Dating the moment cellular became a design element
The first cellular routers entered the estate in 2012, not in a vehicle but at the fixed edge, as a way off legacy ISDN and T1 circuits at the smaller sites. The site list, the model selection and the configuration were written here into a network design document covering address space, drawings and remote site configuration.
In February 2019 the question in front of the change board was whether the Mayor’s executive office should fail over to its cellular router automatically. That is the moment a workaround becomes a design element, and it is worth dating — because the gap from 2014 to 2019 on the mobile problem was not a gap in effort. Cellular good enough to carry a mission-critical application, and an overlay able to secure it, did not exist at a price a city could buy.
Knowing the difference between a problem you are failing to solve and one the market has not solved yet is most of what keeps an architecture roadmap honest.
Ten years of somebody else’s network first
The gateway program is the answer to a decade of not having one. Fire and Rescue apparatus carried mobile data terminals over one carrier while the Sheriff’s Office ran its terminals over another carrier’s IPSEC tunnels, and both paths were owned here.
In July 2014 repeated carrier outages were escalated from this desk — they were degrading the ability to dispatch units and breaking field reporting at the same time — and later that month the team chased an addressing fault through the same carrier. In 2012 a carrier moved the Sheriff’s Office terminals without notice to the division, producing an outage nobody could account for until the carrier itself called to correct the routes. In 2015 the budget office moved Fire and Rescue’s terminals onto Fire and Rescue’s own budget rather than the division’s.
A mission-critical application delivered over somebody else’s network is an architecture you do not control and are still accountable for. The decade of escalations is what eventually justified the capital.
The program
Run as a funded, procured capital project rather than as an upgrade: $1,180,800 from federal recovery funding, with access to the funding code confirmed before work began. The sequence was a project overview and a session with installation vendors to understand the logistics they envisaged, then a fleet telematics product reviewed and split off as a separate requisition.
Every fire and rescue apparatus became a routed node on the enterprise network rather than a vehicle carrying modems. Just over three hundred of them, each running computer-aided dispatch, mobile data terminals and on-board crew Wi-Fi.
What it replaced is the reason it was worth doing. Each apparatus had accumulated several independent wireless devices, every one with its own subscription, its own failure mode and its own management path — which meant no single place to ask whether a vehicle was reachable, and no single place to fix it when it was not. One routed gateway per vehicle made the apparatus a managed node.
Each gateway held two carrier paths on separate private access point names rather than the public internet, so fleet traffic arrived as routed private traffic instead of arbitrary inbound sessions. The tunnels terminated at head-ends in two different buildings behind two different internet providers, with iBGP peering from those head-ends back into the enterprise routing domain. The loss of a carrier, a circuit, a provider or a whole site degrades capacity; it does not take dispatch away from the fleet. The requirement that shaped everything else was session persistence — a crew logged into dispatch cannot be asked to log in again because the vehicle moved between towers.
It was proved on buildings for three years before it went near an apparatus. Cellular routing entered the estate as a cheap failover answer for fixed sites: the Medical Examiner’s Office, after a carrier fiber fault stopped it releasing remains and providing evidentiary images; the elections office on the state voter registration circuit under a grant; and standby units held for disaster recovery. That evaluation record turned out to be the thing that made the fleet procurement possible. When procurement objected that a public agency cannot simply name a manufacturer, three years of hands-on gateway and antenna work became the written technical justification, and the award method was changed from lowest bid to evaluated bid so technical merit could be scored rather than price alone. Antenna selection was treated as apparatus-specific engineering rather than a catalog line. The fleet installation began roughly eight months after the original implementation window, which is an ordinary outcome for a public solicitation of this shape and is recorded here rather than smoothed over.
The overlay came later and answered a different question. Hardware in the vehicles had solved transport and solved nothing about policy, segmentation or steering, so a zero-trust software-defined wide area overlay — Cradlepoint NetCloud Exchange — went on top of it, with the service gateway hosted as a virtual appliance in a demilitarized zone. The perimeter side was not a rule change on an existing boundary. A dedicated Palo Alto Networks virtual system was designed for this program alone, giving the fleet its own policy domain, its own rule base and its own administrative separation from the rest of the estate. Three hundred vehicles on public carrier networks are a different trust posture from a building, and that earns a boundary rather than a set of exceptions inside somebody else’s.
The commissioning is the honest measure of what an integration like this costs. Tunnel initiation blocked at the perimeter and traced to the firewall rather than to the gateways. Tunnel instability while policy was still being built out. Path maximum transmission unit and fragmentation tuning, where encapsulation and encryption headers stack over a cellular path that has no slack to give. Per-vehicle wireless addressing on dedicated subnets, verified from connected clients rather than from the gateway’s own view. Firmware deliberately held below a release while a defect was patched. The management plane’s own path out to the vendor cloud was designed as a piece of work in its own right rather than assumed, and the program went through the architecture review board.
The overlay was scoped and priced against a mobility platform the Sheriff’s Office already ran, before either was chosen. The difference was the segmentation and traffic steering the cheaper option did not carry. Palo Alto Networks planned a white paper on the virtual system design — a manufacturer proposing to write up a customer’s own design is a reasonable outside check on whether the design was sound, and it is recorded as planned rather than as published.
Outcome
A fleet that stayed on dispatch through the loss of a carrier, a circuit, a provider or a building, under a policy domain of its own.