Configuring networking

On-site networking on the SC//Reliant™ platform is built on native Virtual Local Area Network (VLAN) segmentation, iptables policy enforced on each node, and a connectivity-agnostic posture that works with whatever Software-Defined WAN (SD-WAN) or transport is already in place at a site. Together these keep local transaction paths independent of the Wide Area Network (WAN) and keep the cardholder data environment small.

This article covers Local Area Network (LAN) requirements, WAN bandwidth, the segmentation model, SD-WAN integration, offline behavior, local workload performance, guest WiFi, network security controls, and the firewall reference tables that define each communication path.

LAN / on-site network requirements

The SC//Reliant platform operates over standard Ethernet LAN with VLAN-capable switches from any vendor. Required switch capabilities are 802.1Q VLAN tagging, gigabit access ports with 10G uplinks for high-density sites, STP/RSTP, port-based access control, and RADIUS authentication for wireless.

The recommended VLAN topology runs separate VLANs for PCI/POS, OT/IoT, corporate / back-office, guest, and management, with iptables policy on the SC//Reliant platform node enforcing inter-VLAN rules. The platform creates and manages these VLANs natively.

WAN bandwidth requirements

Per-site WAN requires a minimum of 5–10 Mbps to support management-plane, telemetry, and log-forwarding traffic. 10–20 Mbps is recommended to handle workload deployment, video upload, and container image pulls. Cellular failover at 4G LTE bandwidth (5–20 Mbps) is sufficient for management-plane traffic and store-and-forward queue drain.

Site-resident workloads (POS, payment, OT, line-of-business) do not require WAN connectivity for runtime operation, so these figures cover management-plane traffic rather than workload traffic. Sites with a bandwidth-heavy application mix — high-resolution video upload, frequent large container image pulls — need more than the recommended range.

Network segmentation model

Network segmentation is native to the SC//Reliant platform. The platform implements VLAN-based segmentation through the Linux vlan package, with iptables enforcing firewall policy between VLANs. The standard topology supports separate VLANs for PCI/POS, OT/IoT, management, guest, and corporate / back-office. All segmentation is centrally configured through SC//Reliant Platform Manager and enforced declaratively by Puppet across the fleet, with drift automatically remediated.

Alongside these VLANs, each node's Baseboard Management Controller (BMC) is reached over a separate out-of-band management path. It carries chassis control and cluster fencing, and its IPMI traffic on port 623/UDP is unencrypted, so isolation rather than the protocol is what protects it. See The out-of-band management network.

SD-WAN and connectivity-agnostic posture

The SC//Reliant platform is connectivity-agnostic: it makes no assumptions about the SD-WAN provider, WAN transport, or topology in place at a site, and requires no changes to existing SD-WAN infrastructure. SC//Connect™ and SC//AcuVigil™ provide edge SD-WAN and Secure Access Service Edge (SASE) capability for deployments that prefer a single vendor; SC//Connect runs as an integrated workload on the SC//Reliant platform rather than as a separate physical device.

Any WAN transport is supported: MPLS, broadband, fiber, fixed wireless, and LTE / 5G cellular.

When an SD-WAN appliance is not present, the SC//Reliant platform can operate as the router itself. The on-site node handles packet routing between local networks, corporate networks, and the internet via iproute2 and Quagga, supporting BGP, OSPF, and RIP routing protocols.

Offline and cloud-edge hybrid behavior

Site-resident POS, payment processing (store-and-forward), inventory, kitchen, surveillance, and IoT operations continue running during a WAN outage. LTE / 5G cellular failover activates automatically when configured as a backup transport.

The control plane — Puppet, SC//Reliant Platform Manager, and central logging — is reachable for management and updates but is not a runtime dependency for site operations. Configuration changes queue until the control plane is reachable again.

The SC//Reliant platform can also run entirely within a cloud as a virtualized edge appliance. This deployment model is configured per environment rather than being a standard option; contact Scale Computing to discuss it.

Local workload performance

Transaction-critical workloads execute locally on the edge node, which decouples their performance from WAN and cloud conditions. Degradation of a cloud back end, or loss of the WAN entirely, does not affect them, because the critical path runs on the node. This applies to POS transaction processing, local payment store-and-forward, and real-time OT control loops.

Two platform mechanisms protect that local performance:

• Container resource quotas (cgroups) prevent any single workload from starving others under peak load.
• HA clustering provides automatic failover to the peer node on node failure.

Achievable latency for a given workload depends on the application, the hardware profile, and — for online payment authorization and other WAN-bound calls — the responsiveness of the upstream service. Contact Scale Computing to review performance expectations for a specific application mix.

Guest WiFi

The SC//Reliant platform can host a guest WiFi captive-portal and authentication service as a workload on the edge node — for example, CoovaChilli — keeping guest traffic segmented from operational and PCI networks. 802.1Q-tagged VLANs separate the wireless guest network from POS, OT, management, and other on-site network resources. Bandwidth management and rate limiting are part of the platform's network management stack, and wireless configuration is managed centrally through SC//Reliant Platform Manager.

Secure communication paths

Traffic between a site, the customer's cloud environment, and Scale Computing's management plane travels over three distinct encrypted paths. Each has its own transport, endpoints, and purpose.

1. Store to customer cloud (operational data). The edge nodes in each store connect to the customer's Virtual Private Cloud (VPC) over TLS VPN tunnels, terminating at a dedicated Scale Computing VPN server. All operational data moving from the store to the enterprise network is encrypted in transit over this path.

2. Support and maintenance (the management lane). Scale Computing hosts the management, monitoring, and logging services in its own cloud environment. A secure tunnel between the customer's VPC and the SC//Reliant Platform Manager carries software updates, remote support sessions, and configuration changes.

3. Corporate HQ to Scale Computing (administrative access). A hardware-based IPsec VPN provides a permanent link between the customer's headquarters and the Scale Computing cloud environment, for administrators accessing the management tools directly.

For definitions of the terms used above — VPC, TLS and IPsec VPN, tunnel termination — see the Glossary.

Firewall rule requirements

The tables below define each communication path the platform requires, with the party responsible for permitting it in the Owner column. The IPMI rows in the second table — 623/UDP and 443/TCP to the IPMI interface — are the out-of-band management path; for what they carry and why 623/UDP is unencrypted, see The out-of-band management network. For building and managing these rules in the product, see Firewall rules and policies in RPM.

Communication Flow

Network security

Network controls on the SC//Reliant platform combine VLAN segmentation, iptables policy, egress allow-listing, and wireless monitoring to enforce least-privilege traffic between workload classes and between sites and the management plane.

Segmentation as a security control

VLAN segmentation is the primary mechanism for isolating workload classes. Segmentation between PCI/POS, OT/IoT, corporate / back-office, guest, and management VLANs limits east-west traffic to explicitly permitted flows, which is how the cardholder data environment is kept small and PCI scope reduced.

External network connections are denied unless explicitly permitted, and permitted connections are monitored and logged. Segmentation rules are configured centrally through SC//Reliant Platform Manager and enforced declaratively by Puppet, so a policy change is a tracked change rather than a per-device edit, and drift is automatically remediated.

Egress allow-listing

Edge nodes and site workloads operate under a deny-by-default outbound policy: only approved destinations are reachable. Approved destinations typically include management-plane endpoints, payment gateways, vendor update servers, designated DNS and NTP, and explicitly approved business endpoints. Egress allow-lists are managed centrally per workload through the SC//Reliant Management Plane, so adding a new destination is a tracked change rather than a one-off iptables modification.

Wireless segmentation

The SC//Reliant platform supports SSID/VLAN segmentation between payment, back-office, staff, and guest traffic, with zone-to-zone traffic governed by iptables on the edge device, in alignment with PCI DSS 4.0.1 §1.3.1.

Wireless authentication on current-generation access points supports WPA3-Enterprise. Legacy hardware supports WPA2-Enterprise with CCMP/AES. The authentication method available at a given site therefore depends on the access point hardware installed there.

Wireless intrusion detection

Wireless monitoring is provided by the SC//Reliant Wireless Intrusion Detection System (RWIDS), a Kismet-based capability that detects unauthorized access points and wireless devices, logs to the central Security Information and Event Management (SIEM) platform, and alerts via Sensu. Rogue-AP findings are reviewed quarterly per PCI DSS 11.1.

Mobile point-of-sale (mPOS)

The SC//Reliant platform does not currently support mobile POS (mPOS) integration.

In this chapter

• Configuring IPMI / BMC management
• WAN failover behavior
• Firewall rules and policies
• The out-of-band management network
• Web/URL filtering and the Acceptable Use Policy portal
• Use case: Defining the network configuration of your edge devices

For definitions of the networking and firewall terms used in this chapter, see Glossary.