VPN Router MRX2
Compact VPN router
- Very compact thanks to its slim design
- Universal WAN technologies (LTE/DSL/LAN/fiber - also combined as failover)
- Extensive routing functions
- IT security at KRITIS level
- IoT-ready
- Quick start for DELTA LOGIC Connectivity Service
Slim industrial router for optimum coupling of your networks
The MRX2 series enables you to make targeted use of the latest technology, ideal for your specific application. The VPN routers in the MRX2 series offer the great advantage of a very compact and slim design. When used in the control cabinet, they only require 3 partition units. Thanks to their comprehensive routing functions, high IT security and system stability, the MRX2 routers are ideal for a wide range of industrial applications, making them the perfect routers for remote access to critical infrastructures.
The four router variants
The VPN routers in the MRX2 series are available in four different versions.
- The MRX2 LAN consists of an Ethernet module with five LAN ports, as well as a power module for the power supply and two digital inputs. The five LAN ports can be divided into up to five IP networks.
- The MRX2 LTE450 consists of an Ethernet module with five LAN ports and an LTE module with integrated power supply and two digital inputs. The five LAN ports can be divided into up to five IP networks.
- The MRX2 DSL consists of an Ethernet module with five LAN ports and a DSL module with integrated power supply and two digital inputs. The five LAN ports can be divided into up to five IP networks.
- The MRX2 Fiber consists of an Ethernet module with five LAN ports and an SFP/fiberglass module with integrated power supply and two digital inputs. The five LAN ports can be divided into up to five IP networks.
Secure remote maintenance with a VPN service
In addition to the right VPN industrial router, you also need a secure VPN connection for secure remote maintenance. The routers in the MRX2 series offer an integrated quick start for use with the convenient DELTA LOGIC Connectivity Service VPN portal. This enables the creation and management of a VPN of any complexity as well as access via direct routing to the end devices.
You don't want to set up your router for our DELTA LOGIC Connectivity Service yourself? No problem. We will be happy to pre-configure your new router for you. Simply send us the completed router configuration form with your order.
Technical highlights
- Segmentation into several local IP networks
- Multiple VPN tunnels can be used in parallel
- Firewall in the tunnel (e.g. demarcation of remote accesses)
- Flexible administration with profile manager
- Access management via user roles
- Advanced event-based control (e.g. profiles, connections, redundancy)
- High performance for broadband networks and high VPN data rate
- Made in Germany
| Mobile communication (only MRX2 LTE450) | |
|
Frequency bands |
4G/LTE: 1 (2100 MHz), 3 (1800 MHz), 5 (850 MHz), 7 (2600 MHz), 8 (900 MHz), 20 (800 MHz), 28 (700 MHz), 31 (450 MHz), 72 (450 MHz) 2G/GPRS/EDGE: 900, 1800 MHz; EDGE, GPRS |
| Antenna connection | SMA female |
| SIM | Dual SIM: 2 slots for Mini-SIM cards (2FF), locked; automatic failover; Further provider redundancy with multi-roaming SIM cards |
| Dual APN | Splitting of mobile data traffic over 2 APNs (with 2 SIM cards) , e.g. separation of user and management data |
| Cellular Status | Signal field strength, RSSI, RSCP / Ec/No, RSRP / RSRQ, Cell-ID, Location-ID |
| VDSL/ADSL (only MRX2 DSL-B) | |
| DSL standards | MRX2 DSL-B (Annex B): VDSL2 G.993.2 Profile 8a, 8b, 8c, 8d, 12a, 12b, 17a. 30a, VDSL2 Vectoring G.993.5 ADSL/ADSL2/ADSL2+ G.992.1 Annex B, G.992.3. Annex B, G.992.5 Annex B und J |
| DSL connection | RJ45 connector |
| SFP/Fiberglass (only MRX Fiber) | |
| SFP ports | 2x SFP cages for fibre optic transceiver modules according to SFP-MSA, 1000BASE-X, 100BASE-X |
| Hardware interfaces | |
| Ethernet ports | 5 x RJ45 shielded, 10/100 MBit/s, Full/half duplex, Auto MDI-X, 1.5 kV isolation voltage |
| Ethernet function | Assignment to IP network freely configurable per port, link up/down detection, configuration port |
| Inputs | 2 digital inputs (available in all basic variants), status can be monitored: 1x low active (connection to GND) 1x high active (connection to 10...24 V DC, as per EN 61131-2, type 1) |
| Displays (LEDs) | Power, WAN (Internet connection), Info (configurable), Signal (for mobile radio), DSL (for DSL) |
| Network | |
| Network functions | 5 local IP networks, IP static/DHCP,TCP, UDP, IPv4, IPv6, NTP, DHCP, DNS, HTTP/S, ARP, SSH, 802.1Q VLAN incl. tags and trunk ports |
| Service | DHCP Server v4/v6 per IP network, DHCP relay, NTP server, DNS, DynDNS, IPv6 Router Advertiser |
| Routing | Static routing, routing priority, RSTP, dynamic routing (OSPF, BGP, RIPv1, RIPv2, RIPng) |
| WAN redundancy/failover | Several WAN connections configurable also in parallel operation, fallback level for connection breakdown (failover), event-based WAN changeover (see events) |
| Connection check | Periodic, ping/icmp, DNS request, link up/down |
| DSL | PPPoA and PPPoE (MRX3/5 DSL und MRcard PD-A/B); external DSL modems: PPPoE |
| NAT/PAT | SNAT/DNAT (masquerade, netmapping, port forwarding, IP forwarding) unlimited number of rules |
| VPN | |
| DELTA LOGIC Connectivity Service | Supports VPN service for remote maintenance, remote access and M2M-communication |
| OpenVPN | Client/server, several parallel tunnels, server with up to 20 clients, tls-auth/tls-crypt, dead peer detection (DPD) RC2 40-128 Bit, IDEA 128, CAST5 128 Bit, SHA1, SHA 224-512 |
| OpenVPN encryption | Blowfish 128 Bit, DESX 192 Bit, DES 64 Bit, DES EDE 128 Bit, DES EDE3 192 Bit, AES 128-256 Bit, RC2 40-128 Bit, IDEA 128, CAST5 128 Bit, SHA1, SHA 224-512 |
| IPsec | IKEv1, IKEv2 (automatic, fix), several parallel tunnels, pre-shared keys, certificates, tunnel mode, transport mode, dead peer detection (DPD) |
| IPsec encryption | DES EDE3 192 Bit, AES 128-256 CBC/GCM, SHA1, MD5, SHA 256-512, DH-Group 1-31 (Diffie-Hellman 768 - 25519), ChaCha20-Poly1305 |
| GRE | GRE via IPsec, point-to-point, multipoint |
| PPTP | PPTP client/server; PAP/CHAP/MS CHAP/MS CHAP V2; MPPE 40-128 |
| Dynamic VPN | Dynamic multipoint VPN (GRE, IPsec, NHRP, EIGRP, OSPF, RIPv1/v2, BGP) |
| IT security | |
| Authentication | Pre-shared key, X.509 certificates, RADIUS, access rights (read, write, status) |
| Firewall/netfilter | IP filters (stateful firewall) also in VPN tunnel; packet filter: TCP, UDP, ICMP, ESP, AP, GRE; MAC filter; pre-defined firewall rules can be activated |
| Security | Booting signed firmware, HTTP/HTTPS attack prevention; response upon events: configuration change, link up/down, restart, login attempt, netfilter violation, password hashing |
| IoT and Cloud (icom Data Suite, license required) | |
| Function icom Data Suite | Machine connection and data processing; connection to cloud and SCADA Systems; arithmetic & logic functions; data logger; dashboard |
| Data acquisition | CODESYS, Modbus TCP/RTU, MQTT, Siemens S7, OPC UA Client, IEC 60870-5-101, digital input, analogue input (if present) |
| Data transmission | MQTT, OPC UA Server, IEC 60870-5-104, Modbus TCP/RTU, e-mail, SMS, SFTP, digital input, analogue input (if present) |
| IoT platforms | MQTT compatibility: Thingsboard, Cumulocity, AnyViz, Azure IoT Hub, Bosch IoT Suite, AWS IoT Core |
| Events & Actions | |
| Event & Action Handler | Notification, alarming, diagnosis, attack detection, fault handling, operation and commissioning logic |
| Events / alarms (selection) | Change: digital input, Ethernet port, WAN chain, profile status, supply input (with MRX), cellular field strength; timer expired, firewall violation, login attempt detection, pulse sequence on digital input, counter, netfilter rule |
| Event-triggered actions (selection) | Messages via e-mail, SMS (only LTE variants), SNMP traps, MCIP; switch profile, switch connection, change modem state, start timer, switch output or pulse sequence, activate firmware, reset, restart container |
| Programming environment/scripting | |
| Container environment | Installation of several application containers, container with own IP end point, assignment to IP networks - full firewall and routing transparency; access control, SDK available |
| Container Ressources | CPU: 50% of ARMv7 (720 MHz), RAM: 448 MB, Flash: 3 GB eMMC |
| Lua scripting | Lua interpreter for own scripts |
| Monitoring and Management | |
| Monitoring | SNMP traps and agent, configurable system logs, remote syslog, link up/down detection, netfilter violation |
| Certificate management | SCEP, CRL |
| icom Router Management | Supports central router management for FW updates, configuration management, connection monitoring, container updates, mass rollout, certificate management, available as public/private cloud (server) installation or onPremises |
| Administration | |
| Configuration | Web Interface HTTP(S) with session management, command line interface (CLI), Telnet, SSH, configuration profiles as ASCII and binary file, ample configuration profiles event-triggered, REST API |
| Diagnosis tools | Ping/icmp, tcpdump, traceroute, DNS lookup, AT commands, port mirroring |
| FW update | Incremental, failsafe, update server (HTTP, FTP, HTTPS, FTPS), icom Router Management (WebSocket) |
| System time | NTP client and server, buffered real time clock |
| Help | Web interface: inline help, online help; example profiles, plausibility check, Configuration Guides |
| Supply | |
| Voltage | 12 ... 24 V DC (±20 %), 2 supply connections with changeover detection, reverse-polarity protected |
| Terminals | 5-pin push-in terminal connectors (maintenance free), rigid/flexible conductors up to 2.5 sqmm |
| Power consumption (depending on data throughput amongst others) | MRX2 DSL-B: typical approx. 6,5 W, max. 8,0 W MRX2-LAN: typical approx. 2,0 W, max. 3,5 W MRX2 LTE450: typical approx. 2,5 W, max. 8,0 W |
| Ambient conditions | |
| Dimensions | 54 x 117 x 88 mm (W x D x H) |
| Weight | MRX2 LAN: 255 g MRX2 LTE450/Fiber: 270 g MRX2 DSL-B: 280 g |
| Mounting | DIN rail mounting, Horizontal pitch (HP) on DIN rail: 3 HP |
| Operating temperature | -30 .... +75 °C 2 MRX2 LAN, MRX2 LTE450 -25 .... +60 °C MRX2 DSL -30 .... +65 °C MRX2 Fiber |
| Humidity | 0 .... 95 % (non-condensing) |
| IP rating | Housing: IP40 |
| Approvals & Standards | |
| Certifications | CE, UKCA |
| EMC | Emission: EN 55032 class B, EN 61000-6-3; Immunity: EN 55024, EN 61000-6-2 |
| Safety | IEC/EN 62368 |
| Environmental conditions | Vibration/shock as per PLC standard EN 61131-2 and EN 60068-2-6, EN 60068-2-27; Temperature tests as per EN 60068-2-1, EN 60068-2-2, EN 60068-2-14, EN 60068-2-30 |
| Operating time | MTBF > 880.000 h (25 °C), according to SN 29500 standard (according to IEC 61709) |
| Data sheet MRX | ||
| Data_sheet_MRX.pdf | 3.08 MB | February 20, 2024 |
| Manual MRX | ||
| Manual_MRX.pdf | 2.90 MB | February 22, 2024 |
| Quick Installation Guide Router English | ||
| QIG_Router_en.pdf | 1.46 MB | December 12, 2023 |
| DELTA LOGIC Connectivity Service First Steps | ||
| DLCS_First_Steps.pdf | 122 KB | January 08, 2024 |
Accessory Items
