XK-GW gateway manuals

1 · Network

Network checklist for the XK-GW

Firewall, addressing, bandwidth and segmentation requirements for sites using the XK-GW gateway.

Ports and whitelist

AWS IoT endpoint by region (TCP 8883)

• No port forwarding is required.
• Make sure Stateful Packet Inspection (SPI) / connection tracking is enabled on the firewall, so return traffic for sessions the gateway starts is accepted without inbound rules.
• For data to the cloud, allow outbound TCP 8883 (MQTT over TLS) to the AWS IoT endpoint for your region.
• For radar calibration and Sensor Manager (MQTT), allow outbound TCP 8883 to us-central1-xk-calibrationtool.cloudfunctions.net.
• For remote support, open outbound TCP/UDP 6568 to *.net.anydesk.com (AnyDesk) and outbound TCP/UDP 5938 to *.teamviewer.com (TeamViewer).
• For firmware updates, keep outbound TCP 8080 to xandarkardian.float-zone.com open at all times.
• The gateway software regularly checks internet connectivity against Google; allow outbound TCP 443 to google.com.

IP address configuration

• DHCP and static IP: the XK-GW supports both.
• DHCP: make sure there are enough IP addresses for every device that may connect to the network. If there are fewer free addresses than devices, devices compete for addresses and connections become unstable.
• Static IP: share the list of IP addresses with Xandar Kardian in advance. We configure the static IPs before deployment.

Bandwidth

Each XK300 sensor connected to an XK-GW uses, per day:

Data is sent over MQTT every 3 seconds, so traffic is spread evenly through the day without spikes. For comparison, HD video streaming (3 to 5 Mbps) uses about as much bandwidth as 120 sensors, and general web browsing (about 1 Mbps) as much as 40 sensors.

Network segmentation

We recommend a separate Wi-Fi network for XK devices, based on a VLAN, with its own SSID and password, apart from the network used by staff. This isolates XK traffic and reduces the load on the main network.

Without segmentation, XK devices and staff devices share the same access points, switches and routers. Those devices have limited processing power, memory and connection capacity; when they are close to their limit, the network can slow down or drop packets for everyone, even though each XK device uses very little bandwidth.

Even with VLAN segmentation, a network that cannot handle many connected devices can still be overloaded. In that case, a cellular (LTE) connection keeps XK devices fully separate from the facility network.

Troubleshooting

2 · Network

Gateway VLAN setting

The XK-GW supports tagged VLANs on its Ethernet port. First confirm whether the facility uses a tagged or an untagged VLAN. If the facility uses an untagged VLAN, no action is needed. For a tagged VLAN, obtain the VLAN number from the facility.

Tagged VLAN with DHCP

1. Install the VLAN package: sudo apt-get install vlan
2. Open /etc/network/interfaces and add the following lines, where X is the VLAN number:

auto eth0.X
iface eth0.X inet dhcp

1. Apply the changes: sudo systemctl restart networking

Tagged VLAN with a static IP

1. Install the VLAN package: sudo apt-get install vlan
2. Open /etc/network/interfaces and add the following lines, using the VLAN number and addresses from the facility:

auto eth0.X
iface eth0.X inet static
    address 10.10.10.2          # example
    netmask 255.255.255.0       # example
    gateway <facility gateway IP>
    dns-nameservers 8.8.8.8     # optional DNS server from the facility

1. Apply the changes: sudo systemctl restart networking

After the change

A new interface appears for the VLAN, for example eth0.10 for VLAN 10.

To check, ping the facility gateway IP address and confirm that replies are received.