Shapes

The palette

The palette is the left-hand panel. It lists the whole shape catalog, grouped into sections in this order:

Colour comes from the family, which is deliberately not the same list as the sections — garnet for security, cobalt for network, viridian for compute, violet for data, teal for cloud, olive for OT, bronze for people, slate for annotation. That is why Network and Places share one blue and the two OT sections share one olive: a section is only a heading, so splitting a long group needs no new colour. Only the icon is coloured; the tile itself stays neutral, which is what keeps a large diagram calm.

Telling a router from a switch

The three devices you draw most often are deliberately drawn to one rule, so you can read a topology without reading the labels. The shape tells you what the device is and the number of arrows tells you how far it forwards:

Every arrow is drawn identically across the three, so what you are comparing is only the outline and the count. Zoom out on a core-and-access diagram and the tiers separate on sight.

Drawing who gets in

Three shapes cover privileged access, and they say different things:

• PAM (Security) is privileged access management — the thing that holds the credential, hands out a session and records it. It is drawn as a screen with a user on one side and a padlock on the other. Search pam, credential vault, break glass or session recording.
• Jump host (Security) is the box the traffic passes through — a bastion in the DMZ, drawn straddling a dashed boundary with one arrow in and one out. Reach for it when the point of the picture is the path; reach for PAM when the point is who is allowed and what was recorded. Many drawings want both, side by side.
• User group (People) is a set of people rather than a person — a department, a role, a directory or LDAP group, the contractors. It is the User shape drawn three times over, so a page mixing individuals and groups reads at a glance. Search group, role, ad group or team.

PAM shares its screen-on-a-stand outline with the Engineering workstation on purpose — both are a session at a screen — and they never share a colour, so the two do not get confused.

Drawing an attack

The Attack section holds the vocabulary for telling a security story, drawn to one rule:

• Attacker is the hostile actor — the User's own shoulders wearing a solid black hat, the black-hat hacker. It is always garnet, never the bronze of the users beside it, so the threat stands out on a busy page. Search hacker, threat actor, adversary or apt.
• Home (Places) is the remote worker's site — a house alongside Branch office and Campus. The person is a User and their machine is a Laptop; Home is the place they connect from. Search wfh, home office or teleworker.
• Clean / Malicious / Unknown file are a document sheet stamped with a verdict badge: a check, a radiation mark or a question mark. Use them for what moves through the picture — a download, an attachment, a payload.
• Clean / Malicious / Unknown website are a browser window carrying the same three badges. Use them for where the traffic goes — a phishing page, an unrated site, an allowed one.
• Infected laptop is the Laptop shape with the radiation mark ringed on its screen — the endpoint after the malicious file ran. Search compromised, pwned or patient zero.

The verdict shapes are the one place in the palette where colour means status: clean is green, unknown is grey, malicious is red — the same three verdicts whether stamped on a file or a website. The badge mark always says the same thing as the colour, so the verdict never depends on telling red from green. And the radiation mark is the one signal for "malicious" everywhere it appears: on the file, the website and the infected screen alike.

Finding a shape

• Search — the box at the top of the palette filters by name, catalog key and alias. Aliases are built in, so fw finds Firewall. Multiple words all have to match. Escape clears the box. Catalog keys work typed in full, hyphen included — l3- finds L3 switch — so an id you have read in a .dot file leads back to its picture.
• Its DOT name — hover any shape and the tooltip gives you its kind= value, with a small copy button in the tile's corner that puts the bare id on your clipboard. That is the whole point of the palette for anyone writing diagrams as code: find the device by its picture, take the word, paste it after kind=. The Diagrams from code chapter lists every value.
• Collapse — click a family heading to fold that group away. The count next to the heading tells you how many shapes are inside. Collapse all / Expand all does every group at once. Your collapsed groups are remembered.
• If your text is bigger than ours — the palette is a fixed width, so a browser minimum font size or an unusual system font can make a category name longer than the room it has. When that happens the name is shortened with an ellipsis and the whole name is in its tooltip; the count stays beside it, and Collapse all and Connector stack onto two rows rather than one of them being cut off. Nothing ever ends up outside the panel.

Your own shortlist

Most drawings lean on a handful of shapes. Two places keep yours at hand, and you configure each on its own:

• ★ Favorites in the palette — hover any tile and a small star appears in its corner; star it and the shape joins a pinned ★ Favorites group above Security. Hovering a section heading reveals a star too, which pins the whole category. A favorite tile behaves exactly like its original — click to arm, drag to place, same search. Star it again anywhere to remove it.
• The ★ Quick menu in the toolbar — the star button opens a dropdown of shapes you chose for it; picking one arms click-then-place just like a palette tile, which is handy when the palette is buried under a long drawing. Press Customize… inside the menu to star shapes or whole categories for it; search works there like everywhere else.

The two lists are deliberately separate — starring a shape in the palette does not put it in the toolbar menu, and vice versa — so each place can hold what makes sense there. Both are remembered per browser, like your collapsed groups.

Placing a shape

Two ways, both fine:

• Click the shape in the palette, then click the canvas. The palette button stays lit while it is armed; click it again, or press Escape, to disarm.
• Drag the shape from the palette straight onto the canvas.

New nodes are placed centred on your click and snapped to the 8 px grid. Devices come in at 96 × 80; Internet and Cloud are wider (120 × 88) because they read as places rather than boxes; a Zone starts at 320 × 220 and a Rack at 240 × 316 (12U).

Unknown shape kinds — from a file authored elsewhere — always render, falling back to the Generic shape rather than disappearing.

Changing what a device is

Select a device and use Device in the inspector. It is a searchable list, grouped by the same families in the same order, alphabetical inside each. Matching works exactly as it does in the palette, so fw finds Firewall here too. With several devices of different kinds selected the control shows "Mixed"; picking a kind changes all of them.

Labels

• Double-click a device (or a zone, or a connector) to edit its label in place.
• Or select it and type in the inspector's Label field.
• Enter commits the edit. Shift+Enter (or Alt+Enter) inserts a line break instead — labels can be several lines. Escape cancels.

The edit box grows with what you type, in both places, so a long description stays readable while you write it.

Long labels

A label that does not fit wraps on its own; you only need Shift+Enter when you want the break somewhere particular.

How many rows you get depends on where the label sits. Outside the tile nothing is competing for the space, so it can run to six rows. Inside the tile it shares the tile with the icon, and each row takes height away from it — so it gets only what the tile can spare while the icon is still recognisable:

Past that limit the caption ends in an ellipsis (…) and hovering it shows the whole text — nothing you typed is lost, and the full label is always in the inspector's Label field. Making the shape taller raises the inside limit; making it wider fits more on each row.

So if a label is really a sentence rather than a name, put it Below, where it gets six rows and may overhang the tile a little — that reads better than a narrow stack. Container titles (zone, rack, Purdue band) and rack unit names stay on one row whatever you type: they sit in a fixed-height band, and a break you type there becomes a space.

Role and functions

Two devices of the same kind rarely do the same job, and until you say so a drawing cannot tell you which is which. Two inspector fields do that, and they are deliberately different from each other so you never have to work out which one you are reading.

Role — where it sits. One short tag, drawn on a tinted band across the top of the tile in the device's own accent colour: EDGE, ISFW, DCFW, CORE, ACCESS. A device sits in exactly one place, so this is one value.

Functions — what it runs. A comma-separated list, drawn as a quiet line under the device's name in ordinary sentence case: VPN, IPS, Web filter. One box usually runs several things at once, so this is a list. A list too long for the tile ends in "+2 more" rather than being cut off silently.

Both fields have a ▾ at their right-hand edge that opens the vocabulary for whatever you have selected — and the vocabulary follows the device, so a switch is offered core, distribution, access, top-of-rack, spine, leaf and management while a firewall is offered edge, internal segmentation, data center, DMZ, branch, cloud, OT, distributed and host-based. The role list shows each tag beside the name it stands for, so you do not have to remember that "internal segmentation" is written ISFW. The function list is grouped the way you would describe the box — inspection, access, network, platform — and you tick as many as you need: the list stays open, and ticking one that is already on takes it off again. There is a search box in both, matching the long name as well as the tag.

The list is an offer, never a rule. Both fields are ordinary text, so type TRANSIT or PCI in Role if that is what your site calls it, or add a function nobody else has — just separate functions with commas. A device kind that runs nothing worth naming gets no ▾ at all rather than a list it cannot fill; you can still type whatever you like.

The short way to remember it: the band on the tile is where the box is, the line under the name is what it does. They never share a style — the band is a code in mono capitals in the accent colour, the line is plain muted text.

Both travel everywhere the rest of the drawing does: they survive save and reload in .drawio and .vsdx, reach the people you are sharing a live session with, appear in the auto-legend (a kind used at two roles gets two rows, which is usually the point), get their own columns in the inventory CSV, are findable with Ctrl/⌘+F, and show up in the device panel of an exported interactive HTML file. Compare reports a changed role as re-roled rather than as a restyle, because it is a fact about the network and not a look.

One thing they deliberately do not do: the format painter leaves them behind. Copying the look of your edge firewall onto the data-center firewall should carry colour and type, not turn the second one into another edge firewall. Duplicate and paste do carry them, because a copy means "another device like this one".

Label position

The Label position buttons set where a device's caption sits relative to its tile:

Image nodes default to Below instead, because a caption drawn on top of a bitmap is unreadable.

A tile too small to hold its name defaults to Below as well — under 64px wide or 56px tall, which is where an inside caption is down to one short line and starts ending in an ellipsis. That is the size you end up at when you shrink sites to fit several onto a country map, and a marker whose name you cannot read is not a marker. It is only the default that moves: press Inside and the caption goes inside however small the tile is.

Rack units ignore label position: their name is always drawn inline in the unit strip.

Label align

Label align sets whether the caption sits left, centred or right over the tile's width. Centred is the default, and what every label was before.

It applies to the Inside, Below and Above positions — the ones that sit over the tile, where there is a width to align within. With the label Left or Right of the tile its anchor already is the tile edge, so there is nothing left to align it against and the buttons are greyed out.

Alignment works on a multi-row label as a block: every row shares the same edge, so a left-aligned two-row caption is flush left on both rows. It applies to Text and Callout blocks too — that is the same control those have always had, now in one place for every kind.

Colour and text

Color in the inspector is a row of swatches: a default swatch that removes any override and returns the item to its family colour (for nodes) or the theme line colour (for connectors), then the eight family accents read from the theme the app is running in, then — after a hairline — the six brand colours: red, green, teal, blue, purple and silver. The hairline marks a real difference in where those colours come from. The family accents are the current theme's own values, so the row offers the palette the rest of the drawing is already using; the brand colours are fixed and identical in light and dark, so a drawing that has to match a style guide keeps the right red wherever it is opened. Either way, the colour you click is stored on the object as a fixed value — only the default swatch keeps following its family, and so keeps changing with the theme.

Any colour at all

The last chip in the row is Custom…, and it opens the full brand sheet: each of the six hues in a column, five darker shades above the base and five lighter tints below it. Click a square and it applies. Underneath are two other ways in — a Hex field, where you can type or paste a value (#1a2b3c, and the # is optional) and press Enter, and Pick…, which opens your system's own colour picker, with its eyedropper, its sliders and whatever swatches you have saved there. On a Mac that is the macOS colour panel; the colour follows along on the canvas as you move around in it.

All three work on connectors exactly as they do on shapes, and on any number of selected items at once. The Custom… chip lights up when what you have selected is a colour the row itself cannot show — a brand tint, or something you pasted in — so the row never looks as though nothing has been set.

How big the writing is

Document text scale sits in the inspector and is always available, because it belongs to the drawing rather than to anything selected. It sizes every label at once — device names, connector labels, port labels, zone and rack titles, text blocks — so a diagram that is going to be printed at A3, or read on a projector, becomes legible in one move instead of thirteen. It is one setting for one question, which is why there is no font size per kind of label.

The Font size field beside it is an override for whatever you have selected: a device, a zone, a text block, or a connector (which sizes its own label and both its port labels together — one connector, one size). Leave it empty and that object follows the document scale, and keeps following it when you change the scale later; the greyed number in the field is the size that currently produces. Type a size and that object stops following — deliberately, so a heading you made big stays big when you scale the rest of the drawing. Reset empties the field again.

Update all clears every override on the page in one step, so a document somebody has hand-tuned into a mess goes back to following its scale. It says how many objects it changed, and it is a single undo if you did not mean it.

A label positioned inside its tile wraps at the tile's width, so at the largest scales a long name stacks and the icon gives up some room. A single word that cannot fit never breaks in the middle: it stands a little proud of the tile instead, on the same allowance a Below label gets, with its halo keeping it readable over whatever it crosses — and only a name too long even for that is shortened with an ellipsis. If a large scale makes an inside caption feel cramped, the remedies are the same as ever: put the label Below, or make the shape bigger.

Everything else about a shape's look — tile fill, outline, shadow — comes from the design tokens and is not individually settable. That is deliberate: one good default beats a styling panel. (The label's weight, slant and typeface are the exception, and they have their own row — see Text style on the Canvas page.)

Alignment used to live beside the font size and now applies to any node's text — see Label align above.

To copy a look from one item to another — the format painter — use Style → Copy then Paint. It carries the whole look rather than a selection of it. For a shape that means the colour, where the caption sits and how it is aligned, its size, weight, slant, underline and typeface, the size of the shape itself, and — on a basic shape — whether it is dashed or filled and how faded it is. For a connector it means the colour, the connector type, the link type, the speed, the cable medium and wavelength, whether the cable runs through the icons instead of stopping at them, where every caption sits along the line, and the same typography again. The rule is simply that if it changes how something looks, the painter takes it; anything left behind is a bug worth reporting. What it never takes is what a thing IS or where it is — the words in a label, a cable's ends or its bends, which aggregate a cable belongs to, or a tick on the cable schedule. A look only paints onto its own kind — if you copied a connector and then select a device, Paint tells you so rather than doing nothing, and if the thing you are painting onto already looks like that, it says that too rather than leaving you wondering. Size is stricter still: it only moves between like objects — a device's size onto a device, a zone's onto a zone — so painting a firewall's look across a zone recolours it without collapsing it to tile size. Rack-mounted units and racks keep their managed sizes either way, and so do lines and flow arrows: a line's size is just wherever its two ends are, so painting a device's size onto one would move its ends, and painting a flat line's onto a device would flatten the device. Everything else about a line's look — its colour, whether it is dashed, how faded it is — paints exactly as it does on any other shape.

Text and callouts

Two annotation shapes, both in the Annotation family:

• Text is a floating block of writing that belongs to no device — a heading, a note, a caveat.
• Callout is the same block with a leader line pointing at something. Drag the leader's tip to aim it; it follows when you move the callout.

The writing follows the box: a long sentence wraps at the block's width, and resizing the block re-flows it — press Shift+Enter while typing where you want a break of your own, and that break always stays. Nothing is ever cut off to fit; a block too short for its text simply lets it run below, and a taller box gives it room again.

For either one, the inspector offers a Font size, and the Label align buttons set left / centred / right. A callout also has Callout → Bubble: off by default, so a callout is plain text with a leader; on, it draws the note inside an outlined bubble. That is one toggle rather than a border sub-model — a note that needs per-side styling wants a shape, not a note.

Neither is a routing obstacle: a cable passes straight through a text block, which is what you want from writing laid over a diagram.

Flow arrows

A Flow arrow (Annotation family) is a bold red arrow for showing where traffic goes — packets into the DMZ, an attack path, a replication direction. It is an annotation about the drawing rather than a cable: it routes around nothing, it carries no speed or link type, and a connector cannot end on it. Its ends can be fastened to devices, exactly as a Line's can — see The Line is a connector under Basic shapes.

Pick it from the palette and drag on the canvas: the arrow runs along the dominant axis first with one right-angle bend, or hold Shift for a straight diagonal. A plain click places a default arrow to shape afterwards. While an arrow is selected, drag its round point handles to reshape it, click a diamond mid-segment to add a bend, and double-click a point to remove it — an end is a point like any other, and removing a fastened one lets go of its device at the same time. It never drops below two points. Moving the arrow moves the whole shape.

Everything a connector's caption can do, the arrow's label does too: double-click the arrow (or use the inspector's Label field) to write on it, then place the caption with the same Label placement controls — start/middle/end, above/on/below, follow the arrow — or just drag the caption where you want it. The inspector's Flow arrow row switches Solid/Dashed and One way/Both ends, and the colour swatches recolour it; the default red stays out of the family palette so your devices keep their meaning.

In isometric view the arrow lies flat in the floor plane, exactly like cables, so it keeps pointing at what it annotates from every camera corner. On save it becomes a native draw.io arrow, so the file opens correctly in vanilla draw.io.

Asset data

A device carries six optional fields, under Asset data in the inspector: Management IP, Serial, Model, Location, Notes and Link. The section starts collapsed on a device that has none and opens as soon as there is something to read.

Link is the URL of whatever documents this device — its NetBox page, its management UI, a runbook. An Open button sits beside the field and lights up for an http:// or https:// address (management UIs on a LAN are routinely plain http); press it and the page opens in a new tab, or in your normal browser from the desktop app. Only those two schemes ever become clickable — anywhere: here, and in the HTML viewer export — so a link someone else typed into a file you opened cannot run anything. Copying a device deliberately leaves the link behind, like the serial and management IP: it names one physical unit's page, not the kind of device.

It is a fixed set, not a property grid, and it is the same set an audit asks for. What it feeds:

• Export → CSV inventory writes every device on every page with these columns — including the devices that have none, because the point is to show what is undocumented.
• The HTML viewer export renders the link as a real, clickable link in its details panel (http/https only — anything else is shown as plain text).
• The HTML viewer export shows them in its details panel when you click a device.
• A zone's Subnet (CIDR) compares against Management IP for its gentle out-of-subnet hint. If a device has no management IP, the hint falls back to reading an address out of its label.

The fields round-trip as draw.io's own shape data, so what Drawbridge writes is exactly what draw.io's "Edit Data" dialog shows, and a file that gains data in one opens with it in the other. The Link field goes one better: it is stored as draw.io's own link attribute, so a file we write opens in draw.io with the shape clickable there too, and a draw.io file whose shapes carry links opens here with them in the Link field.

Copying a device carries the shared traits — model, location, notes — and deliberately not the management IP or serial: those identify one physical unit, and two devices with the same serial is worse than two with none, because it looks like real data and would flow straight into the inventory.

Racks

A rack is a container drawn as a 19-inch elevation: a title strip at the top, side rails, and a rule per U. U numbers run up the left rail with 1 at the bottom, like a real rack. Racks paint behind devices and are never obstacles for cable routing.

• Resize — a rack snaps to whole Us in height, minimum 4U, and cannot get narrower than a device tile plus its rails. The Rack height (U) field in the inspector sets it numerically.
• Mount by marking — drag down the U rows inside a rack to mark a span; releasing creates a rack unit there, spanning those Us.
• Drop a device in — a device whose centre lands inside a rack's usable area snaps: centred horizontally, aligned to a U boundary. Grab it anywhere, including the middle: dropping a shape into a container always places it, and never draws a cable to the container. (To cable something to a rack or a zone, hover the device and drag from one of its connect handles.)
• Move a mounted unit — drag it up or down the rails; it moves in whole U steps and stops at the last U that fits.

Rear elevation

Elevations → Show rear draws a second elevation beside the front one, sharing a centre rail. Marking U rows on an elevation gives you a unit on that face, so U10 front and U10 rear can hold two different units.

Mounting depth

For units in a two-elevation rack, Depth decides whether the opposite face stays usable:

Full is the default. A front-only rack has no opposite face, so its units are always full depth.

The rack builder

Double-click a rack's title strip to open the rack builder — a full-screen view of one rack, with both elevations drawn large. It is a view over the same document, not a separate one: undo, collaboration and file round-tripping all work normally, and the canvas behind stays live.

In the builder you can:

• Search the device list on the left, click a device to arm it, then click a free U to mount it. Click the armed device again to disarm.
• Drag a mounted unit to another U, or to the other elevation.
• Select a unit to rename it, make it taller or shorter by whole Us (− / +), set Full / Half depth, or Remove it.
• Toggle Show rear without leaving the builder.

The builder refuses exactly the mounts the canvas would refuse: it will not overlap an occupied U or hang a unit off the bottom.

Zones and virtual contexts

Zone is a dashed, tinted container with an uppercase title in the top-left. Virtual context (VDOM / VRF / VSYS as a container) behaves identically. Both paint under devices, never clip them, and are never obstacles — a connector may pass straight through.

A zone owns what stands on it: move the zone and its contents move with it, whichever way you move it. When one object should not travel — a label that belongs to the page rather than to the zone, a device you have placed exactly — Detach it, from the inspector or by Alt-dragging it. Select the zone and anything it will leave behind fades back — and the inspector counts what travels — so you can see the whole answer before you move it; an ordinary drop back into the zone re-attaches an object. Release contents, on the zone itself, detaches everything on it in one step. See Moving and resizing for the whole rule.

A zone can carry a Subnet (CIDR) annotation, e.g. 10.20.30.0/24. It is purely annotational: it appears quietly in the zone title and drives a gentle hint when a device inside carries a management IP outside that subnet. There is no address management or allocation.

The hint reads Asset data → Management IP first. Devices that have none are judged on an address found in their label instead, so a drawing labelled fw1 10.20.31.5 is still checked; fill in a management IP and that is the one that counts, whatever the label says.

The field takes a subnet and only a subnet. Type something that is not one and the box outlines itself in red and nothing is written — the zone's title never presents prose as though it were a network. An IPv6 subnet such as 2001:db8::/32 is accepted as a label; the out-of-subnet hint is IPv4 only, so an IPv6 zone simply gets no hint. Clearing the field removes the annotation.

The bus

The Bus (network family) is the classic shared-segment bar: a thin strip that devices tap into perpendicularly, each at its own position — for "these devices are on the same network" without a zone box or a mesh of cables, and for internal fabric links (NPU, backplane, ISL) where a bar reads better than a cable.

• Connect devices to it like to any node; each cable drops onto the bar next to its device. Crowded taps push apart to a minimum spacing, and beyond capacity they spread evenly — one device or a hundred, never a pile-up.
• The bar grows automatically as you connect more devices (in the same undo step as the connect). It never shrinks by itself — resize it like any node; make it taller than wide and it becomes a vertical bus.
• The label sits above the bar; the Color swatches recolour it.

Map underlays

There are two kinds, and they behave differently on purpose.

Both come from the same control: the Add place… picker in the palette, under the search box.

A backdrop. The picker's first group, Backdrop, holds the world and the five regions — Americas, EMEA, APAC, Europe, Nordics. Choosing one drops that map behind the current page, sized to cover what is already there and shaped to the region itself, so Europe arrives as Europe rather than as a world map with most of the world cropped off. It goes on its own layer, placed beneath every other layer, so it stays scenery in the saved file as well as on screen. A map is scenery in every sense: it paints under everything, is never a routing obstacle, and cannot take a connector endpoint. One backdrop per page — pick another and it selects the one you already have, so you can change its extent in the inspector, which reframes the map and carries the devices standing on it.

Country objects. The rest of the picker — every ISO country and territory, grouped by continent — drops one country as an ordinary object, sized to that country's own shape, drawn on its own with no neighbours — a clean silhouette, with no border or background card around it, and its name underneath. Add as many as you like — each new one lands beside the last, so a run of them reads as a row — and then arrange them however the picture needs. That is how you build a country visualization without an EMEA or world map underneath it. From Russia down to Singapore, Malta and Monaco, each group sorted alphabetically. Each map goes on its own layer, named after it ("Map: Sweden", "Map: Finland"), so with several on a page any one of them can be hidden or locked from the Layers menu without touching the others; adding the same country twice reuses its layer.

Select the map and use the inspector's Map extent picker to choose what slice of the globe it draws — World, the regions (Americas, EMEA, APAC, Europe, Nordics) or a single country. Changing the extent reframes the map: it is resized so roughly the same number of device tiles fit across it at every scale, and devices standing on the map are carried geographically — a device over Stockholm on a Europe map is still over Stockholm when the map becomes Sweden — provided every device lands inside the new frame.

A country map is deliberately not drawn at world scale — the whole page would only be legible at a fraction of a percent — but it is sized to hold a working number of sites: a United Kingdom comes out about ten default tiles across, and shrinking sites towards the minimum (where their names move below the tile and stay readable) fits comfortably more. If a particular map still wants more room, it resizes like any other shape.

The neighbours checkbox chooses between drawing the country with its surroundings (the default) or on its own.

Every place stands upright. A single country or state is drawn flat, re-projected on its own central meridian — the way it looks on its own local map, not leaning the way it does at the edge of a world wall map. The United States sits square, Japan and Australia stop tilting, and countries the world map's edge cuts in half draw whole: a solo map of Russia or the Aleutians is one contiguous place. The world and region extents keep the classic world-map projection, because there the curve of the meridians is the point; showing a country's neighbours draws them in the country's own upright frame, so ticking the box never moves the country. Nothing is squashed or stretched to do this — it is the same geometry, looked at from straight on.

US states are countries to the map. The picker has a United States group with all fifty states and DC, and a state behaves exactly like a country: pick Texas from Add place… and it lands as a silhouette on its own Map: Texas layer, or set a map's extent to a state to frame it. With neighbours shown, the surrounding states are drawn with their borders, so a state map has the same context a country map gets from national borders. The outlines come from US Census Bureau geometry and are drawn in the same projection as the rest of the map, so a device carried between a state and a country extent stays over the same place on the globe.

Show cities marks the map's ten biggest cities — dots with names, sized to the map. Where several of them sit on top of one another — Dallas, Ft. Worth and Arlington share one metroplex — the names are placed around the cluster, one to the left, one to the right, one underneath, so all ten stay readable rather than three of them running together. Every extent has its own list: the world's ten, a region's ten, a country's ten, a state's ten. It is off by default — a map you drew yesterday looks exactly the same today — and it is there for the same reason devices carry geographically: sites belong on real places, and "over Göteborg" is easier to hit when Göteborg is marked.

The Show border and Show background checkboxes control the map's frame: the rounded outline around it and the faint tinted card behind it. A backdrop shows both by default — the frame is the map's edge — while a country added from the picker shows neither. With both off, the map is just its land, and its label sits under it like any other shape's.

The map's label is what names it on the page, so an EMEA extent can be called "Nordics" if that is what it represents to you. The map's layer follows its name the same way: pick Sweden and the "World map" layer becomes "Map: Sweden" — in the same undo step — unless you have renamed the layer yourself, in which case your name stays.

A map's layer belongs to the map: it holds only maps, so nothing else can be moved onto it and new shapes never land there, and it lives and dies with them. If you have locked that layer, adding another copy of the same place is refused with the lock as the reason rather than dropped somewhere else — a map only ever lives on a map layer, so there is nowhere else for it to go. Delete the map and its layer disappears in the same undo step (a layer shared by two copies of the same country stays until the last one goes); delete the layer from the Layers menu and the map goes with it. Pasting a map brings its layer back — cut a map, paste it elsewhere, and it arrives on its own bottom layer again.

The icon library

≡ menu → Icon library puts the whole catalog on one page: every icon, grouped into the same sections as the palette, with its catalog key underneath. There is a search box, and picking an icon arms it and closes the dialog, so browsing ends in drawing rather than in hunting for the same shape again in the palette.

The catalog key under each icon (plc, data-diode, purdue) is the name the shape is saved under in a .drawio or .vsdx file, and the name a CSV import will match — useful if you are writing one by hand.

Your own icon on a device

Select a device and the inspector offers an Icon section: Replace… takes a PNG, JPEG or SVG of your choosing — a vendor logo, a product face — and puts it in the tile's icon slot. Everything else about the device stays the house style: the card, the label, the role band, the colour, the asset data. Reset returns the catalog icon.

A few deliberate rules:

• The image is stored as pixels. Whatever you give it — an SVG included — is rasterized to a small PNG on the way in, so nothing inside the file can ever run, here or in anything you export. That also caps its size: an image that will not fit in 64 KB as a 128-pixel PNG is refused with a message.
• A copy keeps the icon — a copy should look like the original — but the format painter does not paint it: an icon is the device's identity, and painting it would put one appliance's face on another.
• It travels in the .drawio file (draw.io preserves it and shows the device as it always did) and reaches every picture export and the minimap. The one place it does not survive is a .vsdx — Visio interchange drops it, like other page furniture.

Purdue level backdrops

Purdue levels in the palette (Annotation family, or just search purdue) drops a backdrop that draws the seven bands of the Purdue / ISA-95 model — 5 enterprise, 4 site business, 3.5 industrial DMZ, 3 site operations, 2 area supervisory, 1 basic control, 0 process. Like a map it is scenery: it paints under everything, is never a routing obstacle, and cannot take a connector endpoint. A conduit crossing a level boundary is the subject of the drawing, not something to route around.

It is one node, not seven stacked zones. That is deliberate — the bands are derived from the node's box, so they cannot drift apart, and a device's level stays readable from its y position no matter how much the page is edited. Resize the backdrop and every band scales with it.

The bands are not equal height: levels 3, 2 and 1 get more room because that is where devices actually accumulate, while level 5 is usually one cloud and a user. The industrial DMZ is drawn as a seam rather than a band — heavier fill, dashed edges — because that boundary is the reason the diagram exists.

Devices snap into a level: drop or drag one onto the backdrop and it lands centred in the band its middle falls in, so getting a level lined up takes no alignment tools. Only the vertical position is snapped — where a device sits left-to-right in its level is yours to choose. Tiles of different heights are centred rather than top-aligned, so a wide Internet tile still reads as part of the same row as the devices beside it. A device inside a rack keeps the rack's U slot: the rack wins.

Level numbers and names live in the rail down the left, never as captions inside the bands, so a device can never cover them. Narrow the backdrop past a point and the rail keeps the numbers and drops the names.

The OT — Purdue Plant template starts you with a populated one, with the backdrop on its own "Purdue levels" layer so you can switch the whole thing off from the Layers menu and keep a plain plant topology.

Legends

Blocks → Legend in the toolbar is a switch: tick it and a legend is built from what the active page actually uses. There is nothing to configure. It contains:

• the device kinds present on the page (containers and pasted images are skipped — they explain themselves),
• the semantic link types in use, drawn with the real rendering rather than an imitation,
• the link speeds in use with their colours,
• an aggregate entry when the page has one.

The legend is made of ordinary nodes and edges, so it exports, prints and syncs like anything else. You can park the frame anywhere and edit its labels; a refresh rebuilds the content in place, keeping your position and your label edits.

Don't need a row? Delete it. Click the row you do not want and press Delete, and it stays gone — the legend remembers, so the next edit to the page does not put it back. A link or speed row is the two small squares and the sample line between them; deleting any part of it takes the whole row. One undo brings a row back. To start over, clear Blocks → Legend and tick it again: that rebuilds every row, including the ones you deleted. Deleting the legend's backdrop still takes the whole block, as it always did.

The Blocks menu is three switches

Legend, Optics and Title are switches, not buttons. A tick means that block is on this page: tick it to build it, clear it to take it away. Nothing has to be selected on the drawing, so a block parked behind a rack comes off as easily as one in plain sight.

The menu stays open while you work it, so putting a legend and a title block on a page is two clicks rather than four, and it closes when you leave it — click the canvas, press Escape, or open another menu.

Switching a block off is one undo step and takes nothing else with it: the other blocks stay where they are, and what you typed into a title block lives on the document, so switching it off and on again brings your content back with it. A page with nothing to say is the one case a switch declines — a legend on an empty page, or an optics block where no cable needs port hardware — and it says so and goes back off rather than leaving you a tick over nothing.

A block already on the page follows what the page holds, so deleting the last thing it describes leaves it empty rather than gone — the frame stays, with its title, and fills back in the moment there is something to say. Only the switch takes a block away, which is what makes undo work: delete a page's devices and one ⌘Z brings them and their legend back together.

Title blocks

Blocks → Title in the toolbar switches on a title block: the bordered grid an engineering drawing carries in its corner, with your logo, the drawing's title, the date, the file name, who drew it and the current revision.

It is off unless you ask for it. No new document, template or opened file grows one on its own — a sketch you are thinking with should not have paperwork attached to it.

Double-click any cell to fill it in. What you type is stored on the document, not on the cell, which is why:

• a multi-page drawing shows the same author on every page, and correcting it once corrects all of them,
• the printed PDF and the cable schedule name the same person,
• refreshing the block never eats what you typed.

Document info… in the app menu fills in every field at once, and is where you choose the logo. Tick the box there to remember your name, organization and logo for the next drawing.

The revision is yours, always. Nothing in the app ever steps it for you — not saving, not editing, not rebuilding the block. Issuing a revision is a decision, so it takes one: New revision in Document info steps the number and stamps today's date into the fields, where you can still change both before saving. Type whatever scheme you use; R2, V10.20.30 and Issued for construction are all fine.

The revision date is only filled in once you have actually revised something — on a new drawing there is one date, not two.

On a multi-page drawing the block gains a SHEET cell — 2 of 3 — taken from the document's own page list, so it cannot disagree with reality.

Two cells look after themselves. FILENAME follows the file the document is saved as — including the moment you Save As, so what is written to disk already says the right thing. TITLE falls back to the page's name until you give the document one of its own.

It moves as one. Clicking any cell selects the whole block, so a drag takes all of it; deleting any cell removes all of it, rather than leaving a grid with a hole in it. To work on a single cell, double-click it — that drops you inside the block, exactly as it does for a group, and from there you can drag or resize that one cell.

Columns adjust. Select the block and drag any column divider — the vertical rule between two cells, the way a spreadsheet works. The neighbour in the same row gives up what you took, so the grid stays a grid. A cell has no position of its own — dragging one moves the whole block — because a cell pulled out of its row would only leave a hole. Widen the last cell in a row and the block itself grows. Cells resize widthwise only — heights belong to the row — and what you set is kept through every later refresh. If a block ever ends up out of shape, switch Blocks → Title off and on again: a grid that no longer adds up is laid out fresh, and nothing you typed is lost, because the content lives on the document.

It is furniture, not a device: no connectors attach to it, and a cable dragged across it goes to whatever is behind.

Selecting any generated block — a title block, a legend or an optics block — shows a small card naming it rather than the usual property rows. Those blocks are rebuilt from scratch whenever their source changes, so a colour or a label position set on one would be thrown away at the next refresh. Where a rename does stick, the Label field is still there: legend entries and the optics block's title can be renamed and keep it.

The block is made of ordinary nodes, so it exports, prints and syncs like anything else, and you can park it wherever you like. When a page carries one, a PDF export drops its own small footer band — one title block to a sheet.

Branding a drawing

Document info… → Branding stamps the marks an organization puts on a drawing before it leaves the building:

• a watermark across the sheet — DRAFT, CONFIDENTIAL and three more are one click, and the field takes anything you type;
• a classification, printed as a strip above and below the drawing;
• your background logo, behind the diagram, in the middle or any corner;
• a strength slider for how strongly the watermark and logo paint.

Setting a classification fills the watermark too, so marking a sheet CONFIDENTIAL is one choice rather than two — type something different in Watermark and you get both, which is how you stamp DRAFT across a CONFIDENTIAL sheet.

It all sits behind the drawing, and the strength is capped: a watermark that hides a device name has made the drawing worse to protect it. The watermark is sized to the drawing it crosses — a longer phrase and a smaller drawing both make it smaller, so it always fits inside the sheet rather than running off the edges. It appears on every page, in everything you export and in what you print — a mark only on screen would be decoration rather than a control.

Branding is a property of the document, not shapes on the page: you cannot select it, drag it or delete it by accident, it never appears in the object list or the cable schedule, and turning it off leaves nothing behind. Tick the remember box and your logo, organization, name and classification carry to the next drawing.

Images

Paste an image from the clipboard, or drop an image file on the canvas, to create an image node. Images are embedded in the document.

• Inputs over 20 MB are rejected; anything that is not an image is ignored.
• Stored pixels are capped at 1024 px on the longest side. PNGs stay PNG, JPEGs re-encode, small files pass through untouched.
• A pasted image is fitted into the same 96 × 80 box as a device tile, so a vendor icon lands the right size next to your other devices. It arrives selected, so a screenshot is one resize away.

Groups

Select several nodes and press ⌘/Ctrl G (Group) to bind them by identity, not by position — members stay grouped however you move them. Selecting, moving, duplicating or deleting any member acts on the whole group. The group's frame is derived from the members' bounds; it is never a stored shape.

• Ungroup (⇧⌘/Ctrl G) dissolves it.
• Collapse / expand replaces the group with one titled placeholder and hides its members and their connectors. Double-click the placeholder to expand it again.
• Double-click a member to enter the group and select just that one; double-click again to edit its label.

Groups are different from zones: a zone contains by geometry, a group by membership.

Arrange and align

Arrange moves items in the paint order: bring to front, forward one step, backward one step, send to back. It works on everything the same way — a pasted picture, a zone, a device tile — and it moves things past the connectors too, so an image sent to the back really does end up behind the cables that cross it. What Arrange will not do is take something out of its own layer: front means the front of the layer the object is on. To move a whole stack of things at once, drag the layer instead (see Layers). Align aligns edges or centres of a multi-node selection, and spaces three or more shapes evenly. Rack units are excluded from align and spacing — the rack grid owns their positions. Connectors are never moved by either: a cable has no box to line up, so it is not counted and not touched. Aligning shapes joined by a cable you shaped by hand carries that shape along when both of its ends move together, in the same undo step.

Gap, at the bottom of the Align menu, is the other half of spacing: even spacing shares out the room the shapes already occupy, and the gap decides how much room that is. The number shown is the gap your selection is using — two numbers, 40 × 56 px, when it has rows and columns with different ones — and − / + step it by 8 pixels. Each row keeps its leftmost shape and grows to the right, each column keeps its topmost and grows down, so the shape you are measuring from stays put. Press it as many times as you like: a run of presses is one undo step, ending when you pause. It goes down to shapes that touch and no further.

Space evenly works a row at a time. ↔ finds the rows in your selection and evens out the gaps inside each one; ↕ does the same down each column. A row keeps its own end shapes exactly where they are, nothing changes row, and a run of fewer than three is left alone — so selecting two rows of switches and pressing ↔ tidies both rows rather than dealing them out into one long line. If there is no row (or column) to work with, if the shapes are packed too tightly to have gaps at all, or if they are already even, it says so and changes nothing. The gaps come out exactly equal, which can leave a shape a pixel or two off the drawing grid; the next time you drag it, it snaps back onto the grid as usual.

Basic shapes

The palette's last section holds eight plain shapes for annotating a drawing: Rectangle, Ellipse, Diamond, Triangle, Hexagon, Star, Note and Line.

Unlike a device, a basic shape has no icon — the shape itself is the drawing, so it fills whatever box you drag. A rectangle stretched wide is a wide rectangle, and an ellipse stretched wide is an oval. Two of them deliberately behave differently: a Star keeps its proportions whatever box you give it, because a stretched star reads as a mistake rather than a choice; and a Line is not a box at all — it is a connector, described below.

Select a shape and the inspector grows a Shape section with two switches: Solid or Dashed for the outline, and Outline or Filled for the body. They are independent, so the two of them give four looks, and the default — a solid outline over a faint tint — is one of the four. They take the colour you set like anything else on the page, and a mixed selection marks neither button until you pick one for all of them. A Line is offered the dash and not the fill: it has no body to fill.

Opacity fades a shape, and works on zones and the Purdue backdrop too — anything with a body you can see through. Use it to put a shape behind your devices without it competing with them. It scales the shape's own tint rather than replacing it, so a zone at 50% is half as strong as it was, not a half-solid block. The slider stops at 10% rather than 0: a shape at zero would be invisible and unclickable, which is a way to lose your own work rather than a useful setting. Devices do not offer it — an icon on a card looks broken when faded, not subtle.

Basic shapes are marks, not containers: they do not capture the devices you draw on top of them. Use a Zone when you want a boundary that owns what is inside it. You can attach a cable to a rectangle, ellipse, diamond or hexagon; the star, note and line take no connections.

The Line is a connector

A Line is drawn, not dropped: press where it should start and drag to where it should end — sideways-then-down by default, or hold Shift for a straight diagonal. A plain click places a default-length line to shape afterwards.

It behaves like a cable rather than like a box. You can grab it anywhere along its stroke — there is a generous invisible corridor around it, the same width a connector has, so you never have to hit the hairline — and hovering lights it up so you can see what your click will land on. Selecting it gives you a handle at each end and a round handle at every bend, never a rectangle with corner handles: there are no corners to drag on a line.

Drag either end onto a device and it fastens there. The device rings as you pass over it, exactly as it does when you draw a cable, and the end settles on its border. From then on the line follows: move the device and the end travels with it, and it turns to face whichever way the line now runs. To let go, drag the end off onto empty canvas — it stays exactly where you drop it. Either end can stay free, which is the point of a line, and deleting a device the line was fastened to simply releases it rather than taking the line with it. A plain click on an end handle only selects the line: letting go of a device is something you have to drag to do.

Shape it the way you shape an arrow — drag a round handle at any bend, click a diamond mid-segment to add one, and double-click a point to remove it. You can write on a line, too: double-click it to type a caption, then place the caption with the Label placement controls or simply drag it along the line.

A line can carry a caption, and it is placed the way a cable's is rather than the way a device's name is: write it with the inspector's Label field, then use Label placement — Start · Middle · End along the run, Above · On · Below it, and Follow the connector. The device rows (Label position, Label align) are not offered for a line, because a line has no tile for a name to sit beside.

Everything here is true of the Flow arrow as well; a line is that arrow without the head. Both save as real draw.io connectors, fastenings included, so a line you attached to two devices arrives attached to the same two shapes in vanilla draw.io.