docs: updates notes from my failures of setting up 7000

HARDWARE.md

@@ -53,6 +53,56 @@ Access Group
 
 ## AWS and the Local Setup
 
+Gallagher provides ample documentation on how to configure the Controller and a remote Control Centre instance to communicate with each other. Most of the setup complication are around NAT (and security). These are some steps I took note of which putting together our setup.
+
+I have broke my notes into two parts:
+
+- Initial setup based on CC and Controller communicating over the public Internet
+- VPN based setup to secure the channel between the CC and Controller
+
+### Over the public Internet
+
+Follow the initial setup guide from your Controller 7000 Single Door documentation. The steps are as follows:
+
+- Set DIP switch `1`, `2`, `3` to ON
+- Navigate to `192.168.1.199` in your browser (depending on your local network setup you will have to vary your routing rules)
+- Choose static IP as your networking configuration
+
+These are the steps that I had to make note of on the Static IP setting while communicating over a WAN:
+
+- Server IP is the WAN IP of the AWS EC2 instance
+- Controller IP is the LAN IP of the Controller 7000 Single Door, in this instance a static IP of the AWS instance
+- My Controller has the static IP of `192.168.1.180` on the local network
+
+![Single Door 7000 Controller IP configuration](assets/wan-7000-ip.png)
+
+Local network NAT rules:
+
+- Open port `1072` from the outside world to the controller, this is what the CC will use to communicate with the controller
+- For best practices restrict this port to be open for the AWS instance IP only
+
+On the AWS EC2 instance (firewall settings):
+
+- You have allow inbound requests on port `1072` (I missed this in the documentation and assume it's described further in the CC docs)
+
+#### Configuring the Controller for WAN
+
+Upon configuring the Controller it would come online and then quickly reset itself and become unresponsive. After a bit of debugging it occurred to me that the CC was pushing the configuration it thought the Controller should have.
+
+To overcome this I had to configure the CC to push the same information as the initial configuration on the controller that got it online and communicating with the CC.
+
+Network Method should be set to `Manual`:
+
+- The IP address will be of the local network where the Controller is located and connected
+- Override the Server Address to provide the `WAN` address of the Command Centre
+
+As per the Gallagher guide override the NAT settings in this panel to provide the WAN address of the network the Controller is located in.
+
+> [!NOTE]
+> Each time the Controller needed to be reset, it would issue a new certificate. You have to locate the controller on the Command Centre, head over to `Status and Overrides` and ask it to fetch a new certificate.
+
+![Controller configuration to work over the WAN](assets/wan-7000-cc-config.png)
+
 ## Reference videos
 
 Official video tutorials from Gallagher Security:
@@ -63,5 +113,4 @@ Official video tutorials from Gallagher Security:
 Official documentation:
 
 - [Controller 7000 Single door](https://products.security.gallagher.com/security/global/en/products/access-control-hardware/controller-7000-single-door/p/BVC400011)
-
 - [Controller 7000 Single door documents](https://media.gallagher.com/web/1a00857c7c9c8d7/single-door-controller-7000-qr-code/?viewType=grid)