As discussed in a previous article (please add the link to my remote connection article here), most automated equipment today has the ability for engineers and technicians to remotely connect to the machine’s network for troubleshooting and monitoring purposes. In this article, I’ll cover the types of connection and security devices that can be added to your automation project.
How A Remote Connection Works
There are many ways to allow a remote connection to a machine on a network, but there are devices on the market, often referred to as industrial gateways or edge gateways, that make the process easy and secure. These devices require two connections: a connection to the internet and a connection to the machine’s network. It’s important to note that not all devices on the machine network should have access to a remote connection; in most industrial gateways, you can configure the range of IP addresses that are exposed to the internet.
Once all the connections are made, the gateway device will act as a secure bridge between the internet and the machine network. The user will often need to log on to an online interface, or use provided software, which creates a virtual Ethernet adapter that is connected to the machine network. You won’t have to fix your IP address, like a typical hardwired connection; the gateway will take care of that for you. You will now be able to ping or connect to devices on the machine network.
Similar To A VPN
A virtual private network has a similar function to an industrial gateway, where a secure tunnel is opened between the user and another network. The difference comes into play with the configuration and intended use.
A VPN requires static public IP addresses, complex firewall configurations, and often high-end network infrastructure. An industrial gateway is purpose-built for connecting machines to remote users, and will often consist of an outbound-only connection, so complex firewall configurations are not necessary.
VPN will typically expose whole subnets, which can cause unnecessary access to devices on the equipment. An industrial gateway will use a segmented outbound approach where only defined subnets or even IP addresses will be exposed to the remote connection.
Devices To Facilitate A Remote Connection
There are many industrial gateways on the market that will provide reliable and secure connections to equipment in the field. Some offer free tiers while others require quoting or ongoing fees. Some gateways will require IT to integrate them into the corporate network. Below are some examples of more popular brands. Which device you chose, ensure you research the requirements and the security features so that both you and your customer will be comfortable with the solution.
EWON – A popular gateway often used by OEMs to allow for remote diagnostics. A software suite is used to configure and connect to the gateway, with cloud options available. The interface is intuitive and easy to use.
Secomea – Offers certificate-based access control and is often preferred in strictly controlled IT environments. Similar to the EWON, connection is achieved through software.
IXON – Uses a web portal for connection and configuration. Dashboards can be created with a drag-and-drop style of programming.
Tailscale DIY – If you are tech-savvy, the DIY method might be more your style. With Tailscale and a Raspberry Pi, you can create your own VPN tunnel and add specific devices to your connection.
Security Devices
Most gateways will have built-in software security features, while others will have software and hardware inputs to control when a connection can be achieved. Some of the EWON models have digital inputs that can be configured to enable or disable remote connection. These digital inputs can be connected to a physical key switch or a PLC output.
The gateways that do not have this feature can utilize devices like the LAN Lock from Envision. This device has digital inputs that, when energized from either a relay, PLC, or HMI, will isolate the connection between the two ports, essentially acting like a disconnect. A similar device from Line Select includes a keyswitch and allows a user to select an alternate network or to completely disconnect the connection.
These devices provide the customer with a physical disconnect that they control, thus adding another layer of protection.
Providing Remote Support For Your Customer
Not all manufacturing facilities have talented maintenance staff that understand networking, programming, and troubleshooting automated equipment. Providing remote support for your customer ensures they will be supported in the event they cannot recover from a problem, but you need to ensure the safety and security of the support. By using approved industrial gateways, devices like LAN lock, and ensuring you have a strict remote support policy in place, you will be able to supply your customers with secure support and constant monitoring capabilities.
