13.1.1. IPSec Secured Interface over Cellular

The 7705 SAR-Hm series of routers supports IPSec secured interfaces over cellular interfaces.

Figure 17 shows an example of an IPSec secured interface deployment over a cellular interface in a dual SIM environment.

Figure 17:  IPSec Secured Interface over a Cellular Interface 

With IPSec secured interfaces, static IPSec tunnels can be created under the PDN router interface associated for each SIM. When the SIM is active and the node attaches to the cellular network, the PDN router interface becomes operational. At that time, IPSec secured interface tunnels configured on the interface also begin to establish towards the security gateway they are configured to connect to. When the tunnel is established, data traffic traverses the IPSec secured interface. In Figure 17, only the pair of tunnels associated with the active SIM is operational.

The tunnel pair on the second PDN router interface is kept down and becomes operational when the second SIM becomes active.

Each IPsec secured interface tunnel is associated with one service. The supported service types are IES and VPRN.

Each service that needs to be secured over the PDN router interface must be configured with its own IPSec secured interface tunnel. For example if VPRN1, VPRN2, and VPRN3 all need to be secured, then three different IPSec secured interfaces are required, one for each service.

IPSec secured interface is supported on IPv4 and IPv6 PDN router interfaces.

The CLI output below shows an example of IPSec secured interface configured on an IPv6 PDN router interface:

13.2.1. NAT with Static Port Forwarding

With NAT, the source IP address and the port of the host on the private side (inside) of the network are translated to an external IP address and port on the public side (outside) of the network. The IP address on the inside can be assigned to a raw socket IP host connected to an RS-232 serial interface or assigned to an IP interface associated with an Ethernet port.

Static port forwarding is configured on the CLI using the following parameters:

Figure 18 shows an example of a network with a 7705 SAR-Hm series node configured to use NAT with static port forwarding.

Figure 18:  NAT with Static Port Forwarding 

In the scenario shown above, the “RTU” VPRN service is inside and the “SCADA” VPRN service is outside. The “RTU” VPRN contains two IP transport services, one for each connected device. For information about IP transport services, see IP Transport Services and also refer to “Serial Transport over Raw Sockets” in the 7705 SAR-Hm and SAR-Hmc Interface Configuration Guide.

Figure 18 shows specific values for the inside IP address and port and outside IP address and port. The cellular interface of the node is used as the network-facing interface to transport the outside VPRN traffic.

When a packet is sent from the SCADA master to the node over the LTE network, it will be carried within the outside “SCADA” VPRN service towards the node. The node will send the packet to the BB-ISA MDA to perform the required NAT function based on the configured NAT policy. NAT is applied to the packet as needed. The packet is then processed by the inside “RTU” VPRN service, destined to the corresponding IP transport service.

When a packet is sent from the RTU towards the SCADA master, the inside “RTU” VPRN service sends the packet to the BB-ISA MDA where the NAT policy translates the IP address and port to the outside IP address and port, The BB-ISA MDA then sends the packet to the outside “SCADA” VPRN service where it is routed over the cellular interface using the “SCADA” VPRN service.

The steps and CLI outputs below show the configuration of NAT with static port forwarding based on Figure 18.

13.2.2. NAT Command Reference

The 7705 SAR-Hm series of routers supports the NAT commands listed in this section. For command descriptions, refer to the 7450 ESS, 7750 SR, 7950 XRS, and VSR Classic CLI Command Reference Guide.