Industrial LTE Router Selection for Thai Factories: RFP and Acceptance

An industrial LTE router can connect a factory asset to a remote monitoring system, provide backup for a wired WAN, or enable approved maintenance access. A catalog checklist that says “dual SIM,” “VPN,” and “industrial grade” does not show how the application behaves when the link fails. In a Thai factory, the LAN, carrier, antenna, power supply, OT boundary, and support rights must work as one system. This guide helps purchasing, factory IT, maintenance, and equipment suppliers write one RFP and agree on meaningful acceptance tests. It does not guarantee a product’s speed or endorse a particular model.

Start industrial LTE router selection with the process that must keep working

First decide whether LTE is the primary link, a backup for wired WAN, a channel for remote OEM support, or a temporary connection. List each data stream, permitted outage, local fallback, and write permission. A one-minute equipment log may tolerate buffering and later delivery. A critical alert needs a measured detection-to-recipient time. Do not assume a public cellular link is suitable for a real-time control loop; keep basic control and safety functions local.

Specify recovery of the business application separately from restoration of the radio link. A router can reconnect while the receiving application remains stale. Define packet loss, duplicate records, retransmission, and the maximum time until the intended business function resumes.

Draw the complete factory connection path

Before soliciting bids, draw the path from PLC or logger to OT switch, LTE router, mobile network, VPN endpoint, DMZ, and application. Mark which side initiates every connection. Any route from outside to a PLC requires its own purpose, approver, time limit, and audit record. NIST SP 800-82 Rev.3 addresses security in the context of OT safety and availability; CISA advises reducing internet-exposed OT assets. Neither source automatically approves a particular plant architecture.

Compare a direct connection to a PLC with a collection gateway. Direct wiring can be simple but may make a PLC reachable to maintenance users. A gateway can separate data collection from the external link, while adding another maintained component. See our articles on retrofitting existing equipment for IoT and selecting an industrial protocol gateway for adjacent design decisions.

Test the primary-link and backup-link cases separately

A primary link needs normal-day latency and throughput measurements, recovery after loss of coverage, and resilience of the VPN head end. A backup needs a specified wired-failure trigger, routing switchover, application reconnection, switchback rule, and protection from flapping. For maintenance-only access, assess whether the path can remain closed until an approved service window. “LTE capable” is not an acceptance condition; the required application sequence is.

Two SIM cards do not necessarily mean two live connections

Dual SIM and dual modem describe different designs. A single radio may have to detach, change SIM, register again, and rebuild the VPN. Two radios may support simultaneous links on certain models. Cisco’s cellular PIM configuration guide treats a single link, one modem with two SIMs, and two modems as different availability options. A failover time in its example is not a guarantee for a Thai plant or another router.

Ask the bidder for modem count, simultaneous-connection capability, APN configuration per carrier, failover trigger, data gap, and return to the primary network. Two SIMs on the same carrier share a possible network failure. Two carriers can still share an antenna location, plant power, VPN endpoint, or application. Evaluate redundancy against concrete failure scenarios rather than counting SIM slots.

Do not buy on LTE category or theoretical Mbps alone

Catalog peak throughput is not the uplink speed inside a metal-rich factory. Antenna position, building attenuation, radio bands, network load, time of day, and carrier matter. Give vendors the expected uplink volume, peaks, maximum latency, and resend volume. Test at the proposed installation location. Streaming diagnostic video has different needs from sending small equipment readings.

Verify the exact SKU’s supported bands, the Thai carrier’s contract and APN, SIM format, IPv4/IPv6 support, outbound VPN behavior behind NAT or CGNAT, and firmware support term. “Asia compatible” is not proof that this SKU works on this subscribed network. Compare 5G and carrier aggregation only after assessing required capacity, site coverage, and recurring cost. Attach the current official data sheet to the purchase specification; specifications can change with revisions and firmware.

Record application traffic as well as radio signal

Log available signal-quality measures, upload time, reconnections, and gaps by time period. Measure several candidate antenna locations, with cabinet doors closed and equipment operating. Include difficult conditions such as a production shift or rain if relevant. There is no universal passing signal threshold for every application. If the antenna is outside, include weather protection, cable loss, surge protection, grounding, and safe maintenance access in the bid.

Define the security boundary around OT

Cellular connectivity is an external route, not a reason to expose a controller. Separate the router management interface, VPN endpoint, factory OT network, and business application. Specify changed default credentials, disabled unused services, destination restrictions, patch ownership, configuration backups, and renewal of keys and certificates. CISA’s OT mitigation guidance favors removing direct public exposure and securing necessary remote access with VPN and strong authentication.

“VPN supported” is incomplete. Identify whether the router initiates a tunnel to an enterprise or cloud endpoint or accepts inbound connections. Define MFA for people, role-based permission, time-limited approval, and connection logging. Avoid permanent shared OEM accounts. Test deactivation when a worker leaves or a maintenance contract ends. Synchronize time and keep logs where an investigator can establish who connected to which asset and when.

Keep data transmission and remote control as different permissions

Many monitoring applications only need an outbound flow. A technician who can operate or reprogram equipment needs a separate authorization. Use network rules or VLANs so closing maintenance access does not stop data collection. Let the factory authorize any intervention that could halt a line. Record session start and end, and prevent an old maintenance session from silently returning after a link recovery.

Choose hardware for the installation site

Decide whether the router will sit on a DIN rail, in an enclosure by the machine, or in an outdoor cabinet. Check cabinet temperature, condensation, dust, vibration, supply voltage, short interruptions, surges, earthing, and cable retention. A wide temperature rating for the device does not by itself solve the heat of a sealed cabinet. As one product-specific example, Moxa’s current OnCell G4302-LTE4 product information lists redundant power input, dual SIM, VPN, firewall features, and a defined operating-temperature range. Those claims apply to the relevant series and revision, not to every product or enclosure.

Put the exact part number and firmware, antenna and cable, power supply, SIM spares, DIN hardware, warranty, local support, and spare-unit lead time on the bill of materials. Ethernet and serial ports, digital I/O, Wi-Fi, and cloud management vary. Features that are not needed can create support costs and additional attack surface; enable them only for a defined use.

Check Thai procurement, radio approval, and carrier terms

Ask the supplier for the precise model, wireless module revision, route of supply in Thailand, and applicable conformity documents. Thailand’s NBTC Type Approval portal provides a lookup point. The applicable procedure depends on the configuration and supply route, so a generic claim of “NBTC approved” should not replace documentation for the ordered SKU. Assign the seller and importer the task of confirming the relevant requirements and attach evidence to the purchase order.

Confirm the legal account holder, APN, data cap, throttling after the cap, roaming, fixed-IP requirement, fault contact, and payer. Inbound access may be difficult behind carrier-grade NAT; an outbound VPN or management service may solve the technical problem but changes security review and monthly cost. Keep carrier charges and cloud-management charges separate. Include a Thai-language incident contact procedure for the plant.

Make the RFP demand evidence rather than checkboxes

Require the model, firmware revision, configuration, limitations, and test evidence for every feature. “Dual SIM” needs a trigger and measured interruption. “VPN” needs its protocol and endpoint design. “Remote management” needs identity controls, hosting location, termination process, and data removal. The official Teltonika RUT241 page describes WAN failover and remote management for that model; it does not promise identical behavior in all deployments.

Ask for proof with the intended carrier and VPN, even if the feature is standard. Prefer your own site’s logs to photographs of other factories. If the PoC SIM contract differs from the production plan, retest under production terms.

Compare cost in five boxes

A universal price range would obscure differences in hardware, installation, and contract term. Break the quote into (1) router and spare, (2) cabinet work, antenna and surge protection, (3) cellular contract, (4) VPN and management platform, and (5) design, FAT/SAT, and support. Compare three-year and five-year total ownership cost, not only first-year price. Include migration or decommissioning of SIM and cloud management.

For an internal estimate: total cost equals initial hardware and installation plus monthly carrier charges times the contract months, management charges, support, and replacements. To estimate avoided downtime, use the site’s wired-WAN incident history and the business time actually rescued by LTE. The router cannot prevent failures of the machine, OT switch, VPN endpoint, or application.

Derive acceptance numbers from work, not catalog claims

A requirement such as “restore within five minutes” is weak unless it is tied to a production order or shipment deadline. Ask process owners how late each data type may arrive. Split the permitted time across failure detection, route switching, VPN restoration, application resend, and display to the user. If their sum exceeds the business deadline, buying a faster router alone will not solve it. Calculate peak traffic when many machines upload buffered records after an outage, not only average daily megabytes. Prioritize current alarms against backlog transmission. Repeated retries can consume the SIM data cap, while too little buffering leaves silent gaps. Measure both normal and recovery traffic in the PoC.

An “availability of 99.9%” is not comparable without the measurement boundary. Is it the radio, the VPN, or a record arriving in MES? Define start and end, planned maintenance, carrier incidents, brief interruptions, and covered shifts. Separate the supplier’s contractual scope from factory-level application metrics. Make sure every limit has a test method and an owner.

Clear responsibility boundaries shorten recovery

A failure may originate in the SIM, carrier, antenna, cabinet power, router, VPN, OT switch, gateway, or application. The first-response sheet should say which screen to inspect, how quickly to escalate, and where logs come from. Practice a split in which maintenance checks power and wiring, IT checks routes and authentication, the carrier checks its network, and the application owner checks missing records. Define who may reboot the router, renew VPN keys, or activate a temporary route. A reboot may erase useful diagnostics, so capture evidence first. Any change affecting production or safety requires site approval; emergency settings need an expiry time and a named person to restore normal access.

At monthly review, examine user-visible gaps, resend counts, reasons for SIM switching, time to recover, rejected access attempts, and pending updates together. A stable link can still have obsolete firmware or an unused OEM account. Before adding another machine, check data allowance, ports, certificates, and licenses.

Make the pre-order PoC reproducible

Use the candidate model, antenna, firmware, and intended SIM plan. A demo with a stronger antenna or unlimited data plan cannot establish production fitness. Record cabinet location, antenna position, weather, operating machines, door position, carrier, APN, and tariff. Include the whole observation period rather than only good intervals. Compare candidates at the same asset, place, and time of day.

Send records with equipment ID, timestamp, and sequence number, then count missing, reordered, and duplicate records at the receiver. Test time synchronization so a rebooted clock is not mistaken for a radio fault. Limit confidential production data sent to a PoC cloud to the approved scope; verify deletion and access revocation afterward. If only synthetic data may be used, match record size and frequency and state the limitation.

Create one fault at a time: unplug wired WAN, block the LTE path, switch SIM, stop the VPN endpoint, and separately stop the receiving server. Align start and end times, router logs, gateway queue, and received-record counts on one timeline. Restore the approved configuration after each test and close temporary management ports and accounts. Maintenance judges serviceability, IT judges identity and configuration, production judges the impact of gaps, and purchasing judges total cost. If a criterion fails, identify whether the solution is another router, antenna relocation, carrier, local buffer, or application change.

FAT: create failures before delivery

Use the ordered model and firmware, proposed SIMs, VPN head end, gateway, and application. Test power cycling, removal of a SIM, degraded radio, wrong APN, VPN endpoint outage, expired credentials, and full retransmission buffer as relevant. At minimum, reproduce the recovery behavior promised in the contract. Capture time stamps, logs, configuration backups, pass/fail decisions, and retest dates.

“Resend without duplicates” also requires identifiers and idempotent handling in the gateway or receiver. Do not assume the router alone can provide it. A successful VPN reconnect is insufficient if MES still has missing production records.

SAT: repeat the proof at the actual plant

Use the final cabinet, antenna, two intended carrier SIMs where applicable, production application, and normal factory electrical noise. Measure signal quality and uplink at each proposed position, reconnections during day and night, restoration after loss of power, and delivery of an equipment alert. Schedule disruptive fault tests with maintenance and secure plant approval. A photograph of a green status LED is not an application acceptance test.

After SAT, have the plant operator replace a SIM, restore a configuration backup, and retrieve fault logs. If only the vendor can recover the system, verify contractual response and local arrival times. Handover should include wiring and IP plans, allowed traffic, firmware and license versions, certificate-renewal dates, responsible people, emergency contacts, and disposal procedure. Accept the system together with an operable recovery process.

Frequent failures and the order of correction

An apparently strong signal may become unstable when the cabinet door closes: remeasure at the real location and review antenna cable loss and grounding. Two SIMs may use one carrier: examine a second carrier and shared VPN dependencies. The cellular link may recover while the application session or queued data does not: add end-to-end reconnection and resend tests. An OEM router may not appear in factory IT’s asset register: record its owner, access window, update duties, and approved path. A quote may omit antenna work, VPN fees, spares, and updates: use the five-box cost model. Buying a more expensive router does not automatically fix these design faults.

A practical implementation sequence

In the first week, document the use, data, outage fallback, and any need for remote control. Factory IT and maintenance then draw the path and access matrix while purchasing obtains model-specific carrier, radio-approval, and support evidence. Run a short PoC with the actual local SIM and planned antenna. Measure uplink, switching, buffering, and VPN logs. Feed those results into the final RFP values. Reproduce failures at FAT, repeat under site conditions at SAT, train operators, then accept.

This sequence also exposes whether a remote path into the PLC is truly necessary. For monitoring, outbound data may be enough; remote maintenance can be separately authorized. Where emergency maintenance is essential, decide who grants access, records activity, and supports an operator on site before choosing the box. Technology requirements and operating responsibilities belong in one comparable bid.

Include monitoring, updates, and retirement in the purchase requirement

After acceptance, do not let the router become an unmanaged box. Assign who reviews connection and carrier status, SIM identity, signal quality, VPN state, reconnections, data consumption, firmware version, and power alarms each day or week. The incident process should name the first contact in IT, maintenance, the carrier, and the machine supplier. Watch both device alarms and missing application records: a VPN can be up while a gateway’s send queue is stuck.

Put SIM renewal, data limits, abnormal charges, and suspension procedure in the asset register. For multiple plants, separate reusable configuration from each site’s certificates, IP addresses, administrator identities, and secrets. Record who approved each configuration change. During spare replacement, erase the old device, document the SIM move and asset-number change, and review stored keys and logs before returning faulty hardware to the manufacturer.

Evaluate firmware releases and deploy in stages. Back up settings first, retest VPN, SIM switching, and application retransmission on a representative unit, then schedule rollout around the plant’s production window. Specify a recovery image and a person on site if the update fails. Plan for separate end-of-support dates for the router, radio module, management cloud, cellular plan, and VPN endpoint.

Write the retirement procedure before installation. Canceling a SIM does not remove cloud registrations, certificates, local settings, or unused antenna cabling. Close the access route, revoke identities and keys, remove the SIM and router from the register, retain only required logs, and verify no old LTE route remains beside a replacement system. Keep the original path diagram current so untracked remote access does not accumulate.

FAQ: industrial LTE router selection

Does dual SIM mean no interruption?

No. A single modem can need time to register on the other SIM and restore VPN. The same-carrier failure may affect both cards. Define an allowable gap and test the candidate with local SIMs and the real application. Cisco’s configuration guide distinguishes dual SIM from dual modem.

Is a fixed IP needed for a factory LTE router?

It depends on the connection direction, APN, CGNAT behavior, management service, and VPN endpoint. A router-initiated tunnel may not need a fixed public IP. Decide the direction in the path diagram and review it with security before purchasing an address option.

Is Wi-Fi or LTE better for a factory?

Wi-Fi usually addresses many devices or moving terminals within the site; LTE can serve a distant asset, WAN backup, or a temporary external link. Compare the intended use rather than nominal radio speed. See our factory Wi-Fi site-survey guide for local WLAN acceptance.

What causes the biggest cost differences?

The router is only one line. Antenna and cabinet work, carrier contract, VPN or management, FAT/SAT, and support can change the total. Compare equal three-year and five-year scopes using actual local quotations.

Should we select 5G now?

Measure the required uplink, latency, coverage, device bands, and recurring fee. LTE can be sufficient for small readings and alarms. A “5G” label does not guarantee availability or OT security. Assess support life and verify with the intended production SIM.

Conclusion: close the loop from route to fault to owner

An industrial LTE router is both a radio device and a boundary between OT and the outside world. Define the use and allowable outage, check the exact SKU and carrier, test how dual SIM really behaves, limit maintenance rights, and run FAT/SAT through the receiving application. In Thailand, include appropriate NBTC evidence and local antenna and SIM testing in procurement. This turns a catalog comparison into a comparison of systems the plant can operate.

At the planning stage, TOMAS TECH can help map existing equipment data, decide whether LTE should be primary or backup, and define the permitted network path. Share your current equipment layout and monitoring or support needs through our contact page.

Primary sources

• NIST SP 800-82 Rev.3
• CISA: Internet Exposure Reduction
• CISA/FBI et al.: OT Threat Mitigations
• Cisco: Cellular PIM SIM Configuration Guide
• Moxa: OnCell G4302-LTE4 Product Page
• Teltonika: RUT241
• Thailand NBTC: Type Approval