Allen-Bradley 1756-EN2TSC User manual

EtherNet/IP Secure Communication

Catalog Number 1756-EN2TSC

User Manual

Important User Information

Read this document and the documents listed in the additional resources section about installation, configuration, and

operation of this equipment before you install, configure, operate, or maintain this product. Users are required to

familiarize themselves with installation and wiring instructions in addition to requirements of all applicable codes, laws,

and standards.

Activities including installation, adjustments, putting into service, use, assembly, disassembly, and maintenance are required

to be carried out by suitably trained personnel in accordance with applicable code of practice.

If this equipment is used in a manner not specified by the manufacturer, the protection provided by the equipment may be

impaired.

In no event will Rockwell Automation, Inc. be responsible or liable for indirect or consequential damages resulting from the

use or application of this equipment.

The examples and diagrams in this manual are included solely for illustrative purposes. Because of the many variables and

requirements associated with any particular installation, Rockwell Automation, Inc. cannot assume responsibility or

liability for actual use based on the examples and diagrams.

No patent liability is assumed by Rockwell Automation, Inc. with respect to use of information, circuits, equipment, or

software described in this manual.

Reproduction of the contents of this manual, in whole or in part, without written permission of Rockwell Automation,

Inc., is prohibited.

Throughout this manual, when necessary, we use notes to make you aware of safety considerations.

Labels may also be on or inside the equipment to provide specific precautions.

Allen-Bradley, Rockwell Software, Rockwell Automation, ControlFLASH, ControlLogix, FactoryTalk, FLEX, Logix5000, POINT I/O, PowerFlex, RSLinx, RSView, Stratix 5900, and Studio 5000 are trademarks of Rockwell

Automation, Inc.

Trademarks not belonging to Rockwell Automation are property of their respective companies.

WARNING: Identifies information about practices or circumstances that can cause an explosion in a hazardous environment,

which may lead to personal injury or death, property damage, or economic loss.

ATTENTION: Identifies information about practices or circumstances that can lead to personal injury or death, property

damage, or economic loss. Attentions help you identify a hazard, avoid a hazard, and recognize the consequence.

IMPORTANT

Identifies information that is critical for successful application and understanding of the product.

SHOCK HAZARD: Labels may be on or inside the equipment, for example, a drive or motor, to alert people that dangerous

voltage may be present.

BURN HAZARD: Labels may be on or inside the equipment, for example, a drive or motor, to alert people that surfaces may

reach dangerous temperatures.

ARC FLASH HAZARD: Labels may be on or inside the equipment, for example, a motor control center, to alert people to

potential Arc Flash. Arc Flash will cause severe injury or death. Wear proper Personal Protective Equipment (PPE). Follow ALL

Regulatory requirements for safe work practices and for Personal Protective Equipment (PPE).

Rockwell Automation Publication ENET-UM003C-EN-P - November 2015 3

Summary of Changes

This manual contains new and updated information. Changes throughout this

revision are marked by change bars, as shown to the right of this paragraph.

New and Updated

Information

This table contains the changes made to this revision.

Topic Page

Updated all web page interface screens from Series A to Series B module

firmware.

Throughout

Added references to the Stratix 5900 Security Appliance 11, 9, 51, 51

Added information about mobile clients 15

Updated information about Transport Layer Security (TLS) 1.2 11

Added new features Throughout

Added Security Configuration Parameter Descriptions 16

4Rockwell Automation Publication ENET-UM003C-EN-P - November 2015

Summary of Changes

Notes:

Rockwell Automation Publication ENET-UM003C-EN-P - November 2015 5

Table of Contents

Preface

Additional Resources . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7

Chapter 1

Secure Communication Architecture

Considerations. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11

Local Chassis Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12

Network Access Security. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13

IPsec Association . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14

Performance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15

Traffic Filtering . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15

Security Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16

Chapter 2

Get Started

Initial Powerup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20

Default Credentials. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22

Configuration Overview. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22

Assign Network Settings. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23

Change Network Settings Via the Module Web Page. . . . . . . . . . . . 23

Create User Accounts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25

Bad Login Attempts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26

Generate HTTPS Certificate . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26

Certificates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27

Backup / Restore. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28

Chapter 3

Configure a Secure Connection to a

Microsoft Windows Client

L2TP Connections . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32

Create Windows Client Connection By Using a Windows Profile . . . 35

Configure Mobile Client . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37

Configure an L2TP Connection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38

Configure a Connection from a Microsoft Windows Client . . . . . . . . . 40

Interface Metric . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46

Open the VPN Connection to the 1756-EN2TSC Module. . . . . . . . . . 47

Communicate to the Module Via an RSLinx Driver. . . . . . . . . . . . . . . . . 49

Chapter 4

Configure Secure Communication

Between Two 1756-EN2TSC Modules

Configure the First (Local) Module. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53

Configure the Second (Remote) Module . . . . . . . . . . . . . . . . . . . . . . . . . . . 54

Test the Connection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55

Edit the Security Association. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55

Chapter 5

Configure a Secure Connection to a

VPN Appliance

Configure the Module to Connect to a VPN Appliance . . . . . . . . . . . . . 59

Edit the Security Association. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60

6Rockwell Automation Publication ENET-UM003C-EN-P - November 2015

Table of Contents

Chapter 6

Diagnostics

Diagnostic Web Pages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63

Secure Tunnel Diagnostics Web Page . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 64

Status Indicators . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65

Link (LINK) Status Indicator . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65

Network (NET) Status Indicator . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 66

OK Status Indicator . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 66

Index

Rockwell Automation Publication ENET-UM003C-EN-P - November 2015 7

Preface

The 1756-EN2TSC is a security-enhanced version of the 1756-EN2T

EtherNet/IP communication module. This module is designed for applications

that limit network access to a control system from within the plant network. This

module is not intended to connect any devices in the local 1756 backplane to

devices outside of the plant firewall.

Additional Resources These documents contain additional information concerning related products

from Rockwell Automation.

You can view or download publications at

http://www.rockwellautomation.com/literature/. To order paper copies of

technical documentation, contact your local Allen-Bradley distributor or

Rockwell Automation® sales representative.

Resource Description

1756 ControlLogix® Communication Modules Specifications Technical Data, publication 1756-TD003 Specifications for ControlLogix communication modules

EtherNet/IP Network Configuration User Manual, publication ENET-UM001 Guidelines for configuring EtherNet/IP network parameters

EtherNet/IP Modules Installation Instructions, publication ENET-IN002 Guidelines for installing EtherNet/IP modules

Ethernet Design Considerations Reference Manual, publication ENET-RM002 Guidelines for Ethernet networks

Industrial Automation Wiring and Grounding Guidelines, publication 1770-4.1 Guidelines for installing a Rockwell Automation industrial system

Product Certifications website, http://www.ab.com Declarations of conformity, certificates, and other certification details

8Rockwell Automation Publication ENET-UM003C-EN-P - November 2015

Preface

Notes:

Rockwell Automation Publication ENET-UM003C-EN-P - November 2015 9

Chapter 1

Secure Communication Architecture

Many control systems currently use 1756-EN2T and 1756-ENBT modules to

connect ControlLogix® systems to plant-level systems. A 1756-EN2TSC module

offers the same connectivity and additional security options that help protect

access to resources on the local backplane from the plant network. Use the

1756-EN2TSC module to establish secure tunnels with peer modules,

Windows 7 clients, and VPN appliances.

Topic Page

Local Chassis Security 12

Network Access Security 13

IPsec Association 14

Performance 15

Traffic Filtering 15

10 Rockwell Automation Publication ENET-UM003C-EN-P - November 2015

Chapter 1 Secure Communication Architecture

Figure 1 - 1756-EN2TSC module Establishes Secure Tunnels with Peer Modules, Windows 7 Clients,

and VPN Appliances

The 1756-EN2TSC module provides a level of protection against unauthorized

network access, either malicious or accidental, to a ControlLogix® controller via

an EtherNet/IP connection. The 1756-EN2TSC module uses the Internet

Protocol Security (IPsec) protocol suite to provide a secure communication

tunnel.

The 1756-EN2TSC module is intended for use behind an existing

firewall/DMZ that help protect the plant network from outside access. This

module is not intended to be connected directly to the public Internet or to

provide a mechanism by which remote access is provided to a network. The

module does not provide the ability to expose a private network address range via

IPsec; only the module’s IP address is available.

Enterprise Zone

Levels 4 and 5

Demilitarized Zone (DMZ)

Manufacturing Zone

Site Manufacturing

Operations and Control

Level 3

Level 0…2

Secure Tunnel Between 1756-EN2TSC

Module and Windows 7 Client.

Peer-to-peer Secure Tunnel

Between 1756-EN2TSC Modules

ControlLogix Chassis with

1756-EN2TSC Module

Secure Tunnel Between 1756-EN2TSC

Module and VPN Appliance

IMPORTANT

HMIs are not supported by the 1756-EN2TSC/B.

HMIs don’t support IPsec.

Table of contents

Other Allen-Bradley Control Unit manuals

Allen-Bradley

Allen-Bradley 1492-CM1771-LD006 User manual

Allen-Bradley

Allen-Bradley 857-VPA3CG User manual

Allen-Bradley

Allen-Bradley 1747-ASB User manual

Allen-Bradley

Allen-Bradley 1756-M02AS User manual

Allen-Bradley

Allen-Bradley ControlLogix 1756-OX8I User manual

Allen-Bradley

Allen-Bradley ControlLogix SynchLink 1756-SYNCH User manual

Allen-Bradley

Allen-Bradley 1794-OA8K User manual

Allen-Bradley

Allen-Bradley SLC 500 DeviceNet User manual

Allen-Bradley

Allen-Bradley 1794-OW8 User manual

Allen-Bradley

Allen-Bradley 1771-IXHR User manual

Allen-Bradley

Allen-Bradley E Series User manual

Allen-Bradley

Allen-Bradley CAB6-HA 3 User manual

Allen-Bradley

Allen-Bradley ControlLogix 1756-OF6VI User manual

Allen-Bradley

Allen-Bradley ArmorBlock 1732E-12X4M12QCDR Manual

Allen-Bradley

Allen-Bradley PowerMonitor 500 User manual

Allen-Bradley

Allen-Bradley ArmorBlock 1732E User manual

Allen-Bradley

Allen-Bradley 1769-SDN User manual

Allen-Bradley

Allen-Bradley ArmorBlock 1732D A Series User manual

Allen-Bradley

Allen-Bradley 1771-QRD User manual

Allen-Bradley

Allen-Bradley PowerFlex 750 Series User manual

Allen-Bradley

Allen-Bradley ProcessLogix B Series User manual

Allen-Bradley

Allen-Bradley ProcessLogix 1757 Series User manual

Allen-Bradley

Allen-Bradley ArmorBlock 1732E-IT4IM12R User manual

Allen-Bradley

Allen-Bradley ControlLogix 1756-OA8D User manual

Popular Control Unit manuals by other brands

Festo

Festo Compact Performance CP-FB6-E Brief description

Elo TouchSystems

Elo TouchSystems DMS-SA19P-EXTME Quick installation guide

JS Automation

JS Automation MPC3034A user manual

JAUDT

JAUDT SW GII 6406 Series Translation of the original operating instructions

Spektrum

Spektrum Air Module System manual

BOC Edwards

BOC Edwards Q Series instruction manual

KHADAS

KHADAS BT Magic quick start

Etherma

Etherma eNEXHO-IL Assembly and operating instructions

PMFoundations

PMFoundations Attenuverter Assembly guide

GEA

GEA VARIVENT Operating instruction

Walther Systemtechnik

Walther Systemtechnik VMS-05 Assembly instructions

Altronix

Altronix LINQ8PD Installation and programming manual

Eaton

Eaton Powerware Series user guide

WAGO

WAGO 750-407/040-000 manual

Sony

Sony CCU-590 Operation manual

Graco

Graco 25D614 instructions

Task Force Tips

Task Force Tips YE-RF-900 Instructions for installation, safe operation and maintenance

Shini

Shini SPV-U Series manual