Architected a secure WAN solution for remote sensors and control systems across distributed water infrastructure. The design incorporated cellular connectivity with redundant VPN tunnels, out-of-band telemetry, and protocol translation for legacy SCADA equipment.
The Challenge
A utilities provider operating water infrastructure across a vast geographic region needed to establish connectivity for remote monitoring and control sites. These sites included pump stations, reservoirs, and treatment facilities located in areas without fixed-line communications options. The existing solution relied on aging radio equipment with limited bandwidth and reliability. The modernisation needed to support increased telemetry requirements from new sensors while maintaining the reliability essential for water services. Security was paramount given the critical nature of water infrastructure and the use of public cellular networks for transport.
Our Approach
We designed a 4G WAN architecture incorporating dual redundant VPN tunnels ensuring connectivity resilience for critical SCADA traffic. The solution utilised industrial cellular routers capable of operating in harsh environmental conditions while supporting the necessary security and routing features. Out-of-band telemetry was implemented through a separate APN, enabling device management and monitoring without traversing the operational VPN tunnels. This separation provided operational visibility even during primary tunnel failures and enabled proactive device health monitoring. Protocol translation capabilities addressed legacy Modbus equipment requiring conversion to IP-based communication, simplifying the management plane while preserving investment in existing field devices. The architecture incorporated dynamic routing enabling automatic failover between cellular carriers and path selection based on link quality metrics.
Results
4G WAN architecture connecting remote water infrastructure sites
Dual redundant VPN tunnels ensuring SCADA traffic resilience
Out-of-band telemetry APN for device management and monitoring
Protocol translation for legacy Modbus SCADA equipment
Industrial-grade design suitable for remote environmental conditions
Dynamic routing and automatic failover capabilities
Secure connectivity over public cellular networks with appropriate encryption
Further Reading
The Purdue Enterprise Reference Architecture remains foundational for OT security, but modern requirements demand adaptation. Explore how to extend the model for cloud connectivity, remote access, and micro-segmentation.
VLANs alone do not constitute effective segmentation. Explore zone-based architecture, micro-segmentation technologies, and east-west traffic inspection strategies for critical infrastructure networks.
Successful IT/OT convergence requires more than technology integration. Learn how to navigate cultural divides, establish governance frameworks, and implement security that respects operational constraints.
Get in touch to discuss how we can help your organisation.
We take our confidentiality obligations seriously. The project descriptions on this page have been generalised to protect client identities. We are happy to discuss our experience and approach where appropriate during a confidential conversation.