Industrial Networking Solutions Tips & Tricks

Remote Access Simplified with eWON and Talk2M

2012-02-01T12:37:00.000-06:00

So you're an OEM, System Integrator, or End-User and you'd like to remotely access your PLC for troubleshooting? You purchase a typical industrial VPN router, throw it into your control cabinet, connect the WAN port into the business network for internet access, but then what? Turns out your incoming VPN request and session is dropped by the facility's IT firewall and IT must modify the configuration to allow the VPN. This well-known hurdle has stunted remote access objectives for many years. The hurdle is quite simply most remote access solutions involve traffic that goes the "wrong way" when you consider that IT firewalls appropriately DROP inbound traffic initiated from the "untrusted" outside.

So what if we change the picture? Below, the industrial VPN router initiates an outbound connection (utilizing TCP Port 443 typically used for HTTPS) to the hosted service called Talk2M. Next, the remote user establishes a connection to the same Talk2M service, selects a router to connect to and thereby establishes a bi-directional tunnel to the PLC. The key? While IT firewalls drop inbound traffic initiated from the "untrusted" outside, they typically ALLOW outbound HTTPS and other traffic initiated from the "trusted" inside. Fortunately, the eWON + Talk2M solution requires nothing more!

Below is a more complete picture of the overall solution provided with eWON industrial VPN routers and the hosted Talk2M service. The remote user can communicate through the eWON to serial or Ethernet PLCs, HMIs, etc.

In the following video, watch a remote user connecting to an Allen Bradley PLC with RSLogix over the Talk2M VPN connection.

Finally, a remote access solution leveraging the existing high-speed internet connection at the facility without requiring modifications by the IT department! Also, for cases where no hardwired Internet connection is available, there are eWON models with built-in GSM cellular modems. eWON has changed the game with this very unique solution.

In future posts I will demonstrate how easy it is to get this solution up and running in minutes. Having setup many of the other solutions dozens of times over the last several years, I can easily attest eWON's configuration for remote access is simple, quick, and can be completed with limited networking expertise. Nevertheless if you prefer assistance setting up your first unit, we can certainly walk you through it.

I'd be remiss not to at least mention eWON can also perform some advanced SCADA functions including data logging (drivers for Rockwell/Allen-Bradley, Schneider/Modicon, Omron, Hitachi, Mitsubishi, SNMP), Web HMI, and data push via SMS, E-mail, FTP, web services etc. but I'll save further detail on these options for additional future posts.

Related Posts

Links of Interest

eWON Industrial VPN Routers

Power over Ethernet (PoE) Mode A/Endspan vs. Mode B/Midspan

2011-12-12T13:58:00.001-06:00

Ever found yourself in the situation where you have a Power over Ethernet (PoE) Powered Device (PD) device and Power Sourcing Equipment (PSE) but the two don't seem to be working together? Well you may have fallen down the not-so-well-documented rabbit hole of Mode A vs. Mode B.

Taking a closer look 802.3af PoE, you'll find two different sub-standards of 802.3af associated with 10/100 TX Ethernet, namely Mode A and Mode B. The main difference is best illustrated with the following diagrams.

The diagram above shows a PSE supplying power on top of the 10/100 TX data on pins 1,2,3,and 6. PSE providing "phantom" power on the data pairs is known as Mode A, or Endspan.

This diagram above shows a PSE supplying power on pins 4,5, 7, and 8, the "spare" pairs in an Ethernet cable running 10/100 TX. PSE providing power on the spare pairs is known as Mode B, or Midspan. Most "injector" devices (as opposed to full switches) are Mode B.

And here come the "Gotchas." While PDs must support BOTH Mode A and Mode B to be compliant with the 802.3af standard, there is no such requirement for PSEs. There are a few different ways this can lead to mistakes.

1) You might assume your device is 802.3af compliant because it is listed as PoE-capable, but this is not always the case. A recent customer had a PoE-capable Ethernet/IP Rotary Shaft Encoder, but closer datasheet inspection revealed it was not 802.3af compliant. As it turned out, this was only a 4-wire device and therefore incompatible with the customer's existing Mode B PSE. We supplied a Mode A PSE and resolved the issue.

2) In addition to no requirement for PSEs to perform BOTH Mode A and Mode B, many vendors' documentation doesn't state which mode their device utilizes.This makes it challenging to locate the proper equipment for scenarios like the one above.

3) You must confirm specific model numbers and operation. We came across one vendor's PoE switch whose generic datasheet listed Mode A and Mode B and offered two part numbers ending in A and B with PoE Mode as the only difference between the two. Only upon close inspection did we notice the A part number utilized Mode B and the B part number utilized Mode A. Crazy enough?

As we receive confirmation from our vendors, we will be maintaining this list of PSE equipment we offer and the associated operational mode.

Mode A/Endspan
Moxa Switches

Mode B/Midspan
Esteem Injectors
Mobotix Injectors
Moxa Injectors

Links of Interest

How to provision a Verizon Sierra Wireless Airlink Raven X, XT and XE modem

2011-12-10T11:13:00.000-06:00

Sierra Wireless Airlink modems and gateways have a permanent

identification sticker affixed to the device. In addition to serial number and other information, the Sierra Wireless model name and number is listed. The last character in the model number denotes the carrier the device will work with. In the case below "V" is Verizon.

The factory default settings of Verizon Sierra Wireless AirlinkRaven X, XT and XE modem are set to automatically register and provisionthemselves on the Verizon network. When the modem is powered on with an antennaconnected, the modem will send the ESN (Electronic Serial Number) of the deviceto the Verizon Network. If the modem is located in a Verizon primary coveragearea and the correct ESN of the device was used to create an account withVerizon, the modem will register and connect to the network.

If the modem has previously been active on a Verizon account and that account is now inactive or changed, the unit may need to be re-initialized to register on the network. This requires returning the modem to factory default settings. It is recommend to save any custom changes you have made to the unit to a template file prior to manual initialization.

Manual Initialization
To factory default and re-initialize the modem on the Verizon network, hold in the reset button on the front of the unit and hold until the lights chase back and forth. Reset the modem power connection. If the modem ESN is associated with an active Verizon account, it will connect to the network.

Software Initialization
To software re-initialize the modem on the Verizon network, connect to the modem using Ace Manger Web. Navigate to the WAN/Cellular tab and open the Re-Activation section. Select the Re-Activation button to start the process.

The modem will reset and if the modem ESN is associated with an active Verizon account, it will connect to the network.

eWON Config Post 4: Connect to eWON and Remote Devices using eCatcher

2011-12-07T23:17:00.001-06:00

In this post, we'll go through the steps required to connect to your eWON and remote devices using eCatcher. This post assumes you've completed all the other steps in this series. If you haven't, begin with the Related Posts referenced at the bottom of this post.

Ok, we've made it to the fun part. You're back at your office, hotel, etc. and you want to connect to your eWON in the field, and more importantly the PLC or other Ethernet device behind it. Open eCatcher, log in, and you should see your eWONs listed including their "Online" or "Offline" status (whether the eWON is connected to Talk2M).

You highlight the eWON you want to connect to and hit the green "Connect" button. You should then see a Vpn Connection popup dialog that steps through the following:

On the unfortunate occasion you see the following, it means the LAN subnet at your office overlaps the LAN subnet of the eWON/PLC and as this is a networking no-no, one subnet or the other will need to change for this scenario to work.

If all goes well; however, you should end up with a screen like below. You see now that you have an active connection listed.

Clicking the URL in the "Active Connection" list will take you to the eWON's web configuration if you have anything to check out there.

More importantly though, you should now be able to perform any Ethernet tasks with the PLC, etc. just as if you are connected on-site local to the device! How easy was that?

Related Posts

Links of Interest

eWON Industrial VPN Routers

eWON Config Post 3: Configure eWON Connection to Talk2M

2011-12-07T22:37:00.001-06:00

In this post, we'll go through the steps required to get your eWON connected to Talk2M. This post assumes you've already taken the preliminary steps of Updating eBuddy, Setting the eWON IP Address, Upgrading eWON Firmware and connected your eWON to the Internet via a Hardwired connection or Cellular connection.

The first step in this process is acquiring credentials for your eWON to join Talk2M and this procedure is completed using eCatcher. If you haven't already done so, download and install eCatcher. Find the latest version here:
http://www.ewon.us/us/Support/software-download.html

Running eCatcher should present the following Login dialog. Assuming you don't yet have a Talk2M Free+ account, click the "Create a Free+ account" hyperlink located below the "Account" dialog box.

Complete the following form to create your account.

After your account is created, log in using your new credentials. Your eWON list will be empty. I already had one device tied to my account but I will be adding a new unit here to demonstrate the complete process. First, click the "+" sign just below "eWON list."

Here you will type a name for the eWON you want to add, a description, and the connection type. The connection type confirms how the eWON is connected to the Internet. Select "LAN/DSL" for hardwired-connected eWONs and "GPRS/EDGE" for cellular-connected eWONs.

You should now see the eWON you just added in the list. Under "eWON list", select the Gears icon located just to the right of the "+" icon.

From this page you select the Wrench icon, the third available icon under "eWON Detail."

And here's what we've been working for. Copy the Activation Key shown here; we will be using this in the Talk2M configuration wizard of the eWON in an upcoming step. NOTE: I strongly encourage you save this key into a notepad document, in case you want to perform the next step at a later date or time.

With your PC configured such that it can reach the eWON LAN IP, type in the eWON LAN IP into your browser to reach its web configuration. You'll still be using device defaults "adm" username and "adm" password until you configure otherwise. After selecting "Configuration" at the top right and then selecting "Wizards" on the subsequent page you should see this.

After selecting the "Configure Talk2M connectivity" icon, hit "Next > >" on the first screen, then select "Register with ACTIVATION KEY" and paste the key you copied from eCatcher earlier. Hit "Next > >"

The eWON will step through a series of tests and if all goes well you should see the following. Hit "Done."

This confirms that your eWON is successfully connected to Talk2M. Let's continue by Connecting to the eWON and Remote Devices using eCatcher.

Related Posts

Links of Interest

eWON Industrial VPN Routers

eWON Config Post 2b: Configure eWON Internet Access (Cellular)

2011-12-07T22:11:00.001-06:00

In this post, we'll go through the steps required to get your eWON connected to the Internet (Cellular). This post assumes you've already taken the preliminary steps of Updating eBuddy, Upgrading eWON Firmware, and Setting the eWON IP Address.

With your PC configured such that it can reach the eWON LAN IP, type in the eWON LAN IP into your browser to reach its web configuration. You'll still be using device defaults "adm" username and "adm" password until you configure otherwise. You should see the following page.

After selecting "Configuration" at the top right of the above screen, you should now see the following:

Selecting "Wizards" leads you to this.

Next you select the button for "Configure INTERNET Connection" and for Cellular Internet utilizing a SIM card inserted in the eWON you select "Modem Connection" as shown below. Ensure the check box for "Initialize configuration first" remains checked and select "Next > >"

On the following page, you configure the GSM Modem connection properties. For AT&T, all that is required is the APN which you should have received from the party that activated your SIM. Hit "Next > >" again.

Here you can configure the "Go Online" trigger which controls when the eWON connects to the cellular network. Users attempting to minimize cellular data usage should consider the options presented here. For the purposes of this lesson, we continue here with "Maintain connection" such that the eWON will connect at the end of the Wizard without any additional configuration.

Even if selecting "Maintain connection" you may configure some parameters here to avoid a persistent cellular connection when no data is passing through the eWON.

The next screen allows you to test your Internet connection. Leave the "Test online address" option checked and select "Test > >" The eWON will step through a series of tests and if all goes well you should see the following.

This confirms that your eWON is successfully connected to the Internet. Let's continue by Configuring eWON Connection to Talk2M.

Related Posts

Links of Interest

eWON Industrial VPN Routers

eWON Config Post 2a: Configure eWON Internet Access (Hardwired)

2011-12-07T21:50:00.001-06:00

In this post, we'll go through the steps required to get your eWON connected to the Internet (Hardwired). This post assumes you've already taken the preliminary steps of Updating eBuddy, Setting the eWON IP Address, and Updating eWON Firmware.

With your PC configured such that it can reach the eWON LAN IP, type in the eWON LAN IP into your browser to reach its web configuration. You'll still be using device defaults "adm" username and "adm" password until you configure otherwise. You should see the following page.

After selecting "Configuration" at the top right of the above screen, you should now see the following:

Selecting "Wizards" leads you to this.

Next you select the button for "Configure INTERNET Connection" and for hardwired Internet connected to the eWON's WAN port you select "Ethernet WAN connection" as shown below. Ensure the check box for "Initialize configuration first" remains checked and select "Next > >"

On the following page, you configure the WAN connection properties. In many cases, the eWON can simply be left at the defaults of DHCP and DNS via DHCP. Hit "Next > >" again.

This confirms that your eWON is successfully connected to the Internet. Let's continue by Configuring eWON Connection to Talk2M.

Related Posts

Links of Interest

eWON Industrial VPN Routers

eWON Config Post 1: Update eBuddy, Set eWON IP Address, and Upgrade eWON Firmware

2011-12-07T21:01:00.001-06:00

This is the first in a series of posts demonstrating configuration of eWON for remote access. The first step is to visit eWON's support site to download the required software packages: eBuddy and eCatcher.
http://www.ewon.us/us/Support/software-download.html

With your PC still connected to the Internet, let's ensure eBuddy has all the latest firmware packages available for your eWON. After installing and running the application, you should see the following screen. You may need to toggle View-Wizard View to see the layout below.

After selecting "Update eBuddy" above and selecting "Internet" as the source for updates, you arrive at the following screen. Here you select which eWON products and languages to download updates for. I recommend selecting the specific product of interest (Example: eWON 4005CD) and selecting your language of choice. Hit "Next >>" to complete the eBuddy update process.

Next, after connecting your PC to one of the eWON's LAN ports, you select "Set IP Address." Rather than typing in the requested serial number you can simply hit "Browse" and eBuddy will list any locally connected eWONs. Selecting "OK" here will populate the serial number onto the previous page.

After filling in the device defaults "adm" username and "adm" password, you will reach this next screen where you configure the desired LAN IP of the eWON. This address should be an available address in the same subnet of the PLC or other Ethernet device you intend to connect to remotely. Example: if your PLC is 192.168.3.10 255.255.255.0, and 192.168.3.254 is currently unused, you assign that address to the eWON here.

You will see that the "Update request sent successfully" followed soon after with "eWON updated successfully."

You may also use the above step to assign a temporary address to the eWON for the purposes of upgrading firmware as this step requires the eWON LAN IP to be in the same subnet as the eBuddy PC. After completing the required addressing, you select "Update Firmware" at the eBuddy homepage. Using the same "Browse" function as before, select your eWON and hit "OK." You'll then see this screen which confirms the current firmware running on the eWON and allows you to select which firmware to use for update. Hit "Next > >" and again you will see visual confirmation of the update request and eventual update success.

With everything updated, let's continue by configuring your eWON for Internet access. Select the appropriate link below.

Related Posts

Links of Interest

eWON Industrial VPN Routers

Aggregate Multiple WAN Connections and Distribute Traffic with Peplink Balance Routers

2011-11-07T12:05:00.001-06:00

Would you like to take advantage of multiple WAN connections? There are many solutions that can accommodate this for redundancy and perhaps some speed increase; however Peplink's solution is truly unique in the fact that in can completely aggregate the bandwidth of multiple connections of DSL, cable, cellular, etc. when you put an appliance at each end of the connection to created a bonded VPN tunnel. We have deployed Peplink Balance routers for a number of customers with great results including bonding multiple cellular connections in areas with no hardwired internet available. Check out this brief video for an overview of their bonding technology.

In either a bonded (pair of appliances) or non-bonded (one appliance) scenario, Peplink also provides 7 different load balancing algorithms to help you easily fine-tune how traffic is distributed across connections.

Weighted Balance
Assign more traffic to a faster link or less traffic to a connection with a bandwidth cap.

Set a weight on the scale for each connection and outgoing traffic will be proportionally distributed according to the specified ratio. (e.g. 1:3:2)

Priority
Route traffic to your preferred link as long as it's available.

Arrange the connection priority order, and traffic will be routed through the healthy link that has the highest priority in the list. Lower priority links will only be used if the current connection fails.

Overflow
Prevent traffic flow from slowing down when the connection runs out of available bandwidth.

Drag and drop to arrange the connection overflow order and the highest priority link will route traffic as long as it has not been congested. Once it saturates, the lower priority links will start routing traffic.

Persistence
Eliminate session termination issue for HTTPS, E-banking, and other secure websites.

Specify a traffic type and it will be routed through the same connection persistently based on its source and/or destination IP addresses. Traffic will keep routing on the same connection until the session ends.

Least Used
Help you choose the better connection with more free bandwidth.

Traffic will be directed to the link with the most available bandwidth among the selected connections.

Lowest Latency
Give you the fastest response time when using applications like online gaming.

Traffic will be assigned to the link with the lowest latency time among the selected connections.

Enforced
Restrict outbound traffic to a particular connection.

Select a connection and the specified traffic type will be routed through it at all times, whether the link is up or down.
For scenarios like accessing a server that only allows users from a specific IP.

Give us a shout if you'd like to discuss your multi-WAN application.

Links of Interest

Peplink Balance Routers

Configure IGMP on Moxa Managed Switches

2011-10-20T10:50:00.001-05:00

Once a user learns about the potential impacts of multicasting (such as Allen Bradley Produce/Consume messaging) on a network that isn't configured for it, the next question is often "How do I configure my switches for it?" There isn't a perfect answer to this question as it can vary slightly with application, topology, producer/consumer location, etc; however, the following is a good general configuration to use at a minimum.

Let's look at what we've configured in the above screenshot:

1) We enabled IGMP Snooping globally for the switch.

2) We enabled IGMP Snooping Enhanced Mode. Moxa recommends enabling this setting only if the network is all Moxa switches. If there are Cisco or other third party switches in the network, leave this setting disabled.

3) We enabled IGMP Snooping and Querier for the particular VLAN (only default VLAN available in this example).

You can use the above for all managed switches in the network. It's ok to set multiple switches as queriers because Moxa uses Protocol Version 2. This version includes an election process so only one switch will actively perform the querier role, but you'll have others available to perform the task if that switch goes down.

Links of Interest

Moxa Industrial Managed Ethernet Switches

Upgrade Firmware on Hirschmann Managed Switches

2011-10-17T12:14:00.000-05:00

Hirschmann often releases new firmware for their managed switches, not only for bugfixes but often to increase functionality and take advantage of new features that have been implemented. In this post, we will step through the process of upgrading the firmware on a Hirschmann managed switch.

First, you need to confirm the type of switch by logging into the web interface and looking at the Basic Settings>System page. Under Basic Module you see here we have an RS30.

Next, we head over to the Hirschmann US FTP Site to grab the latest firmware. Set the site's language to English in the top right corner and simply search for the switch type, here "RS30". After selecting one of the results, go to the Downloads tab and under Software you can confirm that the Firmware works for your switch. Here we see the selected package works for the RS20, RS30, RS40, etc. Click on the Download link; you'll need to register an account if you don't have one already.

The package you download will be a ZIP archive, so extract the archive to see its contents. You'll see several different files, and I'll show you next how to zero in. On the Basic Settings>Software page, look at the "Running Version" of software. Here we see whether the software is Layer 2 (L2) or Layer 3 (L3), as well as whether is is Enhanced (E) or Professional (P). In our case, you see we are running L2E, or Layer 2-Enhanced.

Next click the "..." button located to the left of Update, and this will allow you to locate the firmware file you'd like to push to the switch. Navigate to the folder you extracted in the previous step. You'll want to pick the corresponding selection based on the info you discovered above, so here we will select the .bin package for L2E.

After the path has loaded, hit the Update button.

After a minute or so, you should receive an "Upgrade completed successfully" popup message. After hitting OK, hit the Reload button at the bottom of the Software page. Now you see that while the Running Version is still the original L2E-6.0.02, the Stored Version is now L2E-7.0.00. Clearly one more step remains.

In order for the switch to begin running the new firmware package, we must reboot the switch. This can be done by going to Basic Settings>Restart>Cold Start and confirming the Cold Start. NOTE: Initiating a Cold Start will reboot the switch and impact the network! This should only be done at a time when a brief switch outage is acceptable.

After the switch completes its reboot, a quick login to the device will reveal on the Basic Settings>Software page that now the Running Version = Stored Version = latest version!

Links of Interest

Hirschmann Industrial Managed Ethernet Switches

Configure Mobotix Camera Recording using Exus Mx-Config Wizard

2011-10-17T12:12:00.000-05:00

One of the absolute coolest features of the Exus QStor QMX Storage Solution products is the MX-Config wizard provided via the web interface of the device. This wizard allows the QMX to locate all of the Mobotix cameras on the network and configure them for basic recording to the QMX! This is an incredible time-saver when deploying a new system, not to mention that it cuts down on potential errors when having to configure the cameras individually.

After logging into the web interface, go to Mobotix>Mx-Config, then hit the "Camera Wizzard" button.

The QMX scans the network and returns all of the Mobotix cameras found. In this example, I only have a single camera; however this process works seamlessly for multiple cameras.

As noted by the red text, you'll need to run the wizard one time for each unique admin password assigned to your cameras. If your cameras all share a common admin password, it will only take one run-through to configure them all. Simply type in the admin password to your cameras on this page.

Skipping the step regarding address configuration, you now confirm the Target NIC and Target Share that you want the cameras to use.

On this page, you can set basic recording properties including resolution, quality, snapshot/event/continuous, etc. As noted in red, the QMX will even perform the necessary math for you to divide the available storage capacity by the number of cameras selected in the initial import!

On this page, you can configure the cameras to sync their time with the QMX.

Finally, the QMX will begin writing configuration changes to all the cameras.

Upon completion, you will see confirmation of "Recording active" for all the cameras you configured. You can make small modifications on this screen by first stopping the recording of individual cameras, or you can of course tweak individual camera recording settings at the cameras themselves.

Links of Interest

Hirschmann Industrial HiVision Network Management Software - Part 1

2011-10-13T18:45:00.000-05:00

Note, for all videos I encourage you to click on the Fullscreen button at the bottom of the player window and check them out in the best possible quality (720p HD). A YouTube bug sometimes requires that you toggle in and out of Fullscreen to truly invoke the resolution change after selecting 720p for example.

So, you bought those fancy managed switches but still find yourself running around, hunting down the cause of problems, sometimes without even an idea of where best to start looking? What if someone else could look for you? Better yet, what if someone could watch the network for you 24/7 and alert you of issues as they happen? Herein lies the value of Network Management Software (NMS), and in these videos I will show what makes Hirschmann's Industrial HiVision (IHV) one of the best NMS packages available.

In this first video, IHV discovers all of the managed switches in the network and then "maps" the network topology showing you how all the switches are connected, down to identifying the port numbers.

In the second video, I am demonstrating what IHV shows when one of your connections goes down in the field. In a ring topology such as the one in the video, it is very beneficial to know when this first break occurs as it allows you to investigate and remedy the issue before a second break occurs which would break communication. Without "watching" the network, you are not utilizing the full benefits of a redundant topology.

In this clip I demonstrate a myriad of diagnostic and configuration tools made easily accessible through IHV: ping, telnet, switch web interface, trap destination configuration, IP configuration, and system wide diagnostics such as port statuses, firmware versions, etc.

IHV is licensed as a server application. Once installing the server application on the machine of choice, there are three different client methods to access the server. One is the standalone installable software client you have been looking at in the previous videos. The second method, shown here is the web client. Simply open a browser on any machine on the network, point it to the server and you have the fully functional web client. You don't have to install anything extra to access the software from any machine with a web browser! Also, there are no licensing restrictions on the number of client connections to the server.

The third client method is an Active-X client. I demonstrate the Active-X client here in a web browser; but the more practical application is dropping this Active-X object into your HMI. Create a blank new graphic, drop in this Active-X object, point it to the server, and your "Network Monitoring" graphic development is complete in a matter of minutes!

I think the features of Industrial HiVision are outstanding, and we're just getting started. You might have noticed the title of this post ended with "Part 1." I plan to cover additional features which are perhaps even more impressive in a future post.

Links of Interest

Configure VLANs on Moxa Managed Switches

2011-10-10T08:37:00.001-05:00

Moxa managed switchessupport two different VLAN (Virtual Local Area Networks) “modes”: 802.1Q andPort-based. Since 802.1Q is used more often and considering thismode is interoperable with VLANs from other vendors, I will focus on 802.1Q modehere.

In regards toVLANs on Moxa Managed Switches, the administrator should recognize thefollowing. An individual port on any switch shall be either an access port (asingle device will be connected to this port for network access) or a trunkport (intended for switch to switch connections and thus must carry all VLANinformation). Configuring a port as an access or trunk port is done on a singlepage in the web configuration of the switch. The page is Virtual LAN-VLANSettings as shown below. You see here I am showing the two options for the VLANMode:

Having selected 802.1Q mode in this example, we continue by assigning thefirst three ports as access ports in VLAN 1, the next three ports as accessports in VLAN 2, and the final two ports are trunk ports carrying bothVLANs. This is typical of what you might see in a Turbo Ring topology withVLANs. Unless there is an explicit need otherwise, all trunk ports areconfigured with Port VLAN ID 1 and all access ports are configured with PortVLAN ID XXX, where XXX represents the appropriate VLAN. Make sure to hit “Activate”at the bottom of the page if you want to set and save your changes.

Another thing to payattention to on the page above is the Management VLAN ID assignment. Understandthat the web configuration of the device will only be reachable if you have accessto the VLAN assigned here, so be careful! If for example, you left theManagement VLAN ID as 1 and changed all ports to access ports in VLAN 2, youwould have no method to access the switch! At that point, the only remedy wouldinvolve getting into the switch via console cable.

Links of Interest

Moxa Industrial Managed Ethernet Switches

Endian - VPN Flexibility

2011-10-07T10:39:00.000-05:00

One of my favorite things about Endian is how absolutely flexible their products are when it comes to VPN functionality. Endian supports both IPSec and OpenVPN and therefore can connect with many different devices and software clients. Here are just a few examples I’ve tested successfully in our lab.

Let's start with making a site-to-site OpenVPN connection between two Endian appliances:

Next, how about connecting to an appliance from a different manufacturer? Here we connect a Moxa EDR-G903 to an Endian via IPSec:

What about a cellular modem? In this drawing we connect a Sierra Wireless Airlink Raven X directly to an Endian over IPSec:

Finally, what about Road Warrior connections? In this YouTube clip, I demonstrate my laptop connecting to an Endian appliance with FOUR different software clients (one IPSec and three OpenVPN):

I’ve tested a number of other scenarios as well, but I think my point is clear: Endian offers extreme flexibility for VPN connectivity.

Links of Interest

Configure VLANs on Hirschmann Managed Switches

2011-10-07T10:35:00.000-05:00

In regards to VLANs (Virtual Local Area Networks) onHirschmann Managed Switches, the administrator should recognize the following.An individual port on any switch shall be either an access port (a singledevice will be connected to this port for network access) or a trunk port(intended for switch to switch connections and thus may carry multiple VLANs).

Configuring a port as an access or trunk port is donethrough two different pages in the web configuration of the switch. The firstpage is Switching-VLAN-Port as shown below. In this example, the first twoports are trunk ports and all remaining ports are access ports for VLAN 101. You see that unless there is an explicitneed otherwise, all trunk ports are configured with Port VLAN ID 1 and allaccess ports are configured with Port VLAN ID XXX, where XXX represents theappropriate VLAN.

Using the same example (first two ports trunk, all remainingaccess ports in 101), the following is configured on the second pageSwitching-VLAN-Static. All trunk ports are configured “U” for VLAN ID 1 and “M”for all remaining VLANs. Furthermore, all access ports are configured “U” forthe appropriate VLAN and “-“ for all other VLANs. The meanings of -, M, and Uare as follows:

- not a member of the VLAN
M a member of the VLAN - packet is sent with tag
U a member of the VLAN - packet is sent without tag

Links of Interest

Hirschmann Industrial Managed Ethernet Switches

Correct Ghosting Problem on Mobotix IP Camera

2011-10-05T13:38:00.002-05:00

When setting up a Mobotix IP Camera for the first time, you will soon notice that the recorded images often exhibit ghosting on people walking in front of the camera. See example below.

Mobotix Tech Support confirms this is due to an odd factory default setting in the camera. They explain further that although the Mobotix camera does not have a shutter speed setting since it has no moving parts, there is a roughly equivalent software parameter that needs to be modified.

Under Setup Menu>Exposure Settings>Exposure Time>Max. Exposure Time (Independent settings for each lens), this setting defaults to 1/5 which is terrible for walking people, etc. It is heavily recommended to change this setting to 1/30 or 1/60 to see which works better in your application.

With this change, the live image might not always look perfect but the recorded images of people in motion will show substantial improvement. Note: you are not to adjust the Min. Exposure Time, only the Max. As always, don't forget to set your changes store the complete configuration to flash before exiting the camera.

Links of Interest

Mobotix IP Video Solutions

How to configure Routing and Port Forwarding in a Sierra Wireless modem

2011-10-04T07:50:00.000-05:00

Depending on the firmware version of your modem, you may need to change the following settings to allow the Public IP address assigned to you by the carrier to be used by multiple attached devices. The settings are labeled as "Public" mode and "Private" mode in the modem LAN settings. Public Mode will provide the carrier assigned IP settings directly to an attached client device though the modem Ethernet port transparently. This mode will only support one Ethernet client device and disables all routing and firewall functionality on the modem.

In the "Private" mode the modem will provide routing and address translation between the carrier assigned IP settings and a private LAN attached to the modem. By default, when this mode is active, all inbound WAN to LAN traffic is blocked and DHCP is enabled with a network of 192.168.13.0/24 providing a primary gateway for the LAN of 192.168.31.31 allowing a possible 253 usable LAN addresses. A switch can be connected to the modem to accommodate the desired number of devices on the LAN.

Access to devices on the modem LAN from the carrier assigned IP address is accomplished by using port forwarding. Port forwarding uses the carrier assigned IP address plus a designated port number to access a particular device on the LAN. Port numbers are registered with the Internet Assigned Numbers Authority and range from 0 to 49000. Many well known port numbers used for services include 80 for HTTP, 21 for FTP, 443 for SSL and 502 for Mod-bus TCP. The port numbers in the modem are configurable and will pass both TCP and UDP protocols when enabled.

The choice of port number is usually based on the software application used to access the end device. A mobile terminated static IP provided by the carrier is recommended for port forwarding applications. Some carriers restrict predefined port number ranges on their network, therefore, it is suggested you check with the carrier before provisioning service.

In the example below, a mobile terminated public address of 166.111.111.111 is assigned to the modem by the carrier. Three devices on the LAN of the modem need to be accessed 192.168.13.100 @ port 502, 192.168.13.101@ port 8080 and 192.168.13.102@ port 4001.

Ace Manager Web

(Ace Manager classic for windows is not recommend for port forwarding configuration)
Connect to the modem with Ace Manager Web. Navigate to the LAN tab. Choose the drop down box on the Host Public Mode and select All Hosts Use Private IP. Apply the change to the modem.

Navigate to the Security tab> Port Forwarding. Select the Add More button fill in the Public Start Port and Public End Port. The Ethernet interface is selected by default and is recommended for most applications. Enter the Host IP (this is the modem LAN IP address on the device you are forwarding to). Enter the Private Port (this is the modem LAN port number address on the device you are forwarding to). Continue to select the Add More button for each entry required. When finished enter the total number of rules listed in the Number of PF Entries field. Apply and reboot the modem.

The modem will now pass connections from the entered Public Port information and rout it to the designated private LAN device. Because of the difference in Ethernet chip sets and possible synchronization issues, we recommend to "Hard code" the LAN IP settings in the Ethernet settings of client devices.

Related Posts

How to configure a sierra wireless modem to pass the public IP tp an attached device

Links of Interest

Hirschmann Spider Switches

Clear Fault Light and Remove Power Supply 2 Alarm on Hirschmann Managed Switch

2011-10-03T13:29:00.001-05:00

Hirschmann Managed Switches have redundant power supply inputs which are a great feature; however, many users don’t take advantage of them for a variety of reasons. In these cases, the unused benefit can become a nuisance. This is because by default, the managed switch monitors for power on both Power Supply 1 and Power Supply 2 inputs and flags it as a fault when either is missing. This fault is presented as both a red fault light on the front of the switch, and as an alarm in the Web Management of the switch. There are three solutions to this issue:

1) Take full advantage of the feature and provide secondary power to the switch.

2) Jumper Power Supply 1 to Power Supply 2 to “trick” the switch into thinking secondary power is connected.

3) Disable monitoring of Power Supply 2 through the Web Management of the switch.

I’m going to show you how to accomplish #3. First, let’s look at the alarm in question. On the Basic Settings>System Page, you see we have a nasty red alarm indicating Power Supply 2 failure.

To disable the monitoring, let’s visit the Diagnostics>Device Status page. Here, we will modify the Monitoring Status of Power Supply 2 from “Monitor” to “Ignore” and then hit Set down at the bottom of the page.

If you’re near the switch, you’ll hear and see the fault light click off. Similarly, if we go back to the Basic Settings>System page we see that the alarm has cleared.

Also, If you’re using the Signal Contact output of the switch, you need to make a similar change on the Diagnostics>Signal Contact page as shown below:

Finally as always, don’t forget to save your changes to NVRAM before leaving the switch. Basic Settings>Load/Save>Save-ToDevice>Save!

Links of Interest

Hirschmann Industrial Managed Ethernet Switches

Display Frame Rate in Live Image of Mobotix IP Camera

2011-10-03T12:38:00.001-05:00

When configuring a Mobotix IP Camera for the best balance of resolution, quality, and frame rate, it can help to display the current frame rate on the live image so you can see the frame rate while making adjustments. Let’s take a look at how to accomplish just that.

You see here that to begin, we have no text in the top left corner of our live image:

Open the Setup Menu and select Text & Display Settings.

We will be populating the empty window to the left of “Comment”. If you’d like to take a look at all the various items you can display, feel free to click on the “comment variables” and “variables” hyperlinks over to the right.

Using the second link we see that $(IMG.FRJ) is described as the Frame rate of JPEG/MxPEG conversion so this is what we will use.

In the empty dialog box, I place “$(IMG.FRJ ) FPS” and then hit Set down at the bottom to apply my changes. I choose to put three spaces after the variable to allow for room and “FPS” as shorthand for frames per second.

Now we see the frame rate displayed in the live image. You’ll notice this frame rate go up and down with various configuration, and you can use this as a guide to reach your ideal balance. As a note, the human eye typically perceives anything at 13 FPS or higher as full motion.

Links of Interest

Mobotix IP Video Solutions

Assign an IP Address to a Hirschmann Managed Switch using HiDiscovery

2011-10-03T11:55:00.002-05:00

The first configuration step for a brand new switch is the assignment of a management IP address. The easiest way to accomplish this is using the HiDiscovery application.

1) Install the HiDiscovery application onto your laptop. The latest version of the software can be downloaded from Hirschmann’s FTP site:

ftp://ftp.hirschmann-usa.com/INET-IndustrialNetworking/Software/HiDiscovery/

2) Power up the switch.

3) Connect an Ethernet cable between your laptop and the switch.

4) Open the HiDiscovery application on your laptop and you will see the following. HiDiscovery will list all Hirschmann switches on the same layer 2 connected network.

5) To configure the IP address, simply double click on the switch you want to configure (identified by the switch’s MAC address) and the following dialog box will appear.

6) Configure the addressing, hit OK, and the changes will be saved to the switch.

7) All switch features can now be accessed via the web interface at the address that was just configured!

Links of Interest

Hirschmann Industrial Managed Ethernet Switches

Industrial Security Appliance Product Selection

2011-09-30T19:06:00.009-05:00

We sell several different Industrial Security Appliances and one of the obvious questions is why so many? The answer is quite simply that each of the products have some unique benefits making it the better fit for a certain application. We created a document to aid in the selection process; this document highlights the unique features of each appliance and then compares them all in a fairly comprehensive feature matrix.

First, let's look at the unique features:

Next, we can use the following to compare all the major specifications and features:

This comparison actually only covers what I consider to be "traditional" Industrial Security Appliances. We also have product offerings such as Eagle20 Tofino from Hirschmann for more comprehensive SCADA security and M2M remote access routers from eWON. Bottom line: we have a solution for your application. If you need help making the right selection, let us talk you through it.

Links of Interest

How to configure a Sierra Wireless modem to pass the public IP to an attached device

2011-09-30T14:10:00.000-05:00

Depending on the firmware version of your modem, you may need to change the following settings to allow the Public IP address assigned to you by the carrier to be used by an attached device. The settings are labeled as "Public" mode and "Private" mode in the modem LAN settings. Public Mode will provide the carrier assigned IP settings directly to an attached client device though the modem Ethernet port transparently. This mode will only support one Ethernet client device and disables all routing and firewall functionality on the modem.

There are currently two different interfaces available to manage Sierra Wireless devices:

Ace Manager Classic for Windows

Connect to the modem with Ace Manager classic for windows. Navigate to the PPP/Ethernet page. Choose the drop down box on the New Value column and select 0 - Ethernet Uses Public IP. Write the change to the modem and re-boot.

Ace Manager Web Connect to the modem with Ace Manager Web. Navigate to the LAN tab. Choose the drop down box on the Host Public Mode and select Ethernet Uses Public IP. Apply the change to the modem and re-boot.

The modem will now pass addressing information from the carrier to an attached device set to accept DHCP. Because of the difference in Ethernet chip sets and possible synchronization issues, we recommend to "Hard code" the IP settings provided by the modem in the Ethernet settings of client devices.

Configure IGMP on Hirschmann Managed Switches

2011-09-30T10:57:00.007-05:00

Let's look at what we've configured in the above screenshot:

1) We enabled IGMP Snooping by setting the Operation to On.

2) We enabled IGMP Querier and selected Protocol Version 2, and left all intervals and times at defaults.

3) In the port-specific settings, we have selected IGMP Forward All and set Static Query Port to automatic for any ports that connect to other switches.

You can use the above for all managed switches in the network. It's ok to set multiple switches as queriers when using Protocol Version 2, as this version includes an election process so only one switch will actively perform the querier role, but you'll have others available to perform the task if that switch goes down.

Links of Interest

Hirschmann Industrial Managed Ethernet Switches

Esteem Ethernet Radio Error on Restore

2011-09-30T09:25:00.015-05:00

Restoring a configuration to an Esteem Ethernet Radio is a pretty straightforward procedure; however, some older firmware versions have a small bug that displays an error on restore attempt. Below I include the complete restore procedure including a workaround for that error.

1) Access the web configuration of the WAP by typing its IP address into a browser. That brings you to the following page.

2) Login using admin/private for read/write access.

3) Click on the tab along the top marked “Restore”.

4) If you arrive at an ERROR page, replace “restore.frm” in the URL with “restore_file.frm” and hit enter. This is a bug in older Esteem firmware but replacing the URL as described is a functioning workaround.

5) Follow along as prompted by the web interface to complete the restoration.

Ultimately, it would benefit you to update your radios to the latest firmware available to take advantage of new features and bug fixes, but this little workaround will at least keep you going until you have that opportunity.

Links of Interest

Esteem Ethernet Radios

Configure E-mail Notifications in Hirschmann's Industrial HiVision Network Management Software

2011-09-23T15:30:00.003-05:00

Network Monitoring and Management packages are incredibly useful, but most users can’t have someone sitting in front of the Network Management PC 24/7. For this reason, Hirschmann’s Industrial HiVision allows you to setup E-mail alerts on events of your choosing. Let’s take a look at how to set this up.

Industrial HiVision does not support sender e-mail accounts that require TLS/SSL authentication like Gmail, so I typically setup a free account with www.gmx.com

First you configure the e-mail account in IHV under Preferences>Advanced>External Applications

***If your ISP blocks outgoing traffic on port 25, change the SMTP mail host to use one of the alternate ports supported by the e-mail service, for example mail.gmx.com:465 or mail.gmx.com:587***

Next configure the Event Action:

Finally you create the alarm and set the action that will occur on the alarm. This alarm was imported from the alarm summary and will send an e-mail when Port 1 link goes down on the 51 switch.

To test, I took the link down and received an e-mail with the following text:

Info from 192.168.3.51 Port 1/Link: Link is Down (9/2/10 6:09:44 PM)

Success! Now we can set up additional alerts for any events we feel warrant attention.

Links of Interest

Hirschmann Industrial HiVision

Configure IP Passthrough and Change Web Management Port on Digi Connect WAN 3G Cellular Gateway

2011-09-23T13:28:00.003-05:00

In a Digi cellular gateway, modifying the Digi web management port involves going to Configuration>Network>Network Services Settings and modifying the Enable Web Server (HTTP) port from the default of 80 to the desired port, applying, and rebooting.

If however, you plan to put the Digi in IP Passthrough mode, you can accomplish IP Pass-through, changing the web management port (changing from 80 to 8080 in the screenshot below) and poking a pinhole for the new port assignment all through the Configuration>Network>IP Pass-through Settings page. Changing the Digi web management port may be required if for example, the customer wants to pass port 80 through to the end-device.

After applying and rebooting the IP Passthrough settings, you’ll see that the configuration pages available are reduced, including that the previously available Network Services Settings page is gone.

In order for the LAN device to receive the WAN IP, it may be necessary to go to Management>Network Services>DHCP Server Management, restart the DHCP Server and then refresh the client connection by release/renew. I tried a simple unplug/replug and still only received private IP; release/renew was required. On subsequent power cycles of the Digi, the LAN device received the public IP right away.

Note: Due to the varying way the Digi responds to DHCP Client requests depending on cellular connection (passes WAN IP through to client if connected to cellular network but passes private IP through if not connected), it may be preferable to statically configure the client device's IP address and disable the DHCP Server in the Digi altogether.

Links of Interest

Digi Cellular Gateways

Configure 802.1X Port Authentication using Moxa Managed Switch Local Database

2011-09-23T11:16:00.001-05:00

Many managed switches support 802.1X authentication; however, most require an external Radius server to perform the authentication while the switch simply relays the requests and responses, ultimately activating the connection after successful authentication of the supplicant.

Moxa managed switches have a local database option such that the switch itself can authenticate the users based on a local database of usernames/passwords managed and stored in the switch.

In the following example, we will configure 802.1X Authentication on Port 3 of a Moxa EDS-508A managed switch.

First navigate to the Port Access Control-802.1X Setting page and set the Database Option to “Local” and enable authentication for Port 3. Make sure to hit Activate when complete.

Next navigate to the Port Access Control-Local User Database page and add the desired users. Make sure to hit Activate when complete.

Next we need to configure the client side. Check to see whether an Authentication tab is available in the Local Area Connection Properties.

If the client PC does not have an Authentication tab available in the Local Area Connection Properties, you will first need to start the “Wired AutoConfig” windows service. This service is only available beginning with Windows XP SP3.

After starting the Wired AutoConfig service, you should now see the Authentication tab. Choose “MD-5-Challenge” as the network authentication method and decide whether the user needs to enter the authentication info each time. The default is to cache user information with the bottom checkbox.

When the user plugs in, he will see the following prompt in the system tray.

Clicking on the systray icon brings up the “Enter Credentials” screen (this window sometimes gets hidden behind the Local Area Connection Status window, simply drag it out of the way).

Once the user types in the proper username and password, and ONLY after doing so, the user will have access to the LAN!

Links of Interest

Moxa Managed Industrial Ethernet Switches

Save Configuration Changes on Hirschmann Managed Switches

2011-09-23T11:03:00.002-05:00

On Hirschmann managed switches changes made to the switch are applied to the running configuration immediately when the user hits “Set” on an individual settings page; however, these changes are not saved to NVRAM/Flash memory until the user explicitly does so on the Load/Save page. Therefore, if a user makes changes to the switch but fails to save these changes to NVRAM via the Load/Save page, these changes will be lost on a power cycle. This “Save – To Device” step is comparable to the “copy running-config startup-config” or “write memory” step required on a Cisco switch.

Let's take a look at how to properly save changes to NVRAM on a Hirschmann Managed Switch.

1 – Original With No Changes

Note the blue floppy disk icon next to Load/Save under Basic Settings. This blue floppy disk icon indicates that the running config and the startup config are equal; that a power cycle will result in no settings being lost.

2 – Changes Set But Not Yet Saved To Flash

Here I have changed the switch name and hit set at the bottom of the screen. Note that the Load/Save icon has changed from a blue floppy disk to a Yellow Triangle with Exclamation Point; this symbol identifies to the user that changes have been made to the running-config but have NOT yet been saved to NVRAM. These changes will be lost on a power cycle if no further action is taken.

3 – Load/Save Dialog

Under Basic Settings>Load/Save, this is where you can save settings to NVRAM. Under the row marked Save, ensure the radio button is set for “To Device” and then hit the button marked “Save” at the end of the row.

4 – After Changes Saved to Flash

After hitting save in the previous step you should now see that the icon has changed back to a blue floppy disk symbol.

And there you have it. Once you see that blue floppy disk symbol, you can be confident that any changes you've made will persist through a power cycle.

Links of Interest

Hirschmann Industrial Managed Ethernet Switches

Assign an IP Address to a Moxa Managed Switch using the Ethernet Switch Configurator

2011-09-23T11:00:00.000-05:00

The first configuration step for a brand new switch is the assignment of a management IP address. The easiest way to accomplish this is using the Ethernet Switch and Video Server Configurator.

1) Install the application onto your laptop. The latest version of the software can be downloaded from the Drivers&Software>Utilities page for any managed switch on Moxa's website.

2) Power up the switch.

3) Connect an Ethernet cable between your laptop and the switch.

4) Open the application on your laptop and you will see the following after clicking the Broadcast Search button at the top left. The application will list all Moxa switches on the same layer 2 connected network.

5) If it's a brand new switch out of the box, you can simply double-click the corresponding row and you will be greeted with the following:

6) Configure the desired parameters, hit OK, and the changes will be saved to the switch.

7) All switch features can now be accessed via the web interface at the address that was just configured!

8) Note, if you are changing the address of a previously configured switch, at Step 5 you will first have to "unlock" the switch by right clicking on the entry and selecting "Unlock." After typing in the admin password, you will be able to double click and continue with the remaining steps.

Links of Interest

Moxa Industrial Managed Ethernet Switches

Configure E-mail Notifications of Storage Failure Detection from Mobotix IP Camera

2011-09-23T10:56:00.000-05:00

Ever go into MxCC to review an event, only to discover there is no recording for the event? A little further investigation and it turns out your cameras haven't been recording to the file server for several days now because the file server is down? This can be a very bad surprise, especially if it goes unnoticed for several days. Let's take a look at how to setup e-mail notifications from a Mobotix camera so you know about this problem as soon as it happens.

Admin Menu > E-mail Profiles

Here you configure the global sending e-mail address and server settings. Mobotix cameras running software older than v4.04.19 do not support sender e-mail accounts that require TLS/SSL authentication like Gmail, so I typically create a free account with www.gmx.com

Further down on the same page, I re-named the first template to “FileServerDown”, filled in the recipients list, and customized the message to be specific to the facility and file server details to help local personnel troubleshoot. Here’s our message as an example:

“You are receiving this e-mail because the cameras at the XYZ facility cannot reach the fileshare. Please investigate why \\w.x.y.z\fileshare is not reachable to resolve the issue. You will continue to receive this e-mail once every 2 hours until the problem has been resolved.”

Before setting up the trigger for the e-mail, you may first want to confirm the general e-mail settings are working properly. From the Admin Menu > Test Network Current Configuration, you can run a test on the E-mail Profile ‘FileServerDown’. There is a good troubleshooting popup that appears during the test that can display configuration problems; otherwise you should see the green success result like below. Note: some e-mail providers might mark inbound e-mail from gmx.com as junk, so the recipient should configure this domain/e-mail address as safe to receive the e-mails.

If the e-mail tested well, the final step is under Admin Menu > Storage Failure Detection. I didn’t care to e-mail on lost events here, only if the file server was unreachable. You’ll see below that we’ve configured the Storage Failure Detection to E-mail using the FileServerDown profile with a frequency of 2 hours until the issue is resolved. As always set and save all your changes.

And that's it! Now the system admin will receive an immediate and then periodic e-mails when there is a file server issue until it has been resolved.

Links of Interest

Mobotix Industrial IP Cameras

Use Telnet to Test Open Ports

2011-09-23T10:20:00.001-05:00

When troubleshooting connectivity issues, one item a user should check is whether the necessary application port is open on the server. An easy way to do this without having to install any additional software is using the familiar Telnet command.

You can check if a port is open on a device by issuing the telnet command. If it is open, you will see a blank screen after issuing the command:

telnet [domainname or ip] [port]

where

[domainname or ip] is the domain name or IP address of the server to which you are trying to connect
[port] is the port number where the server is listening

If the port is open, you will see a blank screen. This means that the connection is successful. If the port is closed, you will receive a Connect failed message.

For example, if I wanted to test whether the device 192.168.1.100 had it’s webserver (port 80) running:

telnet 192.168.1.100 80

We see a blank screen so we know that port 80 is open on this device.

Now, let’s see if the device is listening for Modbus TCP connections (port 502):

Here we see the Connect failed message which tells us this device is NOT open on port 502.

Note, in Windows Vista and Windows 7 you may need to enable telnet first:

Go to Start -> Control Panel -> Programs
Under Programs and features, click Turn Windows features on or off
Check the box for Telnet Client
Click OK

Links of Interest

Industrial Ethernet Network Training

Industrial Security Appliance Functionality Differences - Innominate Hirschmann Moxa Endian

2011-09-23T10:15:00.001-05:00

In my testing and configuration of our various Industrial Security Appliance offerings, I have observed that certain functionality implementation differs between Innominate, Hirschmann, Moxa, and Endian. The majority of these differences likely stem from the fact that the Endian appliance comes from a more commercial background and applications where its primary function is to serve as an Internet Gateway for the private customer network. While this function can be applied to Innominate, Hirschmann, and Moxa, it certainly is not always the primary function. The following are the differences I have noted to date:

I = Innominate, H = Hirschmann, M = Moxa, E = Endian

Outgoing Firewall:

I,H,M – explicit any:any rule in place out of the box

E – explicit rules allowing only common ports out: http/s, ftp, smtp, imap, etc.

IP Masquerading/Source NAT:

I,H,M – nothing in place out of the box. For LAN to WAN connectivity, user would need to add explicit config for LAN subnet to WAN IP or similar

E – implicit rule in place out of the box for LAN subnet to Primary WAN IP

1:1 NAT:

I,H,M – one page/step configuration on dedicated page for such config

E – requires up to three steps: configuration of additional WAN IPs (currently this step requires a reboot after configuration), configuration of associated DNATs, and optional configuration of associated SNATs. SNATs only required if comm from LAN to WAN must be seen by WAN device as coming from unique addresses for each LAN devices; otherwise the default implicit SNAT will facilitate communication albeit from a common WAN IP for all LAN devices.

Initial Device Access:

I – No default IP out of the box, but reachable via https://1.1.1.1/ if connected to external network, or via https://192.168.1.1/ if not connected to external network.

H – Default 192.168.1.1 LAN IP out of the box (reachable at http://192.168.1.1).

M – Default 192.168.127.254 LAN IP out of the box (reachable at https://192.168.127.254)

E – Default 192.168.0.15 LAN IP out of the box (reachable at https://192.168.0.15:10443)

Links of Interest

FTP Active vs Passive

2011-09-23T10:10:00.001-05:00

People sometimes run into difficulty when setting up an FTP Server behind a Firewall or Router. In order to understand the potential issues, it first helps to understand the difference between Active and Passive FTP.

From http://en.wikipedia.org/wiki/File_Transfer_Protocol

“FTP can be run in active or passive mode, which determines how the data connection is established. In active mode, the client sends the server the IP address and port number on which the client will listen, and the server initiates the TCP connection. In situations where the client is behind a firewall and unable to accept incoming TCP connections, passive mode may be used. In this mode the client sends a PASV command to the server and receives an IP address and port number in return. The client uses these to open the data connection to the server.”

So Passive FTP is needed when the client is connecting from behind a NAT router, but what if the server is behind a NAT router as well? Two solutions:

1) Setup your FTP Server application to be aware of its public IP AND use a custom port range for Passive FTP connections. Then configure the server firewall to allow these known port ranges as well as port 21 for the control connection.

2) If the server firewall features an FTP ALG (application-level gateway), the firewall simply needs to be configured to forward 21 to the proper internal IP. The remainder of work (translating internal IP to public IP and poking firewall holes for the server’s ports it responded with for data connections) is all handled automatically by the FTP ALG functionality. I’ve found that the inclusion of an FTP ALG in a device varies widely. For example, I know from experience that Verizon FIOS residential routers do have this functionality while I've encountered some high-end commercial and industrial routers that do not.

Links of Interest

Industrial Ethernet Network Training

Determine What Application is Using a TCP or UDP Port

2011-09-23T10:05:00.000-05:00

Most network technicians know that running “netstat –a” at a command prompt in Windows will show you the status of application ports on the system.

Sometimes when you install or run a new software package, you receive an error that the required port is already in use. While you can confirm with “netstat –a” that this is indeed true, what would be more useful is knowing WHAT or WHO is using the port. A lesser known netstat switch is the –b switch, which displays the executable involved in creating the connection.

“netstat –a –b” will list all listening ports, active connections and what application is bound to the port for both TCP and UDP connections. We can see for example, that port 49396 on my machine is being utilized by firefox.exe

This information can be very useful, as it provides direction on where to look if you needed to reconfigure certain applications to meet your needs.

As always, you can run the “netstat -?” to see descriptions on all the switches available and their functions.

Links of Interest

Industrial Ethernet Network Training

Revised Innominate mGuard RS Recovery Procedure

2011-09-23T10:00:00.000-05:00

For whatever reason, I find it difficult to achieve successful results with the recovery procedure in the manual. Over time, I developed the following revised procedure to achieve recovery on an Innominate mGuard RS.

1) Press the rescue switch button 6 times in a row, holding for approximately one second with each push. If performed correctly, the mGuard will respond with a solid green State light (lasts only 2-3 seconds) and a solid red Fault light.

2) Upon receipt of the solid green State light, press the rescue switch button 6 times again this time with 6 quick successive pushes (do NOT hold for 1 second each).

3) If everything was performed correctly, the switch reboots and you should be able to establish a link between the mGuard LAN port and your laptop. Configure your laptop IP to 192.168.1.2/255.255.255.0/192.168.1.1.

4) If everything was not performed correctly, the mGuard responds after step 3 with a solid red Error light briefly.

5) Also occasionally after steps 1-3 the mGuard gets stuck responding with only power supply solid Green lights and a solid Fault light which remains on. In this case, reboot the mGuard by pressing and holding the rescue switch for 2-3 seconds.

6) Once steps 1 through 3 have completed correctly, attempt to access the mGuard at https://1.1.1.1.

7) If it does not respond, open up a command prompt and type exactly the following “arp –s 192.168.1.1 aa-aa-aa-aa-aa-aa”.

8) Confirm the arp entry has been added by typing “arg –g” and checking the arp table for the entry you just added.

9) Attempt again to access the mGuard now at https://1.1.1.1.

10) If it is still not accessible, return to step 1.

Links of Interest

Innominate mGuard RS