advertisement
EDR-G903/G902 User’s Manual
Second Edition, January 2011 www.moxa.com/product
© 2011 Moxa Inc. All rights reserved.
Reproduction without permission is prohibited.
EDR-G903/G902 User’s Manual
The software described in this manual is furnished under a license agreement and may be used only in accordance with the terms of that agreement.
Copyright Notice
Copyright ©2011 Moxa Inc.
All rights reserved.
Reproduction without permission is prohibited.
Trademarks
The MOXA logo is a registered trademark of Moxa Inc.
All other trademarks or registered marks in this manual belong to their respective manufacturers.
Disclaimer
Information in this document is subject to change without notice and does not represent a commitment on the part of
Moxa.
Moxa provides this document as is, without warranty of any kind, either expressed or implied, including, but not limited to, its particular purpose. Moxa reserves the right to make improvements and/or changes to this manual, or to the products and/or the programs described in this manual, at any time.
Information provided in this manual is intended to be accurate and reliable. However, Moxa assumes no responsibility for its use, or for any infringements on the rights of third parties that may result from its use.
This product might include unintentional technical or typographical errors. Changes are periodically made to the information herein to correct such errors, and these changes are incorporated into new editions of the publication.
Technical Support Contact Information
Moxa Americas
Toll-free: 1-888-669-2872
Tel:
Fax:
+1-714-528-6777
+1-714-528-6778
Moxa Europe
Tel: +49-89-3 70 03 99-0
Fax: +49-89-3 70 03 99-99
www.moxa.com/support
Moxa China (Shanghai office)
Toll-free: 800-820-5036
Tel:
Fax:
+86-21-5258-9955
+86-21-5258-5505
Moxa Asia-Pacific
Tel: +886-2-8919-1230
Fax: +886-2-8919-1231
Table of Contents
1.
1
Introduction
Welcome to the Moxa EtherDevice Router (EDR-G903/G902), the Gigabit Firewall/VPN secure routers designed for connecting Ethernet-enabled devices in industrial field applications.
The following topics are covered in this chapter:
Industrial Networking Capability
Designed for Industrial Applications
Useful Utility and Remote Configuration
EDR-G903/G902 Introduction
Overview
As the world’s network and information technology becomes more mature, the trend is to use Ethernet as the major communications interface in many industrial communications and automation applications. In fact, a whole new industry has sprung up to provide Ethernet products that comply with the requirements of demanding industrial applications.
The EtherDevice Router series is a Gigabit speed, all-in-one Firewall/VPN/Router for Ethernet security applications in sensitive remote control and monitoring networks. The EtherDevice Router supports one WAN, one LAN, and a user-configurable WAN/DMZ interface (EDR-G903) that provides high flexibility for different applications, such as WAN redundancy or Data/FTP server security protection.
The Quick Automation Profile function of the EtherDevice Router’s firewall supports most common Fieldbus protocols, including EtherCAT, EtherNet/IP, FOUNDATION Fieldbus, Modbus/TCP, and PROFINET. Users can easily create a secure Ethernet Fieldbus network from a user-friendly web UI with a single click. In addition, wide temperature models are available that operate reliably in hazardous, -40 to 75°C environments.
Package Checklist
The EtherDevice Router is shipped with the following items. If any of these items are missing or damaged, please contact your customer service representative for assistance.
• 1 Moxa EtherDevice Router
• RJ45 to DB9 console port cable
• Protective caps for unused ports
• DIN-Rail mounting kit (attached to the EtherDevice Router’s rear panel by default)
• Hardware Installation Guide (printed)
• CD-ROM with User’s Manual and Windows Utility
• Moxa Product Warranty statement
Features
Industrial Networking Capability
• Router/Firewall/VPN all in one
• 1 WAN, 1 LAN, and 1 user-configurable WAN or DMZ interface
• Network address translation (N-to-1, 1-to-1, and port forwarding)
Designed for Industrial Applications
• Dual WAN redundancy function
• Firewall with Quick Automation Profile for Fieldbus protocols
• Intelligent PolicyCheck and SettingCheck tools
• -40 to 75°C operating temperature (T models)
• Long-haul transmission distance of 40 km or 80 km (with optional mini-GBIC)
• Redundant, dual 12 to 48 VDC power inputs
• IP30, rugged high-strength metal case
• DIN-Rail or panel mounting ability
Useful Utility and Remote Configuration
• Configurable using a Web browser and Telnet/Serial console
• Send ping commands to identify network segment integrity
1-2
2.
2
Getting Started
This chapter explains how to access the EtherDevice Router for the first time. There are three ways to access the switch: (1) serial console, (2) Telnet console, or (3) web browser. The serial console connection method, which requires using a short serial cable to connect the EtherDevice Router to a PC’s COM port, can be used if you do not know the EtherDevice Router’s IP address. The Telnet console and web browser connection methods can be used to access the EtherDevice Router over an Ethernet LAN, or over the Internet. A web browser can be used to perform all monitoring and administration functions, but the serial console and Telnet console only provide basic functions.
The following topics are covered in this chapter:
RS-232 Console Configuration (115200, None, 8, 1, VT100)
Using Telnet to Access the EtherDevice Router’s Console
Using a Web Browser to Configure the EtherDevice Router
EDR-G903/G902 Getting Started
RS-232 Console Configuration (115200, None, 8,
1, VT100)
NOTE Connection Caution!
We strongly suggest that you do NOT use more than one connection method at the same time. Following this advice will allow you to maintain better control over the configuration of your EtherDevice Router
NOTE
We recommend using Moxa PComm Terminal Emulator, which can be downloaded free of charge from Moxa’s website.
Before running PComm Terminal Emulator, use an RJ45 to DB9-F (or RJ45 to DB25-F) cable to connect the
EtherDevice Router’s RS-232 console port to your PC’s COM port (generally COM1 or COM2, depending on how your system is set up).
After installing PComm Terminal Emulator, perform the following steps to access the RS-232 console utility.
1. From the Windows desktop, click Start Programs PCommLite1.3 Terminal Emulator.
2. Select Open in the Port Manager menu to open a new connection.
3. The Communication Parameter page of the Property window will appear. Select the appropriate COM port for Console Connection, 115200 for Baud Rate, 8 for Data Bits, None for Parity, and 1 for Stop Bits
2-2
EDR-G903/G902 Getting Started
4.
5.
6.
Click the Terminal tab, and select VT100 for Terminal Type. Click OK to continue.
Type 1 to select ansi/VT100 terminal type, and then press Enter.
The Console login screen will appear. Use the keyboard to enter the login account (admin or user), and then press Enter to jump to the Password field. Enter the console Password (this is the same as the Web Browser password; leave the Password field blank if a console password has not been set), and then press Enter.
7. Enter a question mark (?) to display the command list in the console.
The following table shows a list of commands that can be used when the EtherDevice Router is in console (serial or Telnet) mode:
Login by Admin account:
Command Parameter/Example
disable exit/quit lan list no lan ip address (A.B.C.D) netmask (A.B.C.D)
Example: lan ip address 192.168.127.10 netmask
255.255.255.0 no password admin no password user password password admin (password)
Example:
Password admin 1234 ping password user (password)
Example:
Password user 1234 ping (IP address)
Example: ping 192.168.127.10 reboot reload default-config show show lan
Description
Switch the Admin mode to User mode
Exit this consol mode connection
Set the IP address of LAN interface
Print command list
Set the admin password to null
Set the user password to null
Set the admin password
Set the user password
Send echo message
Reboot this device
Reload default configuration and Reboot this device
Show running system information
2-3
EDR-G903/G902
telnet ssh telnet (IP address)
Example: telnet 192.168.127.10 telnet (IP address) (port number)
Example: telnet 192.168.127.10 23 ssh (IP address)
Example: ssh 192.168.127.10
Login by User account:
Command Parameter/Example
exit/quit list ping show ssh telnet ping (IP address)
Example: ping 192.168.127.10 show lan ssh (IP address)
Example: ssh 192.168.127.10 telnet (IP address)
Example: telnet 192.168.127.10 telnet (IP address) (port number)
Example: telnet 192.168.127.10 23
Open a telnet connection
Open a telnet connection with port number
Open a ssh connection
Description
Exit this consol mode connection
Print command list
Ping remote device via IP
Show running system information
Open a ssh connection
Open a telnet connection
Getting Started
Open a telnet connection with port number
Using Telnet to Access the EtherDevice Router’s
Console
You may use Telnet to access the EtherDevice Router’s console utility over a network. To access the EDR’s functions over the network (by either Telnet or a web browser) from a PC host that is connected to the same
LAN as the EtherDevice Router, you need to make sure that the PC host and the EtherDevice Router are on the same logical subnet. To do this, check your PC host’s IP address and subnet mask. By default, the EtherDevice
Router’s LAN IP address is 192.168.127.254 and the EtherDevice Router’s subnet mask is 255.255.255.0 (for a Class C subnet). If you do not change these values, and your PC host’s subnet mask is 255.255.0.0, then its
IP address must have the form 192.168.xxx.xxx. On the other hand, if your PC host’s subnet mask is
255.255.255.0, then its IP address must have the form, 192.168.127.xxx.
NOTE
To use the EtherDevice Router’s management and monitoring functions from a PC host connected to the same
LAN as the EtherDevice Router, you must make sure that the PC host and the EtherDevice Router are connected to the same logical subnet.
NOTE
Before accessing the console utility via Telnet, first connect the EtherDevice Router’s RJ45 Ethernet LAN ports to your Ethernet LAN, or directly to your PC’s Ethernet card (NIC). You can use either a straight-through or cross-over Ethernet cable.
NOTE
The EtherDevice Router’s default LAN IP address is 192.168.127.254.
2-4
EDR-G903/G902 Getting Started
Perform the following steps to access the console utility via Telnet.
1. Click Start ( Run, and then telnet to the EtherDevice Router’s IP address from the Windows Run window.
(You may also issue the telnet command from the MS-DOS prompt.).
2. Refer to instructions 6 and 7 in the RS-232 Console Configuration (115200, None, 8, 1, VT100) section on page 2-3.
Using a Web Browser to Configure the
EtherDevice Router
The EtherDevice Router’s web browser interface provides a convenient way to modify the switch’s configuration and access the built-in monitoring and network administration functions. The recommended web browser is
Microsoft Internet Explorer 6.0 with JVM (Java Virtual Machine) installed.
NOTE
To use the EtherDevice Router’s management and monitoring functions from a PC host connected to the same
LAN as the EtherDevice Router, you must make sure that the PC host and the EtherDevice Router are connected to the same logical subnet.
NOTE
Before accessing the EtherDevice Router’s web browser, first connect the EtherDevice Router’s RJ45 Ethernet
LAN ports to your Ethernet LAN, or directly to your PC’s Ethernet card (NIC). You can use either a straight-through or cross-over Ethernet cable.
NOTE
The EtherDevice Router’s default LAN IP address is 192.168.127.254.
Perform the following steps to access the EtherDevice Router’s web browser interface.
1.
2.
Start Internet Explorer and type the EtherDevice Router’s LAN IP address in the Address field. Press
Enter to establish the connection.
The web login page will open. Select the login account (Admin or User) and enter the Password (this is the same as the Console password), and then click Login to continue. Leave the Password field blank if a password has not been set.
2-5
EDR-G903/G902 Getting Started
NOTE
By default, the EtherDevice Router’s password is not set (i.e., is blank).
You may need to wait a few moments for the web page to be downloaded to your computer. Use the menu tree on the left side of the window to open the function pages to access each of the router’s functions.
2-6
3.
3
Features and Functions
In this chapter, we explain how to access the EtherDevice Router’s configuration options, perform monitoring, and use administration functions. There are three ways to access these functions: (1) RS-232 console, (2)
Telnet console, and (3) web browser.
The web browser is the most user-friendly way to configure the EtherDevice Router, since you can both monitor the EtherDevice Router and use administration functions from the web browser. An RS-232 or Telnet console connection only provides basic functions. In this chapter, we use the web browser to introduce the EtherDevice
Router’s configuration and monitoring functions.
The following topics are covered in this chapter:
Static Routing and Dynamic Routing
Network Address Translation (NAT)
EDR-G903/G902 Features and Functions
The Overview page is divided into three major parts: Interface Status, Basic function status, and Recent 10
Event logs, and gives users a quick overview of the EtherDevice Router’s current settings.
Click More… at the top of the Interface Status table to see detailed information about all interfaces.
3-2
EDR-G903/G902 Features and Functions
Click More… at the top of the “Recent 10 Event Log” table to open the EventLogTable page.
Configuring Basic Settings
The Basic Settings group includes the most commonly used settings required by administrators to maintain and control the EtherDevice Router.
System Identification
The system identification section gives you an easy way to identify the different switches connected to your network.
Router name
Setting
Max. 30 Characters
Description
This option is useful for specifying the role or application of different EtherDevice Router units.
E.g., Factory Router 1.
Factory Default
Firewall/VPN router
[Serial No. of this switch]
Router Location
Setting
Max. 80 Characters
Description
To specify the location of different EtherDevice Router units.
E.g., production line 1.
Factory Default
Device Location
Router Description
Setting
Max. 30 Characters
Description
Use this field to enter a more detailed description of the
EtherDevice Router unit.
Factory Default
None
3-3
EDR-G903/G902 Features and Functions
Maintainer Contact Info
Setting
Max. 30 Characters
Description
Enter the contact information of the person responsible for maintaining this EtherDevice Router
Web Configuration
Setting
http or https https only
Description
Factory Default
None
Factory Default
Users can connect to the EtherDevice Router router via http or https protocol. http or https
Users can connect to the EtherDevice Router router via https protocol only.
Accessible IP
The EtherDevice Router uses an IP address-based filtering method to control access to EtherDevice Router units.
Accessible IP Settings allows you to add or remove “Legal” remote host IP addresses to prevent unauthorized access. Access to the EtherDevice Router is controlled by IP address. If a host’s IP address is in the accessible
IP table, then the host will have access to the EtherDevice Router. You can allow one of the following cases by setting this parameter:
• Only one host with the specified IP address can access this device.
E.g., enter “192.168.1.1/255.255.255.255” to allow access to just the IP address 192.168.1.1.
• Any host on a specific subnetwork can access this device.
E.g., enter “192.168.1.0/255.255.255.0” to allow access to all IPs on the subnet defined by this IP address/subnet mask combination.
• Any host can access the EtherDevice Router. (Disable this function by deselecting the Enable the accessible
IP list option.)
• Any LAN can access the EtherDevice Router. (Disable this function by deselecting the LAN option to not allow any IP at the LAN site to access this device.)
E.g., If the LAN IP Address is set to 192.168.127.254/255.255.255.0, then IP addresses 192.168.127.1 /24 to 192.168.127.253/24 can access the EtherDevice Router.
3-4
EDR-G903/G902 Features and Functions
The following table shows additional configuration examples:
Allowable Hosts
Ay host
192.168.1.120
192.168.1.1 to 192.168.1.254
192.168.0.1 to 192.168.255.254
192.168.1.1 to 192.168.1.126
192.168.1.129 to 192.168.1.254
Input Format
Disable
192.168.1.120 / 255.255.255.255
192.168.1.0 / 255.255.255.0
192.168.0.0 / 255.255.0.0
192.168.1.0 / 255.255.255.128
192.168.1.128 / 255.255.255.128
The Accessible IP list controls which devices can connect to the EtherDevice Router to change the configuration of the device. In the example shown below, the Accessible IP list in the EtherDevice Router contains
10.10.10.10, which is the IP address of the remote user’s PC.
The remote user’s IP address is shown below in the EtherDevice Router’s Accessible IP list.
Password
The EtherDevice Router provides two levels of access privilege: “admin privilege” gives read/write access to all
EtherDevice Router configuration parameters, and “user privilege” provides read access only. You will be able to view the configuration, but will not be able to make modifications.
3-5
EDR-G903/G902 Features and Functions
• ATTENTION!
• By default, the Password field is blank. If a Password is already set, then you will be required to type the Password when logging into the RS-232 console, Telnet console, or web browser interface.
Account
Setting
Admin
User
Password
Setting
Old password
(max. 16 Characters)
New password
(max. 16 Characters)
Retype password
(max. 16 Characters)
Description Factory Default
“admin” privilege allows the user to modify all configurations. Admin
“user” privilege only allows viewing device configurations.
Description
Type current password when changing the password
Type new password when changing the password
Factory Default
None
None
If you type a new password in the Password field, you will be required to retype the password in the Retype new password field before updating the new password.
None
Time
The Time configuration page lets users set the time, date, and other settings. An explanation of each setting is given below.
The EtherDevice Router has a time calibration function based on information from an NTP server or user specified Time and Date information. Functions such as Auto warning “Email” can add real-time information to the message.
3-6
EDR-G903/G902 Features and Functions
NOTE
The EtherDevice Router has a real time clock so the user does not need to update the Current Time and
Current Date to set the initial time for the EtherDevice Router after each reboot. This is especially useful when the network does not have an Internet connection for an NTP server, or there is no NTP server on the network.
Current Time
Setting Description
User adjustable Time The time parameter allows configuration of the local time in local 24-hour format.
Current Date
Setting Description
User adjustable date. The date parameter allows configuration of the local date in yyyy/mm/dd format
Factory Default
None (hh:mm:ss)
Factory Default
None
(yyyy/mm/dd)
Daylight Saving Time
Daylight Saving Time (also know as DST or summer time) involves advancing clocks 1 hour during the summer to provide an extra hour of daylight in the evening.
Start Date
Setting Description
User adjustable date. The Start Date parameter allows users to enter the date that daylight saving time begins.
Factory Default
None
End Date
Setting Description
User adjustable date. The End Date parameter allows users to enter the date that daylight saving time begins.
Offset
Setting Description
User adjustable date. The offset parameter indicates how many hours forward the clock should be advanced.
System Up Time
Indicates the ED-G903’s up time from the last cold start. The unit is seconds.
Time Zone
Setting
User selectable time zone
Description
The time zone setting allows conversion from GMT (Greenwich
Mean Time) to local time.
Factory Default
None
Factory Default
None
Factory Default
GMT
NOTE
Changing the time zone will automatically correct the current time. You should configure the time zone
before setting the time.
Enable NTP/SNTP Server
Enable this function to configure the EtherDevice Router as a NTP/SNTP server on the network.
Enable Server synchronize
Enable this function to configure the EtherDevice Router as a NTP/SNTP client, It will synchronize the time information with another NTP/SNTP server.
3-7
EDR-G903/G902 Features and Functions
Time Server IP/Name
Setting
1st Time Server
IP/Name
2nd Time Server
IP/Name
Description
IP or Domain address (e.g., 192.168.1.1, time.stdtime.gov.tw, or time.nist.gov).
The EtherDevice Router will try to locate the 2nd NTP Server if the 1st NTP Server fails to connect.
Factory Default
None
SettingCheck
SettingCheck is a safety function for industrial users using a secure router. It provides a double confirmation mechanism for when a remote user changes the security policies, such as Firewall filter, NAT, and
Accessible IP list. When a remote user changes these security polices, SettingCheck provides a means of blocking the connection from the remote user to the Firewall/VPN device. The only way to correct a wrong setting is to get help from the local operator, or go to the local site and connect to the device through the console port, which could take quite a bit of time and money. Enabling the SettingCheck function will execute these new policy changes temporarily until doubly confirmed by the user. If the user does not click the confirm button, the EtherDevice Router will revert to the previous setting.
Firewall Policy
Enables or Disables the SettingCheck function when the Firewall policies change.
NAT Policy
Enables or Disables the SettingCheck function when the NAT policies change.
Accessible IP List
Enables or Disables the SettingCheck function when the Accessible IP List changes.
Layer 2 Filter
Enable or disable the SettingCheck function when the Layer 2 filter changes.
Timer
Setting
10 to 3600 sec.
Description
The timer waits this amount of time to double confirm when the user changes the policies
Factory Default
180 (sec.)
For example, if the remote user (IP: 10.10.10.10) connects to the EtherDevice Router and changes the accessible IP address to 10.10.10.12, or deselects the Enable checkbox accidently after the remote user clicks the Activate button, connection to the EtherDevice Router will be lost because the IP address is not in the
EtherDevice Router’s Accessible IP list.
3-8
EDR-G903/G902 Features and Functions
If the user enables the SettingCheck function with the Accessible IP list and the confirmer Timer is set to 15 seconds, then when the user clicks the Activate button on the accessible IP list page, the EtherDevice Router will execute the configuration change and the web browser will try to jump to the SettingCheck Confirmed page automatically. Because the new IP list does not include the Remote user’s IP address, the remote user cannot connect to the SettingCheck Confirmed page. After 15 seconds, the EtherDevice Router will roll back to the original Accessible IP List setting, allowing the remote user to reconnect to the EtherDevice Router and check what’s wrong with the previous setting.
If the new configuration does not block the connection from the remote user to the EtherDevice Router, the user will see the SettingCheck Confirmed page, shown in the following figure. Click Confirm to save the configuration updates.
3-9
EDR-G903/G902 Features and Functions
System File Update—by Remote TFTP
The EtherDevice Router supports saving your configuration file to a remote TFTP server or local host to allow other EtherDevice Router routers to use the same configuration at a later time, or saving the Log file for future reference. Loading pre-saved firmware or a configuration file from the TFTP server or local host is also supported to make it easier to upgrade or configure the EtherDevice Router.
TFTP Server IP/Name
Setting
IP Address of TFTP
Server
Description Factory Default
The IP or name of the remote TFTP server. Must be configured before downloading or uploading files.
None
Configuration File Path and Name
Setting
Max. 40 Characters
Description
The path and filename of the EtherDevice Router’s configuration file in the TFTP server.
Factory Default
None
Firmware File Path and Name
Setting
Max. 40 Characters
Description Factory Default
The path and filename of the EtherDevice Router’s firmware file None
Log File Path and Name
Setting
Max. 40 Characters
Description
The path and filename of the EtherDevice Router’s log file
Factory Default
None
After setting up the desired path and filename, click Activate to save the setting. Next, click Download to download the file from the remote TFTP server, or click Upload to upload a file to the remote TFTP server.
System File Update—by Local Import/Export
Configuration File
Click Export to export the configuration file of the EtherDevice Router to the local host.
3-10
EDR-G903/G902 Features and Functions
NOTE
Log File
Click Export to export the Log file of the EtherDevice Router to the local host.
Some operating systems will open the configuration file and log file directly in the web page. In such cases, right click the Export button and then save as a file.
Upgrade Firmware
To import a firmware file into the EtherDevice Router, click Browse to select a firmware file already saved on your computer. The upgrade procedure will proceed automatically after clicking Import. This upgrade procedure will take a couple of minutes to complete, including the boot-up time.
Upload Configuration Data
To import a configuration file to the EtherDevice Router, click Browse to select a configuration file already saved on your computer. The upgrade procedure will proceed automatically after clicking Import.
Restart
This function is used to restart the EtherDevice Router router.
Reset to Factory Default
NOTE
The Reset to Factory Default option gives users a quick way of restoring the EtherDevice Router’s configuration settings to their factory default values. This function is available in the console utility (serial or
Telnet), and web browser interface.
After activating the Factory Default function, you will need to use the default network settings to re-establish a web-browser or Telnet connection with your EtherDevice Router.
3-11
EDR-G903/G902
Network Settings
Mode Configuration
Features and Functions
Network Mode
EtherDevice Router provides Router Mode and Bridge Mode operation for different applications:
Router Mode
In this mode, EtherDevice Router operates as a gateway between different networks.
• Each interface (WAN1, WAN2 and LAN) has its own IP addresses & different subnet
• It provides Routing, Firewall, VPN and NAT functions
• Default setting of EtherDevice Router
Bridge Mode
In this mode, EtherDevice Router operates as a Bridge mode firewall (or call transparent firewall) in a single subnet. Users could simply insert EtherDevice Router into the existing single subnet without the need to reconfigure the original subnet into different subnets and without the need to reconfigure the IP address of existing devices.
• EtherDevice Router only has one IP address, Network mask and Gateway.
• VPN, NAT, WAN backup, VRRP, DHCP, Dynamic DNS are not supported in this mode
User could select the appropriate operation mode and press Activate to change the mode of EtherDevice
Router. Change operation mode would take around 30-60 seconds to reboot system!!! If the webpage is no response after 30-60 seconds, please refresh webpage or press F5.
3-12
EDR-G903/G902
WAN1 Configuration
Features and Functions
Connection
Note that there are three different connection types for the WAN1 interface: Dynamic IP, Static IP, and PPPoE.
A detailed explanation of the configuration settings for each type is given below.
Connection Mode
Setting
Enable or Disable
Description
Enable or Disable the WAN interface
Factory Default
Enable
Connection Type
Setting
Static IP, Dynamic IP,
PPPoE
Description
Setup the connection type
Detailed Explanation of Dynamic IP Type
Factory Default
Dynamic IP
PPTP Dialup
Point-to-Point Tunneling Protocol is used for Virtual Private Networks (VPN). Remote users can use PPTP to connect to private networks from public networks.
PPTP Connection
Setting
Enable or Disable
Description
Enable or Disable the PPTP connection
Factory Default
None
IP Address
Setting
IP Address
Description
The PPTP service IP address
Factory Default
None
User Name
Setting
Max. 30 Characters
Password
Setting
Max. 30 characters
Description
The Login username when dialing up to PPTP service
Description
The password for dialing the PPTP service
Factory Default
None
Factory Default
None
3-13
EDR-G903/G902 Features and Functions
Example: Suppose a remote user (IP: 10.10.10.10) wants to connect to the internal server (private IP:
30.30.30.10) via the PPTP protocol. The IP address for the PPTP server is 20.20.20.1. The necessary configuration settings are shown in the following figure.
DNS (Doman Name Server; optional setting for Dynamic IP and PPPoE types)
Server 1/2/3
Setting
IP Address
Description
The DNS IP address
Factory Default
None
NOTE
The priority of a manually configured DNS will higher than the DNS from the PPPoE or DHCP server.
Detailed Explanation of Static IP Type
Address Information
IP Address
Setting
IP Address
Description
The interface IP address
Subnet Mask
Setting
IP Address
Description
The subnet mask
3-14
Factory Default
None
Factory Default
None
EDR-G903/G902
Gateway
Setting
IP Address
Description
The Gateway IP address
Detailed Explanation of PPPoE Type
Features and Functions
Factory Default
None
PPPoE Dialup
User Name
Setting
Max. 30 characters
Host Name
Setting
Max. 30 characters
Password
Setting
Max. 30 characters
Description
The User Name for logging in to the PPPoE server
Description
User-defined Host Name of this PPPoE server
Description
The login password for the PPPoE server
WAN2 Configuration (includes DMZ Enable)
Factory Default
None
Factory Default
None
Factory Default
None
Connection
Note that there are there are three different connection types for the WAN2 interface: Dynamic IP, Static IP, and PPPoE. A detailed explanation of the configuration settings for each type is given below.
Connection Mode
Setting
Enable or Disable
Backup
DMZ
Description
Enable or Disable the WAN interface.
Enable WAN Backup mode
Enable DMZ mode (can only be enabled when the connection type is set to Static IP)
Factory Default
None
3-15
EDR-G903/G902
Connection Type
Setting
Static IP, Dynamic IP,
PPPoE
Description
Configure the connection type
Detailed Explanation of Dynamic IP Type
Features and Functions
Factory Default
Dynamic IP
PPTP Dialup
Point-to-Point Tunneling Protocol is used for Virtual Private Networks (VPN). Remote users can use PPTP to connect to private networks from public networks.
PPTP Connection
Setting
Enable or Disable
Description
Enable or Disable the PPTP connection
Factory Default
None
IP Address
Setting
IP Address
User name
Setting
Max. 30 Characters
Description
The PPTP service IP address
Description
The Login username when dialing up to PPTP service
Factory Default
None
Factory Default
None
Password
Setting
Max. 30 characters
Description
The password for dialing the PPTP service
Factory Default
None
Example: Suppose a remote user (IP: 10.10.10.10) wants to connect to the internal server (private IP:
30.30.30.10) via the PPTP protocol. The IP address for the PPTP server is 20.20.20.1. The necessary configuration settings are shown in the following figure.
3-16
EDR-G903/G902 Features and Functions
DNS (Doman Name Server; optional setting for Dynamic IP and PPPoE types)
Server 1/2/3
Setting
IP Address
Description
The DNS IP Address
Factory Default
None
NOTE
The priority of a manually configured DNS will higher than the DNS from the PPPoE or DHCP server.
Detailed Explanation of Static IP Type
Address Information
IP Address
Setting
IP Address
Description
The interface IP address
3-17
Factory Default
None
EDR-G903/G902
Subnet Mask
Setting
IP Address
Description
The subnet mask
Gateway
Setting
IP Address
Description
The Gateway IP address
Detailed Explanation of PPPoE Type
Features and Functions
Factory Default
None
Factory Default
None
PPPoE Dialup
User Name
Setting
Max. 30 characters
Host Name
Setting
Max. 30 characters
Password
Setting
Max. 30 characters
Description
The User Name for logging in to the PPPoE server
Description
User-defined host name for this PPPoE server
Description
The login password for this PPPoE server
3-18
Factory Default
None
Factory Default
None
Factory Default
None
EDR-G903/G902 Features and Functions
Using DMZ Mode
A DMZ (demilitarized zone) is an isolated network for devices—such as data, FTP, web, and mail servers connected to a LAN network—that need to frequently connect with external networks. The deployment of an
FTP server in a DMZ is illustrated in the following figure.
DMZ mode is configured on the WAN2 configuration web page. Set Connect Mode to Enable, Connect Type to Static IP, and checkmark the DMZ Enable check box. You will also need to input the IP Address and Subnet
Mask. Click the Activate button to save the settings.
NOTE
WAN2 configuration and DMZ mode are only available on EDR-G903
LAN Interface
A basic application of an industrial Firewall/VPN device is to provide protection when the device is connected to a LAN. In this regard, the LAN port connects to a secure (or trusted) area of the network, whereas the WAN1 and WAN2/DMZ ports connect to an insecure (or untrusted) area.
3-19
EDR-G903/G902
LAN IP Configuration
IP Address
Setting
IP Address
Description
The LAN interface IP address
Subnet Mask
Setting
IP Address
Description
The subnet mask
Features and Functions
Factory Default
192.168.127.254
Factory Default
255.255.255.0
DHCP Server
The EtherDevice Router provides a DHCP (Dynamic Host Configuration Protocol) server function for LAN interfaces. When configured, the EtherDevice Router will automatically assign an IP address to a Ethernet device from a defined IP range.
DHCP configuration
DHCP Server Enable/Disable
Setting
Enable or Disable
Description
Enable or Disable DHCP server function
Lease Time
Setting
≥ 5 min.
Description
The lease time of the DHCP server
DNS Server IP for Client
Setting
IP Address
Description
The DHCP server’s IP address
Offered IP Range
Setting
IP address
Description
The offered IP address range for the DHCP server
NOTE
1. The DHCP server is only available for LAN interfaces.
2. The Offered IP address range must be in the same Subnet on the LAN.
3-20
Factory Default
Enable
Factory Default
60 (min.)
Factory Default
None
Factory Default
192.168.127.1 to
192.168.127.252
EDR-G903/G902 Features and Functions
Static DHCP List
Use the Static DHCP list to ensure that devices connected to the EtherDevice Router always use the same IP address. The static DHCP list matches IP addresses to MAC addresses.
In the above example, a device named “Device-01” was added to the Static DHCP list, with static IP address set to 192.168.127.101 and MAC address set to 00:09:ad:00:aa:01. When a device with MAC address of
00:09:ad:00:aa:01 is connected to the EtherDevice Router, the EtherDevice Router will offer the IP address
192.168.127.101 to this device.
Enable or Disable
Setting
Enable or Disable
Description Factory Default
Enable or Disable the selected device in the Static DHCP List Disabled
Name
Setting
Max. 30 characters
Static IP Address
Setting
IP Address
MAC Address
Setting
MAC Address
Description
The name of the selected device in the Static DHCP List
Description
The IP address of the selected device
Factory Default
None
Factory Default
None
Description
The MAC address of the selected device
Factory Default
None
Clickable Buttons
Add: Use the Add button to input a new DHCP list. The Name, Static IP, and MAC address must be different than for the existing list.
Delete: Use the Delete button to delete the Static DHCP list. Click on a list to select it (the background color of the device will change to blue) and then click the Delete button.
Modify: To modify the information for a particular list, click on a list to select it (the background color of the device will change to blue), modify the information as needed using the check boxes and text input boxes near the top of the browser window, and then click Modify.
3-21
EDR-G903/G902
DHCP Leased List
Use the DHCP Leased List to view the current DHCP clients.
Features and Functions
Dynamic DNS
Dynamic DNS (Domain Name Server) allows you to use a domain name (e.g., moxa.edr-g903) to connect to the EtherDevice Router. The EtherDevice Router can connect to 4 free DNS servers and register the user configurable Domain name in these servers.
Service
Setting
> Disable
> freedns.afraid.org
> www.3322.org
> members.dyndns.org
> dynupdate.no-ip.com
User Name
Setting
Max. 30 characters
Description
Disable or select the DNS server
Description
The DNS server’s user name
Password
Setting
Max. 30 characters
Verify Password
Setting
Max. 30 characters
Domain name
Setting
Max. 30 characters
Description
The DNS server’s password
Description
Verifies the DNS server password
Description
The DNS server’s domain name
3-22
Factory Default
Disable
Factory Default
None
Factory Default
None
Factory Default
None
Factory Default
None
EDR-G903/G902 Features and Functions
Network Redundancy
Moxa EtherDevice Router provides 2 types of network redundancy functions: WAN backup (EDR-G903 only) and VRRP. The EtherDevice Router has two WAN interfaces: WAN1 is the primary WAN interface and WAN2 is the backup interface. When the EtherDevice Router detects that connection WAN1 has failed (Link down or Ping fails), it will switch the communication path from WAN1 to WAN2 automatically. When WAN1 recovers, the major communication path will return to WAN1.
WAN Backup (EDR-G903 only)
How Dual WAN Backup Works
A power utility at a field site connects to a central office via two different ISPs (Internet Service Providers).
ISP-A uses Ethernet and ISP-B uses satellite for data transmission, with Ethernet used as the major connection and the satellite as the backup connection. This makes sense since the cost of transmitting through the satellite is greater than the cost of transmitting over the Ethernet. Traditional solutions would use two routers to connect to the different ISPs. In this case, if the connection to the primary ISP fails, the connection must be switched to the backup ISP manually.
The EtherDevice Router’s WAN backup function checks the link status and the connection integrity between the
EtherDevice Router and the ISP or central office. When the primary WAN interface fails, it will switch to the backup WAN automatically to keep the connection alive.
When configuring the EtherDevice Router, choose one of the two following conditions to activate the backup path:
• Link Check: WAN1 link down
• Ping Check: Sends ping commands to a specific IP address (e.g., the IP address of the ISP’s server) from
WAN1 based on user configurable Time Interval, Retry, and Timeout.
When the WAN backup function is enabled and the Link Check or Ping Check for the WAN1 interface fails, the backup interface (WAN2) will be enabled as the primary interface.
WAN Backup Configuration
Select Backup for the WAN2/DMZ Connect Mode, and then go to the Network Redundancy WAN Backup setting page for the WAN Backup configuration.
3-23
EDR-G903/G902 Features and Functions
Link Check
Setting
Enable or Disable
Ping Check
Setting
Enable or Disable
Description Factory Default
Activate Backup function by checking the link status of WAN1 Disabled
Description
Activates the Backup function if unable to ping from the
EtherDevice Router to a specified IP address.
Factory Default
Disabled
IP
Setting
IP address
Description
The EtherDevice Router will check the ping integrity of this IP
Address if the Ping Check function is Enabled
Factory Default
None
NOTE
The IP address for Ping Check function should be on the network segment of WAN1.
Interval
Setting
1 to 1000 sec
Description Factory Default
User can set up a different Ping Interval for a different network topology
180 sec.
Retry
Setting
1 to 100
Description
User can configure the number of retries. If the number of continuous retries exceeds this number, the EtherDevice
Router will activate the backup path.
Factory Default
3
Timeout
Setting
100 to 10000 (ms)
Description
The timeout criterion of Ping Check
Factory Default
3000 ms
3-24
EDR-G903/G902
Virtual Router Redundancy Protocol (VRRP)
Features and Functions
VRRP Settings
The Virtual Router Redundancy Protocol (VRRP) feature can solve the problem with static configuration. VRRP enables a group of routers to form a single virtual router with a virtual IP address. The LAN clients can then be configured with the virtual router’s virtual IP address as their default gateway. The virtual router is the combination of a group of routers, and is also known as a VRRP group.
Enable
Setting
Enable
Description
Enables VRRP
Factory Default
Disable
VRRP Interface Setting Entry
Setting
Enable
Virtual IP
Virtual Router ID
Priority
Preemption Mode
Track Interface
Description
Enables VRRP entry
Factory Default
Disabled
L3 switches / routers in the same VRRP group must be set to the same virtual IP address as the VRRP ID. This virtual IP address must belong to the same address range as the real IP address of the interface.
0.0.0.0
Virtual Router ID is used to assign a VRRP group. The L3 switches / routers, which operate as master / backup, should have the same ID. Moxa L3 switches / routers support one virtual router ID for each interface. IDs can range from 1 to
255.
0
Determines priority in a VRRP group. The priority value range is
1 to 255 and the 255 is the highest priority. If several L3 switches / routers have the same priority, the router with higher IP address has the higher priority. The usable range is “1 to 255”.
Determines whether a backup L3 switch / router will take the authority of master or not.
100
Enabled
The Track Interface is used to track specific interface within the router that can change the status of the virtual router for a
VRRP Group. For example, the WAN interface can be tracked and if the link is down, the other backup router will become the new master of the VRRP group.
Disable
3-25
EDR-G903/G902 Features and Functions
Static Routing and Dynamic Routing
The EtherDevice Router supports two routing methods: static routing and dynamic routing. Dynamic routing makes use of RIP V1/V1c/V2. You can either choose one routing method, or combine the two methods to establish your routing table. A routing entry includes the following items: the destination address, the next hop address (which is the next router along the path to the destination address), and a metric that represents the cost we have to pay to access a different network.
Static Route
You can define the routes yourself by specifying what is the next hop (or router) that the EtherDevice Router forwards data for a specific subnet. The settings of the Static Route will be added to the routing table and stored in the EtherDevice Router.
RIP (Routing Information Protocol)
RIP is a distance vector-based routing protocol that can be used to automatically build up a routing table in the
EtherDevice Router.
The EtherDevice Router can efficiently update and maintain the routing table, and optimize the routing by identifying the smallest metric and most matched mask prefix.
Static Routing
The Static Routing page is used to configure the EtherDevice Router’s static routing table.
Enable
Click the checkbox to enable Static Routing.
Name
The name of this Static Router list
Destination Address
You can specify the destination IP address.
Netmask
This option is used to specify the subnet mask for this IP address.
Next Hop
This option is used to specify the next router along the path to the destination.
Metric
Use this option to specify a “cost” for accessing the neighboring network.
3-26
EDR-G903/G902 Features and Functions
NOTE
Clickable Buttons
Add
For adding an entry to the Static Routing Table.
Delete
For removing selected entries from the Static Routing Table.
Modify
For modifying the content of a selected entry in the Static Routing Table.
The entries in the Static Routing Table will not be added to the EtherDevice Router’s routing table until you click the Activate button.
RIP (Routing Information Protocol)
RIP is a distance-vector routing protocol that employs the hop count as a routing metric. RIP prevents routing loops by implementing a limit on the number of hops allowed in a path from the source to a destination.
The RIP page is used to set up the RIP parameters.
RIP State
Setting
Enable/Disable
Description
Enable or Disable RIP protocol
Factory Default
Disable
Enable WAN 1 RIP
Check the checkbox to enable RIP in the WAN 1 interface.
Enable WAN 2 RIP
Check the checkbox to enable RIP in the WAN 2 interface.
Enable LAN RIP
Check the checkbox to enable RIP in the LAN interface.
RIP V1 only
Check the checkbox to enable only RIP V1 interfaces.
Redistributed Static Router
Check the checkbox to enable the Redistributed Static Route function. The entries that are set in a static route will be re-distributed if this option is enabled.
3-27
EDR-G903/G902
Routing Table
The Routing Table page shows all routing entries.
Features and Functions
All Routing Entry List
Setting
All
Connected
Static
RIP
Others
Description
Show all routing entries
Show connected routing entries
Show Static routing entries
Show RIP routing entries
Show others routing entries
Factory Default
N/A
N/A
N/A
N/A
N/A
Network Address Translation (NAT)
NAT Concept
NAT (Network Address Translation) is a common security function for changing the IP address during Ethernet packet transmission. When the user wants to hide the internal IP address (LAN) from the external network
(WAN), the NAT function will translate the internal IP address to a specific IP address, or an internal IP address range to one external IP address. The benefits of using NAT include:
• Uses the N- 1 or Port forwarding Nat function to hide the Internal IP address of a critical network or device to increase the level of security of industrial network applications.
• Uses the same private IP address for different, but identical, groups of Ethernet devices. For example,
1-to-1 NAT makes it easy to duplicate or extend identical production lines.
NOTE
The NAT function will check if incoming or outgoing packets match the policy. It starts by checking the packet with the first policy (Index=1); if the packet matches this policy, the EtherDevice Router will translate the address immediately and then start checking the next packet. If the packet does not match this policy, it will check with the next policy.
NOTE
The maximum number of NAT policies for the EtherDevice Router is 128.
N-to-1 NAT
If the user wants to hide the Internal IP address from users outside the LAN, the easiest way is to use the
N-to-1 (or N-1) NAT function. The N-1 NAT function replaces the source IP Address with an external IP address, and adds a logical port number to identify the connection of this internal/external IP address. This function is also called “Network Address Port Translation” (NAPT) or “IP Masquerading.”
The N-1 NAT function is a one way connection from an internal secure area to an external non-secure area. The user can initialize the connection from the internal to the external network, but may not be able to initialize the connection from the external to the internal network.
3-28
EDR-G903/G902 Features and Functions
Enable/Disable NAT Policy
Setting
Enable or Disable
Description
Enable or disable the selected NAT policy
NAT Mode
Setting
N-1
1-1
Port Forwarding
Description
Select the NAT types
Factory Default
Enabled
Factory Default
N-1
Interface (N-1 mode)
Setting Description Factory Default
Auto
WAN1
Select the Interface for this NAT Policy Auto
WAN2
The EtherDevice Router provides a Dual WAN backup function for network redundancy. If the interface is set to
Auto, the NAT Mode is set to N-1, and the WAN backup function is enabled, the primary WAN interface is WAN1.
If the WAN1 connection fails, the WAN interface of this N-1 policy will apply to WAN2 and switch to WAN2 for
N-1 outgoing traffic until the WAN1 interface recovers.
IP Range
Setting
IP address
Description
Select the Internal IP range for IP translation to WAN IP address
Factory Default
None
WAN IP (N-1 mode)
Setting
IP address
Description
The IP address of the user selected interface (WAN1, WAN2, and Auto) in this N-to-1 policy.
Factory Default
None
NOTE
The EtherDevice Router will add an N-1 policy from the source IP, 192.168.127.1 to 192.168.127.252 to the
WAN1 interface after activating the Factory Default.
Port Forwarding
If the initial connection is from outside the LAN, but the user still wants to hide the Internal IP address, one way to do this is to use the Port Forwarding NAT function.
The user can specify the port number of an external IP address (WAN1 or WAN2) in the Port Forwarding policy list. For example, if the IP address of a web server in the internal network is 192.168.127.10 with port 80, the user can set up a port forwarding policy to let remote users connect to the internal web server from external IP address 10.10.10.10 through port 8080. The EtherDevice Router will transfer the packet to IP address
192.168.127.10 through port 80.
The Port Forwarding NAT function is one way of connecting from an external insecure area (WAN) to an internal secure area (LAN). The user can initiate the connection from the external network to the internal network, but will not able to initiate a connection from the internal network to the external network.
3-29
EDR-G903/G902 Features and Functions
Enable/Disable NAT policy
Setting
Enable or Disable
Description
Enable or disable the selected NAT policy
NAT Mode
Setting
N-1
1-1
Port Forward
Description
Select the NAT types
Interface (Port Forward mode)
Setting
WAN1
WAN2
Description
Select the Interface for this NAT Policy
Protocol (Port Forward mode)
Setting
TCP
UDP
TCP & UDP
Description
Select the Protocol for NAT Policy
WAN Port (Port Forward mode)
Setting
1 to 65535
Description
Select a specific WAN port number
LAN/DMZ IP (Port Forward mode)
Setting
IP Address
Description
The translated IP address in the internal network
LAN/DMZ Port (Port Forward mode)
Setting
1 to 65535
Description
The translated port number in the internal network
3-30
Factory Default
Enabled
Factory Default
N-1
Factory Default
WAN1
Factory Default
TCP
Factory Default
None
Factory Default
None
Factory Default
None
EDR-G903/G902 Features and Functions
1-to-1 NAT
If the internal device and external device need to communicate with each other, choose 1-to-1 NAT, which offers bi-directional communication (N-to-1 and Port forwarding are both single-directional communication
NAT functions).
1-to-1 NAT is usually used when you have a group of internal servers with private IP addresses that must connect to the external network. You can use 1-to-1 NAT to map the internal servers to public IP addresses.
The IP address of the internal device will not change.
The figure below illustrates how a user could extend production lines, and use the same private IP addresses of internal devices in each production line. The internal private IP addresses of these devices will map to different public IP addresses. Configuring a group of devices for 1-to-1 NAT is easy and straightforward.
1-to-1 NAT Setting for EDR-G903 in Production Line 1
1-to-1 NAT Setting for EDR-G903 in Production Line 2
3-31
EDR-G903/G902 Features and Functions
Enable/Disable NAT policy
Setting
Enable or Disable
Description
Enable or disable the selected NAT policy
NAT Mode
Setting
N-1
1-1
Port Forward
Description
Select the NAT types
Interface (1-1 NAT type)
Setting
WAN1
WAN2
Description
Select the Interface for this NAT Policy
LAN/DMZ IP (1-1 NAT type)
Setting
IP Address
Description
Select the Internal IP address in LAN/DMZ network area
WAN IP (1-1 NAT type)
Setting
IP Address
Description
Select the external IP address in WAN network area
Factory Default
None
Factory Default
None
Factory Default
WAN1
Factory Default
None
Factory Default
None
NOTE
The EtherDevice Router can obtain an IP address via DHCP or PPPoE. However, if this dynamic IP address is the same as the WAN IP for 1-to-1 NAT, then the 1-to-1 NAT function will not work. For this reason, we recommend disabling the DHCP/PPPoE function when using the 1-to-1 NAT function.
3-32
EDR-G903/G902 Features and Functions
Firewall Settings
Firewall Policy Concept
A firewall device is commonly used to provide secure traffic control over an Ethernet network, as illustrated in the following figure. Firewall devices are deployed at critical points between an external network (the non-secure part) and an internal network (the secure part).
Firewall Policy Overview
The EtherDevice Router provides a Firewall Policy Overview that lists firewall policies by interface direction.
Select the From interface and To interface and then click the Show button. The Policy list table will show the policies that match the From-To interface.
Interface From/To
Setting Description
All (WAN1/WAN2/LAN) Select the From Interface and To interface
WAN1
WAN2
LAN
Factory Default
From All to All
3-33
EDR-G903/G902 Features and Functions
Firewall Policy Configuration
The EtherDevice Router’s Firewall policy provides secure traffic control, allowing users to control network traffic based on the following parameters.
Interface From/To
Setting Description
All (WAN1/WAN2/LAN) Select the From Interface and To interface
WAN1
WAN2
LAN
Quick Automation Profile
Setting
Refer to the “Quick
Automation Profile” section on page 3-29.
Description
Select the Protocol parameters in this Firewall Policy
Service
Setting
IP Filter
MAC Filter
Description
This Firewall policy will filter by IP address
This Firewall policy will filter by MAC address
Factory Default
From All to All
Factory Default
None
Factory Default
IP Filter
Target
Setting
Accept
Drop
Description
The packet will penetrate the firewall when it matches this firewall policy
The packet will not penetrate the firewall when it matches this firewall policy
Factory Default
Accept
Source IP
Setting
All (IP Address)
Single (IP Address)
Range (IP Address)
Description
This Firewall Policy will check all Source IP addresses in the packet
This Firewall Policy will check single Source IP addresses in the packet
This Firewall Policy will check multiple Source IP addresses in the packet
Factory Default
All
Source Port
Setting
All (Port number)
Description
This Firewall Policy will check all Source port numbers in the packet
Single (Port number) This Firewall Policy will check single Source Port numbers in the packet
Range (Port number) This Firewall Policy will check multiple Source port numbers in the packet
Factory Default
All
3-34
EDR-G903/G902 Features and Functions
Destination IP
Setting
All (IP Address)
Single (IP Address)
Range (IP Address)
Description
This Firewall Policy will check all Destination IP addresses in the packet
Factory Default
All
This Firewall Policy will check single Destination IP addresses in the packet
This Firewall Policy will check multiple Destination IP addresses in the packet
Destination Port
Setting
All (Port number)
Description
This Firewall Policy will check all Destination port numbers in the packet
Single (Port number) This Firewall Policy will check single Destination Port numbers in the packet
Range (Port number) This Firewall Policy will check multiple Destination port numbers in the packet
Factory Default
All
NOTE
The EtherDevice Router’s firewall function will check if incoming or outgoing packets match the firewall policy.
It starts by checking the packet with the first policy (Index=1); if the packet matches this policy, it will accept or drop the packet immediately and then check the next packet. If the packet does not match this policy it will check with the next policy.
NOTE
The maximum number of Firewall policies for the EtherDevice Router is 256.
Layer 2 Policy Setup
In Bridge Mode, the EtherDevice Router provides an advanced Layer 2 Firewall policy for secure traffic control, which depends on the following parameters:
Interface From/To
Setting Description
All (WAN1/WAN2/LAN) Select the From Interface and To interface
WAN1
WAN2
LAN
Protocol
Setting
Refer to table
“EtherType for Layer 2
Protocol” for a more detailed description
Description
Select the Layer 2 Protocol in this Firewall Policy
3-35
Factory Default
None
Factory Default
None
EDR-G903/G902 Features and Functions
EtherType
Setting
0x0600 to 0xFFFF
Description
When Protocol is set to “Manual” you can set up EtherType manually
Factory Default
None
Target
Setting
Accept
Drop
Description
The packet will pass the Firewall when it matches this Firewall policy
The packet will not pass the Firewall when it matches this
Firewall policy
Factory Default
None
None
Source MAC Address
Setting
Mac Address
Description
This Firewall Policy will check all Source MAC addresses of the packet
Factory Default
00:00:00:00:00:00
Destination MAC Address
Setting
Mac Address
Description Factory Default
This Firewall Policy will check all destination MAC addresses of the packet
00:00:00:00:00:00
The following table shows the Layer 2 protocol types commonly used in Ethernet frames.
EtherType for Layer 2 Protocol
0x6003
0x6004
0x6005
0x6006
0x6007
0x6558
0x6559
0x80F3
0x809B
Type
0x0800
0x0805
0x0806
0x0808
0x08FF
0x6000
0x6001
0x6002
0x8100
0x8137
0x8191
0x86DD
0x880B
0x884C
0x8863
0x8864
0x8884
0x9000
Layer 2 Protocol
IPv4 (Internet Protocol version 4)
X.25
ARP (Address Resolution Protocol)
Frame Relay ARP
G8BPQ AX.25 Ethernet Packet
DEC Assigned proto
DEC DNA Dump/Load
DEC DNA Remote Console
DEC DNA Routing
DEC LAT
DEC Diagnostics
DEC Customer use
DEC Systems Comms Arch
Trans Ether Bridging
Raw Frame Relay
Appletalk AARP
Appletalk
8021Q VLAN tagged frame
Novell IPX
NetBEUI
IPv6 (Internet Protocol version 6)
PPP
MultiProtocol over ATM
PPPoE discovery messages
PPPoE session messages
Frame-based ATM Transport over Ethernet
Loopback
3-36
EDR-G903/G902 Features and Functions
Quick Automation Profile
Ethernet Fieldbus protocols are popular in industrial automation applications. In fact, many Fieldbus protocols
(e.g., EtheNet/IP and Modbus TCP/IP) can operate on an industrial Ethernet network, with the Ethernet port number defined by IANA (Internet Assigned Numbers Authority). The EtherDevice Router provides an easy to use function called Quick Automation Profile that includes 45 different pre-defined profiles (Modbus TCP/IP,
Ethernet/IP, etc.), allowing users to create an industrial Ethernet Fieldbus firewall policy with a single click.
For example, if the user wants to create a Modbus TCP/IP firewall policy for an internal network, the user just needs to select the Modbus TCP/IP(TCP) or Modbus TCP/IP(UDP) protocol from the Protocol drop-down menu on the Firewall Policy Setting page.
The following table shows the Quick Automation Profile for Ethernet Fieldbus Protocol and the corresponding port number
Ethernet Fieldbus Protocol
EtherCat port (TCP)
EtherCat port (UDP)
EtherNet/IP I/O (TCP)
EtherNet/IP I/O (UDP)
EtherNet/IP Messaging (TCP)
EtherNet/IP Messaging (UDP)
FF Annunciation (TCP)
FF Annunciation (UDP)
FF Fieldbus Message (TCP)
FF Fieldbus Message (UDP)
FF System Management (TCP)
FF System Management (UDP)
FF LAN Redundancy Port (TCP)
FF LAN Redundancy Port (UDP)
LonWorks (TCP)
LonWorks (UDP)
LonWorks2 (TCP)
LonWorks2 (UDP)
Modbus TCP/IP (TCP)
Port Number
34980
34980
2222
2222
44818
44818
1089
1089
1090
1090
1091
1091
3622
3622
2540
2540
2541
2541
502
3-37
EDR-G903/G902 Features and Functions
Modbus TCP/IP (UDP)
PROFInet RT Unicast (TCP)
PROFInet RT Unicast (UDP)
PROFInet RT Multicast (TCP)
PROFInet RT Multicast (UDP)
PROFInet Context Manager (TCP)
PROFInet Context Manager (UDP)
IEC 60870-5-104 (TCP)
IEC 60870-5-104 (UDP)
DNP (TCP)
DNP (UDP)
502
34962
34962
34963
34963
34964
34964
2404
2404
20000
20000
The Quick Automation Profile also includes the commonly used Ethernet protocols listed in the following table:
Ethernet Protocol
IPSec NAT Traversal (UDP)
IPSec NAT traversal (TCP)
FTP-data (TCP)
FTP-data (UDP)
FTP-control (TCP)
FTP-control (UDP)
SSH (TCP)
SSH (UDP)
Telnet (TCP)
Telnet (UDP)
HTTP (TCP)
HTTP (UDP)
IPSec (TCP)
IPSec (UDP)
L2F & L2TP (TCP)
L2F & L2TP (UDP)
PPTP (TCP)
PPTP (UDP)
Radius authentication (TCP)
Radius authentication (UDP)
RADIUS accounting (TCP)
RADIUS accounting (UDP)
1723
1723
1812
1812
1813
1813
23
23
80
80
1293
1293
1701
1701
21
21
22
22
Port Number
4500
4500
20
20
PolicyCheck
The EtherDevice Router supports a PolicyCheck function for maintaining the firewall policy list. The
PolicyCheck function detects firewall policies that may be configured incorrectly.
PolicyCheck provides an auto detection function for detecting common configuration errors in the Firewall policy (e.g., Mask, Include, and Cross conflict). When adding a new firewall policy, the user just needs to click the PolicyCheck button to check each policy; warning messages will be generated that can be used for further analysis. If the user decides to ignore a warning message, the EtherDevice Router firewall will run on the configuration provided by the user.
The three most common types of configuration errors are related to Mask, Include, and Cross Conflict.
3-38
EDR-G903/G902 Features and Functions
Mask: Policy [X] is masked by Policy [Y]
The Source/Destination IP range or Source/Destination port number of policy [X] is smaller or equal to policy
[Y] but the action target (Accept/Drop) is different.
For example, two firewall policies are shown below:
Index Input
1
2
WAN1
WAN2
Output
LAN
LAN
Protocol
All
All
Source IP
10.10.10.10
20.20.20.10 to 20.20.20.30
Destination IP
192.168.127.10
192.168.127.20
Target
ACCEPT
ACCEPT
Suppose the user next adds a new policy with the following configuration:
Index
3
Input
WAN2
Output
LAN
Protocol
All
Source IP
20.20.20.20
Destination IP
192.168.127.20
Target
DROP
After clicking the PolicyCheck button, the EtherDevice Router will issue a message informing the user that policy [3] is masked by policy [2] because the IP range of policy [3] is smaller than the IP range of policy [2], and the Target action is different.
Include: Policy [X] is included in Policy [Y]
The Source/Destination IP range or Source/Destination port number of policy [X] is less than or equal to policy
[Y], and the action target (Accept/Drop) is the same. In this case policy [X] will increase the loading of the
EtherDevice Router and lower its performance.
For example, two firewall policies are shown in the following table:
Index
1
2
Input
WAN1
WAN2
Output
LAN
LAN
Protocol
All
All
Source IP
10.10.10.10
20.20.20.10 to 20.20.20.30
Destination IP
192.168.127.10
192.168.127.20
Target
ACCEPT
ACCEPT
Suppose the user next adds a new policy with the following configuration:
Index
3
Input
WAN2
Output
LAN
Protocol
All
Source IP
20.20.20.20
Destination IP
192.168.127.20
Target
ACCEPT
After clicking the PolicyCheck button, the EtherDevice Router will issue a message informing the user that policy [3] is included in policy [2] because the IP range of policy [3] is smaller than the IP range of policy [2], and the Target action is the same.
Cross Conflict: Policy [X] cross conflicts with Policy [Y]
Two firewall policy configurations, such as Source IP, Destination IP, Source port, and Destination port, in policy [X] and policy [Y] are masked, and the action target (Accept/Drop) is different.
For example, two firewall policies are shown in the following table:
Index Input
1
2
WAN1
WAN2
Output
LAN
LAN
Protocol
All
All
Source IP
10.10.10.10
20.20.20.20 to 20.20.20.30
Destination IP
192.168.127.10
192.168.127.25
Target
ACCEPT
ACCEPT
3-39
EDR-G903/G902 Features and Functions
Suppose the user next adds a new policy with the following configuration:
Index Input
3 WAN2
Output
LAN
Protocol
All
Source IP
20.20.20.25
Destination IP
192.168.127.20 to 192.168.127.30
Target
DROP
The source IP range in policy 3 is smaller than policy 2, but the destination IP of policy 2 is smaller than policy
3, and the target actions (Accept/Drop) of these two policies are different. If the user clicks the PolicyCheck button, the EtherDevice Router will issue a message informing the user that policy [3] is in Cross Conflict with policy [2].
Denial of Service (DoS) function
The EtherDevice Router provides 9 different DoS functions for detecting or defining abnormal packet format or traffic flow. The EtherDevice Router will drop the packets when it detects an abnormal packet format. The
EtherDevice Router will also monitor some traffic flow parameters and activate the defense process when abnormal traffic conditions are detected.
Null Scan
Setting
Enable or Disable
Xmas Scan
Setting
Enable or Disable
NMAP-Xmas Scan
Setting
Enable or Disable
SYN/FIN Scan
Setting
Enable or Disable
FIN Scan
Setting
Enable or Disable
NMAP-ID Scan
Setting
Enable or Disable
Description
Enable or disable the Null Scan
Description
Enable or disable the Xmas Scan
Description
Enable or disable the NMAP-Xmas
Description
Enable or disable the SYN/FIN Scan
Description
Enable or disable the FIN Scan
Description
Enable or disable the NMAP-ID Scan
3-40
Factory Default
None
Factory Default
None
Factory Default
None
Factory Default
None
Factory Default
None
Factory Default
None
EDR-G903/G902
SYN/RST Scan
Setting
Enable or Disable
ICMP-Death
Setting
Enable or Disable
Packet/Second
SYN-Flood
Setting
Enable or Disable
Packet/Second
Description
Enable or disable the SYN/RST Scan
Description
Enable or disable the ICMP-Death defense
The limit value to activate ICMP-Death defense
Features and Functions
Factory Default
None
Factory Default
None
None
Description
Enable or disable the Null Scan function
The limit value to activate SYN-Flood defense
Factory Default
None
None
VPN (Virtual Private Network)
Overview
This chapter describes how to use the EtherDevice Router to build a secure Remote Automation network with the VPN (Virtual Private Network) feature. A VPN provides a highly cost effective solution of establishing secure tunnels, so that data can be exchanged in a secure manner.
There are two common applications for secure remote communication in an industrial automation network:
IPSec (Internet Protocol Security) VPN for LAN to LAN security: Data communication only in a pre-defined IP range between two different LANs.
L2TP (Layer 2 Tunnel Protocol) VPN for Remote roaming User: Secure data communication for remote roaming users with dynamic IP. L2TP is a popular choice for remote roaming users for VPN applications because the L2TP VPN protocol is already built in to the Microsoft Windows operating system.
IPSec uses IKE (Internet Key Exchange) protocol for Authentication, Key exchange and provides a way for the
VPN gateway data to be protected by different encryption methods.
There are 2 phases for IKE for negotiating the IPSec connections between 2 VPN gateways:
Key Exchange (IPSec Phase 1):
The 2 VPN gateways will negotiate how IKE should be protected. Phase 1 will also authenticate the two VPN gateways by the matched Pre-Shared Key or X.509 Certificate.
Data Exchange (IPSec Phase 2):
In Phase 2, the VPN gateways negotiate to determine additional IPSec connection details, which include the data encryption algorithm.
3-41
EDR-G903/G902 Features and Functions
IPSec Configuration
IPSec configuration includes 5 parts:
• Global Setting: Enable / Disable all IPSec Tunnels and NAT-Traversal function
• Tunnel Setting: Set up the VPN Connection type and VPN network plan
• Key Exchange: Authentication for 2 VPN gateways
• Data Exchange: Data encryption between VPN gateways
• Dead Peer Detection: The mechanism for VPN Tunnel maintenance.
Global Configuration
The EtherDevice Router provides 2 Global Settings for VPN applications.
NOTE
All IPSec Connection
Users can Enable or Disable all VPN services with this configuration.
The factory default setting is Disable, so when the user wants to use VPN function, make sure the setting is enabled.
IPSec NAT-T:
If there is an external NAT device between VPN tunnels, the user must enable the NAT-T (NAT-Traversal) function.
IPSec Quick Setting
The EtherDevice Router’s Quick Setting mode can be used to easily set up a site-to-site VPN tunnel for two
EtherDevice Router units.
NOTE
When choosing the Quick setting mode, the user just needs to configure the following:
• Tunnel Setting
• Security Setting
Encryption Strength: Simple (AES-128), Standard (AES-192), Strong (AES-256)
Password of Pre-Shared Key
The Encryption strength and Pre-Shared key should be configured identically for both EtherDevice Router units.
IPSec Advanced Setting
Click Advanced Setting to configure detailed VPN settings.
3-42
EDR-G903/G902
Tunnel Setting
Features and Functions
Enable or Disable VPN Tunnel
Setting
Enable or Disable
Description
Enable or Disable this VPN Tunnel
Name of VPN Tunnel
Setting Description
Max. of 16 characters User defined name of this VPN Tunnel.
NOTE
The first character cannot be a number.
Factory Default
Disable
Factory Default
None
L2TP over IPSec Enable or Disable
Setting
Enable or Disable
Description
Enable or Disable IPSec tunnel over L2TP protocol function
VPN Connection Type
Setting
Site to Site
Site to Site (Any)
Description
VPN tunnel for Local and Remote subnets are fixed
VPN tunnel for Remote subnet area is dynamic and Local subnet is fixed
Factory Default
None
Factory Default
Site to Site
Remote VPN Gateway
Setting
IP Address
Description
Remote VPN Gateway’s IP Address
Factory Default
None
Connection Interface
Setting
WAN1
WAN2
Default Route
Description
The interface of the VPN Tunnel
If the user enables the WAN backup function, WAN1 would be the primary default route and WAN2 would be the backup route.
Factory Default
WAN1
Startup Mode
Setting
Start in Initial
Wait for Connecting
Description
This VPN tunnel will actively initiate the connection with the
Remote VPN Gateway.
This VPN tunnel will wait remote VPN gateway to initiate the connection
Factory Default
Start in Initial
NOTE
For both the EDR-G903 and EDR-G902, the maximum number of Starts in the initial VPN tunnel is 5. The maximum number of total IPSec VPN tunnels (Start in initial, and Wait for connection) is:
EDR-G903: 25
EDR-G902: 10
3-43
EDR-G903/G902 Features and Functions
Local Network / Netmask / ID
Setting
IP Address
Subnet Mask
Description
IP address of local VPN network
Subnet Mask of local VPN network
Factory Default
IP address of LAN interface
Netmask of LAN interface
ID ID for indentifying the VPN tunnel connection.
The Local ID must be equal to the Remote ID of the VPN
Gateway. Otherwise, the VPN tunnel cannot be established successfully
Remote Network / Netmask / ID
Setting
IP Address
Subnet Mask
ID
Description
IP address of Remote VPN network
Subnet Mask of local VPN network
ID for indentifying the VPN tunnel connection.
The Local ID must be equal to the Remote ID of the VPN
Gateway. Otherwise, the VPN tunnel cannot be established.
None
Factory Default
0.0.0.0
0.0.0.0
None
Key Exchange (IPSec phase I)
IKE Mode
Setting
Main
Aggressive
Description Factory Default
In “Main” IKE Mode, both the Remote and Local VPN gateway will negotiate which Encryption/Hash algorithm and DH groups
MAIN can be used in this VPN tunnel; both VPN gateways must use the same algorithm to communicate.
In “Aggressive” Mode, the Remote and Local VPN gateway will not negotiate the algorithm; it will use the user’s configuration only.
Authentication Mode
Setting
Pre-Shared Key
X.509
Description
The authentication mode of IPSec VPN
Factory Default
Pre-Shared Key
In Pre-Shared Key Mode, the user needs to key-in the same Pre-Shared Key in the IPSec setting between the
Local and Remote secure router.
3-44
EDR-G903/G902 Features and Functions
In X.509 Mode, the user needs to upload the Local and Remote certifications first, and then select the certifications from the drop-down list.
See the X.509 Certification section in this chapter for details.
Encryption Algorithm
Setting
DES
3DES
AES-128
AES-192
AES-256
Description
Encryption Algorithm in key exchange
Factory Default
3DES
Hash Algorithm
Setting
Any
MD5
SHA1
SHA256
DH Group
Setting
DH1(modp 768)
DH2(modp 1024)
DH5(modp 1536)
DH14(modp 2048)
Negotiation Time
Setting
Negotiation time
Description
Hash Algorithm in key exchange
Description
Diffie-Hellman groups
(the Key Exchange group between the Remote and VPN
Gateways)
Factory Default
SHA1
Factory Default
DH2(modp 1024)
Description
The number of allowed reconnect times when startup mode is initiated. If the number is 0, this tunnel will always try connecting to the remote gateway when the VPN tunnel is not created successfully.
Factory Default
0
IKE Lifetime
Setting
IKE lifetime (hours)
Rekey Expire Time
Setting
Rekey expire time
(minutes)
Rekey Fuzz Percent
Setting
0-100 (%)
Description
Lifetime for IKE SA
Description
Start to Rekey before IKE lifetime expired
Factory Default
1 (hr)
Factory Default
9 (min)
Description
The rekey expire time will change randomly to enhance the security.
Rekey fuzz percent is the maximum random change margin of the Rekey expire time.
100% means the rekey expire time will not change randomly.
Factory Default
100 (%)
3-45
EDR-G903/G902
Data Exchange (IPSec phase II)
Features and Functions
Perfect Forward Secrecy
Setting
Enable or Disable
Description
Uses different security key for different IPSec phases to enhance security
SA Lifetime
Setting Description
SA lifetime (minutes) Lifetime for SA in Phase 2
Encryption Algorithm
Setting
DES
3DES
AES-128
AES-192
AES-256
Description
Encryption Algorithm in data exchange
Hash Algorithm
Setting
Any
MD5
SHA1
SHA256
Description
Hash Algorithm in data exchange
Factory Default
Disable
Factory Default
480 (min)
Factory Default
3DES
Factory Default
SHA1
Dead Peer Detection
Dead Peer Detection is a mechanism to detect whether or not the connection between a local secure router and a remote IPSec tunnel has been lost.
Action
Action when a dead peer is detected.
Setting
Hold
Restart
Clear
Disable
Timeout
Setting
Timeout (seconds)
Description
Hold this VPN tunnel
Reconnect this VPN tunnel
Clear this VPN tunnel
Disable Dead Peer Detection
Delay
Setting Description
Delay time (seconds) The period of dead peer detection messages
Description
Timeout to check if the connection is alive or not
3-46
Factory Default
Hold
Factory Default
30 (sec)
Factory Default
120 (sec)
EDR-G903/G902 Features and Functions
IPSec Status
The user can check the VPN tunnel status in the IPSec Connection List.
This list shows the Name of the IPSec tunnel, IP address of Local and Remote Subnet/Gateway, and the established status of the Key exchange phase and Data exchange phase.
X.509 Certification
X.509 is a digital certificate method commonly used for IPSec Authentication. The EtherDevice Router can generate a trusted Root Certification and then export/import the certificate to the remote VPN gateway.
The diagram below indicates the 5 steps you should follow to use X.509 for IPSec authentication with two VPN gateways, referred to as EDR-G903(A) and EDR-G903(B) in the diagram:
1. Root Certificate generation. Both EDR-G903(A) and EDR-G903(B) need to generate their own root certificates.
2. EDR-G903(A) and EDR-G903(B) can request new certifications based on their own Root Certificates.
3. Generate PKCS#12 local certificate with password (.p12) and Certificate file for remote VPN tunnel (.crt)
• EDR-G903(A)Moxa-A.p12 and Moxa-A.crt
• EDR-G903(B)Moxa-B.crt and Moxa-B.crt
4. Upload the PKCS#12 certificate to the Local Certification list
• Moxa-A.p12 in EDR-G903(A)
• Moxa-B.p12 in EDR-G903(B)
5. Send the Certificate file (.crt) to the remote VPN gateway and upload to the Remote certificate file
• Upload Moxa-B.crt to EDR-G903(A)
• Upload Moxa-A.crt to EDR-G903(B)
3-47
EDR-G903/G902
Certificate Generation
Features and Functions
NOTE
The user must fill in the following information to generate the Root certification:
• Country name (2 Letter code)
• Certificate Days
• State or Province Name
• Locality Name
• Organization Name
• Organization Unit Name
• Common Name
• Email Address
After keyin in all information, press Activate to generate the Root Certification.
The default setting for Certificate Day is 0, which means that the certification will not terminated unless modified by the user.
Certificate Setting
After Root Certification is activated, the user can generate different certifications for different VPN Tunnels. The user needs to fill in the following information and press Add and Activate to add the new certificate to the
Certificate List.
• Certificate Days
• Organization Unit Name
• Certificate Name
• Email Address
• Certificate Password
The user can then choose certificates from the list and press the PKCS#12 Export button to generate a .p12 file for a local certificate and press Certificate Export to generate a .crt file for certificates on a Remote VPN gateway.
3-48
EDR-G903/G902
Local Certificate Upload
Features and Functions
Upload the .p12 local certificate on this page. The Password must be the same as the .p12 certificate file. If the password is not correct, the certificate import process will fail.
Label: User defined name for this local certificate
Name/Subject: Show the Name and subject when the certificate is imported successfully or the user selects the certificate on the list
PKCS#12 Upload: Use Browser to select the .p12 file and press the Import button
Import Password: The Password for the .p12 certificate
Remote Certificate Upload
Upload the .crt Remote certificate on this page.
Label: User defined name for this local certificate
Name/Subject: Show the Name and subject when the certificate is imported successfully or the user selects a certificate from the list
Certificate Upload: Use the Browser to select a .p12 file and press the Import button.
L2TP (Layer 2 Tunnel Protocol)
L2TP is a popular choice for remote roaming users for VPN applications since an L2TP client is built in to the
Microsoft Windows operating system. Since L2TP does not provide an encryption function, it is usually combined with IPSec to provide data encryption.
3-49
EDR-G903/G902
L2TP Configuration
Features and Functions
L2TP Server Mode
Setting
Enable / Disable
Description
Enable or Disable the L2TP function on the WAN1 or WAN 2 interface
Local IP
Setting
IP Address
Description
The IP address of the Local Subnet
Offered IP Range
Setting
IP Address
Description
Offered IP range is for the L2TP clients
Login User Name
Setting Description
Max. to xx character. User Name for L2TP connection
Login Password
Setting Description
Max. to xx character. Password for L2TP connection
Factory Default
Disable
Factory Default
0.0.0.0
Factory Default
0.0.0.0
Factory Default
NULL
Factory Default
NULL
3-50
EDR-G903/G902
Examples for Typical VPN Applications
Features and Functions
Site to Site IPSec VPN tunnel with Pre-Shared Key
The following example shows how to create a secure LAN to LAN VPN tunnel between the Central site and
Remote site via an Intranet network.
VPN Plan:
• All communication from the Central site network (100.100.1.0/24) to the Remote site Network
(100.100.3.0/24) needs to pass through the VPN tunnel.
• Intranet Network is 100.100.2.0/24
• The configuration of the WAN/LAN interface for 2 EtherDevice Routers is shown in the following table.
EDR-G903
Interface Setting
Configuration
WAN IP
LAN IP
EtherDevice Router (1)
100.100.2.1
100.100.1.1
EtherDevice Router (2)
100.100.2.2
100.100.3.1
Based on the requirement and VPN plan, the recommended configuration for VPN IPSec is shown in the following table
Tunnel Setting
Key Exchange
Data Exchange
Configuration
Connection Type
Remote VPN gateway
Startup mode
Local Network /
Netmask
Remote Network /
Netmask
Pre-Shared Key
Encryption / Harsh
EtherDevice Router (1)
Site to Site
100.100.2.2
Wait for Connection
100.100.1.0 /
255.255.255.0
100.100.3.0 /
25.255.255.0
12345
3DES / SHA1
EtherDevice Router (2)
Site to Site
100.100.2.1
Start in Initial
100.100.3.0 /
25.255.255.0
100.100.1.0 /
255.255.255.0
12345
3DES / SHA1
3-51
EDR-G903/G902 Features and Functions
L2TP for Remote User Maintenance
The following example shows how a Roaming user uses L2TP over IPSec to connect to theremote site network.
VPN Plan:
• All communication from the Roaming user (no fixed IP) to the Remote site Network (100.100.3.0/24) needs to pass through the VPN tunnel.
• Communication goes through the Internet.
• The configuration of the WAN/LAN interface for the EtherDevice Router is shown in the following table.
EDR-G903
Interface Setting
Configuration
WAN IP
LAN IP
EtherDevice Router (1)
100.100.2.1
100.100.3.1
Based on the requirement and VPN plan, the recommended configuration for L2TP over IPSec is shown in the following table:
L2TP Server Setting
Tunnel Setting
Key Exchange
Data Exchange
Configuration
L2TP Server Mode (WAN1)
Local IP (L2TP Server IP)
Offer IP Range
Login User / Password
Connection Type
L2TP Tunnel
Local Network
Startup mode
Pre-Shared Key
Encryption Algorithm
Harsh Algorithm
EtherDevice Router (1)
Enable
100.100.4.1
100.100.4.1 ~100.100.4.100
User01 / 12345
Site to Site (Any)
Enable
100.100.3.1 / 24
(Same as LAN Interface)
Wait for Connection
12345
3DES
SHA1
Traffic Prioritization
The EtherDevice Router’s traffic prioritization capability provides Quality of Service (QoS) to your network by making data delivery more reliable. You can prioritize traffic on your network to ensure that high priority data is transmitted with minimum delay. Traffic can be controlled by a set of rules to obtain the required Quality of
Service for your network.
NOTE
The maximum number of traffic prioritization policies for the EtherDevice Router is 256.
3-52
EDR-G903/G902 Features and Functions
How Traffic Prioritization Works
The EtherDevice Router provides four different priorities levels (0-3, high to low) for incoming and outgoing traffic. The following figure illustrates incoming traffic, which refers to the traffic transmitted from WAN1 to LAN or WAN2 to LAN interface. Outgoing traffic refers to the traffic transmitted from LAN to WAN1 or from LAN to
WAN2.
The following figures show the configuration for incoming and outgoing traffic. Users can manage the priority of incoming traffic (WAN1 to LAN and WAN2 to LAN) and outgoing traffic (LAN to WAN1 and LAN to WAN2).
Traffic Prioritization Configuration
Enable or Disable
Setting
Enable or Disable
Description
Enable or disable the Traffic Prioritization function
3-53
Factory Default
Disabled
EDR-G903/G902 Features and Functions
Max. Bandwidth
Setting
1 to 1,000,000
KBytes/s
Description Factory Default
The maximum bandwidth for total incoming or outgoing traffic 100 KBytes/s
Default Priority
Setting
Priority 0/1/2/3
Description
A packet without matching any incoming/outgoing policy will adhere to the default priority
Factory Default
Priority 3
Minimum Bandwidth of Priority 0/1/2/3
Setting
1 to 1,000,000
KBytes/s
Description
The minimum bandwidth for Priority 0/1/2/3
Factory Default
Priority 0: 10 KBytes/s
Priority 1: 20 KBytes/s
Priority 2: 30 KBytes/s
Priority 3: 40 KBytes/s
Maximum Bandwidth of Priority 0/1/2/3
Setting
1 to 1,000,000
KBytes/s
Description
The maximum bandwidth for Priority 0/1/2/3
Factory Default
Priority 0: 10 KBytes/s
Priority 1: 20 KBytes/s
Priority 2: 30 KBytes/s
Priority 3: 40 KBytes/s
Outgoing/Incoming Policy Setup
After configuring the minimum/maximum bandwidth for each priority, users can set up the incoming or outgoing policies for Ethernet traffic, providing the setup meets all of the following conditions:
Enable or Disable
Setting
Enable or Disable
Description
Enable or disable this Incoming or Outgoing Policy
Packet To / From
Setting Description
All (WAN1 or WAN2) Select the direction of Ethernet traffic for this policy
WAN1
WAN2
To: For outgoing policy
From: For incoming policy
Protocol
Setting
All (TCP/UDP/ICMP)
TCP
UDP
ICMP
Service
Setting
By IP
By MAC
Description
Select the Protocol for in this Policy
Description
Select the service type (IP address or MAC address) for this policy
Factory Default
Disabled
Factory Default
All
Factory Default
All
Factory Default
By IP
3-54
EDR-G903/G902 Features and Functions
Priority
Setting
Priority 0/1/2/3
Source IP
Setting
All (IP Address)
Single (IP Address)
Range (IP Address)
Source Port
Setting
All (Port number)
Single (Port number)
Range (Port number)
Destination IP
Setting
All (IP Address)
Single (IP Address)
Range (IP Address)
Destination Port
Setting
All (Port number)
Single (Port number)
Range (Port number)
Description
Select the priority for this policy
Description
Select the Source IP address for this policy
Description
Select the Source port number for this policy
Description
Select the Destination IP address for this policy
Description
Select the Destination port number for this policy
Factory Default
Priority 0
Factory Default
All
Factory Default
All
Factory Default
All
Factory Default
All
The following table shows the management of outgoing traffic. The maximum bandwidth from LAN to WAN is
100 Kbytes. 10 Kbyte is reserved for traffic that matches the parameters of Priority 0. 20 Kbytes is reserved for traffic that matches the parameters of priority 1 and so forth.
Set up the outgoing policies as below:
3-55
EDR-G903/G902 Features and Functions
The EtherDevice Router will manage the bandwidth for outgoing packets. Based on the four outgoing policies below, when the source
IP of the Ethernet traffic matches the outgoing policies, the maximum bandwidth for a packet sent from these source IP addresses will be reserved by its target priority.
If there are only two kinds of traffic packets, priority 0 and priority 1, then transmission will proceed from LAN to WAN1, and the
EtherDevice Router will reserve the minimum bandwidth (10 KBytes/s and 20 Kbyte/s) based on these two different IP addresses. In this case, there are still 100 KBytes/s - 10
KBytes/s - 20 KBytes/s = 70 KBytes/s that do not belong to any priority. So, the EtherDevice Router will increase the bandwidth from highest priority (0) to lowest priority (3). The EtherDevice Router will add this
70 KBytes/s bandwidth to priority 0 because the maximum bandwidth of priority 0 is 100 KBytes/s. The figure to the above right shows the bandwidth arrangement of the EtherDevice Router based on this configuration.
Configuring SNMP
The EtherDevice Router supports SNMP V1/V2c/V3. SNMP V1 and SNMP V2c use a community string match for authentication, which means that SNMP servers access all objects with read-only permissions using the community string public (default value). SNMP V3, which requires that the user selects an authentication level of MD5 or SHA, is the most secure protocol. You can also enable data encryption to enhance data security.
SNMP security modes and security levels supported by the EtherDevice Router are shown in the following table.
Select the security mode and level that will be used to communicate between the SNMP agent and manager.
Protocol
Version
UI Setting
SNMP V1, V2c V1, V2c Read
Community
Authentication Type Data Encryption Method
Community string No Uses a community string match for authentication
SNMP V3 MD5 or SHA Authentication based on MD5 or SHA
No Provides authentication based on HMAC-MD5, or HMAC-SHA algorithms. 8-character passwords are the minimum requirement for authentication.
Provides authentication based MD5 or SHA Authentication based on MD5 or SHA
Data encryption key onHMAC-MD5 or HMAC-SHA algorithms, and data encryption key. 8-character passwords and a data encryption key are the encryption.
These parameters are configured on the SNMP page. A more detailed explanation of each parameter is given below. minimum requirements for authentication and
3-56
EDR-G903/G902
SNMP Read Settings
Features and Functions
SNMP Versions
Setting
Disable
V1, V2c, V3, or
V1, V2c, or
V3 only
Contact Person
Setting
Admin or user
Description
Select the SNMP protocol version used to manage the secure router.
Factory Default
Disable
Description
Admin privilege allows access and authorization to read and write the MIB file. User privilege only allows reading the MIB file, but does give authorization to write.
Factory Default
Admin
Auth. Type
Setting
MD5
SHA
Description
Provides authentication based on the HMAC-MD5 algorithms.
8-character passwords are the minimum requirement for authentication.
Provides authentication based on the HMAC-SHA algorithms.
8-character passwords are the minimum requirement for authentication.
Factory Default
MD5
Data Encryption Key
Setting
Max. 30 Characters
Description
8-character data encryption key is the minimum requirement for data encryption
Factory Default
None
Community Name 1/2
Setting
Max. 30 Characters
Description
Use a community string match for authentication
Factory Default
Public
3-57
EDR-G903/G902 Features and Functions
Access Control
Setting
Read only (Public MIB only)
No Access
Description
Access control type after matching the community string
Factory Default
Read only
Target IP Address
Setting
IP Address
SNMP Trap Type
Description Factory Default
Enter the IP address of the Trap Server used by your network. Read only
SNMP Trap Types can be divided into two basic groups: System Events and Port Events. System Events are related to the overall function of the router, whereas Port Events are related to the activity of a specific port.
System Events
Cold Start
SNMP Trap is sent when…
Power is cut off and then reconnected.
Warm Start The EtherDevice Router is rebooted, such as when network parameters are changed (IP address, subnet mask, etc.).
Power Transition (On-Off) The EtherDevice Router is powered down.
Power Transition (Off-On) The EtherDevice Router is powered up.
DI (Off) Digital Input is triggered by an on to off transition
DI (On)
Config. Change
Auth. Failure
Digital Input is triggered by an off to on transition
A configuration item has been changed.
An incorrect password is entered.
Port Events
Link-ON
Link-OFF
SNMP Trap is sent when…
The port is connected to another device.
The port is disconnected (e.g., the cable is pulled out or the opposing device shuts down).
Using Auto Warning
Since industrial Ethernet devices are often located at the endpoints of a system, these devices will not always know what is happening elsewhere on the network. This means that an industrial Ethernet router that connects to these devices must provide system maintainers with real-time alarm messages. Even when control engineers are out of the control room for an extended period of time, they can still be informed of the status of devices almost instantaneously when exceptions occur. The EtherDevice Router supports different approaches to warn engineers automatically, such as by using email and relay output. It also supports one digital input to integrate sensors with your system and automate alarms using email and relay output.
Configuring Email Warning
The Auto Email Warning function uses e-mail to alert the user when certain user-configured events take place.
Three basic steps are required to set up the Auto Warning function:
3-58
EDR-G903/G902 Features and Functions
1. Configure Email Event Types
Select the desired Event types from the Web Browser Event type page (a description of each event type is given later in the Email Alarm Events setting subsection).
2. Configure Email Settings
To configure the EtherDevice Router’s email setup from a browser interface, enter your Mail Server’s IP/Name
(IP address or name), Account Name, Account Password, the sender’s email address, and the email address to which warning messages will be sent.
3. Activate your settings and if necessary, test the email
After configuring and activating your EtherDevice Router’s Event Types and Email Setup, you can use the Test
Email function to see if your e-mail addresses and mail server address have been properly configured.
Event Type
Email Warning Event Types can be divided into two basic groups: System Events and Port Events. System
Events are related to the overall function of the router, whereas Port Events are related to the activity of a specific port.
System Events
Cold Start
Warning email is sent when…
Power is cut off and then reconnected.
Warm Start The EtherDevice Router is rebooted, such as when network parameters are changed (IP address, subnet mask, etc.).
Power Transition (On-Off) The EtherDevice Router is powered down.
Power Transition (Off-On) The EtherDevice Router is powered up.
DI (Off) Digital Input is triggered by on to off transition
DI (On)
Config. Change
Auth. Failure
Digital Input is triggered by off to on transition
A configuration item has been changed.
An incorrect password is entered.
Port Events
Link-ON
Link-OFF
Warning email is sent when…
The port is connected to another device.
The port is disconnected (e.g., the cable is pulled out or the opposing device shuts down).
3-59
EDR-G903/G902
E-mail Setup
Features and Functions
NOTE
Main Server IP/Name
Setting
IP address
Description
The IP Address of your email server.
Port
Setting
Port number
Account Name
Setting
Max. 30 Characters
Email Password
Setting
Max. 30 characters
Description
The port number of your email server.
Description
Your email account name (typically your user name)
Description
The Password of your email account
Factory Default
None
Factory Default
None
Factory Default
None
Factory Default
None
Sender Email Address
Setting
IP address
Description
The IP Address of the email sender
Factory Default
None
Recipient Email Address
Setting
Max. 50 characters
Description
You can set up to 4 email addresses to receive alarm emails from the EtherDevice Router.
Factory Default
None
Send Test Email
After configuring the email settings, you should first click Activate to activate those settings, and then click
Send Test Email to verify that the settings are correct.
Auto warning e-mail messages will be sent through an authentication protected SMTP server that supports the CRAM-MD5, LOGIN, and PLAIN methods of SASL (Simple Authentication and Security Layer) authentication mechanism. We strongly recommend not entering your Account Name and Account Password if auto warning e-mail messages can be delivered without using an authentication mechanism.
3-60
EDR-G903/G902 Features and Functions
Configuring Relay Warning
The Auto Relay Warning function uses relay output to alert the user when certain user-configured events take place. There are two basic steps required to set up the Relay Warning function:
1. Configuring Relay Event Types
Select the desired Event types from the Web Browser Event type page (a description of each event type is given later in the Relay Alarm Events setting subsection).
2. Activate your settings
After completing the configuration procedure, you will need to activate your EtherDevice Router’s Relay Event
Types.
Event Types can be divided into two basic groups: System Events and Port Events. System Events are related to the overall function of the router, whereas Port Events are related to the activity of a specific port.
System Events
Power Input 1 failure (OnOff)
Power Input 2 failure (OnOff)
DI (Off)
DI (On)
Warning Relay output is triggered when…
Power input 1 is down.
Power input 2 is down.
Digital Input is triggered by on to off transition
Digital Input is triggered by off to on transition
Port Events
Link-ON
Link-OFF
Ignore
Warning Relay output is triggered when…
The port is connected to another device.
The port is disconnected (e.g., the cable is pulled out or the opposing device shuts down).
Ignore the status of the port
Override relay warning settings
Select this option to override the relay warning setting temporarily. Releasing the relay output will allow administrators to fix any problems with the warning condition.
Warning List
Use this table to see if any relay alarms have been issued.
3-61
EDR-G903/G902 Features and Functions
Using Diagnosis
The EtherDevice Router provides Ping tools and LLDP for administrators to diagnose network systems.
Ping
The Ping function uses the ping command to give users a simple but powerful tool for troubleshooting network problems. The function’s most unique feature is that even though the ping command is entered from the user’s
PC keyboard, the actual ping command originates from the EtherDevice Router itself. In this way, the user can essentially control the EtherDevice Router and send ping commands out through its ports. There are two basic steps required to set up the Ping command to test network integrity:
1.
2.
Select which interface will be used to send the ping commands. You may choose from WAN1, WAN2, and
LAN.
Type in the desired IP address, and click Ping.
LLDP Function Overview
Defined by IEEE 802.11AB, Link Layer Discovery Protocol (LLDP) is an OSI Layer 2 Protocol that standardizes the methodology of self-identity advertisement. It allows each networking device, such as a Moxa managed switch/router, to periodically inform its neighbors about itself and its configuration. In this way, all devices will be aware of each other.
The router’s web interface can be used to enable or disable LLDP, and to set the LLDP Message Transmit
Interval. Users can view each switch’s neighbor-list, which is reported by its network neighbors.
LLDP Setting
Enable LLDP
Setting
Enable or Disable
Description
Enable or disable LLDP function.
Factory Default
Enable
Message Transmit Interval
Setting
5 to 32768 sec.
Description Factory Default
Set the transmit interval of LLDP messages. Unit is in seconds. 30 (sec.)
LLDT Table
Port: The port number that connects to the neighbor device.
Neighbor ID: A unique entity that identifies a neighbor device; this is typically the MAC address.
Neighbor Port: The port number of the neighbor device.
3-62
EDR-G903/G902 Features and Functions
Neighbor Port Description: A textual description of the neighbor device’s interface.
Neighbor System: Hostname of the neighbor device.
Using Monitor
You can monitor statistics in real time from the EtherDevice Router’s web console.
Monitor by System
Access the Monitor by selecting “System” from the left selection bar. Monitor by System allows the user to view a graph that shows the combined data transmission activity of all the EtherDevice Router’s 3 ports. Click one of the three options—Total Packets, TX Packets or RX Packets—to view transmission activity of specific types of packets. Recall that TX Packets are packets sent out from the EtherDevice Router, and RX Packets are packets received from connected devices. The Total Packets option displays a graph that combines TX and RX activity.
The graph displays data transmission activity by showing Packets/s (i.e., packets per second, or pps) versus
sec. (seconds).The graph is updated every few seconds, allowing you to analyze data transmission activity in real time.
Monitor by Port
Access the Monitor by Port function by selecting the WAN1, WAN2, or LAN interface from the left drop-down list.
You can view graphs that show All Packets, TX Packets, or RX Packets, but in this case, only for an individual port. The graph displays data transmission activity by showing Packets/s (i.e., packets per second, or pps) versus sec. (seconds).The graph is updated every few seconds, allowing you to analyze data transmission activity in real time.
3-63
EDR-G903/G902 Features and Functions
Using System Log
The EtherDevice Router provides EventLog and Syslog functions to record important events.
Using EventLog
Field
Bootup
Date
Description
This field shows how many times the EDR-G509 has been rebooted or cold started.
The date is updated based on how the current date is set in the “Basic Setting” page.
Time The time is updated based on how the current time is set in the “Basic Setting” page.
System Startup Time The system startup time related to this event.
Event Events that have occurred.
The following events will be recorded in the EtherDevice Router EventLog Table:
Event Status
Syslog
DNS
Static Route
SYSTEMINFO
SNMPTRAP
Filter
NAT
DoS
QoS_Bandwith
QoS_DownStream
QoS_UpStream
DHCP
NTP
SNMP
DDNS
WAN Backup
LAN
WAN2
WAN1
Password
Login
Accessible IP function
Power transition (On -> Off)
Power transition (Off -> On)
DI transition (Off -> On)
Configuration change activated
Configuration change activated
Configuration change activated
Configuration change activated
Configuration change activated
Configuration change activated
Configuration change activated
Configuration change activated
Configuration change activated
Configuration change activated
Configuration change activated
Configuration Change activated/ Enable / Disable
Configuration Change activated/ Enable / Disable
Configuration Change activated/ Enable / Disable
Configuration Change activated/ Enable / Disable
Configuration change activated
Link on / Link off / IP change
Link on / Link off / IP change
Link on / Link off / IP change
Configuration change activated
Authentication Fail / Authentication Pass
Enable / Disable
3-64
EDR-G903/G902 Features and Functions
DI transition (On -> Off)
Cold start
Factory default
System restart
Firmware Upgrade
Configuration Upgrade
Warm start
Warm start
Warm start
Warm start
NOTE
The maximum number of event entries is 1000.
Using Syslog
This function provides the event logs for the syslog server. The function supports 3 configurable syslog servers and syslog server UDP port numbers. When an event occurs, the event will be sent as a syslog UDP packet to the specified syslog servers.
Syslog Server 1/2/3
Setting
IP Address
Port Destination
(1 to 65535)
Description
Enter the IP address of the Syslog Server used by your network.
Enter the UDP port of the Syslog Server.
Factory Default
None
514
Using HTTPs/SSL
To secure your HTTP access, the EtherDevice Router supports HTTPS/SSL to encrypt all HTTP traffic. Perform the following steps to access the EtherDevice Router’s web browser interface via HTTPS/SSL.
1. Open Internet Explorer and type https://< EtherDevice Router’s IP address> in the address field. Press
Enter to establish the connection.
3-65
EDR-G903/G902 Features and Functions
2. A warning message will appear to warn the user that the security certificate was issued by a company they have not chosen to trust.
3. Select Yes to enter the EtherDevice Router’s web browser interface and access the web browser interface secured via HTTPS/SSL.
3-66
A.
A
MIB Groups
The EtherDevice Router comes with built-in SNMP (Simple Network Management Protocol) agent software that supports cold start trap, line up/down trap, and RFC 1213 MIB-II. The standard MIB groups that the
EtherDevice Router series support are:
MIB II.1 – System Group sysORTable
MIB II.2 – Interfaces Group ifTable
MIB II.4 – IP Group ipAddrTable ipNetToMediaTable
IpGroup
IpBasicStatsGroup
IpStatsGroup
MIB II.5 – ICMP Group
IcmpGroup
IcmpInputStatus
IcmpOutputStats
MIB II.6 – TCP Group tcpConnTable
TcpGroup
TcpStats
MIB II.7 – UDP Group udpTable
UdpStats
MIB II.11 – SNMP Group
SnmpBasicGroup
SnmpInputStats
SnmpOutputStats
Public Traps:
1. Cold Start
2. Link Up
3. Link Down
4. Authentication Failure
Private Traps:
1. Configuration Changed
2. Power On
3. Power Off
4. DI Trap
The EtherDevice Router also provides a MIB file, located in the file “Moxa-EDRG903-MIB.my” on the
EtherDevice Router Series utility CD-ROM for SNMP trap message interpretation
advertisement
* Your assessment is very important for improving the workof artificial intelligence, which forms the content of this project