VSAT to dual-LTE ATM migration
How 2,500 ATM sites moved from VSAT to dual-LTE, provisioned zero-touch on day one, with more than double the bandwidth and higher uptime.
Key facts
- Sites migrated
- 2,500 ATMs, VSAT to dual-LTE
- Provisioning
- Zero-touch from day one: no engineer configuring devices on site
- Bandwidth
- More than double the previous VSAT bandwidth
- Architecture
- Direct cloud connectivity; no satellite hub in the path
- Uptime
- Higher than on VSAT
- Customer
- On request
Why banks and ATM operators are leaving VSAT
When monsoon cloud sits over a VSAT dish, your ATM can go offline. VSAT served remote ATMs well when terrestrial coverage was thin. Today 4G covers most of your ATM locations. Satellite links bring familiar problems: limited bandwidth, high latency, weather sensitivity and dish maintenance. Their hub-based design also makes direct cloud connectivity awkward. Dual-LTE with an industrial router gives each of your ATMs two independent paths, more capacity and central control.
How to move ATMs off VSAT without disrupting service
- Survey. Check signal at each of your ATMs for at least two operators. Choose the SIM pair per site.
- Pre-register. Import router serial numbers into the management platform as a CSV. Add a template and per-site variables such as APN, VLANs and IPsec peer. Each device's configuration, SIM policy and VPN are ready before it ships.
- Install and power on. The field technician mounts the router, inserts SIMs and connects the ATM. The router calls home over cellular and the platform recognises its serial number. It pulls its full configuration: zero-touch, day one.
- Cut over. Your ATM moves to the LTE path. You can keep VSAT in place until you verify the new link.
- Operate. Our 24×7 NOC in Pune monitors per-SIM signal (RSRP, RSRQ, SINR, CSQ), link health and data usage for every ATM. Country-wide field teams handle hardware swaps.
What bank ATM RFPs typically require, and how we answer
Your ATM connectivity RFP likely sets detailed technical requirements. These are typical bank requirements, not RBI regulations. RBI does not mandate dual-SIM or LTE for ATMs.
| Typical bank requirement | Nexapp approach |
|---|---|
| Industrial, managed router; no USB dongles or home routers | Instaroute industrial routers on NexappOS, centrally managed |
| SNMPv3-managed devices | SNMP v2c/v3 and TR-069 |
| Closed user group / private APN, isolated from public internet traffic | APN configuration and SIM PIN lock per SIM |
| Single or multi-SIM from different operators, multi-band 4G | Dual-SIM with arbitration by signal, latency or data usage (IR11004GD and other dual-SIM models); the dual-module IR11004GDW keeps two LTE links active at once |
| Uptime of about 99.5% for ATMs | Two operator paths per site, with link backup, switch and load balance gated on health checks |
| Latency ≤ 100 ms, jitter ≤ 10 ms, loss under 1%, signal ≥ -80 dBm | Per-SIM RSRP, RSRQ, SINR and CSQ with signal-quality alarms and worst-signal ranking; link SLA checks on the router |
| IPsec with SHA-2, DH Group 5 or higher, PFS | IPsec IKEv1/v2 with AES-GCM, SHA-2 and DH groups 14–16; hybrid post-quantum key exchange (ML-KEM, FIPS 203) on IKEv2 |
| Encrypted management over a dedicated interface | Always-on, encrypted, device-authenticated management channel (OOBDM), separate from business traffic and working without a public IP; WAN admin access off by default; post-quantum TLS 1.3 |
| DoS protection and defence against IPsec and routing attacks | Zone firewall, SPI and DoS protection with port-scan detection, ML-DSA peer authentication (FIPS 204), signed firmware and configuration |
| API integration with the bank's NMS or ticketing tool | Documented REST API, alarm webhooks and SIEM log export on SDWAN Lite 2.0; multi-tenant REST API with OpenAPI on Nexapp Controller |
| Connectivity during internet suspension or jamming | On request |
| Lightning protection for external antennas | On request |
What changes for the bank
- More bandwidth per ATM. You get more than double the VSAT bandwidth. That leaves room for video surveillance, remote software updates and new services.
- Higher uptime. Your ATMs get two cellular paths from different operators, with automatic failover, instead of one satellite link.
- Direct cloud connectivity. Your traffic reaches the switch, the data centre or cloud services without a satellite hub in between.
- Central control. You get one console for every ATM: configuration, firmware, alarms and remote troubleshooting.
Security and data residency
Your ATM traffic carries card and transaction data. Where the management and log data lives is a gating question for banks and white-label ATM operators. RBI's 2018 rule on storage of payment system data requires that data to be stored in India. You run management Nexapp-hosted in India or self-hosted in your own data centre, which helps you meet that obligation. Central logs help you meet CERT-In's 180-day in-India log retention and 6-hour incident reporting. They also support the 6-hour reporting to RBI under the July 2026 Directions. You configure log retention, and every log stream exports to your SIEM as RFC 5424 syslog.
Every ATM tunnel uses hybrid post-quantum key exchange (ML-KEM, NIST FIPS 203). Firmware and configuration are post-quantum signed. This protects against harvest-now, decrypt-later. It is also a practical first step as RBI asks payment system operators to begin preparing for quantum-safe systems.
Related guides
Frequently asked questions
How do you migrate thousands of ATMs without downtime?
We pre-register and configure your routers before shipping, so each ATM comes online zero-touch when the router is powered on.
You can keep VSAT in place until you verify the LTE path. That is how 2,500 ATM sites moved from VSAT to dual-LTE.
Is dual-LTE more reliable than VSAT?
In the 2,500-ATM migration, uptime was higher after the move.
Two operators give two independent paths, and failover is automatic.
Does RBI require dual-SIM or 4G for ATMs?
No. There is no RBI rule mandating a specific ATM connectivity technology.
Dual-SIM, private APN, SNMPv3 and uptime targets come from your own RFP.
Do you support private APN and closed user groups?
Every Instaroute router supports APN configuration and SIM PIN lock per SIM.
What happens when signal is weak?
Your router reports RSRP, RSRQ, SINR and CSQ for each SIM and raises signal-quality alarms.
It moves traffic to the better link based on signal, latency or health checks. A site survey before installation selects the strongest operator pair for each of your ATMs.
What does it cost compared with VSAT?
You can also buy the full service, including hardware, connectivity, security and 24×7 operations, on a per-site subscription under NaaS.
Where is the management platform hosted?
You choose: Nexapp-hosted in India, or self-hosted in your own data centre or private cloud.
Planning to move ATMs off VSAT? Get a migration plan for your estate.
24×7 NOC in Pune · 75,000+ devices deployed · 400+ enterprise and banking customers since 2014.