TECH SESSION -T9 - GALLERY OVERLOOK B ROCKWELL AUTOMATION SELECT THE RIGHT STRATIX SWITCH FOR YOUR APPLICATION

Transcription

1 TECH SESSION -T9 - GALLERY OVERLOOK B ROCKWELL AUTOMATION SELECT THE RIGHT STRATIX SWITCH FOR YOUR APPLICATION

2 KENDALL DATACOMM SPECIALIST Kirk Ritter, RCDD Datacomm Market Development Manager Brian Fisher DatacommSpecialist / Northwest MI Rob Rodriguez-Pelizzari Datacomm Specialist / Northeast MI Tom Herbstreith Tom Tate Chris Brooks Bill Nausieda DatacommSpecialist / Southern MI DatacommSpecialist / Indiana DatacommInside Sales, Muskegon Datacomm Inside Sales, Grand Rapids ROCKWELL DATACOMM SPECIALIST John Gajor Jeff Stekl Solution Architect Integrated Architecture Technical Consultant

3 Download the event App

4 Where? 11 Ottawa Avenue NW, Grand Rapids, MI

5 SWITCH SELECTION Unmanaged vs. Managed SWITCH SELECTION Lightly Managed, Lite Managed Fully Managed SWITCH SELECTION VLANs, NAT & ROUTING INDUSTRIAL NETWORK SECURITY Protocols, Open Port Strategies, ACLs, Firewalls and VPNs TOOLS & RESOURCES OUT OF THE BOX Stratix2500 Express Setup

6 Industrial Control Switches (OT)

7 SWITCH SELECTION Unmanaged vs. Managed SWITCH SELECTION Lightly Managed, Lite Managed Fully Managed SWITCH SELECTION VLANs, NAT & ROUTING INDUSTRIAL NETWORK SECURITY Protocols, Open Port Strategies, ACLs, Firewalls and VPNs TOOLS & RESOURCES OUT OF THE BOX Stratix2500 Express Setup

8 SWITCH SELECTION Unmanaged vs. Managed

9 SWITCH SELECTION Unmanaged vs. Managed

10 Select the Right Stratix Switch for Your Application Challenge Cables are not always clearly marked Plugging cable in created an unmanaged Loop Broadcast messages get repeated in an infinite loop Network will crash as the broadcast storm grows Downtime and lost visibility to locate cause will result Resolution Loop Prevention to stop this before it happens Diagnostics can be used to locate the cabling error Both Available on our Lightly, Fully, and High Performance Managed Switches Stratix 2500, 5700, 8000, 5400, and 5410

11 5700 or or 2500 SWITCH SELECTION Unmanaged vs. Managed

12 SWITCH SELECTION Unmanaged vs. Managed

13 Select the Right Stratix Switch for Your Application Challenge Need to perform Infrastructure Maintenance Cannot impact real time communications during runtime Network availability required even during planned downtime to support connectivity which is required for line maintenance and changeover tasks Resolution Multiple Communication paths, localize impact of Infrastructure Maintenance Resilient communications will find alternative path with no user intervention High Speed Resiliency options like Integrated DLR and REP recover connectivity quickly to prevent data loss Available on Fully and High performance Managed Switches Stratix 5700, 5400 and 5410

14 Select the Right Stratix Switch for Your Application Challenge Unmanaged switches do not have any port diagnostics No visibility or counters that could be leveraged Nuisance faults occur intermittently No indications that cables are becoming marginal until failure occurs Resolution Port diagnostics are available for visibility Lightly, Fully, and High Performance Managed Switch options available Features enabling visibility on the operator terminal FactoryTalk View Faceplates provide actionable information Stratix 2500, 5700, 8000, 5400, and 5410

15 SWITCH SELECTION Unmanaged vs. Managed SWITCH SELECTION Lightly Managed, Lite Managed Fully Managed SWITCH SELECTION VLANs, NAT & ROUTING INDUSTRIAL NETWORK SECURITY Protocols, Open Port Strategies, ACLs, Firewalls and VPNs TOOLS & RESOURCES OUT OF THE BOX Stratix2500 Express Setup

16 Select the Right Stratix Switch for Your Application Challenge No visibility to tools typically used in IT roles Escalation path for communications issues using other diagnostic tools Operations does not manage switches higher in the architecture Coordination of shared Infrastructure changes Resolution Cisco IOS ensures compatibility with common IT tools Facilitates collaboration with remote expertise to solve communications issues impacting operations Available on Fully and High Performance Managed Switches Stratix 5700, 8000, 5400 and 5410

17 Select the Right Stratix Switch for Your Application Two Installation Methods Out of the box installation that prioritizes traffic, or Configured for specific applications to support security, resiliency and bandwidth optimization features Features & Benefits Premier Integration to the Rockwell Automation Integrated Architecture system Minimized downtime by monitoring traffic flow Improved network resiliency to help uncover errors before the network stops Increased network security with port security to control connections to the network when needed Reduced overall TCO with logical segmentation Offered in 5 and 8 10/100 Mbps fast EtherNet/IP copper SWITCH SELECTION Lightly Managed, Lite Managed Fully Managed

18 Select the Right Stratix Switch for Your Application The Stratix 5700 vs. the Stratix 2500 the differences 5700 has higher port density (represented by 6, 10, 18 and 20-port catalogs numbers in Lite Firmware and Full Firmware category), support for up to 4 SFP slots for fiber connectivity, up to 2 Gig ports, up to 4 power over Ethernet (PoE) ports DHCP per port (which simplifies Automatic Device Configuration) for automatic end device IP address assignment Internal Flash and SD card for backup and restore capability Support of REP resiliency protocol Select Stratix 5700 catalog numbers offer integrated DLR, NAT, and support of PTP It is built on Cisco IOS, which provides a command line interface (CLI) as a flexible configuration tool that is familiar to IT professionals Stratix 5700 extends on Stratix 2500 security capabilities through Access Control Lists, IEEE 802.1x Security, Centralized Authentication capability (RADIUS, TACACS+) SWITCH SELECTION Lightly Managed, Lite Managed Fully Managed

19 8-port 16-port IP67-rated for dust and washdown protection 8,16 and 24 port versions with rugged M12 (D-coded) Ethernet Connectors Panel/machine mount design for on-machine connectivity outside of the cabinet Basic Offering 24-port SWITCH SELECTION Lightly Managed, Lite Managed Fully Managed

20 The Stratix 5700 is a compact, scalable Layer 2 managed switch for use in applications from small isolated, to complex networks. The switch combines advanced Cisco technology and premier integration into the Integrated Architecture to provide solutions for both Information Technology (IT) and Operational Technology (OT) professionals SWITCH SELECTION Lightly Managed, Lite Managed Fully Managed

21 Advanced Features Power over Ethernet (PoE and PoE+) delivers power over a single Ethernet cable Network Address Translation (NAT) reduces commissioning time Integrated Device Level Ring (DLR) connectivity helps optimize the network architecture and provide consolidated network diagnostics Enhanced Security Options Application/project based port access for machine protection Encrypted administrative traffic and advanced security features such as centralized authentication for plant protection SWITCH SELECTION Lightly Managed, Lite Managed Fully Managed Optimized Integration Embedded Cisco technology provides integration with enterprise network FactoryTalk View Faceplates for status monitoring and alarming Predefined Logix tags help diagnostics retrieval Studio 5000 add-on profiles for configuration and monitoring Simplified Setup & Maintenance SD card for easy device replacement Default configurations Common Smartports DHCP per port IP addressing Diagnostics and tools

22 Studio 5000 Add-on Profile (AOP) for easy configuration and monitoring Pre-defined Logix tags for monitoring and port control Pre-designed FactoryTalk View faceplates for monitoring and alarming SWITCH SELECTION Lightly Managed, Lite Managed Fully Managed

23 Configure, Manage and Diagnose your network with familiar tools Automation Operations Technology (OT) Professionals FactoryTalk Services tightly integrate into the Integrated Architecture system Information Technology (IT) Professionals Cisco CNA, CLI, Cisco Prime tightly integrate into joint Cisco and Rockwell Automation Converged Plant-wide Ethernet (CPwE) Reference Architectures SWITCH SELECTION Lightly Managed, Lite Managed Fully Managed

24 Easy Switch configuration without being a network expert Express Setup Automatically sets switch configuration for typical automation applications Smartports Pre-defined port settings for common automation and network devices like Logix Controllers, Desktop devices and Routers Optimizes traffic through the port and network Minimizes latency

25 SWITCH SELECTION Unmanaged vs. Managed

26 Distribution Features Unmanaged Stratix 2000 Stratix port model 8-port model Lightly Managed Stratix port Lightly managed Basic GB SFP option 5-16 ports Traffic management Fiber port Diagnostics options Gig port option Security Plug & play 10M/100M 10M/100M/1G Access Stratix 5700/ ArmorStratix Layer 2 firmware 6 20 ports IP30 and IP67 On-Machine platform Integrated DLR Integrated NAT IEEE1588 PTP PoE/PoE+ Stratix 8000/8300 Layer 2 or layer 3 routing firmware 6 26 ports Modular platform for maximum flexibility IEEE1588 PTP PoE/PoE+ 10M/100M/1G SWITCH SELECTION Unmanaged vs. Managed Managed Stratix 5400 Layer 2 or Layer 3 routing firmware 8 20 ports 4 port or all gig port versions IEEE1588 PTP Integrated NAT Up to 8 PoE/PoE+ ports PRP (RedBox) 10M/100M/1G Stratix inrack Mount Layer 2 or Layer 3 routing firmware 28 ports All gig ports plus four 10 gig ports IEEE1588 PTP Up to 8 separate integrated NAT ports Up to 12 PoE/PoE+ ports PRP (RedBox) DC and AC power input options 10M/100M1G/10G

27 SWITCH SELECTION Unmanaged vs. Managed SWITCH SELECTION Lightly Managed, Lite Managed Fully Managed SWITCH SELECTION VLANs, NAT & ROUTING INDUSTRIAL NETWORK SECURITY Protocols, Open Port Strategies, ACLs, Firewalls and VPNs TOOLS & RESOURCES OUT OF THE BOX Stratix2500 Express Setup

28 Select the Right Stratix Switch for Your Application Camera Camera Controller Drive Operator Interface SWITCH SELECTION VLANs, NAT & ROUTING

29 Select the Right Stratix Switch for Your Application Linear network example SWITCH SELECTION VLANs, NAT & ROUTING

30 NAT: Network Address Translation (NAT) provides, Remote support capabilities of control systems Flexibility to allow the placement of identical machines on a Ethernet network without network setting changes Ability to apply consistent configurations to control systems on a network, allowing for exact duplications of machines / processes Reduces the need for public IP addresses Routing/VLAN Routing Provides, Ability to converge two or more distinct IP scheme into the same network Ability to converge two or more distinct VLANs into the same network Access Control Lists Provide Grant or restrict access to any of the destination ports of a TCP/IP Address Firewalls Provide DeMilitarized Zone (DMZ) between the internet and controls network DeMilitarized Zone (DMZ) between the IT and OT network SWITCH SELECTION VLANs, NAT & ROUTING

31 Stratix 5700 NAT Solution - 4 Networks same IP Scheme SWITCH SELECTION VLANs, NAT & ROUTING

32 SWITCH SELECTION VLANs, NAT & ROUTING

33 Filtering can be done by examining such things as: -Source IP, MAC ID, or port -Destination IP, MAC ID, or port -Upper layer protocol Stratix 5410 Distribution Switch ACLs are implemented the same way in all Stratix switches with ACL capabilities Only applies to inbound traffic on an interface Camera Camera Controller Drive Cell/Area Zone - Levels 0 2 Star Topology (Lines, Machines, Skids, Equipment) Operator Interface SWITCH SELECTION VLANs, NAT & ROUTING

34 Firewalls keep track of legitimate connections (syn, syn ack, ack) Firewalls reject attempted connections from sources without a syn, syn ack, ack connection history If a packet crafting tool is used in an attempt to gain access through the firewall, the firewall will reject packets who s sequence numbers are out of range Outside Interface Inside Interface SYN SYN ACK Firewall ACK Destination Seq# SWITCH SELECTION VLANs, NAT & ROUTING

35 Inline Transparent Mode Inline Routed Mode Network A IFW Network A Network A IFW Network B Traffic Traffic Traffic Traffic Same Network Addresses on Ingress and Egress Interfaces Passive Monitor Mode Different Network Addresses on Ingress and Egress Interfaces (Think router ) Packet IFW Copy of the Packet Packet SWITCH SELECTION VLANs, NAT & ROUTING

36 NATR ENA STRATIX 5700 STRATIX NATR Layer ENA Layer 3 / VPN 1783-BMS10CGN Layer BMS20CGN Layer Layer 2/3 SWITCH SELECTION VLANs, NAT & ROUTING

37 NATR 5950 ENA WHEN? 5700 SWITCH SELECTION VLANs, NAT & ROUTING

38 How many work cells are involved? ANSWER: 1 to 4 How many devices (nodes) do you have in the work cell? 1 to 32 = 1783-NATR NATR ENA 32 to 128 = 9300-ENA 1783-NATR 9300-ENA /w VPN SWITCH SELECTION VLANs, NAT & ROUTING

39 How many work cells are involved? ANSWER: 4 or more Do all of the work cells have unique private IP addresses? ANSWER: 2 or more similar or dissimilar IP s How many devices (nodes) are in the work cell? ANSWER: The 5700 configuration can support an almost limitless amount of nodes. It s true limit is the switch processor utilization and the amount of data the needs to flow between the private and public networks. Are you planning on using a single appliance? ANSWER: If YES, The 5700 configuration can support multiple NAT Tables, meaning it is able to bring multiple work cells together into one public address BMS10CGN 1783-BMS20CGN SWITCH SELECTION VLANs, NAT & ROUTING 40

40 Do all of the work cells have unique private IP addresses? With which public network are you converging? Are you creating a DMZ between the OT and IT networks? Are you creating a firewall between a work cell and the rest of the network? 5950 SWITCH SELECTION VLANs, NAT & ROUTING

41 SWITCH SELECTION VLANs, NAT & ROUTING

42 The following products are available to mitigate the security threats using NAT, ACL & Firewall on an OT network. SWITCH SELECTION VLANs, NAT & ROUTING

43 SWITCH SELECTION Unmanaged vs. Managed SWITCH SELECTION Lightly Managed, Lite Managed Fully Managed SWITCH SELECTION VLANs, NAT & ROUTING INDUSTRIAL NETWORK SECURITY Protocols, Open Port Strategies, ACLs, Firewalls and VPNs TOOLS & RESOURCES OUT OF THE BOX Stratix2500 Express Setup

44 SECURITY & PRODUCTS Today s internet is populated all kinds of equipment.

45 SECURITY & PRODUCTS What do all of these devices have in common? They can ALL be exploited if they aren t secured.

46 SECURITY & PRODUCTS Why secure them? Secure them from what? Some devices like PLCs were created from an open platform. They send and receive clear text data. Often times, usernames and passwords are included.

47 SECURITY & PRODUCTS Why security for devices on the factory floor. Devices are added to company networks without strong controls. Without the use of routers and deep packet inspectionnot only can the device be exploited, you ll never know how it was exploited. Some devices have remote access and in many cases this makes them accessible by anyone, anywhere.

48 SECURITY OPEN PORTS The Open Port Search Engine, Shodan, was launched in 2009 by a computer programmer, John Matherly, who in 2003,[4] conceived of the idea to search for devices linked to the Internet. It started as his pet project based on the fact that large numbers of devices and computer systems are connected to the Internet. Shodan users are able to find systems including traffic lights, security cameras, home heating systems as well as control systems for water parks, gas stations, water plants, power grids, nuclear power plants and particle-accelerating cyclotrons.

49 OPEN PORTS - MODBUS

50 OPEN PORTS - ETHERNET/IP - WORLD

51 OPEN PORTS - ETHERNET/IP - US

52 OPEN PORTS - ETHERNET/IP MICHIGAN

53 SECURITY & PRODUCTS Why is it such a big deal if you have a few open ports?

54 SECURITY & PRODUCTS Having an open port on any device makes you vulnerable to attacks.

55 SECURITY & PRODUCTS

56 SWITCH SELECTION Unmanaged vs. Managed SWITCH SELECTION Lightly Managed, Lite Managed Fully Managed SWITCH SELECTION VLANs, NAT & ROUTING INDUSTRIAL NETWORK SECURITY Protocols, Open Port Strategies, ACLs, Firewalls and VPNs TOOLS & RESOURCES OUT OF THE BOX Stratix2500 Express Setup

57 1783-NATR = NAT SOLUTION (1 4) work cells, (1 32) NAT translations, 1 NAT TABLE 9300-ENA = NAT SOLUTION & VPN (1 4) work cells, (1 128) NAT translations, 1 NAT TABLE 1783-BMS10CGN 1783-BMS20CGN = NAT & ACL SOLUTION (4 or more) work cells, 2 or more NAT tables 1783-SAD2T2SPK9 = NAT, ACL, FIREWALL SOLUTION & VPN Router (DMZ control), Firewall (DMZ control), NAT TOOLS & RESOURCES

58 Select the Right Stratix Switch for Your Application Join for the latest trends, developments, and implementation advice on the use of IP in industrial applications, don t leave without registering. Join for the latest ANSI/TIA Standards Limited Power NFPA Revision of the NEC, Specific NEC page where LP is addressed: / Other definitions: TCP Transmission Control Protocol UDP User Datagram Protocol Other resources Subscribe to for an open port search engine Real-time network attacks: Real-time and web thread detection: TOOLS & RESOURCES

59 Select the Right Stratix Switch for Your Application Pre-sales activity; not post-sales activity Rockwell Automation Sales initiated Follow normal Global Commercial Engineering Engagement Request Process arepoint.com/teams/gtc/eng agement/default.aspx TOOLS & RESOURCES

60 Select the Right Stratix Switch for Your Application Commercial Engineering Architecture Review Process When submitting for CE Engagement request, be very specific on which area(s) of the architecture you would like CE to review: Sizing the system Choosing the right products/approach for the application Choosing the right topology Choosing the resiliency protocol, etc. Review the list of required documents and attach them with the request After submittal, review your request for any comments from CE that will be put in the CE Leader Comments field Go back and fill in the "TBD" for Opportunity Tracking # with the CRM opportunity ID. Currently only one quarter of the requests have them filled in. TOOLS & RESOURCES

61 Select the Right Stratix Switch for Your Application CPwE Architectures - Cisco and Rockwell Automation Networks Products Webpage CPwE design guides CPwE Whitepapers Stratix Reference Guide TOOLS & RESOURCES

62 SWITCH SELECTION Unmanaged vs. Managed SWITCH SELECTION Lightly Managed, Lite Managed Fully Managed SWITCH SELECTION VLANs, NAT & ROUTING INDUSTRIAL NETWORK SECURITY Protocols, Open Port Strategies, ACLs, Firewalls and VPNs TOOLS & RESOURCES OUT OF THE BOX Stratix2500 Express Setup

63 Select the Right Stratix Switch for Your Application Power up the switch Press Express Setup Out of the box

64 Out of the box

65 Out of the box

66 1. Open a new tab in the browser or close and reopen the browser Open up the network connection settings locate the local area connection go to internet protocol version 4 click on properties. 3. Change the IP address to / Click OK (2) times and then click on close. Out of the box 4

67 Open a command window and test the connection between the switch and your pc. Ping Out of the box

68 Out of the box

69 Out of the box

70 Out of the box

71 Out of the box

72 Questions? Here s my contact information Rob Rodriguez-Pelizzari E: rob.rodriguez-pelizzari@kendallelectric.com C: Datacomm inside sales: (877)