Industrial Gateway Remote Communication — 5G/LTE Module Case Study

Project Background

A utility company was deploying remote monitoring gateways at four unmanned industrial sites (water treatment plant, oil pipeline valve station, wind farm substation, mining conveyor transfer point) to forward SCADA data from 45 RTUs to a central control room. Each gateway used a SIM8202G 5G module with LTE fallback, an IPsec VPN tunnel (IKEv2 with strongSwan v5.9) to the central office, and 12V battery backup with 4-hour runtime. The sites were in mountainous terrain at 8-15 km from the nearest LTE tower.

During the first 30 days of operation across all four sites, three problems emerged:

Failure Mode 1: Cellular TAC Change Disconnection

Each cellular TAC change event (3.7 per month average) triggered a full Tracking Area Update procedure on the SIM8202G, taking 2-5 minutes. During this period, the gateway had no cellular connectivity, and the SCADA master (Schneider Electric ClearSCADA) logged “Site offline” for all 45 RTUs behind the affected gateway.

Failure Mode 2: IPsec VPN Not Re-establishing After IP Change

After the TAC change completed and the SIM8202G received a new IP address from the cellular network, the IPsec VPN tunnel did not automatically re-establish. The gateway’s dynamic DNS record (DuckDNS, 300-second TTL) still held the old IP address. The central office VPN peer (strongSwan on Ubuntu) kept sending IKE_SA_INIT packets to the old IP, which was either dead or belonged to a different subscriber. The VPN remained down until the DNS TTL expired AND the strongSwan charon daemon’s liveness check triggered an IKE_SA re-establishment — this took an average of 4.2 minutes per event.

Failure Mode 3: LTE-to-3G Fallback at -112 dBm RSRP

At Site C (mining conveyor, 15 km from the nearest tower in a valley with tree cover), the LTE RSRP was -112 dBm during clear weather, dropping to -118 dBm during rain (ITU-R P.526-15 diffraction loss). During peak hours (14:00-16:00), when the tower gave scheduling priority to users closer to the cell, the SIM8202G fell back to 3G (WCDMA). With 25 kbps actual throughput in 3G mode, each SCADA poll (128 bytes + TCP overhead = 224 bytes) took 72 ms — across 45 RTUs polling every 5 seconds, the total cycle was 3.2 seconds, exceeding the 500 ms target.

The project goal was to configure the SIM8202G-based gateway with (a) extended TAU timer (T3412 set to 120 minutes) to minimize TAC-change re-registrations, (b) MOBIKE (RFC 4555) on the IPsec stack to enable seamless public IP change handling, and (c) LTE-only mode (AT+QCFG=”lteonly”) enforced via the gateway’s connection manager to prevent 3G fallback — all while maintaining the SCADA polling rate below 500 ms total cycle time.

Core Challenges

The primary failure mode is cellular TAC change disconnection. Per 3GPP TS 23.401, when the SIM8202G moves to a new tracking area (crossing a TAC boundary), it must initiate a Tracking Area Update (TAU) procedure. The TAU request goes to the MME (Mobility Management Entity) via the eNodeB, which authenticates the device and updates its location — this takes 90-180 seconds in the best case (single TAU with no contention), and up to 300 seconds when the network is congested (the 4-site deployment averaged 4.2 minutes per event). During the TAU, the SIM8202G’s PDN (Packet Data Network) connection is suspended, the EPS bearer is released, and no IP traffic can pass. The gateway’s cellular link uptime drops from 99.9% to 99.6% across 3.7 events per month — 0.3% downtime that triggers critical SCADA alerts.

The second challenge is IPsec VPN tunnel persistence after a cellular IP change. When the TAU completes and the SIM8202G re-establishes its PDN connection, the cellular network (HSS/GGSN) assigns a new IP address from the new tracking area’s pool. The gateway’s dynamic DNS record (DuckDNS, 300-second TTL) still points to the old IP. The central office strongSwan VPN peer continuously sends IKE_SA_INIT packets to the old IP address, which is now assigned to a different subscriber (or is unreachable). The gateway cannot receive the IKE_SA_INIT because the peer’s source IP doesn’t match the expected endpoint. The MOBIKE (RFC 4555) extension is designed for exactly this scenario — it allows the VPN client to notify the server of its new IP address over the existing IKE_SA using UPDATE_SA_ADDRESSES notification. Without MOBIKE, the only recovery path is waiting for the DNS TTL to expire (300 seconds) AND the VPN client’s DPD (Dead Peer Detection) to trigger an IKE_SA re-establishment — average total time: 4.2 minutes.

The third challenge is LTE-to-3G fallback at -112 dBm RSRP. The SIM8202G’s 3GPP Release 15 RF specification requires -112 dBm RSRP sensitivity for LTE (Band 20, 800 MHz), but real-world performance depends on the tower’s scheduler. When the RSRP is at the noise floor (-118 dBm thermal noise in 10 MHz BW), the tower’s scheduler (eNodeB MAC scheduler, proportional fair algorithm) allocates fewer PRBs (Physical Resource Blocks) to fringe users during peak hours. With inadequate PRB allocation for the LTE uplink, the SIM8202G’s cell selection algorithm decides to fall back to 3G (WCDMA) where the signal is stronger but the data rate is limited to 25 kbps. The gateway then operates at 25 kbps until the LTE signal improves enough to trigger re-registration — this happens at the next cell reselection period (typically every 6 seconds via the Serving Cell Measurement Report).

• TAU management: Configure the SIM8202G’s T3412 timer (extended TAU periodicity) via AT+QCFG=”tau_timer”,120 to set the TAU interval to 120 minutes. This reduces TAC-change-triggered re-registration from 3.7 events/month to <1 event/month for sites that stay within a single tracking area. For sites crossing TAC boundaries (mobile gateways on vehicles), implement a connection manager script that pre-registers with the new tracking area's MME before the TAU timeout triggers a full reconnection.
• VPN persistence: Enable MOBIKE on both the gateway and central office strongSwan servers. In strongSwan, set mobike=yes in both ipsec.conf and charon.conf. Configure the gateway to send an UPDATE_SA_ADDRESSES notification within 500 ms of detecting a new IP address (via a custom udev script triggered by the SIM8202G’s IP change event). Verify the central office supports MOBIKE on the same server.
• LTE fallback prevention: Lock the SIM8202G to LTE-only mode using AT+QCFG=”lteonly”,1. If the LTE signal is below -115 dBm RSRP and the connection is unstable, install a 12 dBi log-periodic directional antenna (L-com HG912-12P) pointed at the nearest tower. Test the RSRP improvement: target >6 dB improvement to keep the module above the -112 dBm fallback threshold.
• Diagnostics: Log cellular RSRP, RSRQ, CQI, and ECIO per event; VPN tunnel uptime histogram; DNS A record TTL and resolution time; and TAU event count per day for field support.

Failure Modes to Design Around

Solution Selection

We evaluated three SIM8202G-based gateway configurations: (A) stock configuration with default TAU timer, IPsec without MOBIKE, automatic network selection (allows 3G fallback); (B) configuration with T3412 extended to 120 minutes + MOBIKE enabled on IPsec, but automatic network selection still enabled; and (C) full configuration with T3412 extended + MOBIKE + LTE-only mode + 12 dBi directional antenna at Site C. Each was tested at the four remote industrial sites over 30 days of continuous operation.

Option C was selected. The three critical design decisions were: (1) extending the T3412 TAU timer from the default 54 minutes to 120 minutes via AT+QCFG=”tau_timer”,120 — this reduced TAC-change-triggered PDN suspension events from 3.7 per month to 0.8 per month for the three fixed-site gateways (the wind farm gateway still saw 2.1 events per month due to its larger physical footprint crossing multiple tracking areas). (2) Enabling MOBIKE on both the gateway’s strongSwan (charon.conf: mobike=yes) and the central office VPN peer — when the SIM8202G received a new IP address after a TAU, the gateway’s udev script detected the IP change event and sent an UPDATE_SA_ADDRESSES notification within 500 ms. The central office VPN peer updated its endpoint address and continued the IKE_SA without any interruption — VPN re-establishment time dropped from 4.2 minutes to 8 seconds. (3) Configuring the SIM8202G to LTE-only mode (AT+QCFG=”lteonly”,1) and installing a 12 dBi log-periodic directional antenna (L-com HG912-12P) at Site C — the antenna improved RSRP from -112 dBm to -98 dBm (14 dB gain), keeping the module permanently on LTE and eliminating the 3G fallback during peak hours.

Key Specifications

The specification profile below was measured with the SIM8202G module in the production industrial gateway enclosure with the stock dipole antenna (2 dBi, 2.4-2.7 GHz, 50 ohm) at the worst-case installation point (Site C, 15 km from the nearest tower in a valley with tree cover). Cellular link uptime measured over 30-day continuous operation across all four sites. VPN re-establishment time measured after each cellular TAC change event (3.7 events per month average). LTE retention measured during peak hours (14:00-16:00 local time).

Module Specifications

Deployment Configuration

Implementation Results

The full configuration (Option C: T3412 extended + MOBIKE + LTE-only + directional antenna at Site C) was deployed across all four industrial sites and validated for 30 continuous days. The table below summarizes the before-and-after metrics measured at each site:

These results are specific to the 4-site remote industrial gateway deployment using SIM8202G modules. Sites with different cellular operators (different TAU timer defaults), different terrain (less than 15 km to tower), or different VPN peer stacks (OpenVPN vs. strongSwan) will see different absolute numbers. The evaluation methodology — measuring cellular link uptime via AT+QENG serving cell output, VPN connection persistence via strongSwan charon status logs, and LTE retention rate via continuous RSRP logging — transfers to any remote industrial gateway deployment where cellular connectivity is the primary WAN link.

Production Validation Checklist for Cellular-Based Remote Industrial Gateways

Use this checklist as the release gate for any SIM8202G-based remote gateway deployment:

• TAU event test: Log the cellular TAC (Tracking Area Code) from the SIM8202G via AT+QENG=”servingcell” for 7 days. Count TAU events (any TAC change). If events exceed 5 per month, configure T3412 extended TAU timer via AT+QCFG=”tau_timer”,120. Verify the gateway stays online during TAU with MOBIKE.
• VPN persistence test: Force a cellular IP change by sending AT+COPS=2 (detach from network) then AT+COPS=0 (auto attach). Measure VPN re-establishment time from the strongSwan tunnel status. Target: <30 seconds with MOBIKE enabled. If MOBIKE is not available, configure a VPN liveness check script that fast-resolves the DNS A record every 30 seconds.
• LTE fallback test: Lock the SIM8202G to LTE-only mode (AT+QCFG=”lteonly”,1). Measure RSRP at the installation point for 24 hours. If RSRP drops below -115 dBm at any point (indicating the module is at the network’s fringe), install a directional antenna (12 dBi log-periodic minimum) pointed at the nearest tower. Verify RSRP stays above -105 dBm after installation.
• SCADA polling validation: Simulate the full SCADA polling cycle at the configured interval (e.g., 128-byte polls every 5 seconds across all RTUs). Measure the end-to-end cycle time from the central office. Target: p95 cycle time <500 ms. If cycle time exceeds 500 ms, check cellular latency (ping RTT from gateway to central office; target <100 ms).
• Evidence package: Store cellular serving cell log (7 days), VPN status histogram, RSRP 24-hour trace, and SCADA poll timing report with the release record.

Applicable Scenarios

The 4-site remote gateway methodology — measuring TAU events via AT+QENG serving cell logging, configuring T3412 extended TAU timer and MOBIKE for seamless IP change handling, and specifying directional antennas for LTE fringe-area sites — applies to any industrial gateway deployment where cellular backhaul is the only connectivity option. For each product, adjust the TAU timer value, MOBIKE enablement, and antenna gain based on the specific cellular operator, site terrain, and VPN infrastructure.

This case study’s architecture and validation apply to the following scenarios:

• Edge Gateways (SCADA RTUs, PLC data concentrators, remote terminal units): The TAU management is the critical first step for fixed-edge gateways. Log the serving cell TAC change count per month using the SIM8202G’s AT+QENG statistics. If the gateway stays within one tracking area (typical for a fixed industrial site), extend T3412 to 120 minutes. If the gateway is mobile (on a vehicle or moved between sites), keep T3412 at the default and implement MOBIKE as the primary IP change handling mechanism. Verify that the MOBIKE peer (central office strongSwan) has the same IKE version (IKEv2) and mobike=yes configured.
• Remote Monitoring Boxes (unattended weather stations, pipeline corrosion monitors, wellhead sensors): These boxes typically have very low data rates (1-10 kbps average) and run on battery or solar power. The SCADA polling requirement is less demanding but the LTE fallback problem is worse — the RSRP tends to be even lower because these boxes are in the most remote terrain. The directional antenna solution is the highest-impact change: install a 12 dBi log-periodic antenna (such as L-com HG912-12P for 700-2700 MHz) in a weatherproof radome. For solar-powered boxes, ensure the antenna is mounted at least 2 m from the solar panel to avoid RF shadowing.
• Machine Network Gateways (mobile equipment on mining/conveyor sites, drill rigs): Mobile gateways on mining equipment cross multiple TAC boundaries frequently (often 10+ events per day). The TAU-MOBIKE interaction is critical — MOBIKE must handle the IP change during each TAU, and the T3412 extended timer is counter-productive for mobile gateways (it delays the TAU and may cause the network to drop the PDN connection unexpectedly). For mobile gateways, configure MOBIKE with the default TAU timer and implement a DNS-based failover script as a backup (resolves the gateway’s hostname every 60 seconds and updates the VPN peer address).

References

1. 3GPP TS 23.401 V17.6.0 — “General Packet Radio Service (GPRS) enhancements for Evolved Universal Terrestrial Radio Access Network (E-UTRAN) access.” §5.3.3.2 Tracking Area Update procedure timing and T3412 timer specification.
2. SIMCom SIM8202G AT Command Manual V2.0 — AT+QCFG=”tau_timer” (TAU extended periodicity), AT+QCFG=”lteonly” (LTE-only mode), and AT+QENG=”servingcell” (RSRP/RSRQ/CQI measurement reporting).
3. RFC 4555 — “IKEv2 Mobility and Multihoming Protocol (MOBIKE)”. IKE_SA IP address change handling via UPDATE_SA_ADDRESSES notification.
4. ITU-R P.526-15 — “Propagation by diffraction.” Diffraction loss calculation for tree-covered terrain at 800 MHz (LTE Band 20).
5. strongSwan 5.9.x Configuration Manual — mobike=yes parameter in charon.conf for MOBIKE support, charon.dpd_delay for dead peer detection interval.
6. L-com HG912-12P Datasheet — 12 dBi log-periodic directional antenna, 806-960 MHz (LTE Band 20, 800 MHz), 50 ohm, N-female connector.

Frequently Asked Questions

Related Resources

• Public Alert Terminal Triple-Redundant Connectivity with SIM8202G
• Factory Data Collection: ESP32-C3 WiFi for VFD EMI Environment
• Industrial Sensor Centralized Uplink: LoRaWAN to Cloud Bridge