Ethernet Configuration
Introduction
Firewall Presentation
In general, firewalls help protect network security zone perimeters by blocking unauthorized access and permitting authorized access. A firewall is a device or set of devices configured to permit, deny, encrypt, decrypt, or proxy traffic between different security zones based upon a set of rules and other criteria.
Process control devices and high-speed manufacturing machines require fast data throughput and often cannot tolerate the latency introduced by an aggressive security strategy inside the control network. Firewalls, therefore, play a significant role in a security strategy by providing levels of protection at the perimeters of the network. Firewalls are an important part of an overall, system level strategy.
NOTE: Schneider Electric adheres to industry best practices in the development and implemen tation of control systems. This includes a "Defense-in-Depth" approach to secure an Industrial
Control System. This approach places the controllers behind one or more firewalls to restrict access to authorized personnel and protocols only.
WARNING
UNAUTHENTICATED ACCESS AND SUBSEQUENT UNAUTHORIZED MACHINE
OPERATION
Evaluate whether your environment or your machines are connected to your critical infrastructure and, if so, take appropriate steps in terms of prevention, based on Defense-in-
Depth, before connecting the automation system to any network.
Limit the number of devices connected to a network to the minimum necessary.
Isolate your industrial network from other networks inside your company.
Protect any network against unintended access by using firewalls, VPN, or other, proven security measures.
Monitor activities within your systems.
Prevent subject devices from direct access or direct link by unauthorized parties or unauthen ticated actions.
Prepare a recovery plan including backup of your system and process information.
Failure to follow these instructions can result in death, serious injury, or equipment damage.
Firewall Configuration
There are three ways to manage the controller firewall configuration:
Static configuration
Dynamic changes
Application settings
Script files are used in the static configuration and for dynamic changes.
EIO0000004135 09/2020
175
Ethernet Configuration
Static Configuration
The static configuration is loaded at the controller boot.
The controller firewall can be statically configured by managing a default script file located in the controller. The path to this file is /usr/Cfg/FirewallDefault.cmd
.
Dynamic Changes
After the controller boot, the controller firewall configuration can be changed by the use of script files.
There are two ways to load these dynamic changes using:
A physical USB memory key.
A function block
( see page 177 )
in the application.
176
EIO0000004135 09/2020
