High Availability Dual WAN Remote Industrial Connectivity

Industry cannot stop. Many processes are very expensive to shutdown and restart (think plastic extrusion and the material condensing solid). When this is combined with the rising Subscription Model, and increasing Remote Operations and Asset Management, it becomes clear that Industry 4.0 has a reliance on reliable, non-stop Internet connectivity. However, Industry is commonly not colocated with multiple resilient fibre providers, leading to a challenge: How can we ensure a highly-available, economical, industrial connectivity that will meet our security objectives, end-user objectives, and performance objectives using multiple unlike Internet (WAN) links?

High Availability Dual WAN Industrial Connectivity Challenges

There are multiple methods to provide a high-resilience always-on connectivity experience. These include:

Packet Ring Fibre Architectures

In this model, a single networking provider uses ring-architectures (originally SONET/SDH, later Resilient Packet Rings) and technologies such as MPLS. These Metro Ethernet type standards become very expensive as your facility moves away from the downtown core of a larger city.

These technologies have the benefit of high performance, low latency. However, no matter how much resilience is engineered into the network, they still rely on a single provider. The old adage of “the Internet’s natural predator is the backhoe” remains true.

Single Provider, Dual Technologies (AKA cellular failover)

In this architecture, the network provider has a termination device consuming a wireline technology, and, it has a cellular modem in it that becomes active if the wireline becomes unavailable for some time.

This solution might also be bundled with a SD-WAN architecture, in which a VPN is also used over each link to a cloud provider.

The downside to this architecture is it is impossible to have any inbound connectivity (since the IP is not public, or, can change). Also, for SD-WAN overlays, the impact of unlike links with unlike latency and MTU can generate significant performance reductions even in the normal, online case.

In 2022, Rogers Communications, a provider of wireline and wireless connectivity, had a nation wide outage in Canada. This took down even (believed) highly resilient systems such as payment processing. Dual technologies is not sufficient as a backup mechanism.

Dual WAN

In an uncorrelated dual WAN setup, two independent Internet providers are contracted. This provides high resiliency, accounting for even e.g. BGP routing failures, peering failures.

Typical challenges here include inbound traffic (no public IP is present, all clients would need reconfiguring), unlike latency and MTU on the two links, health checking to know which link to use.

Other Challenges

The use of remote connectivity in industrial settings remains a contentious issue, largely due to the unreliability of common tools like VPNs. When an industrial facility lacks a fixed, always-available IP address, establishing inbound VPN connections becomes impossible. This necessitates the reconfiguration of all external clients whenever a failover occurs, which can be inconvenient and time-consuming.

Port forwarding to a DMZ, another frequently used tool, suffers similar limitations. Cellular or satellite backup links typically lack the public IP address needed for port forwarding. Even if one were available, it would necessitate either updating DNS records and waiting for cache expiration, or reconfiguring all external clients, both inconvenient and time-consuming solutions.

Firewall configuration is also rendered more complex when there are multiple unlike WAN, usually requiring calibrated changes on multiple firewalls simultaneously. It is also complex to deal with internal constructs such as NAT and default routes. Some routers support tools like MWAN3, but these require complex health checks to setup.

High Availability Dual WAN Industrial Connectivity: Agilicus AnyX