Understanding the Devices Used in Remote Industrial Networking

As discussed in our previous article, most automated equipment today has the ability for engineers and technicians to remotely connect to the machine's network for troubleshooting and monitoring purposes. In this article, I’ll cover the types of connections and security devices that can be added to your automation project.

How Does a Remote Connection Work?

There are many ways to allow a remote connection to a machine on a network. To accommodate this variety, there are devices on the market, often referred to as industrial gateways or edge gateways, that make the process easy and secure.

The definition of a gateway is fairly simple: it’s a device that bridges two distinct networks. Some gateways bridge two types of network protocols (e.g., Ethernet to RS232), while others are used to link between two levels of a network (e.g., factory floor level to enterprise level, both using Ethernet). Gateways discussed in this article are used for remote access, and so they require connections both to the internet and to the machine network.

Note: not all devices on the machine network should have access to a remote connection. In most industrial gateways, you can configure the range of IP addresses that are exposed to the internet.

Once all the connections are made and configured, the gateway device acts as a secure bridge between the internet and the machine network. The user will need to log on to an online interface or use provided software that creates a virtual Ethernet adapter that is connected to the machine network. You won’t have to fix your IP address as you would in a typical hardwired connection; the gateway will take care of that for you. You will now be able to ping or connect to devices on the machine network.

Figure 1. The Secomea industrial gateway. Image used courtesy of Secomea

Similarities to a VPN

A virtual private network (VPN) has a similar function to an industrial gateway, where a secure tunnel is opened between the user and another network. The difference lies in the configuration and the intended use.

A VPN requires static public IP addresses, complex firewall configurations, and, usually, a high-end network infrastructure. In contrast, an industrial gateway is purpose-built for connecting machines to remote users, and will often consist of an outbound-only connection, so complex firewall configurations are not necessary.

A VPN will typically expose entire subnets, which can cause unnecessary access to devices on the equipment. An industrial gateway, on the other hand, will use a segmented outbound approach where only defined subnets or IP addresses will be exposed to the remote connection.

Figure 2. A collection of remote gateways from HMS networks (EWON). Image used courtesy of HMS Networks

Devices to Facilitate a Remote Connection

There are many industrial gateways on the market that can provide reliable, secure connections to equipment in the field. Some offer free tiers while others require a custom quote or ongoing fees. Some gateways will require you to work with IT to integrate them into the corporate network.

Below are some examples of more popular brands. Whichever device you choose, ensure you research the requirements and the security features so that both you and your customer will be comfortable with the solution.

EWON - A popular gateway often used by OEMs to allow for remote diagnostics. A software suite is used to configure and connect to the gateway, with cloud options available. The interface is intuitive and easy to use.

Secomea - Offers certificate-based access control and is often preferred in strictly controlled IT environments. Similar to the EWON, connection is achieved through software.

IXON - Uses a web portal for connection and configuration. Dashboards can be created with a drag-and-drop style of programming.

Tailscale DIY - If you are tech-savvy, the DIY method might be more your style. With Tailscale and a Raspberry Pi, you can even create your own VPN tunnel and add specific devices to your connection.

Security Devices

Most gateways have built-in software security features, while others have software and hardware inputs to control when a connection can be achieved. Some of the EWON models have digital inputs that can be configured to literally, physically enable or disable remote connection. These digital inputs can be connected to a physical key switch or a PLC output.

Figure 3. An Ethernet isolating device for customer-controlled VPN access. Image used courtesy of LAN LOCK

Gateways that lack a built-in disconnect feature can use devices like the LAN LOCK from Envision. This device has digital inputs that, when energized by a relay, PLC, or HMI, will isolate the connection between the two ports, essentially acting like a physical disconnect. A similar device from ElectroStandards includes a keyswitch and allows a user to select an alternate network or to completely disconnect the connection.

Figure 4. An Ethernet switching and isolating device. Image used courtesy of ElectroStandards

These devices provide the customer with a physical disconnect which they control, thus adding another layer of protection.

Providing Remote Support For Your Customer

Not all manufacturing facilities have talented maintenance staff that understand networking, programming, and troubleshooting automated equipment. Providing remote support for your customer ensures they will be supported in the event they cannot recover from a problem, but you need to ensure the safety and security of the support.

By using approved industrial gateways, adding devices like LAN LOCK when needed, and ensuring you have a strict remote support policy in place, you will be able to supply your customers with secure support and constant monitoring capabilities.