Imagine you have dozens, maybe hundreds of cellular routers deployed in the field - at remote industrial sites, in vehicles, in buildings. You need to monitor each one, occasionally change its configuration, check its signal strength, or find out where it is. How do you do that without driving out to every location or building a custom management platform from scratch? That's exactly the problem LwM2M Manager solves - a RouterApp for Advantech cellular routers.

What is LwM2M?

LwM2M stands for Lightweight Machine-to-Machine – a standardised protocol developed by the OMA (Open Mobile Alliance) specifically for remote management of IoT devices. The word "lightweight" is key: the protocol is designed to work on resource-constrained devices and over cellular networks where every kilobyte of data has a cost.

Unlike general-purpose protocols or proprietary solutions, LwM2M defines a clear, interoperable model for reading data from a device, writing to its configuration, and triggering remote operations - all from a central server. And because it is an open standard, it works with a wide range of existing IoT platforms and device management servers out of the box.

What problem does it actually solve?

Advantech ICR routers are deployed in many different roles - as industrial gateways, as connectivity for remote machinery, or as backup links for enterprise networks. What they all have in common is this: they end up in places that are difficult or impossible to reach physically.

Yet the network administrator still needs to know things like:

• Is the device online and healthy?
• What cellular technology is it using (LTE, 5G NR), and how strong is the signal?
• Where is the device physically located?
• What firmware version is running on it?

Without the right tool, the options are either logging into each device manually on a regular basis, or building a bespoke monitoring infrastructure from the ground up. LwM2M Manager offers a third way: the router registers itself with your LwM2M server and continuously reports its status. The server can then monitor, store, and react to that data - all without any direct intervention on the router itself.

How does it work in practice?

Once installed and enabled, the RouterApp acts as an LwM2M client: the router registers with the configured LwM2M server and maintains a live connection. Every 30 seconds it sends a keepalive update, which also keeps NAT mappings open - meaning the server can reach the device at any time, even without the router having a public IP address.

Communication runs over CoAP/UDP, which is significantly more efficient for cellular networks than conventional HTTP. If you want the connection to be secured (and in most deployments you should), the RouterApp supports DTLS encryption - either with a Pre-Shared Key (PSK) or X.509 certificates.

What does the server see?

The router automatically provides the server with core device information: manufacturer, model, serial number, and firmware version. Two additional data sources can be enabled optionally:

Location (GNSS) – if the router has a GPS/GNSS module, it reports the current geographic position to the server. This is useful for vehicle applications or tracking field equipment.

Mobile WAN status – signal strength, operator name, network technology (LTE, NR), IMEI, and SIM card ICCID. This data is often the most practical for diagnostics: you can immediately see why a device is slow or why it has switched to a fallback operator.

Two ways to connect to the server

The RouterApp supports two deployment models to cover different operational scenarios:

Direct registration – the LwM2M server address and credentials are pre-configured on the device. This is the right choice when you configure routers upfront before deploying them to a specific project.

Bootstrap – the router first connects to a bootstrap server, which then provisions the actual LwM2M server address and credentials. This model enables zero-touch provisioning: routers can be shipped and installed without any prior configuration, and the bootstrap server takes care of the rest automatically.

Security

LwM2M Manager supports three security levels:

• No encryption (plain CoAP) – suitable only for testing in an isolated network
• PSK (Pre-Shared Key) – simpler setup; both sides share a secret key
• X.509 certificates – full PKI-based mutual authentication, appropriate for deployments with higher security requirements

When should you use it?

LwM2M Manager is a good fit when you:

• Manage a larger number of routers across multiple sites and need a centralised view of their status
• Want to integrate routers into an existing IoT platform or device management system that supports LwM2M
• Deploy devices in scenarios where physical access to the router is impractical or too costly
• Need to monitor cellular connection quality at remote sites without having to log into each device individually

Availability

LwM2M Manager is a RouterApp for Advantech ICR routers. It is not included in the standard router firmware - it is installed separately through the Router Apps section of the router's web interface. All configuration is done through a GUI built into the router, with no need to edit configuration files manually.

You've built your Configuration Profile - but how do you actually get it onto your routers? In Video Tutorial #9, we walk through three ways to assign a profile: to a single device, to multiple devices at once, or straight from a device's own page.

Device happens to be offline? No problem - the profile just waits and assigns itself automatically the moment it connects.

Watch it now:
🔹 on WebAccess/DMP portal
🔹 on YouTube

In factories and industrial facilities, even a short network outage can lead to production delays, safety risks, or significant financial losses.

With the ICR-1745 5G NR Gateway and WebAccess/DMP, mission-critical machines stay online - no matter what. The router's robust multi-WAN mechanism supports automatic failover between primary networks and a backup 5G connection. VPN ensures secure communication, while centralized management gives IT teams full visibility and control.

🔁 Seamless failover
🔒 Secure remote access via VPN
📡 Centralized monitoring & provisioning via WebAccess/DMP

👉 Learn more: https://www.advantech.com/en/resources/case-study/mission-critical-connectivity-with-icr-1745

New ICR-OS release is here. Version 6.6.2 brings new features, security updates, and a range of fixes to Advantech cellular routers. As with all new releases, routers leaving our production line will come pre-installed with this firmware.

What Changed?

1. Multiple Security Vulnerabilities Patched: OpenSSL was updated to 3.5.7, resolving several high-severity CVEs (including CVE-2026-28390 and CVE-2026-31789), and OpenSSH was updated to 10.3, addressing CVE-2026-35385 among others. The Linux kernel was also updated to 6.1.175 and the CA certificates bundle refreshed, bringing broad upstream security and stability improvements.

2. GNSS Constellation Selection Added: Users can now choose which GNSS constellations are used, with GPS and Galileo enabled by default, and the GNSS status page now shows satellites from all enabled constellations.

3. Maximum Firewall Rules Increased: The firewall rule limit has been doubled from 32 to 64, giving users more flexibility for complex network policies.

4. Emergency Reset Data Wiping Extended to All Devices: Emergency Reset now clears user data, Router Apps, and device certificates on all router models, not just -S1 devices as before.

5. Reboot Process Improved: The reboot command now properly shuts down running services first, and a new halt command safely powers down the router for unplugging.

More Details?

For a full breakdown of the advancements and changes in this release, we encourage you to review the official Release Notes.

Ready to update?

The firmware is available on the Firmware and Router Models pages, or can be downloaded directly to the router from Advantech's public server.

Every device connected to the internet has an IP address. The problem is, for most cellular connections, that address isn’t fixed – it changes whenever the connection drops and reconnects, or when the mobile provider decides to reassign it. For anyone who needs to reliably reach a router from the outside – to check on a remote site, pull data, or manage the device – that’s a real obstacle.

Dynamic DNS solves this by keeping a domain name continuously pointed at the router’s current IP address, no matter how often it changes. ICR-OS 6.6.1 significantly extends this capability – adding HTTPS transport support, custom certificate authority support, and full RFC 2136 DDNS protocol support.

How Dynamic DNS works – the basics

The idea behind Dynamic DNS is straightforward. You register a hostname with a DNS provider – something like myrouter.example.com. The router monitors its own public IP address, and whenever it detects a change, it automatically notifies the DNS provider, which updates the record. Anyone connecting to that hostname always ends up at the right address, even if the underlying IP has changed ten times since yesterday.

The router detects IP address changes immediately. However, to avoid flooding the DNS provider with requests, updates are sent at most once per minute. In practice, this means that after a reconnect or IP reassignment, the DNS record is updated within a minute – fast enough for the vast majority of remote access scenarios.

One important prerequisite: this only works if the cellular provider assigns the SIM card a public IP address. Many mobile providers use carrier-grade NAT, where multiple customers share a single public IP – in that case, Dynamic DNS won’t help, because there’s no unique public address to point to.

Two protocols, two use cases

Advantech ICR routers now support two distinct Dynamic DNS protocols, each suited to different scenarios.

DynDNS (HTTP API)

This is the classic approach – the router calls a web-based API at a third-party DNS provider whenever its IP changes. Services like freedns.afraid.org, duckdns.org, or noip.com work this way. It’s simple to set up and widely supported. As of ICR-OS 6.6.1, updates can be sent over HTTPS, encrypting the communication with the provider. You can also supply a custom CA certificate, which allows the router to verify the identity of a private or self-hosted DNS update server – useful in enterprise or industrial environments where traffic must stay within a controlled infrastructure.

It’s worth clarifying what “DynDNS” actually refers to, since it often causes confusion. DynDNS is not a generic protocol name – it’s the name of the company (Dyn, Inc.) that first offered this kind of service, and whose update protocol went on to become the de facto industry standard. Other DNS providers later built compatible services around the same basic idea, and some introduced their own tweaks or extended versions along the way. All of these still run over HTTP or HTTPS and look broadly similar from the outside, but the implementation details can vary from provider to provider. Advantech ICR routers support a wide range of DynDNS providers, but always through the original, standard DynDNS protocol – proprietary extensions or provider-specific variants are not supported.

DDNS via RFC 2136

RFC 2136 is a standardized DNS update protocol that communicates directly with a DNS server – no third-party service required. Instead of calling an HTTP API, the router sends a DNS UPDATE message straight to an authoritative DNS server on your network. Authentication is handled via TSIG (Transaction Signature), a shared key that ensures only authorized devices can modify DNS records. This makes RFC 2136 a strong fit for organizations running their own DNS infrastructure, where relying on a public cloud provider is not desirable or permitted. Note: RFC 2136 support is available on all ICR models except ICR-20, ICR-24, ICR-25, and ICR-2600.

Configuration on Advantech routers

Dynamic DNS is configured under Services → Dynamic DNS. The key settings are:

• Hostname – the fully qualified domain name you’ve registered with a DNS provider (e.g., myrouter.example.com)
• IP Mode – choose between IPv4, IPv6, or dual-stack IPv4/IPv6 updates
• Service – select DynDNS (HTTP API) for third-party providers, or DDNS (RFC 2136) for direct DNS server updates
• Server – the update server address; for DynDNS, this defaults to members.dyndns.org if left blank; HTTPS URLs are supported
• Skip Certificate Verification – when checked, the router skips validation of the server’s SSL/TLS certificate. The connection is still encrypted over HTTPS – only the server identity check is bypassed. Useful for testing or self-signed certificates, but should be avoided in production.
• CA Certificate – optional; paste a PEM certificate or load from file to verify a custom HTTPS update server (DynDNS only)
• TTL – Time to Live for the DNS record; defaults to 60 seconds, adjustable between 5 and 86400 seconds (RFC 2136 only)
• TSIG Key – the shared authentication key for signing RFC 2136 update messages

The current status of the Dynamic DNS client – including the last update result and any error messages – is visible under Status → Dynamic DNS.

What happens when an update fails?

If a Dynamic DNS update cannot be delivered, the router retries automatically. Transient errors – like a temporary DNS failure or server overload – are retried after 10 minutes. Errors that suggest a configuration problem, such as an incorrect password or a non-existent hostname, cause the router to wait 24 hours before trying again, or stop retrying altogether until the configuration is corrected. This prevents unnecessary load on the DNS provider and avoids account lockouts.

When should you use which option?

The right choice depends on your infrastructure:

• If you need a quick, low-maintenance solution and are comfortable using a public DNS provider, DynDNS with HTTPS is the easiest path.
• If your organization runs its own DNS infrastructure and requires full control over DNS records without depending on third-party services, RFC 2136 is the better fit.
• If security is a priority and you’re connecting to a private update server, combine DynDNS over HTTPS with a custom CA certificate to ensure the connection is both encrypted and the server identity is verified.

Available now in ICR-OS 6.6.1

The expanded Dynamic DNS functionality is available on Advantech ICR routers running ICR-OS 6.6.1. The firmware is available for download on the Firmware page. For full configuration details, refer to the Configuration Manual.

Copy once, deploy everywhere. That's the idea behind Configuration Profiles in WebAccess/DMP - and in Video Tutorial #8, we show you exactly how to pull it off.

Whether you want to snapshot a live device, tweak an existing profile, or build one from scratch - there's a method for that. Same config, every device, no excuses.

Watch it now:

🔹 WebAccess/DMP portal
🔹 YouTube channel

Most people think of a network as something that lives in one place – a building, a factory floor, an office. But what if your devices are spread across multiple locations, and you still need them to behave as if they’re on the same local network? That’s the problem VXLAN solves. And as of ICR-OS 6.6.1, it’s now natively supported on Advantech cellular routers.

What is VXLAN, and why does it matter?

VXLAN stands for Virtual Extensible LAN. In plain terms, it’s a tunneling technology that takes Layer 2 Ethernet traffic – the kind that normally only works within a single physical network – and wraps it up so it can travel over a Layer 3 IP network, like the internet or a cellular WAN link.

Why does that distinction matter? Layer 2 connectivity means devices can discover each other automatically, share broadcasts, and run protocols that simply don’t work across routed networks. Think of things like network printers, legacy industrial controllers, or building automation systems – equipment that was designed to live on a single LAN and has no concept of routing.

With VXLAN, you can connect a machine at a remote site to your main office network as if it were plugged into the same switch – even if it’s hundreds of kilometers away, connected only via a cellular link. For engineers managing distributed infrastructure, that’s a significant capability.

How does it work under the hood?

VXLAN works by encapsulating Ethernet frames inside UDP packets. Each tunnel is identified by a VNI – a VXLAN Network Identifier – which is a 24-bit number, meaning you can run up to roughly 16 million isolated virtual networks in parallel. Compare that to traditional VLANs, which top out at 4,096 segments.

The two endpoints of a VXLAN tunnel are called VTEPs (VXLAN Tunnel Endpoints). Each router involved acts as a VTEP: it takes outgoing Ethernet frames, wraps them in a UDP packet addressed to the remote router, and sends them across the WAN. On the other end, the receiving router strips the wrapper and delivers the original Ethernet frame to the local network – as if it had never traveled anywhere.

One important note: VXLAN on its own does not encrypt traffic. If you’re deploying over a public network, it’s strongly recommended to run the VXLAN tunnel inside an encrypted VPN – IPsec or WireGuard both work well for this.

VXLAN on Advantech ICR routers

On Advantech ICR routers running ICR-OS 6.6.1, VXLAN is configured under Configuration → VXLAN. Each router supports up to four simultaneous VXLAN tunnels, which can be useful when connecting multiple remote sites independently. VXLAN is supported on all ICR models with the exception of ICR-1600, ICR-1700, and the following models: ICR-2031, ICR-2431, ICR-2531, ICR-2412, ICR-2432, ICR-2436, ICR-2437, ICR-2631, ICR-2041, ICR-2441, ICR-2501, ICR-2438, ICR-2545, ICR-2413, ICR-2452, and ICR-2452 RedCap.

The key parameters for each tunnel are:

• Local Address – the IP address of the router itself, used as the VTEP source
• Remote Address – the IP address of the remote router (VTEP peer); for secure deployments, this should be an IP within an established VPN tunnel
• VNI – the tunnel identifier (1–16777215); must match on both ends
• MTU – recommended value is 1450 bytes for a direct VXLAN connection, to account for VXLAN header overhead and avoid packet fragmentation. When running VXLAN inside a VPN tunnel (IPsec or WireGuard), additional overhead may require a lower MTU value – if you’re unsure, it’s worth consulting Advantech support for your specific setup.
• Bridged mode – when enabled, the VXLAN interface is added to the router’s local bridge, providing seamless Layer 2 connectivity; when disabled, it operates as a routed interface with its own IP address

A typical deployment connects two sites over an existing WireGuard or IPsec VPN. Both routers are configured with matching VNI values and each other’s VPN IP as the remote address. With Bridged mode enabled, devices at both sites end up on the same Layer 2 segment – broadcasts pass through, local discovery works, and legacy protocols that don’t route well behave as expected.

Connecting more than two sites

Connecting two routers with a single VXLAN tunnel is straightforward. But what if you need to bring three or more sites onto the same Layer 2 network?

The current implementation does not support multicast, which means there is no automatic way to broadcast traffic to multiple peers at once. Instead, each pair of routers must be connected with its own dedicated VXLAN tunnel – and each tunnel must use a unique VNI. A router cannot have two VXLAN tunnels sharing the same VNI.

In practice, this means a full mesh topology. If you want to connect three sites – A, B, and C – you need three tunnels: A↔B, A↔C, and B↔C, each with a different VNI. With four sites, that’s six tunnels; with five sites, ten. Since each router supports up to four simultaneous VXLAN tunnels, this limits full-mesh deployments to a maximum of five sites before additional tunnels would be needed beyond that cap.

For smaller deployments – two or three sites – this is entirely manageable and works well in practice.

Resilience: what happens when the WAN link switches?

Unlike connection-oriented tunnels that need to be actively established, a VXLAN tunnel doesn’t have a handshake or session state to maintain. It simply exists as a network interface on the router. This means that if the primary WAN link fails and the router switches to a backup cellular connection, the VXLAN tunnel continues to function on the new link without any intervention – as long as the remote address is still reachable. For deployments that rely on cellular failover, this is a meaningful advantage.

A note on security configuration

Creating a VXLAN tunnel does not automatically configure any firewall rules or routing entries. The router leaves both entirely up to the administrator. This gives you full control, but it also means that securing the tunnel – restricting which traffic can flow through it and from where – is your responsibility. At a minimum, it’s recommended to whitelist the VXLAN UDP port (default 4789) to allow traffic only from the known peer IP address, and to ensure VXLAN traffic is carried inside an encrypted VPN rather than exposed directly to the internet.

When should you use it?

VXLAN is a good fit when you need to:

• Connect remote sites to a shared Layer 2 segment without replacing existing equipment
• Support legacy industrial or building automation devices that rely on Layer 2 broadcasts
• Extend a data center network across geographically distributed nodes
• Run multiple isolated virtual networks over the same physical WAN infrastructure

It’s worth noting that VXLAN is not a replacement for a standard VPN. A VPN secures your traffic; VXLAN extends your network topology. In practice, the two work best together – VPN for encryption and authentication, VXLAN for the Layer 2 overlay on top.

Available now in ICR-OS 6.6.1

VXLAN support is available on Advantech ICR routers running ICR-OS 6.6.1. The firmware is available for download on the Firmware page.
For full configuration details, refer to the Configuration Manual.

Advantech recently showcased products at Eurosatory in Paris, one of the world's leading exhibitions for the defense and security sector. Among the highlights on the booth was a space model of our upcoming ICR-4800 - a 5G cellular router purpose-built for rail and other mission-critical applications.

Engineered for Demanding Environments

The ICR-4800 is designed to meet the EN 50155 standard for railway rolling stock electronics, ensuring reliable operation under the vibration, temperature extremes, and power fluctuations typical of railway environments. With an IP67-rated enclosure, the router is built to withstand dust, moisture, and harsh outdoor conditions without compromising performance.

Flexible 5G Connectivity

A key feature of the ICR-4800 is its support for single or dual 5G cellular radios, enabling flexible deployment options - from straightforward single-carrier connectivity to dual-radio configurations for applications requiring redundancy or higher throughput. This makes the router well suited not only for railway use cases, but also for broader Defence & Security and critical infrastructure applications where dependable connectivity is non-negotiable.

What's Next

The ICR-4800 is currently in the engineering sample phase. We look forward to sharing more details as the product moves closer to release, and to presenting it to customers exploring next-generation connectivity solutions for rail and defense applications.

Stay tuned for updates as the ICR-4800 makes its way to market.

Following the introduction of our RSS feed, we're adding another way to keep track of the latest updates from us. You can now subscribe to our newsletter and receive newly published articles from our News section directly in your inbox.

Whether it's:
✔ Product launches and updates
✔ New firmware releases
✔ Technical tutorials and how-to guides
✔ Case studies and use cases
✔ Company announcements

You'll be notified as soon as new content becomes available.

Simple, convenient, and always up to date.

👉 Subscribe today via the blue icon on our website and never miss an important update!

Accurate time is easy to overlook – until something breaks. For industrial cellular routers deployed in remote sites or critical infrastructure, a synchronized clock is a hard dependency: without it, TLS handshakes fail, VPN tunnels reject authentication due to timestamp skew, syslog data becomes useless for forensic analysis, and time desynchronization across devices can corrupt SCADA/IIoT data integrity.

Time synchronization sources

So where does a router actually get its time from? The answer depends on the hardware - most basic models may support NTP only, while cellular routers add NITZ synchronization, and models with a GNSS module can use satellite time as well.

NTP (Network Time Protocol) is the most accurate option, typically within several milliseconds. It uses a hierarchical stratum model and queries upstream servers over UDP port 123. The main limitation: if the WAN link is down, the router falls back to its local oscillator, which drifts.

Cellular network time (NITZ) is broadcast by LTE/5G base stations with typical accuracy of up to several seconds. Less precise than NTP, but available whenever a cellular connection exists – independent of WAN reachability.

GNSS-based synchronization uses satellite signals to determine time on-site without any network connectivity. Typical accuracy is around one second – sufficient for general clock correction, but not recommended for high-precision requirements.

Configuration on Advantech ICR routers

On Advantech ICR routers, all three sources are configured under Configuration → Services → NTP. The full set of options is available on the ICR-4233, which integrates both an LTE modem and a GNSS receiver.

When Synchronize clock with remote NTP server is enabled, the router queries up to three configured servers – anywhere on the network, not necessarily on the internet. Synchronize clock with cellular network uses NITZ as a fallback when no NTP server is reachable. On equipped models, Synchronize clock with GNSS adds satellite time as an additional source. Enable local NTP server turns the router into a time source for the local network – routers can be chained, though each hop adds a stratum level and reduces precision. For full configuration details, refer to the Configuration Manual.

How are multiple sources prioritized?

When more than one synchronization source is enabled, the router does not simply follow a fixed priority order. Instead, it evaluates source quality continuously using the stratum system: GNSS time is treated as stratum 10, cellular network time (NITZ) as stratum 11, and any remote NTP server carries its own stratum inherited from upstream. Lower stratum generally means higher quality – but stability matters too. An intermittent GNSS signal at stratum 10 may be considered less reliable than a consistent NITZ source at stratum 11. The router's internal algorithms weigh both stratum and signal regularity when selecting the active time source.

Most router models also include a battery-backed real-time clock, which preserves the last known time across restarts. After a reboot, the router immediately serves the stored time to local clients and updates it once synchronization with an external source is re-established.

Recommended deployment approach

Use remote NTP as the primary time source, with NITZ as a fallback during WAN unavailability. GNSS is an option where internet connectivity is unavailable altogether, but for high-precision requirements a reachable NTP server is always preferred. Monitoring NTP peer reachability, stratum, and offset should be part of standard device health checks.

Since then, the world has changed dramatically - technology, markets, and the way we work. But some things don't change: the drive to keep improving, the relationships we've built, and the belief that the best chapter is still ahead.

We celebrate 43 years of Advantech. A good moment to look back - and an even better one to look forward.

To our colleagues, clients, and partners - thank you for being part of this journey. We're just getting started. 🚀

Nobody wants to be the last to know when something goes wrong. Especially with their routers. That's why we created Video Tutorial #7 – and this time it's all about setting up alerts in WebAccess/DMP.

Learn how to stay on top of what matters – connection drops, power supply issues, signal loss, or any custom event you care about.

Watch it now:

🔹 WebAccess/DMP portal
🔹 YouTube channel

We are pleased to announce the release of version 7.0.23 of the Zabbix Agent Router App. This update brings our router monitoring solution up to date with the latest upstream release from Zabbix.

What does it do?
Zabbix is a mature, open-source monitoring solution that proactively tracks the health, performance, and availability of your network devices. With this Router App, Zabbix Agent runs directly on your routers, collecting key metrics such as CPU load, memory usage, interface traffic, and system uptime. It solves the common problem of “blind spots” in network infrastructure – instead of waiting for a failure to be reported, you get real-time visibility, early warnings about potential issues, and historical data for capacity planning. In short, it helps you keep your network reliable, understand its behavior, and troubleshoot problems before they impact your users.

For the full list of changes, please refer to the official Zabbix release notes:
🔗 https://www.zabbix.com/rn/rn7.0.23

Get the new version
The new version of RouterApp is available for download now.
https://icr.advantech.com/products/software/user-modules#zabbix-agent

The latest ICR-OS release is here. Version 6.6.1 brings a focused set of stability fixes and incremental enhancements to Advantech cellular routers. As with all new releases, routers leaving our production line will come pre-installed with this firmware.

What Changed?

1. VXLAN Tunnel Support Introduced: Create isolated Layer 2 networks that span multiple sites using VXLAN tunnels. This enables seamless connectivity between geographically distributed offices or data centers, allowing devices on separate physical networks to communicate as if they were on the same local network.

2. Dynamic DNS Functionality Extended: Added support for RFC 2136 DDNS and HTTPS transport to the Dynamic DNS. RFC 2136 enables secure, standards-compliant DNS record updates directly from the device, while HTTPS transport ensures these updates are encrypted in transit.

3. LLDP Service Implemented: Automatically discover neighboring network devices with the new Link-Layer Discovery Protocol service. LLDP makes it easier to map and document your network topology, speeds up troubleshooting by identifying connected devices and their capabilities, and improves interoperability with switches, routers, and other infrastructure from any vendor.

4. Web Administration User Experience Improved: Moved Factory Reset to its own page, widened firewall address fields for full IPv4/IPv6 display, added WAN IP and IPv6 addresses for backup routes and moved the Connections list link to the main menu.

5. IPsec Tunnel Configuration and Stability Updated: Modified Key Lifetime to strictly control rekeying and IKE Lifetime to strictly control reauthentication, and resolved a stability issue with IPsec tunnels using multiple subnets when Separate Child SA for Each Subnet is enabled.

6. GNSS SNMP Reporting: Fixed an issue with GNSS data not reporting correctly via SNMP.

7. MBIM on ICR-4261: Fixed MBIM communication failure with the RM520N-GL module.

More Details?

For a full breakdown of the advancements and changes in this release, we encourage you to review the official Release Notes.

Ready to update?

The firmware is available on the Firmware page, or can be downloaded directly to the router from Advantech's public server.

Managing site security across large, remote areas is tough — especially when real-time video streaming is critical for incident response and theft prevention.

With the ICR-1745 5G NR Gateway and WebAccess/DMP, construction sites can transmit HD or 4K video from multiple IP cameras reliably and securely. Low latency, high uplink speeds, VPN support, and automatic recovery ensure uninterrupted monitoring — even in harsh environments.

🔒 Secure communication
📡 Stable real-time video transmission
☁️ Centralized device management via WebAccess/DMP

👉 Learn more: https://www.advantech.com/en/resources/case-study/high-quality-ip-surveillance

#5G #IPSecurity #Surveillance #IndustrialIoT #RemoteMonitoring #EdgeConnectivity #ICR1745 #Advantech #WebAccessDMP #ConstructionTech

Like everybody, you probably wondered how to display Router Position on the map in WebAccess/DMP and we are happy to announce that you can watch a video explaining this functionality right now!

Learn how to easily display your router's position on the map using WebAccess/DMP — our central device management platform.

You can watch it on:

🔹 WebAccess/DMP portal
🔹 YouTube channel

We launched the ICR-1745 a few weeks back - and we wanted to remind you a video we created to show you what this 5G NR industrial gateway is all about.

What you'll see in the video:
•Hardware overview
•Software side – ICR-OS, WebAccess/DMP
•Typical applications and use cases

Check out the original launch announcement here:
🔗 https://icr.advantech.com/blog/detail/icr-1745-5g-nr-industrial-connectivity-gateway

And watch the full video introduction here:
🎥 https://icr.advantech.com/icr-1700-video

See what the ICR-1745 can do! 

Legacy serial networks can’t keep up with modern grid demands. That’s why we powered a European energy distributor’s rollout with ICR-2431 routers and WebAccess/DMP.

🛡️ Secure IPsec tunnels, certificate management, private APNs
🔄 Built-in conversion from IEC 60870-5-101 to 104
📡 Centralized deployment, remote diagnostics and REST API with WebAccess/DMP

👉 Read the full case study and see how the network went from brittle to future-ready: Connectivity for Energy Distribution

We're excited to share a video overview of WebAccess/DMP 3.4.0 a release focused on making device management at scale even easier, more secure, and more operationally transparent.

This update brings Role-Based Access Control (RBAC) for more granular permissions, Service Accounts as dedicated API-only users for cleaner automation, and command history in the UI to simplify troubleshooting. We've also made it possible to move devices between companies without losing configuration history, introduced Company Contacts to separate notification recipients from user accounts, and added several quality-of-life improvements to streamline daily workflows.

It's a step forward in control, clarity, and operational maturity.

👇 Watch the video to see what's new 

on  WebAccess/DMP Microsite or on Youtube

In this webinar, you’ll learn how secure and robust industrial 5G connectivity can help your business unlock data value and improve operations.

In today’s increasingly connected world, remote industrial islands are being brought together. Once air-gapped, these environments are now pooling and concentrating valuable operational data to drive greater efficiency and deeper insight. Secure connectivity sits at the very core of this transformation.

We’ll cover:

You can also find the previous on-demand and register to upcoming webinar in 2026 by following this link: https://us02web.zoom.us/webinar/register/2017719262446/WN_CeD64McNQOC7i_kLtqGcGg#/registration

ICR-1745 introduces reliable 5G NR connectivity for real-time, mission-critical industrial deployments.

Designed to connect IP devices and legacy serial buses directly to 5G networks, the ICR-1745 delivers ultra-low latency, high reliability, and long-term flexibility for modern industrial M2M and IoT use cases.

Key highlights:
✅ 5G NR for low-latency, real-time communication
✅ 5× Gigabit Ethernet + DI/DO + RS232 & RS485
✅ Secure VPN tunneling with multiple protocols
✅ Built-in diagnostics, watchdog, and auto-recovery
✅ Open Linux platform (ICR-OS) for custom apps in C/C++ or scripts
✅ WebAccess/DMP for secure cloud-based provisioning and fleet management

A compact, cost-effective gateway engineered for scalable industrial deployments - from environmental monitoring to smart vending and surveillance.

See the ICR-1700 Introduction video

Not everyone wants another newsletter in their inbox or another notification on their phone. If you prefer a cleaner, more controlled way to follow updates, RSS is still one of the most efficient tools available.

That’s why we’ve created a dedicated guide explaining how to subscribe to our updates via RSS and what options you have across different platforms and tools.

On the new page, you’ll find:

• A clear explanation of what RSS is (and why it’s still relevant)
• Direct access to our RSS feed
• Practical tips on how to use RSS readers across devices
• Guidance for integrating RSS into tools like Microsoft Teams or other workflow platforms

If you want updates on your terms — without algorithms, without noise — RSS is the way to go.

👉 Explore the full guide here

The APN^[1] helps the mobile network decide which slice to use. The SIM card specifies which slices a device is allowed to use, and the user selects an APN. When the device connects to the mobile network, the network determines which permitted slices are available at the current location and routes the traffic through a PDU session associated with the selected slice.

Multiple approaches can be used depending on customer needs. However, at the moment, Advantech routers can connect via one APN at a time (Single Slice option).

Single Slice

A single APN can be used on our 5G routers now, with the mobile network assigning the traffic to a specific slice. Each device can be configured to use a different slice. But just one slice at a time.

Version 3.4.0 focuses on making WebAccess/DMP easier to manage at scale, with stronger access control, better operational transparency, and cleaner workflows for both people and automation. Developed by Advantech, this release continues to move the platform toward more robust operation.

A major step forward is the introduction of Role-Based Access Control (RBAC), which simplifies how permissions are managed while also enabling more granular access rules where needed. This helps reduce over-privileged accounts and makes responsibility boundaries clearer across teams and companies.

Operational visibility has also improved with command history directly in the UI, making it easier to track what was scheduled on devices, what succeeded, and why something failed when synchronization doesn’t go as planned. This extends much-needed transparency to day-to-day device management and troubleshooting.

For automation and integrations, Service Accounts are now a dedicated, API-only user type, providing a cleaner and more secure separation between human users and scripts. This establishes a clearer long-term model for integrations and automated workflows and prepares the ground for tightening script access in future releases.

Managing larger or changing organizations is now even easier thanks to the ability to move devices between companies while preserving their monitoring history and desired configuration. At the same time, Company Contacts introduce a more flexible way to handle notifications by separating security, billing, and operations recipients from user accounts instead of tying everything to admin users.

Finally, several quality-of-life improvements - such as clearer indicators for unsupported or outdated application versions and smoother navigation in paginated tables - round out a release focused on control, clarity, and operational maturity.

We’ve just published our 6th training video, titled “Display Router Position on Map”

With this release, there are now 6 training videos available, covering the basics of working with the system. The first five focus on core topics, and this latest one expands the series with a practical, real-world use case.

Think of these first 6 videos as a foundation - whether you’re new to WebAccess/DMP or just need a quick refresher.

After a short pause in production, we’re getting back to creating new training content. New videos are already in production and will be added step by step, so you can look forward to more practical guides and examples.

You can find the existing training videos here:

🔹 WebAccess/DMP portal
🔹 YouTube channel
 

Are you looking to seamlessly connect your industrial devices, PLCs, and machines to SCADA, MES, cloud platforms, or databases -even in remote or challenging environments?

Introducing ICR-3241-EL, designed specifically for the North American market. This proven combination automates data transmission, bridges multiple industrial protocols, and ensures secure, reliable communication across your operation - wherever you deploy it.

Key Features:

Multi-Protocol Conversion:
Effortlessly convert and bridge protocols such as OPC UA, Modbus, BACnet, IEC-61850, CANbus, and more, enabling interoperability between diverse industrial devices and systems.

Cellular Connectivity & Data Acquisition:
The ICR-3241-EL delivers LTE Cat.4 performance (up to 150 Mbps down / 50 Mbps up), and a rugged industrial design. It supports over 200 PLC and I/O drivers, standard protocol drivers, and custom user-defined tags—ensuring reliable, always-on connectivity in demanding environments across North America.

Cloud & Database Integration:
Connect edge devices directly to leading cloud platforms such as Azure, AWS, Cumulocity IoT, and MindSphere, as well as to databases, enabling real-time analytics and monitoring without additional gateways.

Data Logging & Processing:
Import tags, log time-stamped data, and trigger alarms for abnormal conditions via SMS or email—without manual scripting or configuration overhead.

Security First:
Protect your data with whitelisting, SSL encryption, authenticated data handling, and OpenVPN support—maintaining secure communication even over public cellular networks.

OpenAPI Support:
Enable programmatic access and straightforward integration with your existing software applications and workflows.

Why EdgeLink with ICR-3241-EL?

Simplifies industrial automation and IIoT deployments at the edge, including remote and hard-to-reach locations

Improves interoperability and scalability through broad protocol support and reliable cellular connectivity

Reduces integration complexity and total cost by combining protocol conversion, edge data processing, and secure networking in a single device

🔗 Ready to unlock the full potential of your industrial network?

Discover how EdgeLink with ICR-3241-EL helps streamline data flow and accelerate IIoT deployments across North America.

#IIoT #EdgeComputing #ProtocolConversion #IndustrialRouter #EdgeLink #ICR3241 #NAM #SmartFactory #Advantech

We have updated our NIS2 Compliance Statement to reflect our current regulatory and security status under the EU NIS2 Directive.

Our organization falls under NIS2 in the lower obligations regime, classified within the manufacturing sector (CZ-NACE 26). We are registered as a regulated entity in the NÚKIB Portal, as required by Czech NIS2 implementation.

Cybersecurity governance is explicitly assigned to executive management, in line with NIS2 accountability requirements.

We are certified according to ISO/IEC 27001, and our Information Security Management System already fulfills applicable NIS2 requirements. NIS2 compliance is therefore part of our operational security framework, not a future commitment.

The updated NIS2 Compliance Statement reflects this status.

⛽ Secure Connectivity for Gas Distribution
Maintaining reliable communication across gas distribution stations is critical - and failures can be costly.

With ICR‑2834 LTE routers and WebAccess/DMP, gas utility operators get secure, redundant connections to PLCs and dataloggers, supporting Modbus RTU/TCP. Fully cross-linked topology ensures continuous operation, while centralized management makes monitoring and updates easy.

💡 Protect infrastructure, reduce downtime, and scale your network efficiently.

👉 Learn more: https://icr.advantech.com/solutions/secure-connectivity-for-gas-distribution-stations

#IndustrialIoT #GasDistribution #SecureConnectivity #LTE #ICR2834 #WebAccessDMP #SCADA #RedundantNetwork #Advantech

Detailed Changelog

For a full breakdown of the advancements and changes in this release, we encourage you to review the official Release Notes.

Major Enhancements

1. ETH0 Configuration Expanded: Extended configuration options for the switched ETH0 port on ICR-25xx/26xx and ICR-44xx. Switched routers now support per-port enable control, individual Media Type selection, and VLAN Filtering for restricting traffic to specific VLANs.

2. Quick Setup Workflow Introduced: A Quick Setup page is now shown after first login to guide users through initial configuration.

3. Main Menu Consolidated: Various main menu items have been consolidated. Most notably the Peripheral Ports configuration, central System settings, and Manage SIM commands have been moved inder a single menu item.

4. Router App Features Integrated: Functionality from several Router Apps has been integrated into the firmware:

• GPS: Geolocation and GNSS are now built into the firmware, including SNMP reporting and a new GNSS Configuration page.
• Event Notificator: A new Events Configuration page centralizes event-driven actions.
• Daily Reboot: Reboot Schedule feature has been added.
• IO Control and USR LED Management: Digital input events can trigger SMS actions, with variable support and an Inputs/Outputs Configuration page.
• PLMN Whitelist: Mobile WAN Operator selection now directly supports PLMN whitelisting.

5. WiFi Country Selection Structure Changed: WiFi Country selection is now managed on a dedicated page with a single setting for all WiFi APs and STAs. After changing the country, users should review HW Mode, Bandwidth, and Channel, as some options may be disabled. During upgrade, differing AP and STA country settings are unified, which may require reconfiguring radio parameters. Users should re-apply their WiFi AP settings and verify that WiFi STAs can still connect.

6. Default Forwarding Rule Revised: Added Input Interface and Output Interface selection to Firewall Configuration. The default forwarding rule in Firewall Configuration has then been revised to match all traffic with Input Interface in LAN.

7. IPsec Subnet Capacity Increased: Several configuration menus were consolidated and refined, including an expanded IPsec Tunnel Configuration that now supports up to 10 subnets with unused entries hidden automatically.

8. Legacy Configuration Restore Removed: Support for restoring configuration files from firmware versions older than 6.2.0 has been removed.

Important Note

This firmware version is not intended for mass deployment. Given the significant changes introduced in this release, extensive testing is strongly recommended prior to deploying it in a production environment.

Availability

The new firmware can be downloaded directly to the router from Advantech's public server, or manually from the Firmware page.

🔧 Remote Maintenance Made Simple

Managing industrial air compressors across Europe and North America can be costly and slow — until you enable secure remote access.

With ICR‑4271 LTE routers and WebAccess/DMP, technicians can monitor performance, perform diagnostics, and apply predictive maintenance without visiting sites. Zero Touch Deployment ensures quick setup, while secure VPN connections protect your infrastructure.

💡 Reduce downtime, cut costs, and streamline maintenance — globally.

👉 Learn more: https://icr.advantech.com/solutions/remote-access-for-maintenance-of-industrial-compressors

#IndustrialIoT #RemoteMaintenance #EdgeComputing #LTE #VPN #PredictiveMaintenance #Advantech #WebAccessDMP #ICR4271