centrally. For a DGX Station that translates to:
- No inbound internet exposure. Do not port-forward SSH or model APIs to the internet.
- Outbound allow-list. Permit the Ubuntu, NVIDIA and container registries and the model sources you approve; block the rest.
- Separate management network. The 1GbE BMC port gives power control, a remote console and firmware access. It should never sit on the office or guest network.
- Named accounts and MFA. CSA Cyber Essentials expects multi-factor authentication for administrator access.
- Secure Boot and TPM. NVIDIA says both are on by default; keep them on.
- Encryption at rest where needed. The headless HP ZGX Fury G1n configuration ships with self-encrypting drives, which its listing notes are often required for regulated, government and financial-sector work.
How do remote users connect without opening the firewall?
Use a route that does not need inbound ports. NVIDIA Sync supports the DGX Station over SSH on the local network or through Tailscale, a WireGuard-based mesh that needs no port forwarding. It does not support bastion or jump hosts. Cloudflare Tunnel is another outbound-only option, letting the firewall block all inbound traffic. On the HP ZGX Fury, the free HP Z Toolkit handles discovery, pairing and SSH from an x86 Windows 11 or Ubuntu client. Our article on running the Station as shared departmental infrastructure covers access in more detail.
Does AI change the answer?
It raises the stakes. A Station running AI agents that can browse, call tools or write code can be steered by text it reads. Microsoft names cross-prompt injection as a risk for Windows agents, and OWASP lists "Excessive Agency" among its top risks for LLM applications. If an agent can reach the internet and your files, an injected instruction could send data out. Outbound allow-lists, least-privilege accounts and human approval for consequential actions are the controls that limit that. For the agent side, read whether to trust an AI agent with your Windows desktop and why your AI assistant may be your biggest security risk.
A local Station also helps on the data side. Many companies buy one precisely so internal documents never leave the building. That only holds if the machine's own connectivity is controlled. Our article on where company data goes when using AI explains the comparison with cloud services.
What about backups and support on an isolated system?
Both still need a path. Backups should go to storage isolated from the Station, as CSA's backup clause asks, which works well with an air-gapped design. Hardware support usually needs logs and sometimes remote diagnosis. ASUS, for example, states onsite service after remote diagnosis. Agree with the OEM and SourceIT how a fault will be diagnosed if the system has no internet access. Our article on the Station as a single point of failure covers backup and recovery.
Buying in Singapore
SourceIT supplies the HP ZGX Fury G1n (including the headless configuration with self-encrypting drives), MSI XpertStation WS300, ASUS ExpertCenter Pro ET900N G3, GIGABYTE W775-V10-L01 and Supermicro ARS-511GD-NB-LCC on a price-on-request basis. For a separate management and storage network, the HPE Networking Instant On 1960 12-port 10G switch (S$2,444.40) and D-Link DXS-1210-10TS (S$1,680) are in stock (listed 4 Nov 2026). Browse the NVIDIA DGX Spark and DGX Station collection. For a quotation, use Request for Quotation on the product page, call (65) 6978 3502, email Sales@sourceit.com.sg or use our contact page.
Frequently asked questions
Can a DGX Station run without internet access? Yes. NVIDIA documents offline DGX OS 7 updates from an ISO or a local ARM64 apt mirror of up to about 250GB, and offline NIM model serving from a pre-cached model.
What is the downside of air-gapping it? Updates, new models and support diagnostics all become manual, and mirror updates only cover the same major OS release, so patches can lag unless someone owns the routine.
How should remote staff connect? Through an outbound-only method such as NVIDIA Sync with Tailscale, or Cloudflare Tunnel, with named accounts and multi-factor authentication. Do not open inbound ports to the internet.
Should the BMC port be on the office network? No. It gives power control, a remote console and firmware access, so keep it on a separate management network.
Does Singapore have guidance on this? CSA's Cyber Essentials mark covers patching, MFA and isolated backups, and its June 2026 "Securing Agentic AI" addendum recommends outbound allow-lists, least privilege and logging for AI agents.
