Network Infrastructure
Satellite POP infrastructure without unnecessary complexity.
Mobilware delivers purpose-built Points of Presence for satellite data services. Our architecture combines resilient routing, firewall protection, redundant authentication infrastructure, IP address management and operational visibility in one manageable environment.
Inmarsat POP
Terminate Inmarsat I4 and GX traffic in your own POP, with RADIUS authentication, IP management and firewall policy under your control.
Iridium POP
Route Iridium data sessions through dedicated infrastructure for consistent authentication, addressing and monitoring.
Starlink POP
Bring Starlink traffic into a managed POP to apply your own routing, security and value-added services.
OneWeb POP
Connect OneWeb LEO services to the same POP environment, so every network is operated through one consistent setup.
Security at the core
Juniper SRX firewalls in a high-availability architecture.
Every Mobilware POP is built around Juniper SRX services gateways, deployed as a redundant pair. The firewalls handle routing, security policy and VPN for all subscriber traffic, so a single hardware or link failure never takes the POP offline.
- Two SRX firewalls in an active/passive chassis cluster
- Stateful failover: sessions survive a node or link failure
- Zone-based security policies, NAT and IPsec VPN
- Redundant uplinks to the satellite gateway and the Internet
Operations
Live network visibility from the POP Monitor
Fifteen views from the POP Monitor, from network overview to RADIUS sessions and logs. Select a view, then click the screenshot to see it at full resolution.
Network
Network overview
The whole POP on one screen: Inmarsat ingress, the redundant SRX cluster, VPN tunnels, multi-homed BGP uplinks and customer VPNs, with live health and throughput.
Screen 1 of 15
Capabilities
Technical capabilities
Traffic routing
Satellite network traffic termination and onward routing to the public internet or customer networks.
Redundant security
Paired firewalls and configurable traffic policies, VPN services and network segmentation.
IMSI-based RADIUS authentication
Subscriber identity-based authentication and authorized IP assignment, similar in principle to mobile APN workflows.
IPAM
Address pools, dedicated and dynamic allocations, customer mapping, utilization and change history.
RADIUS resiliency
Independent primary and secondary RADIUS servers, with configuration coordination via POP Manager where deployed.
POP Manager
Centralized configuration, network status, terminal and customer mapping, operational control and reporting.
Monitoring
Firewall health, RADIUS status, VPN health, uplinks, BGP state, bandwidth, sessions and security-policy events.
Value-added services
Web/content acceleration, filtering, VPNs, custom routing and customer-specific services, subject to design.
Integration with Unity
Provisioning, account data and usage/billing workflows where configured.
In detail
How a Mobilware POP is built
Authentication, security, hosting, peering, redundancy and provisioning — the six building blocks behind every Inmarsat and 4G Point of Presence we deliver.
RADIUS functionality
Inmarsat I4 and 4G services require authentication:
- The Inmarsat or 4G operator requests authentication
- A standard 3GPP RADIUS request is sent
- The RADIUS server authenticates based on IMSI
- IP addresses are assigned to terminals
- A single terminal can receive multiple IP addresses
Firewall functionality
Connecting satellite terminals to the Internet requires firewalls and routing:
- Advanced Juniper SRX firewalls deliver security and routing
- Firewalls provide operator security as well as separate security zones
- RADIUS servers in a separate zone; value-added services separated
- Terminal firewalls based on the profiles being provisioned
- Complete end-customer self-care for each individual terminal
Hosting
POP hosting is one of the larger cost items:
- POP peering needs to be where Inmarsat is located
- POP hosting is typically in Equinix locations
- A POP requires relatively little space — around ¼ rack
- Fire protection, redundant power and redundant cabling
- Hosting is not part of Mobilware's delivery
Peering
- Peering with Inmarsat MMP and peering with the Internet
- Fully redundant infrastructure — routers and firewalls
- RADIUS authentication based on IMSI
- Provisioning across firewalls, RADIUS servers and the POP
- IP management through IPAM
- Firewall profiles per terminal
Redundancy
Delivering a highly professional service requires redundancy:
- Peering fibre connections to Inmarsat replicated
- Internet BGP failover over fibre connections
- Firewalls installed with redundant Ethernet (RETH) interfaces and keepalives
- Redundant RADIUS servers — completely separated
- IP management and provisioning fully redundant
Provisioning
Adding a new terminal or assigning a static IP requires provisioning:
- POP Manager provides the link between Unity and the POP
- Provisioning of terminal firewall profiles — and firewall self-care
- RADIUS provisioning across both RADIUS servers
- Value-added service provisioning managed by POP Manager
- Advanced firewall management handled directly
POP Manager
The missing link between your satellite business and your POP.
Managing a satellite POP is normally a manual job: staff log in to each device to assign IMSIs and IP addresses and to build firewall rules. POP Manager replaces that with a fully integrated setup, where a redundant pair of POP Managers handles all provisioning across RADIUS, firewalls and value-added services.
Connected to Unity, it gives you an automated workflow from order to active terminal — automated authentication, automated firewall provisioning, and self-care that lets end customers manage the firewall policies on their own satellite terminals.
RADIUS provisioning
IMSI-to-IP provisioning replicated across both RADIUS servers. If one server does not complete, an error is returned to the business system.
- Terminal, SIM and IMSI details
- IP address profile
- Authentication username and password
- Activate, edit and delete
Firewall provisioning
Each assigned IP address is combined with a firewall profile — a predefined rule set such as all incoming closed, or standard ports open. Operators can build as many profiles as needed, and both operators and end users can edit a terminal's rules later.
Integrated IPAM
Manages private and public, static and dynamic addresses and customer-assigned ranges, preventing IP conflicts and wasted subnets. Also handles the more complex Inmarsat GX case, with up to 32 terminal ports and multiple addresses per port.
Value-added services
Automates provisioning of services in the POP's dedicated service zone — such as WAN acceleration (e.g. Riverbed SteelHead), VoIP, tracking and the integrated web-acceleration platform — so they become part of your offering.
Syslog & security logs
An integrated Graylog server gives simple access to syslog messages from RADIUS and firewalls, including firewall security logs. Logs can stay local or be forwarded to a central syslog environment.
Service orders
Every manual or automated action creates a service order that can contain multiple workflows, with the status of each order and workflow visible at any time.
Secure API & replication
Unity sends a request to POP Manager over a secure API; POP Manager performs the workflow and reports back the status. The two POP Manager nodes keep their local databases replicated.
Sample setup
Linking Unity with remote satellite POPs
POP Manager links the Unity Satellite Business Environment with remotely installed satellite POP environments. It provisions the firewalls, where terminal profiles with predefined firewall policies are managed, and the redundant RADIUS servers, so terminals are authenticated and IP addresses are assigned based on IMSI authentication.
POP Manager handles any type of remote provisioning, and gives end customers advanced self-care over their own firewall rules. In the example, an Inmarsat POP in New York is managed by POP Manager and Unity, while Unity connects to the Satellite Broker through the Broker API.
Inside POP Manager
Supports authentication, routing and security for Inmarsat BGAN, FleetBroadband, SwiftBroadband, GSPS, LINK, M2M and GX, Iridium Certus, Thuraya IP, Intelsat, Viasat VSAT and 4G/LTE — subject to deployment.
How it works
How traffic moves through the POP
- 01
Ingress
Traffic from the satellite network arrives over redundant ingress links.
- 02
Authenticate
RADIUS authenticates the subscriber identity and assigns an authorized address from IPAM.
- 03
Secure & route
Firewalls apply policy, then route traffic to the internet or a customer VPN.
- 04
Observe & bill
Health, sessions and usage are visible in the POP Monitor and can feed Unity.
Reference POP topology. Satellite networks: Ingress A, Ingress B → Security: Firewall A, Firewall B → Auth & addressing: RADIUS A, RADIUS B, IPAM → Egress: ISP A, ISP B, Customer VPN / NAT → Business: Unity
Security and operational considerations
No public console access
Operational consoles are not exposed on public networks; access is restricted to authorized operators.
Customer separation
Customer traffic, VPNs and address space are segmented by design.
Change control
Configuration changes are coordinated centrally and logged.
Typical deployment
A service provider launching its own satellite data service
A provider needs to terminate subscriber traffic, authenticate terminals by IMSI, assign static addresses to enterprise customers and connect selected customers via VPN — while feeding session data to billing. A Mobilware POP combines these functions with redundant components and one monitoring view.
FAQ
Questions we're often asked
How does IMSI-based authentication work?
When a terminal opens a data session, the network forwards an authentication request containing the subscriber identity to RADIUS. RADIUS checks the identity against authorized subscribers and returns the address and policy to apply — similar in principle to a mobile APN.
What happens if one RADIUS server fails?
POP designs use independent primary and secondary RADIUS servers so that authentication continues if one becomes unavailable. Configuration is kept consistent through POP Manager where deployed.
Can POP Manager work with existing infrastructure?
POP Manager can be applied to existing POP environments, subject to an assessment of the installed equipment and access model.
What network monitoring is available?
Firewall and RADIUS health, VPN tunnels, uplinks, BGP state, bandwidth, sessions and security-policy events, presented in the POP Monitor.
Related solutions
IPAM & RADIUS
Bring IMSI-based authentication, address allocation, RADIUS server health and subscriber mappings into one operational view.
Learn moreUnity
Unity unifies the essential processes of a satellite service business: real-time provisioning, usage collection, mediation, rating, billing, customer self-care and monitoring.
Learn moreManaged Firewalls
Deploy and remotely manage customer edge security across Starlink-connected locations.
Learn moreBuilding or modernizing a satellite service business?
Tell us what you need to connect, automate or monitor. Our team can help define a practical architecture — from a single integration to an end-to-end environment.