Understanding concepts for network security.

In today's interconnected world, network security is of utmost importance. It is crucial to understand key concepts like IP firewall settings, port forwarding, network address translation (NAT), and gateway address settings to safeguard systems and data. In this article, we will delve into these topics and explore how they contribute to network security as well as tips for proper IP router operation.

An IP firewall acts as a barrier between your network and external networks, monitoring and filtering incoming and outgoing traffic. By defining rules and policies, it allows or denies access to specific IP addresses or ports. Firewall settings can be customized to suit individual security requirements and provide access to desired LAN-side devices, prevent unauthorized access, and minimize potential threats.

Port forwarding is a technique that enables remote devices to traverse the firewall and access specific services or applications hosted on a private network. By configuring port forwarding settings on a router or firewall, incoming requests to a specific port are directed to a particular device within the network. This feature is commonly used for accessing webpages and applications to configure and program remote jobsite devices. It is essential to ensure that port forwarding is implemented securely, as misconfigurations can expose vulnerable services to unauthorized access.

Network address translation (NAT) is a technology that allows changing or translating IP addresses between different subnets. Usually, a WAN-side or public IP is translated to a private network to allow access to all services of LAN-side device. This provides an added layer of security by hiding internal IP addresses from external networks, making it difficult for potential attackers to target individual devices directly. The WAN-side device can communicate to a LAN device behind the firewall without any special configuration as it uses the WAN-side IP address.

The gateway address is the IP address of the device that connects a local network to an external network, typically a router. Configuring IP address settings involves defining the IP address, subnet mask, and default gateway for devices within the network. This ensures proper communication between devices within the local network and establishes a secure connection with external networks. For the LAN-side devices, the gateway address should be the IP address of the LAN port of the IP router.

Understanding IP firewall settings, port forwarding, NAT, and gateway address settings is essential for maintaining a secure network environment. If the gateway address is missing or misconfigured, it will prevent internet access for the LAN-side devices. Additionally, any port forwarding and NAT settings will not work without the proper gateway address setting. Port forwarding and NAT settings provide a means to traverse the firewall – hence the firewall needs to be enabled to use these settings. If the firewall is disabled, then the router is just connecting two subnets together and the devices on either side can access each other directly using the actual IP address provided they have the correct gateway setting at both the source and destination device. 

Contemporary Controls' Skorpion Series of IP routers provide access to these features in an easy to configure webpage format. 

@ccontrolsgmbh #Pauto #CyberSecurity

Expanded testing and troubleshooting IP networks .

The LinkIQ™ Cable+Network Tester has been upgraded to expand the tester’s ability to test and troubleshoot IP networks, and support users in 12 languages. This new software is shipping in all new LinkIQ units and is available as a free upgrade to existing customers*. 

“While systems integrators and network administrators need to verify cabling performance to ensure network performance, they also need to ensure that the user’s traffic can reach its destination,” stated Robert Luijten, Field Marketing Director, Fluke Networks.

“Our network test features give these professionals visibility into network connectivity and response time of key resources, allowing them to verify and troubleshoot end-to-end network issues.”

The new release includes:

• Expanded network testing – With version 1.1, customers can now verify connectivity and response time to key network devices with one touch of the screen. LinkIQ can now be configured to perform IPv4 or v6 ping tests and will display the response time for four pings to a target device of the user’s choosing. The test results display the DNS and DHCP servers and the gateway router. LinkIQ also displays the IP address of the nearest switch. The new version of LinkWare PC includes this information in its test reporting.
• Two-pair cable tests – Cable performance tests up to 100 Mb/s can be specified for two-pair cables, widely used in industrial environments.
• Language support – The LinkIQ user interface now supports 12 languages.
• Reporting – A new version of the LinkWare™ PC software, the industry's de facto reporting solution, is also available. This new version provides reports including the expanded network testing, allowing users to document their work.

The 1.1 software release is available in the LinkIQ Cable+Network Tester, which can be purchased from Fluke Networks resellers worldwide or on-line.

* Current owners can access and download the new firmware and LinkWare PC from the Fluke Networks website here.

@FlukeNetDCI @FlukeCorp @NapierPR #TandM

Linking devices between Rockwell Automation PLCs and serial devices.

HMS Industrial Networks has released the first product in a new family of EtherNet/IP Linking Devices. The new Serial EtherNet/IP Linking Device allows users to connect any serial device to a Rockwell ControlLogix® or CompactLogix® PLC. The main advantage of the new Linking Device is the unique integration to Rockwell’s Studio5000 Logix Designer. All configuration is made from inside Studio 5000.

The new serial EtherNet/IP Linking Device makes it possible to include any automation device with a serial RS-232/422/485 application interface in an EtherNet/IP-based network architecture. It supports all kinds of serial protocols including Modbus, DF1, produce/consume, ASCII and custom protocols.

Besides being a more cost-effective alternative to in-chassis communication modules, the distributed EtherNet/IP Linking Device also brings other advantages:

Improved system architecture
Contrary to an in-chassis module which is physically connected to the PLC, the Linking Device can be mounted close to the connected machine. This means that it is possible to establish a connection via a single Ethernet cable instead of multiple network specific cables. The Linking Devices support ODVA’s Device Level Ring (DLR) for ring topology.

Easier configuration
Users access serial protocol configuration through their existing Studio 5000 software. All configuration is made inside Studio 5000 where there is support for Process Variable Data Tags and manual and automatic generation of named and structured Studio 5000 Controller Tags without any required user logic.

High performance and stability
Since the Linking Devices are stand-alone (distributed), they do not affect PLC backplane performance (PLC execution time), even when large amount of data is transferred. The PLC simply scans the Linking Device as if it were any other I/O device on the network

Easier system integration
“After first communicating about the EtherNet/IP Linking Devices in 2015, we have seen a great interest from the market in these solutions,” says Kevin Knake, Executive Vice President, HMS Inc. “The Serial EtherNet/IP Linking Device is the first step in our Linking Devices program and we will add versions for PROFIBUS and Modbus TCP later during 2016. With the Serial Linking Device, we can offer a cost-efficient solution with a very tight integration to Studio 5000 which will give many Rockwell users easy access to serial devices such as variable frequency drives, barcode scanners, process instrumentation and weight controllers.”

@HMSAnybus #PAuto #Ethernet @ROKAutomation

Innovative features for monitoring and controlling distributed assets and IP networks.

PcVue 11.1 is the latest release of PcVue SCADA solution created by ARC Informatique. It now features the monitoring of geographically distributed assets and IP network devices. The innovative design improves operator effectiveness with powerful data analysis tools and developer productivity with advanced automation of configuration.

GEO Map Control, a built-in component for GIS decision making, provides live interactive maps from popular mapping services such as Google and Microsoft. Maps are interactive and dynamic; supporting both off-line and on-line maps access. PcVue graphical objects (Symbols) may be used as markers including animations and display of real-time asset status and alarms. No scripting or programming is required to configure the Map Control.

PcVue’s communication driver pack, CIMWay, has been expanded to support SNMP for monitoring and controlling devices on IP networks. This native capability not only allows PcVue applications to monitor the health of the network, but provides access to an ever increasing number of IED’s and other equipment with IP interfaces. Designed for optimization of large IP networks in mind, the PcVue SNMP solution capability supports the growing Internet of Industrial Things (IoIT).

Data Analysis for operator decision-making support is an increasing requirement in a modern SCADA application. PcVue 11.1 provides powerful analysis, with a few clicks operators may move from real-time to analysis mode and back. The resulting visualization may be with dashboard KPI displays or the powerful new X-Y charting control for correlation and statistical analysis.

Enhancements to BACnet® Scheduling and new SMART Generators for BACnet® and TwinCAT® - Beckhoff for automated configuration are some of the many additional new features and improvements to PcVue Solutions with PcVue 11.1.

Other additions are worth to be noted: the implement of a new license utility, a unique tool for license management, and improved client drivers for Energy management such as DNP3, our DNV Kema certified IEC 61850, IEC 60870-5-104, etc.

To preserve the SCADA investment and ensure its longevity, PcVue has been maintaining backward compatibility for 20 years. This new version is compatible with the latest technologies (Windows 8.1, Microsoft SQL Server 2014, etc.) including virtual environments.

Vector signal transceiver

Examples of IP

• Hardware power servoing for RF amplifier test
• RF channel impairments including fading, noise, multipath and Doppler effects
• Digital device under test control
• Contiguous I/Q waveform streaming to and from disk

National Instruments has announced 10 pieces of new application IP that enable engineers and scientists to use NI LabVIEW system design software to build their own custom RF instruments. This IP integrates with PXI FPGA targets such as the NI PXIe-5644R vector signal transceiver (VST) and extends their default capabilities by adding new features or enhancing performance in specific applications.

Each piece of IP is available in a stand-alone package so that users can add it to one of the default VST personalities and mix and match the relevant components for their applications. The IP is also prebuilt into examples to provide immediate access to its functionality. This eliminates the need for the user to compile the code and subsequently reduces development time. In addition to VST IP from National Instruments, NI Alliance Partners and third-party developers are creating IP and developing software add-ons for the VST.

“We use the VST to give our DOCSIS Channel Emulator multiple ‘personalities.’ This means we can test both mainstream features and unique corner cases,” said Andy Brown, Principal Technology Engineer at NI Platinum Alliance Partner Averna. “With the power, flexibility and compact sise of the VST, we can deliver easy-to-use tools that help our customers test and troubleshoot their products faster.”

2-Port EtherNet/IP Plug-in-Module

New EtherNet/IP module with integrated switch reduces infrastructure cost and eliminates the need for external switches.

HMS Industrial Networks is extending its Anybus-CC family with the addition of a 2-port EtherNet/IP communication module with integrated switch. It is the newest member of HMS´s Anybus-CC family of plug-in communication modules providing interchangeable connectivity solutions for all major fieldbus and Industrial Ethernet networks including Profibus, DeviceNet, CC-Link, CANopen, Profinet, EtherCAT and Modbus-TCP. Anybus-CC modules are used as communication interfaces of intelligent automation devices such as drives, HMIs, robots, inverters, instruments, and scales.

The new 2-port version allows EtherNet/IP real-time communication with bus or ring topologies. The module provides an easy way for any kind of automation device with an integrated Anybus-CC slot, to connect to any PLC with EtherNet/IP support and eliminates the need for expensive external switches. In addition to the EtherNet/IP protocol, the module provides a full featured TCP/UDP-IP socket interface which can be used to implement specific application protocols such as Modbus-TCP.

Another key feature of this module is the added support for the DLR (Device Level Ring) network protocol. DLR technology adds device-level network resilience to optimize machine operation. When a DLR detects a break in the ring, it provides alternate routing of the data to help recover the network. In addition, the module also includes industrial IT functions such as an embedded web server, an FTP server and an E-mail client.

The Anybus-CC module comes in housing and is about the size of a compact flash card. The core of the module is HMS´s NP30 microprocessor with its integrated fast Ethernet controller and RAM and Flash memories for the EtherNet/IP device software stack. The onboard 2-port switch provides two 100 Mbit/s full duplex Ethernet interfaces with RJ45 connectors.

All members of the Anybus-CC family are interchangeable and offer device manufacturers a simple and efficient way to connect intelligent automation devices to all major fieldbus and industrial Ethernet networks with just one development.