Sandeep Balani – Manager Product Management Kawal Grover - Technical Marketing Engineer Agenda

BRKIOT-2588

Ease of management and deployment for scalable solutions in Industrial IoT Routing

01. Introduction

02. IoT Customer Requirements AGENDA 03. IoT Product Design

04. IoT Gateway Technical Considerations

Oil & Gas Station

Campuses Transportation

Extended Buildings Enterprise

Kiosk Headquarters Branches

Utility Substation

Utility Grid

Sub Station

01 Headquarters Deployment Future Proof Compliance Low Power 5G Ready Utility Compact Long Lifecycle 02 Branch Routing Enterprise Routing Security

Enterprise Extended Enterprise

Outdoor Kiosk

Trackside

01 Headquarters Rugged Management Reliability Extended Simplified Cloud Dual LTE Temperature Management 02 Branch Routing Enterprise Routing Security

Enterprise Extended Enterprise

Compression Station

Pumping Station

01 Headquarters Edge Compute Compliance Management Application Hazardous IT Managed Hosting Location 02 Branch Routing Enterprise Routing Security

Enterprise Extended Enterprise

Edge Compute App Hosting Management Simplified IT/OT Management App Management

Enterprise Routing Cisco ISR Compliance Rugged Extended Temperature Hazardous Location Utility Environment Protection

Routing Security

Deployment Management Future Proof Low Power Compact 5G Ready Dual LTE

IR1101 ISR Rugged

Built for Intent-based Networking | Powered by IOS XE | Edge Enabled

Proven Cisco Technology A Modern Modular OS

Ruggedized │ Built for IoT│ Industries Certified High Availability │ Programmability │ Proven

Driving Intent-Based-Networking to the IoT Edge Designed for IoT Deployment

01 Mounting 02 Compact 03 Lower Power

DIN Rail, Wall Mount, 2.36”x5.22”x4.92” Solar 9.8W Battery (Typical Consumption) Rack Mount 6.14”

IR807

2.36”

5.22” IR1101

–40°C to 75°C (with 200 LFM of air)

Salt & Fog Tolerant (IR1101)

Solid Particle Protection: IP30

Compliance: Hazardous Location, Safety, EMC (UL 60950, EN 60950-1, IEC 60079-0, EMC )

Cisco 5 Year Limited Hardware Warranty

IR807 IR809 IR1101 -40c Salt and Fog +75c Salt and Fog Tolerant

Salt fog test per IEC 68-2- 52 and IEC 60068-2-11 Ka conditions

Corrosion evaluation per ISO 4628-3

168 Hours of Salt Fog Exposure

Future

Cat 6 LTE

Cat 4 LTE

LTE Pluggable shared with Cisco ISR 1100 Future Proof Design with Dual LTE

Compression Station

Outdoor Kiosk LTE1

LTE2 01 Headquarters Trackside

Dual LTE Enabled Gateways Transportation IR829 IR1101

GE Copper Fiber SFP Single LTE Dual LTE

Centralized app IOx developer tool Cisco® IOx enabled lifecycle management

App Container

IR1101 App Container IOx

IR829

App container IOx Things Container IR809 ready

IEDs connected power lines Management Meter Control Center concentrator to IR1101 Field Network Director residential meters IPV6 Flex VPN tunnel

Radius RA LTE TPS IPV6

IEDs connected power lines Meter SCADA DMS concentrator to IR1101 residential meters IPV6 Control Center

IPV6 Secondary Substation Secondary Substation x1000’s Cisco ASR1000

Features/Benefits: • Investment protection with modularity • End-to-end security • End-to-end IPV6 • Flex VPN for the massive scale and simplicity • FND for zero touch provisioning and management

SD-WAN: vManage (IT) Cisco Kinetic™ GMM (OT)

01. IoT Gateway Consideration

02. How to connect IoT Gateway over cellular? IoT Gateway Technical 03. Security Baseline for IoT Gateways Considerations 04. Edge compute for IoT applications

05. Management for scalable IoT Gateway deployments

Hardware Software

# of RS232 and Wi-Fi LED indication Auto SIM Real Time Clock Remote Debugging RS485 interfaces Cellular

Memory Remote Ethernet Flash Alarm Ports Remote Reboot ZTD provisioning GPS streaming Management Compute

Power Industry Ruggedized Signed software Secure boot Secure Logging Netflow Requirements Certification

Signal Isolation i.e Sensors Open application VPN QOS IPV6 Digital, power and GPS (Gyroscope and Framework analog accelerometer)

SCADA Protocol Segmentation 802.1x Hardware Crypto translation Acceleration

IR809 IR1101 IR807 IR829 Platform

• When customers are designing the Control Traffic 12.5% network, plan data, control and

management traffic Management Traffic • Customer needs to differentiate 12.5% between periodic(SNMP, keep alive) and event-based traffic(software image upgrade) Data Traffic • Some of the protocols can be fine- 75.0% tuned to optimize backhaul usage for cost saving

• IPV6 gives you an extended address space for IoT(Future proofing…) • Regional registry can’t provide IPV4 address space anymore to enterprise and Service provider • Time to simplify networks , no NAT rules for IoT Edge computing • We have customers having deployed millions of IoT IPv6 endpoints with Cisco IoT gateways

Secure access LAN and backhaul WAN Secure embedded edge application Framework

• Secure data connectivity • IoT Gateways should provide backhaul connectivity via Ethernet, Cellular or Wi-Fi • Secure Provisioning and device management. • IoT Gateways should provide access connectivity to IoT endpoints like sensors, • IoT gateway may securely embed RTUs, PLCs, cameras etc. application agent ( MQTT, DNP3, Modbus etc.) and micro services. • Provide secure data connectivity from IoT endpoint to IoT application server (Edge or • Secure data acquisition and local storage. Remote) • Support for containerized applications that provide edge processing and cost saving

IR809 IR1101 IR829 Platform

• Different LTE categories define a wide range in the supported parameters and performances

• Asymmetric bandwidth – downlink is greater than uplink data rate

Headline Data Rates for LTE Categories

LTE UE CATEGORY Link NB-IoT 1 2 3 4 5 6 7 8 Downlink(Mbps) .065 10 50 100 150 300 300 300 1200 Uplink(Mbps) .027 5 25 50 50 75 50 150 600

PIDs IR807 IR829-2LTE-*-*K9 * IR809G-LTE-*K9 IR829GW-LTE-LA- K9, IR829G-LTE-*-*K9 IR829M-2LTE-*-*K9 IR829M-2LTE-*-*k9 P-LTEA-EA P-LTEA-LA P-LTE-US P-LTE-VZ P-LTE-GB

BRKIOT-2588 © 2019 Cisco and/or its affiliates. All rights reserved. Cisco Public 28 LTE IOS-XE LTE Features LTE Software Feature List Global Navigation System (GNSS) and National Marine Electronics Association (NMEA) streaming. A-GPS (Assisted GPS ) – modem dependent Short Message Service (SMS) 3G/4G Simple Network Management Protocol (SNMP) MIB Modem Firmware Upgrade LTE Serviceability SIM lock and unlock capabilities DUAL SIM(differentiate with DUAL radio) PLMN selection IPV4 and IPV6 Multi PDN

UE eNB MME S-GW P-GW

UE Powers on

1) Attached Request (PDN Connectivity Request) 2) Create Session Request IMSI, PDN Type=IPv4, PCO=DNS Server IPv4 Address Request IMSI, PDN Type=IPv4, PDN Address=0.0.0. PCO=DNS Server IPv4 Address Request 3) Create Session Request

IMSI, PDN Type=IPv4, PDN Address=0.0.0.0, PCO=DNS Server IPv4 Address Request 4) Dynamic IP address allocation: UE IP=1.1.1.5 Deliver DNS UP as well as UE IP

5) Create Session Response

PDN Type=IPv4, PDN Address=UE IP(1.1.1.5), PCO=(Primary DNS IP, Secondary DNS IP) IOS features 6) Create Session Response AUTO SIM PDN Type=IPv4, PDN Address=UE IP(1.1.1.5), IPV4 and IPV6 PCO=(Primary DNS IP, Secondary DNS IP) NAT/PAT 7) Attach Accept (Activate Default EPS Bearer Context Request) MTU support of 2K PDN Type=IPv4, PDN Address=UE IP(1.1.1.5), MPDN PCO=(Primary DNS IP, Secondary DNS IP) Carrier Aggregation 8) UE gets UE IP and DNS IP Serviceability EPS Default Bearer

IP Packet BRKIOT-2588 © 2019 Cisco and/or its affiliates. PDN:All rights reserved. Internet Cisco Public 30 SIM-Based Auto-Carrier Selection Automatically configure modem carrier based on detected sim What is it: Automatically detects active SIM and configures modem for appropriate cellular carrier. Just insert an active SIM and power up.

Carrier A Carrier B • Simplifies configuration process and reduces setup time • Single SKU for all carriers Automatic Carrier • Reduces inventory complexity, simplifies deployments Selection

What is it: Multi-PDN (Packet Data • . Network) makes it possible to have more than one simultaneous WAN SIM1 PDN1 SIM1 PDN2 interface/connection on a single Private Cell IP Public Cell IP modem/SIM. 172.21.10.212 72.104.73..69

• The first PDN could be configured as a public network, and the second as a private network. • Each PDN billed to a separate account. LAN 192.168.0.1/24 • Users can access public and private network simultaneously.

LAN 192.168.0.150/24

20 MHz LTE Band A 20 MHz

Second LTE radio channel is idle when device received on the other channel LTE Network Maximum 150 Mb/s Typical USA: 5-12 Mbps

20 MHz LTE Band A Aggregated Data Pipe 40 MHz 20 MHz LTE Band B

LTE Advanced Maximum 300 Mb/s Network Both LTE radio channel are utilized Typical USA: 10-25 Mbps

LTE Bands supported Carrier Aggrégation Band combination Catégories

EM7455 FDD/TDD LTE 4+17, 2+17, 2+29, 4+5, 17+30, 2+13, Cat. 6 bands: 1-5, 7, 8, 12, 13,17, 4+13, 4+4, 41+41, 3+20, 7+20, 3+3, 20, 25, 26, 29, 30, 41 7+7

P-LTEA-EA* (Multicarrier – U.S, Canada, Europe) EM7430 FDD/TDD LTE 1+8, 1+1, 1+5, 1+18, 1+19, 3+8, 3+3, Cat. 6 bands: 1, 3, 5, 7, 8, 11, 18, 3+28, 3+5, 3+19, 7+5, 7+3, 7+7, 7+28, P-LTEA-LA* 19, 21, 28, 38-41 11+18, 21+19, 38+38, 40+40, 41+41 (APJC, LATAM)

Features Explanation CLI

controller Cellular 0 This feature allows the user to configure and lock down the modem to lte modem band-select band- a specific RF band, or set of bands. The preference can be set to be indices "2,4,5" slot 0 Radio Frequency Band Selection equal to, or a sub-set of the capability supported by the show cellular modem/carrier combination radio band

This feature provides the error code for the modem going into a low show cellular Low Power Mode power mode . It uses the device power control information provided by radio the modem

Maximum Transmission Unit (MTU) on a LTE interface can be set to 2K interface cellular 0/0/0 if your service provider's network can supports it. MTU value is MTU Selection for WP76xx modems mtu 2000 determined only after a call is established between the IOS and the show cellular logs network Firmware over the air (FOTA) is a feature to remotely upgrade the modem FOTA feature is for carrier firmware on the modems The FOTA feature leverages the Sierra certification only and is not CISCO FOTA Wireless Airvantage server (also referred to as the FOTA server in this recommended way of upgrading the document) to upgrade the firmware while being connected over the firmware in the field. cellular interface

Router Issue IOS and OTA Logs Network Issues

• APN not tied to the • debug dialer • Signal Strength issues controller correctly • debug cellular • Not attached to the • Not valid Firmware for messages network because of the the LTE APN not callcontrol SIM issues configured correctly. • debug chat • The network kicked the • Modem in low power • DM logs UE out for regular mode maintenance • Show cellular • IP source violation all • Network outage • Show running- configuration

HARDWARE HARDWARE SOFTWARE Mechanical & Sensors Processors & Electronics Applications & Resources

Input Alarm Hardware based Device hardening (see for Digital Sensors Trust Anchor manual) (ACT2 Chipset) Application Level Firewall IR1101: 4 GPIIOs with Umbrella expansion module

Secure Boot GPS Asset Tracking Hardware Acceleration for & Geo Fencing (requires Encryption Cellular module) Cisco Process (CSDL, Vulnerability Testing, PSIRT, TALOS Group) Sim Card SUDI (Secure Unique Locking Plate Identifier) Validation Hosted App lifecycle security with Cisco IOX

Boot integrity visibility Attacker compromises the very code that is supposed to protect against compromised code

Secure storage Attacker steals device - uses forensic techniques to read secrets & credentials from non-volatile RAM

Device Hardening Secure your Cisco devices from unauthorized access and common attacks. https://www.cisco.com/c/en/us/support/docs/ip/access-lists/13608-21.html

Simplified factory reset Resets all writable file systems, licenses, ROMMON variables, User credentials etc.

Secure guest shell (future release) Prevents Open Container hosted applications and their users from manipulating underlying Linux system on IR1101 – requires Expansion module with mSATA option

Network Security

Layered Encryption – MAC, IP, Application Traffic Filtering – ACL, Firewall,… VPN – IPv4 and IPv6 Network Protocols Cryptography – quantum computer resistant

Role Based Access control Policies Automation – Cloud and On-Prem Tools Traffic profiling and capacity planning – Flexible Netflow

Zero Touch Provisioning (PnP, SCEP, EST…) VPN scalability and IPsec performances Scalable Cellular & VPN – Traffic tuning, Zone-based Firewall, Deployment Umbrella, Telemetry… IoT GW VPN Requirements

Headend Cost Optimization Segmentation & QoS HA & Failover Scalability

 Optimizing control plane traffic  Traffic isolation through VRF  Support customer  Support larger number to reduce customer’s monthly over VPN requirements from 1:1 to N:1 (2000-20000) of IPsec cellular subscription  QoS per tunnel for Hub-to- redundancy tunnels for large deployments Spoke and Spoke-to-Hub  IKEv2 prefix injection for IPv4  dual WAN or ISP  May double when 1+1 HA is and IPv6 – no dynamic routing required  Clustering of Hubs but for specific dual active  Headend clustering LTE case  Tunnel failover across interfaces  Cellular bandwidth is asymmetric (upstream/downstream)

v6 v4 IPv4/IPv6 Unicast & IPv4 NAT/PAT IPv4/IPv6 Addr Open Standard Multicast Traversal Mgmt  single IPsec tunnel (IPv4 or  Support customers who get  Automatic Dynamic IP  Dual source strategy on IPv6) to transport IPv4 and their private IPv4 address on Address Allocation specific verticals IPv6 traffic their FAN routers but also on rd  Includes IPv6 Multicast for their head-end  ZTD process to be simple on  Interoperability with 3 party AMI use case headend router for each open source such as Strong  Cellular also use IPv4 private tunnel creation Swan VPN  RFP requirements  Quantum Computing resistant crypto algorithm FlexVPN vs DMVPN

Compatibility with any IKEv2-based third-party VPN vendors

IKEv2 routing – very light solution fit for IoT

Point-to-point tunnel interfaces instead of mGRE

Granular per tunnel configuration of QoS, ZBF, VRF, etc. (AAA server)

Simplified use of NHRP – no NHS registration

One way of NHRP compared to 3 phases of DMVPN

• What is FlexVPN?

• IKEv2 based unified VPN that combines Site-to-Site, Remote-Access, Hub-Spoke and Spoke-Spoke topologies

• FlexVPN highlights • Unified CLI • Leverages common IOS Point-to-Point tunnel interface implementation • Feature-rich: AAA, config-mode, dynamic routing, IPv6 • Simplified configuration using Smart Defaults • IKEv2 standard compliant – interoperable with non-Cisco implementations • Easy to learn, deploy, and manage

Transport IP hdr hdr Data

Append Append New IP hdr UDP hdr IP Hdr Original Transport GRE hdr for IPsec NAT-T AH hdr ESP hdr for GRE IP hdr hdr Data ESP Trailer ESP ICV Transport +GRE Transport + Tunnel + NAT-T IPv4 packet Transport mode Tunnel mode Tunnel + GRE with key NAT-T + GRE + GRE 64 bytes 148 180 188 180 196 204

128 bytes 212 244 252 244 260 268

256 bytes 340 372 380 372 388 396

512 bytes 596 628 636 628 644 652

1024 bytes 1108 1140 1148 1140 1156 1164

• IPv4 with AH-SHA, ESP-AES and ESP-SHA-512-HMAC exemple • https://blogs.cisco.com/digital/industrial-IoT-routers-gateways-under-the-hood-of-ipsec-vpn

Edge-Ready Network Infrastructure Application Framework

IOS-XE IOX application Application IOx Framework Hosting Services

Application Management

Cisco Linux

Edge Application Management Developer Tools

Management IOx Control Center Field Network Director Flex VPN tunnel

Radius RA LTE TPS Virtual SCADA Ethernet / Serial RTU container

SCADA DMS Control Center

Protection Relay I/O Module Fault Detector

Secondary Substation Cisco ASR1000

Features/Benefits: • Integrated RTU saves Capex of ~$2500 • Single Management for Device & Application • Application Security with Containers • Flexible software defined protocol translation • FND for zero touch provisioning, device and application management

Cisco Web UI Cisco Configuration Professional Express

IR1101 IR807 IR809 IR829

Day 0 set-up includes

 Cellular  IOx  WAN  WiFi  LAN  Security  VPN: Advance configuration

Day to Day router management  Interface information  Device information (Hostname, and status IOS version etc)  Traffic volume  Cisco Active Advisor: Lifecycle information of network inventory

Extended Enterprise OT driven

Cisco Prime Control Center Cisco DNA Center Cisco SDWAN Cisco IoT Field Cisco Kinetic GMM Infrastructure support-SIM Network Director management

IR1101 IR807 IR809 IR829 Platform

Gateway States Gateway calls home over HTTPS Claim Initiated Kinetic Startup Https response with WAN configuration Kinetic Startup Gateway saves WAN configuration into startup * Gateway connects to Kinetic using configured WAN Kinetic Base

HTTPS response with IPSec configuration

IR809 IR807 IR829 Gateway establish IPSec Tunnel tunnel Gateway

Final configurations over the IPSec Tunnel Management Gateway saves final configuration into startup Operational Module Management traffic using https over IPSec Tunnel

* This only happens the first time the gateway is claimed

4 PnP Connect Service PnP Provisioning 3 Cisco Provision configuration DNA Center and image securely PnP Cloud Connection Benefits Resolve DNS host at devicehelper.cisco.com Secure connection to PnP cloud is • Low cost of deployment and established and device presents operation – no manual SN number intervention Obtain APIC-EM IP from cloud 2 4G LTE network • Fast and easy bring-up IR8x9/IR1101 PnP discovery 1 Base with LTE station • Does not require technical Cellular interface is expertise to deploy configured with DHCP 4G modem attachment Cisco Prime® automatically 4G modem will attach to base • Works with all Cisco® PnP discovery kicks off station and obtain DHCP IP management tools over 4G

Management FND

Products IR807 IR809 IR1101 IR829

Questions? Use Cisco Webex Teams (formerly Cisco Spark) to chat with the speaker after the session How 1 Find this session in the Cisco Events Mobile App 2 Click “Join the Discussion” 3 Install Webex Teams or go directly to the team space 4 Enter messages/questions in the team space cs.co/ciscolivebot#BRKIOT-2588

• Please complete your Online Session Survey after each session

• Complete 4 Session Surveys & the Overall Conference Survey (available from Thursday) to receive your Cisco Live T- shirt

• All surveys can be completed via the Cisco Events Mobile App or the Communication Stations

Don’t forget: Cisco Live sessions will be available for viewing on demand after the event at ciscolive.cisco.com

Related Demos in Walk-in Meet the sessions the Cisco self-paced engineer Showcase labs 1:1 meetings

BRKIOT-2588