Secure edge computing through container functionality

When purchasing and commissioning your firewall for the first time, you should always perform a software update to LCOS FX 11.2. Please note that you will need the corresponding SAG license (SAG Basic or SAG Full) to use the full range of features, including support for Docker containers. A 30-day trial version of the SAG licenses is included free of charge when you purchase a new firewall, or upgrade your firewall in isolated test environments to LCOS FX 11.2 RC.

The SAG licenses (Basic or Full) are primarily intended for customers who want to flexibly enhance their firewalls with professional features and security mechanisms – without the need for additional hardware or separate servers. Typical use cases include:

1. Integrating specialized applications (professional customization)
   For customers who want to run industry-specific or business-critical applications directly on the firewall via Docker containers, rather than on separate devices or additional servers. This reduces hardware requirements, simplifies the IT infrastructure, and lowers administrative overhead.
2. Advanced security and analysis functions (extended security)
   For customers who require additional security or monitoring tools beyond the standard firewall features we offer. With SAG licenses, containers with such solutions – e.g., vulnerability scanners or log analysis tools – can be deployed. This enables LANCOM R&S®Unified Firewalls or vFirewalls to be individually extended.
3. Decentralized tasks and remote maintenance (local administration)
   For customers managing multiple distributed sites who need to perform cross-location tasks reliably without installing extra hardware at each site. SAG licenses allow containers to run directly on the local firewall, supporting decentralized process automation or local services independently of the central data center.

Running software in Docker containers directly on security devices offers significant advantages: containers operate in isolated environments with tightly scoped privileges and can be updated or extended flexibly, without affecting the core functionality of the system. All traffic – both between containers and to the outside – is consistently filtered through existing firewall rules. Optionally, a reverse proxy with SAML authentication can be placed in front: it manages access control, enforces centralized authentication (e.g., via single sign-on), and helps reduce the system’s attack surface. While running third-party software on a firewall may introduce potential security risks, these can be significantly mitigated through environment hardening, strict access controls, and regular updates – maintaining a high overall level of system security.

Secure Edge Computing is beneficial wherever security-critical data needs to be processed directly on-site — close to the data source and in real time. Workloads no longer have to be offloaded to distant data centers or central infrastructures but can instead be efficiently handled in edge environments. Customer-owned Docker containers can run directly on the firewall, regardless of the surrounding system architecture.

Typical use cases include running vulnerability scanners, isolating legacy systems, or enabling secure remote access. It also supports direct connectivity and monitoring of modern production machines at the edge — helping to detect failures more quickly and optimize production processes.

In short: Secure Edge Computing is ideal wherever data sovereignty, real-time capability, and the security of distributed systems are critical — from healthcare and critical infrastructure to Industry 4.0.