Siemens Stratos Outstation User manual

667/CI/45025/000
3G OTU
IP ROUTERS INSTALLATION
GUIDE
Jun-19
Issue 4

Contents
IP ROUTERS INSTALLATION GUIDE 3G OTU
667/CI/45025/000 Rev 4 Unrestricted
2
Contents
Contents 2
List of Figures 3
List of Tables 4
Health and Safety Protection 5
Handling Precautions 6
1. Introduction 7
1.1. Purpose 7
1.2. Document References 7
1.3. Key Terms and Abbreviations 7
2. Routers - General Description 9
2.1. MuLogic RSA ADSL 9
2.2. PROROUTE 3G/4G Router 9
2.3. Connection Types 9
2.3.1. Transparent Connection 9
2.3.2. VPN Connection 10
3. Installation and Configuration Guidance 11
3.1. Installation of the Antenna Cable 11
3.1.1. Installation of Pole Mounted Antenna Kit 13
3.2. Configuration and Installation of the 3G/4G Router 14
3.2.1. RMS over IP Gemini Mk2 14
3.2.2. STRATOS Outstation Connection 14
3.2.3. UTC Connection via 3G/4G router 16
3.3. Installation and Configuration of ADSL Routers 20
4. Maintenance 21
4.1. Modifications 21
4.2. Routine Maintenance Visits 21
4.3. First Line Maintenance 21
4.4. Second Line Maintenance 22

List of Tables
IP ROUTERS INSTALLATION GUIDE 3G OTU
667/CI/45025/000 Rev 4 Unrestricted
3
List of Figures
Figure 1 : SIM Card Slot 14
Figure 3 : 3G/4G Router Settings (WAN) 15
Figure 4 : 3G/4G Router Settings (ICMP) 15
Figure 5 : IPSec Configuration 16
Figure 6 : Example IPSec Instance 18
Figure 7 : Example IPSec Status 19

List of Tables
IP ROUTERS INSTALLATION GUIDE 3G OTU
667/CI/45025/000 Rev 4 Unrestricted
4
List of Tables
Table 1 : External Document References 7
Table 2 : Terms and Abbreviations 8
Table 3 : IPSec Settings Table 17

Health and Safety Protection
IP ROUTERS INSTALLATION GUIDE 3G OTU
667/CI/45025/000 Rev 4 Unrestricted
5
Health and Safety Protection
Safety of Installation and Maintenance Personnel
In the interests of health and safety, when installing, using or servicing this equipment the
following instructions must be noted and adhered to:
(1) Only skilled or instructed personnel, with relevant technical knowledge and experience,
who are also familiar with the safety procedures required when dealing with modern
electrical/electronic equipment, are to be allowed to use and/or work on this equipment.
All work shall be performed in accordance with the local regulations1,2.
(2) Such personnel must take heed of all relevant notes, cautions and warnings in this
Handbook and any other Document or Handbook associated with the equipment includ-
ing, but not restricted to, the following:
i. The equipment must be correctly connected to the specified incoming power supply.
ii. Only trained / competent persons should work on this equipment.
iii. Any power tools must be regularly inspected and tested.
iv. Any personnel working on site must wear the appropriate protective clothing, e.g. re-
flective vests, etc.
Safety of Road Users
It is important that all personnel are aware of the dangers to road users that could arise during
repair and maintenance of traffic control equipment.
Ensure that the junction area is coned and signed as necessary to warn motorists and pedes-
trians of any dangers and to help protect the personnel working on the site.
1
For UK this refers to Electricity at Work Regulations 1989.
2
For DE this refers to GV A3, DIN EN 50110-1 (VDE 0105-1) and VDE 0832 and the work-safety leaflet
ASM 0099-01

Handling Precautions
IP ROUTERS INSTALLATION GUIDE 3G OTU
667/CI/45025/000 Rev 4 Unrestricted
6
Handling Precautions
Safety of Handling
•Take care not to ‘kink’ the cable when installing. The impact may manifest in poor re-
turn loss.
•Due to the cable thickness the RF cable the minimum bend radius of 25cm must be ob-
served
•It is recommended that RF connectors exposed to the environment are protected using
amalgamating Tape, and electrical tape

Introduction
IP ROUTERS INSTALLATION GUIDE 3G OTU
667/CI/45025/000 Rev 4 Unrestricted
7
1. Introduction
1.1. Purpose
This User Guide gives a general description for the range of IP router used by Siemens ITS.
This document either outlines the general procedures for installation, commissioning and
maintenance or refers to appropriate and applicable documents.
1.2. Document References
External Document References
667/HB/31601/000
UTMC OTU/ MOVA Handbook
667/HB/32600/000
GEMINI² Traffic Outstation Handbook
667/AY/45025/000
3G/4G OTU Communications Site Selection Guide
667/DZ/31601/000
Family Tree
667/CI/32630/000
Gemini MK2 3G/4G Conversion GUIDE
667/CI/52251/000
Stratos Outstation 3G/4G Comms Installation QS Guide
Table 1 : External Document References
1.3. Key Terms and Abbreviations
Key Terms and Abbreviations
PSTN
Public Switching Telephone Network
GSM
Global System for Mobile communication (This Usually Refers to 2nd Generation,
2G Networks)
GPRS
Global Packet Radio Service, Used on, 2G networks as a packet data service.
2G
Second Generation GSM Networks optimised for Voice Communication
3G
Third Generation GSM Network optimised for Data Communications
4G
Fourth Generation GSM Network optimised for Data Communications
EDGE
Enhanced Data rates for GSM Evolution (or EGPRS). Used on 2G networks to
increase the data rates achievable.
PSU
Power Supply Unit
I/O
Inputs / Outputs

Introduction
IP ROUTERS INSTALLATION GUIDE 3G OTU
667/CI/45025/000 Rev 4 Unrestricted
8
Key Terms and Abbreviations
MOVA
Microprocessor Optimised Vehicle Actuated
UTC
Urban Traffic Control
OTU
Outstation Transmission Unit
SCOOT
Split Cycle Offset Optimisation Technique
IPT
Intelligent Portable Terminal
RAM
Random Access Memory
PROM
Programmable Read Only Memory
CPU
Central Processor Unit
UTMC
OTU
Urban Traffic Management and Control (Outstation Transmission Unit)
UTMC
VMS
Urban Traffic Management and Control (Variable Message Sign)
NAT
Network Address Translation (sometimes referred to as Port Forwarding)
VPN
Virtual Private Network
LAN
Local Area Network
WAN
Wide Area Network
ADSL
Asymmetrical Digital Subscriber Line
SDSL
Symmetrical Digital Subscriber Line
Table 2 : Terms and Abbreviations

Routers - General Description
IP ROUTERS INSTALLATION GUIDE 3G OTU
667/CI/45025/000 Rev 4 Unrestricted
9
2. Routers - General Description
Siemens ITS (Poole) provide and support three types of routers, namely a 3G/4G Router, xDSL
Route and Instation Router for use in customer networks.
This chapter outlines these devices and provides an overview on their use.
2.1. MuLogic RSA ADSL
This type of router can be used to connect IP based equipment to a customer network using
an ADSL “Broadband“ Connection. The ADSL line will allow a connection to the Public Inter-
net, and the router can provide a IPSEC VPN (Virtual Private Network) tunnel to another Rout-
er to allow the WAN (Wide Area Network) connection back to the customer LAN (Local Area
Network). For details please refer to 667/CI/99107/000.
2.2. PROROUTE 4G Router
The current router is the PROROUTE H685 4G (667/1/99110/000), which can be used to con-
nect IP based equipment to a customer network using a Mobile Phone connection (3G or 4G
GSM). Wireless connections of this type are not normally as reliable as using wired communi-
cations solutions and are not always suitable in some locations or for certain applications. If
in doubt, please contact the Engineering department in Poole for clarification.
The PROROUTE H685 4G (667/1/99110/000) Router also allows IPSEC VPN tunnels to be con-
figured for secure connections across the public Internet, these settings would be provided
by the Customer or Poole Engineering department.
2.3. Connection Types
There are two types of equipment connections used in Siemens ITS. The first is the ‘transpar-
ent’ connection and the second is the ‘VPN’ connection.
2.3.1. Transparent Connection
In this type of connection the STRATOS Outstation, or ST950 controller, will be the VPN cli-
ent. Therefore any communications interface only needs to act as a transparent ‘pipe’ to and
from the STRATOS Outstation/ST950 Controller.
Safety of Licences
The STRATOS Outstation/ST950 Controller needs to be supplied with the appropriate certifi-
cates in order to enable connection through to the STRATOS Instation.

Routers - General Description
IP ROUTERS INSTALLATION GUIDE 3G OTU
667/CI/45025/000 Rev 4 Unrestricted
10
Safety of Security
Although the 3G/4G router modem does not handle the STRATOS Outstation to Instation secu-
rity explicitly, it is nevertheless incumbent on the installers to secure the router. Having a se-
cure router may discourage accidental or intentional re-configuration that could end up
providing third parties with access to customers’ internet bandwidth.
The process for securing the 3G/4G router is as follows;
1Generate a random password. It is recommended that KeePass (www.keepass.com) is
used for such a purpose.
2Configure the router such that the spare Ethernet port is not active.
3Confirm and configure the modem such that the WiFi device is in-operable.
4Update the modem with the password generated above.
5Export the router configuration
6Store the password for the router along with router configuration in the STRATOS Outsta-
tion site-log or the ST950 Site Log.
7Delete local copies of the configuration and password.
2.3.2. VPN Connection
This type of connection relies on the router to become the VPN client. Product applications
such as RMS over IP (Gemini Mk2), OMU, Saphire JTM will use this methodology.
Safety of Security
It should be noted that this method of connection is not considered as secure as the ‘Transpar-
ent’ connection method.

Installation and Configuration Guidance
IP ROUTERS INSTALLATION GUIDE 3G OTU
667/CI/45025/000 Rev 4 Unrestricted
11
3. Installation and Configuration Guidance
3.1. Site Selection Guide
In order to assist in appropriate site selection for 3G/4G installation, the user is referred to the
3G/4G Communications Site Selection Guide (667/AY/45025/002).
3.2. Antenna Selection Guide
Siemens provide two types of antenna. The first is the Omni antenna which is normally
mounted on a traffic pole. Due to the mounting height the Omni installation is most likely to
provide the ‘best’ performance.
The second type, is a case (controller cabinet or VMS sign) mounted antenna. This antenna is
unlikely to perform as well as a pole mounted Omni due to the mounting height (<2m in the
case of a controller cabinet) and its antenna technology (patch antenna), which has a lower
gain (typically 0dBi as opposed to 3dBi for an Omni).
To assist installers in deciding the type of antenna to select, the sample signal strength; that
has been ascertained by working through the Site Selection Guide (see above), can be used.
Signal Guide
Antenna Guide
Strength
Quality
Condition
Omni Antenna
Case Antenna
RSSI dBm
CSQ
-109
2
Marginal
-107
3
Marginal
-105
4
Marginal
-103
5
Marginal
-101
6
Marginal
-99
7
Marginal
-97
8
Marginal
-95
9
Marginal
-93
10
OK
-91
11
OK
-89
12
OK
-87
13
OK
-85
14
OK
-83
15
Good
-81
16
Good
-79
17
Good
-77
18
Good
-75
19
Good
-73
20
Excellent
-71
21
Excellent
-69
22
Excellent
-67
23
Excellent

Installation and Configuration Guidance
IP ROUTERS INSTALLATION GUIDE 3G OTU
667/CI/45025/000 Rev 4 Unrestricted
12
-65
24
Excellent
-63
25
Excellent
-61
26
Excellent
-59
27
Excellent
-57
28
Excellent
-55
29
Excellent
-53
30
Excellent
3.3. Installation of the Antenna Cable
The Cable kits (667/1/46193/150 and /300) comes with:
•15M or 30M lengths of reinforced coaxial antenna cable (998/4/25011/400)
•PIB Self Amalgamating Tape (992/4/07906/000)
•Female N-Type Connector (For termination in the controller Cabinet)
•Male N-Type Connector (For Pole Top Termination)
•Adapter SMA plug to ReSMA socket
•ReSMA plug to N type plug pigtail cable.
•N-Type Cable Termination Guide (667/CI/46193/ETC)
The reader is to refer to N-Type Cable Termination Guide (667/CI/46193/ETC) for details;
1Install the cable between the Roadside Cabinet and traffic signal pole.
2Terminate the antenna cable using a Male N-Type connector (See Terminating N-Type
Connectors).
Safety of Cable Handling
Ensure that the bend radius is not less than 6 times the diameter of the cable at any time dur-
ing installation
Safety of Cable Handling
The antenna should be installed as a single cable with no joins, and care must be taken not to
kink the cable. Once it has been kinked, it cannot be straightened without attenuating the
signal.

Installation and Configuration Guidance
IP ROUTERS INSTALLATION GUIDE 3G OTU
667/CI/45025/000 Rev 4 Unrestricted
13
Safety of Cable Handling
Use some PIB Self Amalgamating Tape (992/4/07906/000) (supplied) and some electrical tape
to protect the N-Type connectors.
3.3.1. Installation of Pole Mounted Antenna Kit
The pole mounted 3G/4G Omni Antenna kit (667/1/46190/100) comes with:
•3G/4G Omni Antenna
•Bracket and fittings to mount the Antenna at the pole top
•Installation drawing (667/CI/46190/ETC)
The reader is to refer to Installation drawing (667/CI/46190/ETC) for
details;
1Install the antenna in the supplied plastic bracket.
2Attach the plastic bracket to the metal Pole mounting bracket using
the supplied bolts.
3Bolt the pole spacer kit to the pole using U Bolt provided.
4Attach the Pole mounting bracket to the spacer kit and pull the an-
tenna cable out through the hole.
5Plug terminated antenna cable directly into the Antenna
6The N-Type connector needs to be protected using self-
amalgamating tape sealing against the bottom of the antenna hous-
ing and extending 1-2cm past the barrel of the connector onto the
cable.
7Complete the protection by neatly covering the self-amalgamating
tape with black electrical tape, ensuring that the tape finishes with a
cut off end (do not snap tape).
8At the cabinet, bring the cable into the cabinet and terminate using appropriate connect-
or, dependent on the router provided.
Safety of Cable Handling
Use some PIB Self Amalgamating Tape (992/4/07906/000) (supplied) and some electrical tape
to protect the N-Type connectors.

Installation and Configuration Guidance
IP ROUTERS INSTALLATION GUIDE 3G OTU
667/CI/45025/000 Rev 4 Unrestricted
14
3.4. Configuration and Installation of the 3G/4G Router
3.4.1. RMS over IP Gemini Mk2
For details the reader is referred to document 667/CI/32630/000 which is supplied as part of
the Gemini Mk2 3G/4G Router Kit (667/1/32630/000).
3.4.2. STRATOS Outstation Connection
For details the reader is to refer to the STRATOS Outstation 3G Communications Installation
Quickstart Guide (667/CI/52251/000), which is supplied as part of the STRATOS OUTSTATION
3G/4G ROUTER KIT (667/1/32630/100).
The STRATOS Outstation will be the VPN client. Any communications interface only needs to
act as a transparent ‘pipe’ to and from the STRATOS Outstation. The STRATOS Outstation
needs to be supplied with the appropriate certificates in order to enable connection through
to the STRATOS Instation.
The 4G router needs to be setup as follows:
1Ensure the router SIM card has been installed. Remove the panel at the back of the router
and slide the SIM card into the slot.
Figure 1 : SIM Card Slot
2Connect to the 3G/4G router, using the default IP address 192.168.8.1. Login using
username siemens_field.

Installation and Configuration Guidance
IP ROUTERS INSTALLATION GUIDE 3G OTU
667/CI/45025/000 Rev 4 Unrestricted
15
3APN setup (including username and password)
Figure 2 : 3G/4G Router Settings (WAN)
4Setup ICMP check settings. This provides the 3G/4G router the ability to monitor the
backhaul link and if down will reboots to ensure there are no router issues. Any ‘pingable’
IP address can be used but the STRATOS Instation would be a reasonable option.
Figure 3 : 3G/4G Router Settings (ICMP)

Installation and Configuration Guidance
IP ROUTERS INSTALLATION GUIDE 3G OTU
667/CI/45025/000 Rev 4 Unrestricted
16
3.4.3. UTC Connection via 3G/4G router
In these applications the 3G/4G router provides the secure connection to the Instation, where
there will be an Instation router configured to accept the VPN connections.
Safety of VPN Prerequisites
•This section assumes that the PROROUTE is already configured to allow traffic out to
the internet.
•It is also assumed that the router has been updated to the latest firmware (v3.2.133 as
of 12th October 2017) available here:
http://www.proroute.co.uk/support/firmware/proroute-h820wrt-h685wrt-firmware/
1The following instructions are used to ensure the 3G/4G router is configured for appropri-
ate VPN connection;
2Log on to the PROROUTE router(s) and navigate to Services > VPN > IPSec
3Enter a memorable name in the New instance name box (spaces not allowed), select a
method of Client and click the Add button:
Figure 4 : IPSec Configuration

Installation and Configuration Guidance
IP ROUTERS INSTALLATION GUIDE 3G OTU
667/CI/45025/000 Rev 4 Unrestricted
17
4Once created, select Edit beside the newly created instance.
5On the new page you will be required to enter the information as follows;
Setting
Value
Enable
Tick this box to enable the tunnel
Exchange mode
IKEv1-Aggressive or IKEv1-Main
Operation Level
Main
Authentication Meth-
od
Client
Remote VPN endpoint
Change to 'custom' then enter the public IP address for the VPNC
Local endpoint
Any
Local IKE identifier
[SCN]@[customer].com (must match VPNC)
Remote IKE identifier
Instation_[SCN]@[customer].com (must match VPNC)
Preshared Keys
Preshared key for this tunnel (refer to the ipsec.secrets file on VPNC)
Perfect Forward Secre-
cy
Enable
DPD action
Clear
DPD delay
30 seconds (must match VPNC)
DPD timeout
120 seconds (must match VPNC)
NAT traversal
Enable
Local LAN bypass
Tick this box if the local network range is contained within the remote range
Local subnet
Internal IP Address and subnet Mask (including any static routes) of the out-
station
Remote subnet
Internal IP Address and subnet Mask of cloud-hosted environment
Phase 1
Encryption algorithm
This is the AES value e.g. AES 256 (must match VPNC)
Hash algorithm
This is the 3DES/SHA value e.g. HMAC_SHA1 (must match VPNC)
DH group
Set the Diffie Hellman Group e.g. MODP4096/16 (must match VPNC)
Life time
28800 (refer to lifetime details within ipsec.conf on VPNC)
Phase 2
Encryption algorithm
This is the AES value e.g. AES 256 (must match VPNC)
PFS group
Set the Diffie Hellman Group e.g. MODP4096/16 (must match VPNC)
Authentication
This is the 3DES/SHA value e.g. HMAC_SHA1 (must match VPNC)
Life time
3600 (refer to lifetime details within ipsec.conf on VPNC)
Table 3 : IPSec Settings Table

Installation and Configuration Guidance
IP ROUTERS INSTALLATION GUIDE 3G OTU
667/CI/45025/000 Rev 4 Unrestricted
18
Figure 5 : Example IPSec Instance

Installation and Configuration Guidance
IP ROUTERS INSTALLATION GUIDE 3G OTU
667/CI/45025/000 Rev 4 Unrestricted
19
6Click Save & Apply to save this new tunnel.
7Once the settings have saved you will return to the main list and a connection will be
attempted.
8You can check the status of the tunnel by navigating to Status > VPN > IPSec and identify
any issues by selecting IPSec Log above the status
Figure 6 : Example IPSec Status

Installation and Configuration Guidance
IP ROUTERS INSTALLATION GUIDE 3G OTU
667/CI/45025/000 Rev 4 Unrestricted
20
3.5. Installation and Configuration of xDSL Routers
For details the reader is to refer to the Field Document Installation of the MuLogic RSA-4222
667/CI/99107/000). This document also includes the details relevant to VPN connections.
In addition, the Installation of the MuLogic RSA-4222 Base Configuration (667/CR/99107/000)
document is supplied as part of the CONFIGURED MULOGIC ROUTER RSA-4222/VR2
(667/1/99107/000).
3.6. 2U Mounting Kits
When installing an xDSL router and/or a wireless router, which isn’t mounted to a STRATOS
Outstation, the use of a 19 INCH 2U Mounting Kit is recommended.
There are a few options available, with the main ones listed below;
Part Number
Description
667/1/31625/019
19 INCH 2U Rack with UTMC 13A Socket Kit
667/1/31625/119
19 INCH 2U Rack
667/1/31625/219
19 INCH 2U Rack with STRATOS O/S 13A Socket Kit