Why our control plane runs on cellular, not your LAN

A network appliance that is controlled over the network it controls is a security paradox most operators have learned to live with. Managed switches, remote PDUs, KVMs, and segmentation devices all expose a management interface — and that interface, by necessity, lives on a network that someone can reach.

Even when the management plane is on its own VLAN, that VLAN is still IP. It has an address, a route, a port, and a stack. Any of those is a foothold under sufficient pressure — credentials leak, firmware has CVEs, jump hosts get compromised, segmentation rules drift. The whole class of attacks that target out-of-band management is a function of the management plane being electrically reachable from somewhere an attacker also is.

AGN1's control channel is GSM/SMS. The radio module is a separate die from the network ports it gates; it does not share a bus with the relay logic and it does not speak IP. You open a window by SMS from a whitelisted phone number, and the relay opens. The protected LAN never carries control traffic, because control traffic does not exist on that LAN.

This is not about cryptography being better over GSM — it isn't. It is about topology. The attacker who is on the protected segment has no path to the controller, because the controller is not on the segment at all. It is across an air gap that is enforced by physics, not by routing.

GSM is not free. Each device needs a SIM. Latency on SMS is in the seconds, not milliseconds. Coverage at the install site matters — and on a basement install in a thick-walled facility, it sometimes does not exist without an external antenna.

We picked this trade deliberately. A control plane that opens a relay in two seconds instead of two hundred milliseconds is fine for maintenance windows, which are scheduled in advance or opened by an operator who is already in a meeting about them. The use case is not low-latency control — it is non-shared control.

GSM control is not a backdoor for AirGapNet. The device does not phone home to us, does not stream telemetry, does not accept commands from anyone outside the operator's whitelisted phone numbers. The carrier sees that an SMS was sent and received; they do not see the content of the maintenance window plan or what is on the other side of the gated line.

If your environment forbids cellular radios on principle — some defense and high-security industrial environments do — AGN2 is the right device. It exposes the same physical-break semantics over a wired out-of-band port instead.