Ethernet Configuration
Firewall Configuration Section 11.2
Firewall Configuration
Introduction
This section describes how to configure the firewall of the Modicon M258 Logic Controller.
What Is in This Section?
This section contains the following topics:
Topic
Introduction
Dynamic Changes Procedure
Firewall Behavior
Firewall Script Commands
Page
175
177
178
180
174
EIO0000004135 09/2020
Ethernet Configuration
Introduction
Firewall Presentation
In general, firewalls help protect network security zone perimeters by blocking unauthorized access and permitting authorized access. A firewall is a device or set of devices configured to permit, deny, encrypt, decrypt, or proxy traffic between different security zones based upon a set of rules and other criteria.
Process control devices and high-speed manufacturing machines require fast data throughput and often cannot tolerate the latency introduced by an aggressive security strategy inside the control network. Firewalls, therefore, play a significant role in a security strategy by providing levels of protection at the perimeters of the network. Firewalls are an important part of an overall, system level strategy.
NOTE: Schneider Electric adheres to industry best practices in the development and implemen tation of control systems. This includes a "Defense-in-Depth" approach to secure an Industrial
Control System. This approach places the controllers behind one or more firewalls to restrict access to authorized personnel and protocols only.
WARNING
UNAUTHENTICATED ACCESS AND SUBSEQUENT UNAUTHORIZED MACHINE
OPERATION
Evaluate whether your environment or your machines are connected to your critical infrastructure and, if so, take appropriate steps in terms of prevention, based on Defense-in-
Depth, before connecting the automation system to any network.
Limit the number of devices connected to a network to the minimum necessary.
Isolate your industrial network from other networks inside your company.
Protect any network against unintended access by using firewalls, VPN, or other, proven security measures.
Monitor activities within your systems.
Prevent subject devices from direct access or direct link by unauthorized parties or unauthen ticated actions.
Prepare a recovery plan including backup of your system and process information.
Failure to follow these instructions can result in death, serious injury, or equipment damage.
Firewall Configuration
There are three ways to manage the controller firewall configuration:
Static configuration
Dynamic changes
Application settings
Script files are used in the static configuration and for dynamic changes.
EIO0000004135 09/2020
175
Ethernet Configuration
Static Configuration
The static configuration is loaded at the controller boot.
The controller firewall can be statically configured by managing a default script file located in the controller. The path to this file is /usr/Cfg/FirewallDefault.cmd
.
Dynamic Changes
After the controller boot, the controller firewall configuration can be changed by the use of script files.
There are two ways to load these dynamic changes using:
A physical USB memory key.
A function block
( see page 177 )
in the application.
176
EIO0000004135 09/2020
Ethernet Configuration
Dynamic Changes Procedure
Using a USB Memory Key
This table describes the procedure to execute a script file from a USB memory key:
Step
1
2
3
Action
Create a valid script file
( see page 180
For example, name the script file
) .
FirewallMaintenance.cmd
.
Load the script file on the USB memory key.
For example, load the script file in the usr/Cfg folder.
In the file Sys/Cmd/Script.cmd
, add a code line with the command
Firewall_install "/pathname/FileName"
For example, the code line is
Firewall_install "/bd0/usr/cfg/FirewallMaintenance.cmd"
4 Insert the USB memory key on the controller.
Using a Function Block in the Application
This table describes the procedure to execute a script file from an application:
Step
1
2
3
Action
Create a valid script file
( see page 180
For example, name the script file
) .
FirewallMaintenance.cmd
.
Load the script file in the controller memory.
For example, load the script file in the usr/Syslog folder with FTP.
Use an ExecuteScript function block.
For example, the [SCmd] input is 'Firewall_install
"/usr/Syslog/FirewallMaintenance.cmd"'
EIO0000004135 09/2020
177
Ethernet Configuration
Firewall Behavior
Introduction
The firewall configuration depends on the action done on the controller and the initial configuration state. There are five possible initial states:
There is no default script file in the controller.
A correct script file is present.
An incorrect script file is present.
There is no default script file and the application has configured the firewall.
A dynamic script file configuration has already been executed.
No Default Script File
If...
Boot of the controller
Execute dynamic script file
Execute dynamic incorrect script file
Download application
Then ...
Firewall is not configured. No protection is activated.
Firewall is configured according to the dynamic script file.
Firewall is not configured. No protection is activated.
Firewall is configured according to the application settings.
Default Script File Present
If...
Boot of the controller
Execute dynamic script file
Execute dynamic incorrect script file
Download application
Then ...
Firewall is configured according to the default script file.
The whole configuration of the default script file is deleted.
Firewall is configured according to the dynamic script file.
Firewall is configured according to the default script file.
The dynamic script file is not taken into account.
The whole configuration of the application is ignored.
Firewall is configured according to the default script file.
Incorrect Default Script File Present
If...
Boot of the controller
Execute dynamic script file
Execute dynamic incorrect script file
Download application
Then ...
Firewall is not configured. No protection is activated
Firewall is configured according to the dynamic script file.
Firewall is not configured. No protection is activated.
Firewall is configured according to the application settings.
178
EIO0000004135 09/2020
Ethernet Configuration
Application Settings with No Default Script File
If...
Boot of the controller
Execute dynamic script file
Execute dynamic incorrect script file
Download application
Then ...
Firewall is configured according to the application settings.
The whole configuration of the application settings is deleted.
Firewall is configured according to the dynamic script file.
Firewall is configured according to the application settings. The dynamic script file is not taken into account.
The whole configuration of the previous application is deleted.
Firewall is configured according to the new application settings.
Execute Dynamic Script File Already Executed
If...
Boot of the controller
Execute dynamic script file
Execute dynamic incorrect script file
Download application
Then ...
Firewall is configured according to the dynamic script file configuration (see note).
The whole configuration of the previous dynamic script file is deleted.
Firewall is configured according to the new dynamic script file.
Firewall is configured according to the previous dynamic script file configuration. The dynamic incorrect script file is not taken into account.
The whole configuration of the application is ignored
Firewall is configured according to the dynamic script file.
NOTE: If a USB memory key containing a cybersecurity script is plugged into the controller, booting is blocked. First remove the USB key to correctly boot the controller.
EIO0000004135 09/2020
179
Ethernet Configuration
Firewall Script Commands
Overview
This section describes how script files (default script files or dynamic script files) are written so that they can be executed during the booting of the controller or during a specific command triggered.
NOTE: The MAC layer rules are managed separately and have more priority over other packet filter rules.
Script File Syntax
The syntax of script files is described in Script Syntax Guidelines.
General Firewall Commands
The following commands are available to manage the Ethernet firewall of the M258 Logic
Controller:
Command
Firewall Enable
Firewall Disable
FireWall Eth1 Default Allow
FireWall Eth1 Default Reject
Description
Blocks the frames from the Ethernet interfaces. If no specific
IP address is authorized, it is not possible to communicate on the Ethernet interfaces.
NOTE: By default, when the firewall is enabled, the frames are rejected.
IP addresses can access the controller on the Ethernet interfaces.
Frames are accepted by the controller.
Frames are rejected by the controller.
NOTE: By default, if this line is not present, it corresponds to the command FireWall Eth1 Default Reject .
Specific Firewall Commands
The following commands are available to configure firewall rules for specific ports and addresses:
Command
Firewall Ethx
Allow IP •.•.•.•
Firewall Ethx
Reject IP •.•.•.•
Firewall Ethx
Allow IPs •.•.•.• to •.•.•.•
Range
• = 0...255
• = 0...255
• = 0...255
Description
Frames from the specified IP address are allowed on all port numbers and port types.
Frames from the specified IP address are rejected on all port numbers and port types.
Frames from the IP addresses in the specified range are allowed for all port numbers and port types.
180
EIO0000004135 09/2020
Ethernet Configuration
Command
Firewall Eth1
Reject IPs •.•.•.• to •.•.•.•
Range
• = 0...255
Firewall Eth1
Allow port_type port Y
Y = (destination port
numbers ( see page 183 )
)
Firewall Eth1
Reject port_type port Y
Y = (destination port
numbers ( see page 183 )
)
Description
Frames from the IP addresses in the specified range are rejected for all port numbers and port types.
Frames with the specified destination port number are allowed.
Frames with the specified destination port number are rejected.
NOTE: When IP forwarding is activated, rules with reject port only filter frames with current controller as destination. They are not applied for the frames routed by the current controller.
Frames with a destination port number in the specified range are allowed.
Firewall Eth1
Allow port_type ports Y1 to Y2
Y = (destination port
numbers ( see page 183 )
Firewall Eth1
Reject port_type ports Y1 to Y2
Y = (destination port
numbers ( see page 183 )
Firewall Eth1
Allow IP •.•.•.• on port_type port
Y
• = 0...255
Y = (destination port
numbers ( see page 183 )
Firewall Ethx
Reject IP •.•.•.• on port_type port
Y
• = 0...255
Y = (destination port
numbers ( see page 183 )
Firewall Ethx
Allow IP •.•.•.• on port_type ports
Y1 to Y2
• = 0...255
Y = (destination port
numbers ( see page 183 )
)
)
)
)
Firewall Ethx
Reject IP •.•.•.• on port_type ports
Y1 to Y2
• = 0...255
Y = (destination port
numbers ( see page 183 )
)
Firewall Ethx
Allow IPs
•1.•1.•1.•1 to
•2.•2.•2.•2 on port_type port Y
• = 0...255
Y = (destination port
numbers ( see page 183 )
)
Firewall Ethx
Reject IPs
•1.•1.•1.•1 to
•2.•2.•2.•2 on port_type port Y
• = 0...255
Y = (destination port
numbers ( see page 183 )
)
)
Frames with a destination port number in the specified range are rejected.
Frames from the specified IP address and with the specified destination port number are allowed.
Frames from the specified IP address and with the specified destination port number are rejected.
Frames from the specified IP address and with a destination port number in the specified range are allowed.
Frames from the specified IP address and with a destination port number in the specified range are rejected.
Frames from an IP address in the specified range and with the specified destination port number are allowed.
Frames from an IP address in the specified range and with the specified destination port number are rejected.
EIO0000004135 09/2020
181
Ethernet Configuration
Command
Firewall Ethx
Allow IPs
•1.•1.•1.•1 to
•2.•2.•2.•2 on port_type ports Y1 to Y2
Range
• = 0...255
Y = (destination port
numbers ( see page 183 )
)
Firewall Ethx
Reject IPs
•1.•1.•1.•1 to
•2.•2.•2.•2 on port_type ports Y1 to Y2
• = 0...255
Y = (destination port
numbers ( see page 183 )
)
Firewall Ethx
Allow MAC
••:••:••:••:••:••
• = 0...F
Firewall Ethx
Reject MAC
••:••:••:••:••:••
• = 0...F
Description
Frames from an IP address in the specified range and with a destination port number in the specified range are allowed.
Frames from an IP address in the specified range and with a destination port number in the specified range are rejected.
Frames from the specified MAC address ••:••:••:••:•• are allowed.
NOTE: When the rules to allow the MAC address are applied, only the listed MAC addresses can communicate with the controller, even if other rules are allowed.
Frames with the specified MAC address ••:••:••:••:•• are rejected.
Script Example
; Enable FireWall. All frames are rejected;
FireWall Enable;
; Allow frames on Eth1
FireWall Eth1 Default Allow;
; Block all Modbus Requests on all IP address
Firewall Eth1 Reject tcp port 502;
; Reject frames on Eth2
FireWall Eth2 Default Reject;
; Allow FTP active connection for IP address 85.16.0.17
FireWall Eth2 Allow IP 85.16.0.17 on tcp ports 20 to 21;
NOTE: Characters are limited to 200 per line, including comments.
182
EIO0000004135 09/2020
Ports Used
Protocol
EcoStruxure Machine Expert
FTP
HTTP
Modbus TCP
SNMP
NVL
EtherNet/IP
Destination Port Numbers
UDP 1740, 1741, 1742, 1743
TCP 1105
TCP 21, 20
TCP 80
TCP 502
UDP 161, 162
UDP Default value: 1202
UDP 2222
TCP 44818
Ethernet Configuration
EIO0000004135 09/2020
183
