Eurogard ServiceServer Manuale utente

Eurogard Service-Server

Manual

Falk Schönfeld <[email protected]>

Eurogard Service-Server: Manual

by Falk Schönfeld

iii

Table of Contents

1. System description .................................................................................................... 1

Short overview ................................................................................................... 1

Function overview and concept ............................................................................ 1

Preconditions ..................................................................................................... 3

2. Installation and operation ............................................................................................ 4

Hardware installation ............................................................................................. 4

Connection and control elements on the rear side of the device .............................. 4

Connections on the front panel ........................................................................ 4

Initial contact set-up .............................................................................................. 5

Operating concept ................................................................................................. 5

Installation – quick set up guide .............................................................................. 6

Preparation of the ServiceServer ...................................................................... 7

Connection to the Internet .............................................................................. 8

Time ........................................................................................................... 8

Certificates .................................................................................................. 9

Next steps ................................................................................................... 9

OpenVPN .................................................................................................... 9

3. Configuration options of the ServiceServer ................................................................... 10

Administration area ............................................................................................. 11

Basic settings/LAN .............................................................................................. 12

Host name ................................................................................................. 12

Domain name ............................................................................................. 12

IP-Address of the Server in the LAN network .................................................. 12

Netmask .................................................................................................... 13

DHCP-Server for the LAN ............................................................................ 13

DHCP area ................................................................................................. 13

HTTPS-Port of the web interface ................................................................... 13

Web access/WAN ............................................................................................... 13

WAN-Media ............................................................................................... 13

Configuration of connection .......................................................................... 14

Time ................................................................................................................. 14

Time source ............................................................................................... 15

Time zone .................................................................................................. 15

Device is NTP-Server .................................................................................. 15

NTP-Update interval .................................................................................... 15

NTP-Server chart ........................................................................................ 15

dDNS ................................................................................................................ 15

Certificates ......................................................................................................... 16

Field contents ............................................................................................. 17

Validity in days .......................................................................................... 18

Issue certificates for WAN IP as well ............................................................. 18

Issue certificates for LAN IP as well .............................................................. 19

Generate Server certificates ........................................................................... 19

Import root certificate .................................................................................. 19

Show Server certificate ................................................................................ 27

OpenVPN .......................................................................................................... 27

OpenVPN-Mode ......................................................................................... 28

Logging of client connections in a database ..................................................... 28

DHCP range for VPN-clients of the admin network ........................................... 28

Start port ................................................................................................... 28

Enable client-to-client connections ................................................................. 28

Limit VPN packet size ................................................................................. 28

Keeping a log file ....................................................................................... 29

Detail options of the logs ............................................................................. 29

Maximum size of the logs ............................................................................ 29

Eurogard Service-Server

Allow access to the admin network to VPN-Clients ........................................... 29

Time interval for keep-alive-packets in seconds ................................................ 29

VPN restart after how many unsuccessful Pings ................................................ 30

Cryptoalgorithm .......................................................................................... 30

Service networks ................................................................................................. 30

General overview ....................................................................................... 31

Update network status .................................................................................. 31

Restart all networks ..................................................................................... 31

Add network .............................................................................................. 31

Change service networks .............................................................................. 31

Delete service networks ................................................................................ 32

Accounts ............................................................................................................ 32

Refresh status ............................................................................................. 32

Add new account ........................................................................................ 32

New user certificate ..................................................................................... 33

Download .................................................................................................. 33

Change password ........................................................................................ 34

Delete account ............................................................................................ 34

Logs ................................................................................................................. 34

Firewall ............................................................................................................. 34

Port 22 - ssh .............................................................................................. 34

Port 443 - https ........................................................................................... 34

Allow LAN devices access via external interface .............................................. 35

Allow access service network/LAN ................................................................ 35

4. Messaging .............................................................................................................. 36

Email ................................................................................................................ 36

Emailing .................................................................................................... 36

Email address ............................................................................................. 36

Server/Port ................................................................................................. 36

Username/Password ..................................................................................... 36

Transport encryption .................................................................................... 36

Allow certificates of unknown origin .............................................................. 36

Email account for receiving .......................................................................... 36

Test configuration ....................................................................................... 36

Reports .............................................................................................................. 37

5. Status and diagnosis ................................................................................................. 38

Connections ........................................................................................................ 38

DHCP ............................................................................................................... 38

OpenVPN .......................................................................................................... 38

Logs ................................................................................................................. 38

Firewall ............................................................................................................. 39

dDNS ................................................................................................................ 39

Diagnosis ........................................................................................................... 39

6. Backup-Maintenance ................................................................................................ 41

Backup .............................................................................................................. 41

Restore point .............................................................................................. 41

Upload restore point .................................................................................... 41

Reset ......................................................................................................... 41

Service .............................................................................................................. 41

Maintenance access ..................................................................................... 41

7. Logging of connection data ....................................................................................... 43

General .............................................................................................................. 43

Show logged connection data ................................................................................ 43

Read out log database .......................................................................................... 43

8. Disclaimer .............................................................................................................. 45

General .............................................................................................................. 45

Safety instructions ............................................................................................... 45

Proper use, installation and assembly ...................................................................... 45

Eurogard Service-Server

A. Wichtige Begriffe ................................................................................................... 46

List of Figures

1.1. Eurogard ServiceServer ............................................................................................ 1

1.2. VPN-concept of the Remoteserviceproducts ................................................................. 2

vii

List of Examples

3.1. Host- and Domain name ......................................................................................... 12

3.2. URL for HTTPS in case of different port .................................................................. 13

7.1. Syntax URL VPN-Log ........................................................................................... 43

7.2. Example of valid query .......................................................................................... 44

Kapitel 1. System description

Short overview

The Eurogard ServiceServer system is a product from the Eurogard remote service family. These

products represent a secure, central access to remote, IP-capable terminal devices via Internet, with

the focus always on automation and control engineering.

Abbildung 1.1. Eurogard ServiceServer

The ServiceServer system connects the user PC and the machine, plant or computer network via a

secure connection, a so-called “virtual private network”, VPN in short.

During this process, the communication between the participants is secured through the encryption

protocol SSL. This guarantees confidentiality and integrity of all exchanged data.

ThedeviceincludesacompleteVPNsystemwithcertificateanduseradministrationinordertoprovide

the user with an optimally secured programming and monitoring access to the machine network.

The protected web administration area can be accessed via HTTPS or VPN and provides the

administrator with all necessary tools for the integration of devices and machine networks and for the

administration of programmers and service staff.

Function overview and concept

Thekeyelement of the Eurogard remote servicesolutionis the Eurogard ServiceServer which provides

an especially protected dial-up service for network connections.

Connection is established via software which can be installed on any standard PC.

Since devices in the area of control and automation engineering do not provide possibilities for a VPN

connection or for software installation as standard, the Eurogard ServiceRouter serves as a bridging

device.

The controls of the plants to be monitored are connected to the ServiceRouter. Just as with the

service technicians’ or programmers’ PCs, the ServiceRouter then establishes a connection to the

ServiceServer.

All devices, even though connected via different Internet connections, perform as if in a common

LAN.Theonly indication for thespatialseparation between the network participantsmaybe the higher

latency rates.

With the help of a ServiceRouter, the ServiceServer sets up a separate, independent VPN for each

plant network.

In this context, it is necessary to ensure that the different plant networks each use different IP ranges.

The ServiceRouter which integrates the plant network into the VPN can choose between Ethernet,

UMTS, PPPoE (DSL) or WLAN for the Internet connection.

System description

The security architecture provides for two main user groups: administrators and users associated with

a plant network. As a basic principle, administrators have access to all networks und administrative

functions of the ServiceServer; plant network users can only access the allocated plant network.

Abbildung 1.2. VPN-concept of the Remoteserviceproducts

Eurogard offers a free and efficient OpenVPN client which administers your certificates, logs access

times to various plants and securely sets up connections to the routers at the plant via a mouse click.

The Eurogard ServiceServer and router provide a complete solution for the remote access to IP-based

automation structures in machines and plants.

As the ServiceRouter, the ServiceServer has two network sides at its disposal.

• WAN-side

Used to connect the device to the Internet. Here, access to plant networks or to the LAN side is

only possible indirectly via VPN.

• LAN-side

This is the primary “working network”. Here, all units and PC’s have direct access to all plant

networks and their devices.

All data packets from LAN devices sent to the Internet via the Server are masked via Source-NAT by

the Server. As a consequence, only the external Server IP is outwardly visible, in case the device goes

online indirectly on the WAN-side via the in-house network. This helps to keep down the installation

and administration efforts and expenses.

A so-called service network is installed on the ServiceServer for each plant for which a remote

service is to be set up. This is shown on the right hand side of Abbildung 1.2, „VPN-concept of the

Remoteserviceproducts“. In order to allow for admin network access to each single network at the

same time, a unique network IP-address has to be assigned to each of these networks.

The next step is to create an account for an Eurogard ServiceRouter on the Server. A configuration

file is downloaded from the Server into the Router. This Router is parameterised and integrated into

the plant network. It acts as intermediary between the various devices of the plant and the service

network of the ServiceServer. All IP terminals of the plant can now be accessed via the LAN network

at the Server.

System description

In the process of generating a new VPN access its range of validity needs to be specified. This range

may be a specifically selected service network or the entire network, in the case of an administrative

account.

In the standard configuration of the Server, devices from a service network are not able to send or

receive data to or from other service networks. Devices from the plant network can also not access

devices in the admin network. Only the admin network is authorised to communicate with terminal

devicesinmachine networks. This issymbolisedon the left hand sideofAbbildung 1.2, „VPN-concept

of the Remoteserviceproducts“. All functions shown may be configured separately. Accessibility

within the plant network, either between local or between VPN clients, is not affected and always

ensured.

Preconditions

Prerequisite for an adequate operation of the Eurogard ServiceServer is a sufficiently dimensioned

Internet connection. This will depend on your specific requirements. Depending on the hardware, the

Server can handle bandwidths of a minimum of 100 MBit to 1 GBit.

The Server must have a DNS entry available. This is an essential precondition for the overall concept

to function “out-of- the-box”, even if operation via IP is possible. By means of this entry, the clients

are able to ‘find’ and access the Server.

It may often make sense to attribute a static IP to the ServiceServer in order to guarantee 24-hour

accessibility to the service network. Dynamic IPs may result in “Blackouts” of up to 15 minutes.

In those cases where the Eurogard remote service concept may be required to be used with a dynamic

Internet IP, our devices support the dynamic DNS services of DynDNS [http://www.dyndns.com].

Since the ServiceServer deals with client’s requests from the Internet, the accessibility of the relevant

ports has to be guaranteed. In the case of an NAT-Firewall protecting the device, this means that port

forwarding has to be set up.

Please note the preconditions regarding the operation of the ServiceRouter which are required for

setting up a plant network.

Indice

Altri manuali Eurogard Hardware di rete

Eurogard

Eurogard ServiceRouterV3 Manuale utente

Manuali Hardware di rete popolari di altre marche

Matrix Switch Corporation

Matrix Switch Corporation MSC-HD161DEL Manuale utente

B&B Electronics

B&B Electronics ZXT9-IO-222R2 Manuale utente

Yudor

Yudor YDS-16 Manuale utente

D-Link

D-Link ShareCenter DNS-320L Manuale utente

Samsung

Samsung ES1642dc Istruzioni per l’uso

Honeywell Home

Honeywell Home LTEM-PV Istruzioni per il montaggio

evertz

evertz 7700 Series Manuale utente

D-Link

D-Link ShareCenter DNS-343 Manuale utente

Asante

Asante AsanteBridge 1012 Manuale utente

FireBrick

FireBrick FB2700 Manuale utente

Audiovox Electronics

Audiovox Electronics ARWH2T Manuale utente

ADC

ADC DSX-1 Manuale

NetComm

NetComm NF2 Manuale utente

Alcatel-Lucent

Alcatel-Lucent 5620 Manuale utente

Dell EMC

Dell EMC XC6420 Series Manuale utente

Lanner

Lanner NCA-1020A Manuale utente

Allied Telesis

Allied Telesis AT-TN121-A Manuale utente

Arista

Arista CCA-ETM-Q12 Manuale utente