Alarm status not refreshing live over a proxied (2-hop) Remote Tag Provider Perspective 8.3

Hey all, running into an issue on 8.3.x and hoping someone's seen this before.

Setup: 3 gateways — a remote site gateway with the actual alarms, a central "backend" gateway with a direct Gateway Network connection to the remote site, and a central "frontend" gateway that only connects to the backend (not directly to the remote site — that's intentional, need to keep it that way for security reasons).

So frontend's path to the remote alarms is backend → remote site, basically proxied through backend.

The issue: when an alarm fires on the remote site, backend's Alarm Status table updates instantly, every time. Frontend's doesn't — it just sits there until I disable and re-enable the remote tag provider on frontend, then it catches up. Feels like it's doing a one-time fetch on connect instead of an actual live subscription.

Things I've tried:

  • Bumped Allowed Proxy Hops from 0 to 1 on all three gateways — no difference at all, so I don't think that's it.
  • Switched the alarm mode on frontend's remote provider from Subscribed to Queried — that made it worse, now it shows nothing at all. Wondering if that's a security zone permission thing (we've got an alm-query entry in there I'm not 100% sure covers this).

Anyone know if a live alarm subscription is even supposed to work through a proxied/2-hop remote tag provider, or is this a known limitation? And any idea why Queried mode would come back completely empty instead of just stale?

Would really rather not have to connect frontend directly to the remote site if there's another way around this.

I believe your backend gateway will need to be set to 1 hop and both the frontend and edge/site will need to be set to 2.

I'm not sure how you got it working without this seeing, but that's what I believe is required. Are the gateways showing up in the network diagram properly?