topic Re: Gateway behind LTE Modem in Firewall & Security Management

Gateway behind LTE Modem

Pe46dro — Mon, 21 Jul 2025 08:11:20 GMT

Hi all, i have a strange configuration for a small network in a remote location the setup is like this:

[Smart Console]--[QF 9000 series]--((Internet))--[LTE Modem]--[SMB]

I have a route based VPN between [QF 9000 series]-[SMB] and policy installation work by [SMB] policy fetch it's not a direct installation, [SMB] report error in smart console since LTE Modem don't have a public IP address, [SMB] is a DAO object, I tried to set IP address of VTI interface in smart console but it still don't work, when i use the DAO object i see the IP of [LTE Modem] in "Device & License Information".

I'm also trying to set a NAT in [QF 9000 series] to expose a device behind [SMB] but I will make some more tries before try with another post.

Thanks in advance for any support.

Re: Gateway behind LTE Modem

_Val_ — Mon, 21 Jul 2025 09:55:50 GMT

Can you please share some diagrams, versions in use, any other details you may want us to know?

Re: Gateway behind LTE Modem

Chris_Atkinson — Mon, 21 Jul 2025 11:47:28 GMT

In general you do not want management traffic to traverse the VPN.

Presumably you've exposed your MGMT via NAT so it can be reached remotely?

Re: Gateway behind LTE Modem

Pe46dro — Mon, 21 Jul 2025 12:25:52 GMT

SMB have "Dynamic Address" checked and "SIC" established.

Log forwarding from SMB to smart console works

If I click in "Device Information" i see "LTE Router" DHCP WAN IP.

VPN Community don't exclude any service.

Here list of IPs, I have also attached a schema.

	WAN	LAN	VTI
QF 9000	Public IPs	192.168.200.1/24	10.254.254.1
LTE Router	DHCP	192.168.178.1/24	-
SMB	192.168.178.2/24	192.168.220.1/24	10.254.254.2

Re: Gateway behind LTE Modem

Pe46dro — Mon, 21 Jul 2025 12:27:04 GMT

MGMT have a NAT to be reachable from external allowed IPs and this allow log forwarding and policy fetch from SMB, I would like to have MGMT to show device health.

Re: Gateway behind LTE Modem

PhoneBoy — Wed, 23 Jul 2025 14:02:56 GMT

I don't believe I've seen this work for DAIP gateways.
I would check with TAC to see if this is expected.