Field Agents User Guide

Transcription

1 GFK-2993A Field Agents User Guide Oct 2016

2 These instructions do not purport to cover all details or variations in equipment, nor to provide for every possible contingency to be met during installation, operation, and maintenance. The information is supplied for informational purposes only, and GE makes no warranty as to the accuracy of the information included herein. Changes, modifications, and/or improvements to equipment and specifications are made periodically and these changes may or may not be reflected herein. It is understood that GE may make changes, modifications, or improvements to the equipment referenced herein or to the document itself at any time. This document is intended for trained personnel familiar with the GE products referenced herein. GE may have patents or pending patent applications covering subject matter in this document. The furnishing of this document does not provide any license whatsoever to any of these patents. Public This document is approved for public disclosure. GE provides the following document and the information included therein as is and without warranty of any kind, expressed or implied, including but not limited to any implied statutory warranty of merchantability or fitness for particular purpose. For further assistance or technical information, contact the nearest GE Sales or Service Office, or an authorized GE Sales Representative. Revised: Oct 2016 Issued: Aug General Electric Company. * Indicates a trademark of General Electric Company and/or its subsidiaries. All other trademarks are the property of their respective owners. We would appreciate your feedback about our documentation. Please send comments or suggestions to controls.doc@ge.com Document Updates Location MFA Important Product Information Power Requirements Configure a Network Proxy Create a Device Representation in EdgeManager Assign the Technician to the Field Agent Obtain Enrollment Information Description Removed this section this content has been moved to Mini Field Agent (MFA) Important Product Information (GFK-2997) Corrected the operating temperature range Removed instructions for Bypass Proxy Server and Test Connection Replaced multiple screenshots to reflect Predix EdgeManager screen updates, specifically the dashboard option Control Panel and related windows were replaced with Settings

3 Safety Symbol Legend Warning Indicates a procedure or condition that, if not strictly observed, could result in personal injury or death. Caution Indicates a procedure or condition that, if not strictly observed, could result in damage to or destruction of equipment. Attention Indicates a procedure or condition that should be strictly followed to improve these applications. GFK-2993A 3

4 Contents 1 Overview Field Agent Architecture Mini Field Agent (MFA) MFA Hardware Instructions Internal Components Field Agent Sales Catalog Agency Certifications and Standards Replacement and Spares Secure Deployment Introduction Communication Requirements Security Capabilities Configuration Hardening Network Architecture & Secure Deployment Other Considerations Getting Started with the Field Agent Start the Field Agent Log Into the Web Console Configure the Network Update the Field Agent Enroll with Predix Cloud EdgeManager Using the Field Agent Device Management Remote Monitoring Push Button Operations GFK-2993A Field Agents User Guide

5 1 Overview 1.1 Field Agent Architecture The goal of field agent technology is to connect industrial machines to the Predix cloud, so that asset owners can receive insights and optimization for their equipment. Field agents connected and transmit this data securely. Operators can then visualize the performance of their assets and enable predictive analytics. Armed with this valuable information, operators can optimize equipment uptime. OEMs can proactively maintain and service their equipment fleet, improving operations, growing service revenues and winning new business. Asset owners can evolve past a break-fix model and implement predictive analytics to minimize unplanned downtime. GE has developed a family of Field Agent devices to address the challenges of communicating equipment data. A field agent has two primary functions: Collecting and transmitting machine data securely A platform for running applications at the edge Once a Field Agent is up and running, data is transferred from the plant to the cloud over encrypted channels, preserving its time stamp, quality, and fidelity. It also provides a rich domain application environment for edge processing, so logic can be executed at the most appropriate place in the architecture locally on the machine or in the cloud. HTTPS Predix Cloud Customer Access Using Laptop or Mobile Device HTTPS OPC UA, Modbus TCP, etc. Control System at Customer Site Field Agent at Customer Site Overview GFK-2993A 5

6 1.2 Mini Field Agent (MFA) The GE Mini Field Agent* (MFA) module is a Machine to Cloud collector that securely forwards data to a Predix Time Series Database Service. The MFA is based on the ARM architecture and designed to meet low power, harsh environment specifications for industrial use. It runs an embedded Linux operating system and comes with Predix Machine pre-integrated and ready to enroll in Predix Manager. The Field Agent ecosystem enables end users ease of developing Predix solutions using the MFA platform. The following figure depicts the typical installation of a MFA. The section Network Configuration provides defaults IP addresses. Features 6 GFK-2993A Predix Machine One Wide Area Network (WAN) Ethernet port Three Local Area Network (LAN) Ethernet ports with built-in switch RS-485 hardware interface RS-232 hardware interface CAN bus hardware interface One discrete input One relay contact Field Agents User Guide

7 1.2.1 MFA Specifications Note For the latest information, refer to the webpage at Item Processor Memory Ambient Temperature, Humidity Real Time Clock Battery Description TI AM bit ARM processor, 600MHz 512MB DDR3 RAM 1GB on-board flash -40 C to 70 C, (use above 55 C requires installation in a restricted access location) 5 to 95% non-condensing Battery backup for RTC, 6 yrs USB Port USB 2.0 SD Card Slot Ethernet Ports One MicroSD card slot One unswitched Ethernet port, 10/100 Mbps Three switched Ethernet ports, 10/100 Mbps One RS 232 Serial Port (pluggable screw terminal) RS-232 Maximum cable distance is 15m Maximum communication rate is kbps One RS 485 Serial Port (pluggable screw terminal) RS-485 Maximum cable distance: 305 m (1000 ft) Maximum communication rate: kbps One CAN port (pluggable screw terminal) CAN bus Maximum cable distance is 40 meters Maximum communication rate is 1 Mbps Discrete input Relay contact Operating System Operating voltage Power consumption 1 x 24 V opto-coupled / isolated input, 10 ma nominal Minimum ON = 1.4µs Maximum OFF = 28 µs Hipot tested to 1202 V DC (equivalent of 925 V rms) 1 x Output relay, DC (Form A normally open relay contact, 1A, 250 V AC/220 V DC, 30W switching power) 30 V DC, 1A 110 V DC, 0.27 A 220 V DC, 0.13 A 125 V AC, 0.24 A 250 V AC, 0.12 A Hipot tested to 1202 V DC (equivalent of 925 V rms) Embedded Linux built using the Yocto Toolchain 9 to 30 V DC, nominal 24 V DC 4 Watts Wire sizes: 22 to 14 AWG Screw torque: 2 in-ib 3-pin power plug Temperature rating for copper wire: 80 C Wiring to power input terminals shall be limited to 30 meters in length Housing dimensions 5.53 x 5.33 x 1.55 Inches (140.5 x x 39.4 mm) Overview GFK-2993A 7

8 Item Mounting Certifications Operational Vibration Operational Shock Security Features Protocols Description DIN rail or panel mount Refer to the section Agency Certifications and Standards IEC Hz, 0.012"ppk displacement HZ, 2.0g acceleration IEC g, 11ms (sine wave) On board Trusted Platform Module Modbus TCP, OPC UA (built in) Other protocols can be added using the Predix Machine SDK. 8 GFK-2993A Field Agents User Guide

9 2 MFA Hardware Instructions 2.1 Internal Components Caution The only user-serviceable component in the Mini Field Agent is the Real Time Clock Battery. Do not remove or alter any other components on the Mini Field Agent. The MFA module is shipped with a battery pre-installed. The battery holder is located below the Supercap, and can be replaced by opening the top cover. To replace the battery 1. Power OFF the MFA Module. 2. Wait for 1 minute. 3. Open the top cover by loosening the four screws on the edges. 4. Use a small flat-head screw driver to gently pry out the old battery. 5. Insert the new battery. Replace battery only with Rayovac BR2032 or part IC690ACC001B or later. Use of another battery may present a risk of fire or explosion. Warning Battery may explode if mistreated. Do not recharge, disassemble, heat above 100 C (212 F) or incinerate Installation There are two different mounting options for the MFA: DIN Rail Mount or Panel Mount. The ICMFAACC001 MFA Panel Mounting Kit is required to use the Panel Mount option. After mounting the MFA, connect it to the facility network using standard Ethernet cables. The LAN interface should be connected to the local area network containing one or more industrial devices. The WAN interface should be connected to a network with access to the Internet. MFA Hardware Instructions GFK-2993A 9

10 DIN Rail Mount The MFA comes equipped with a DIN Rail mounting clip as displayed in the following figure. For DIN Rail mounting, pull the clip down and lock it in place. Place the unit on the DIN rail, and then push the clip up to secure it. The optional panel mounting plate should not be attached because it will prevent DIN rail mounting. [84.9] 3.34 DIN MOUNT CENTER LINE [88.7] 3.49 [74.6] 2.94 [146] GFK-2993A Field Agents User Guide

11 Panel Mount To panel mount the MFA module, attach the ICMFAACC001 panel mount plate to the side of the MFA module using the four M3 screws included with the mounting kit. Attach the panel mount plate in the orientation as displayed in the following figure. The screw size for each panel mount tab is recommended to not exceed M5. [157.2] 6.19 [139.4] 5.49 [135.3] 5.33 [84.9] 3.34 [140.5] 5.53 [139.4] 5.49 [157.2] 6.19 MFA Hardware Instructions GFK-2993A 11

12 MFA Interface Details Note Refer to Mini Field Agent (MFA) Important Product Information (GFK-2997) for version-specific interface details. The following figure displays all four sides of the MFA module with details for connections. Local Field I/O MicroSD slot (for G E internal use only ) Wi-Fi Antenna Connection Top View USB Interface Rear V iew Front V iew Ethernet Interfaces Push Button RS-232 Bottom View RS-485 Status LE Ds DIN Rail Mounting C lip 9 to 30 V DC power polarity must match Termination Jumper for CAN (rightmost 2 contacts) 12 GFK-2993A Field Agents User Guide

13 Power Requirements The MFA is powered by a DC Power Supply (9 to 30 V DC, nominal 24 V DC). Power for the MFA shall be provided by a Class II power supply marked as "double insulated", Limited Power Source (LPS), or a SELV source with a minimum 32 V dc listed fuse with 6 A max rating. Power for the relay output and discrete input shall be provided by an isolated source. The IC690PWR024 (Selectable 115/230VAC input, 24V 5A Output) DIN Rail mountable power supply meets the power requirements of the MFA. Specifications for the IC690PWR024 are as follows: Operating temperature range: -40 to 70 C EMI complies with EN and EN CE (LVD) UL recognized ( ) UL 508 Caution Reversing input power polarity might cause damage to the MFA. The ICMFAACC002 (24 V DC 1 A Power Supply with Pre-Wired Power Connector) may be used to supply power to the MFA in a temporary installation. For example, the ICMFAACC002 supply could be used to power the MFA in an office environment to perform an Offline or Manual Cloud Update prior to installation, or for Predix Application development activities. The ICMFAACC002 Power Supply is not rated for permanent installation, and should not be used to power the MFA in permanent installations. Caution The ICMFAACC002 Power Supply is not designed nor rated for permanent installation. It is the responsibility of the system integrator to specify a power supply for permanent installation. The ICMFAACC002 is rated for VAC and Hz input, and features an IEC C14 inlet plug for attachment of the AC power cord. The ICMFAACC002 may be adapted to local power by using a desktop computer-style AC power cord (with an IEC C13 connector on one end and the correct AC mains plug on the other). MFA Hardware Instructions GFK-2993A 13

14 Pin Definitions Note Refer to the section MFA Interface Details for a figure that displays the physical locations of each pin. Connector Function Pin Number Description PWR Power connector ( 9 to 30 V DC) 1 Ground 2 Negative Voltage 3 Positive Voltage IO Normally Open relay contact output, 30 V DC, 1 A resistive load +24 V Opto-coupled Input, 10 ma 1 K1-A 2 K1-B 3 IN+ 4 IN- CAN bus RS-485 Serial Serial 1 CAN_H 2 CAN_L 3 Ground 4 A /RX 5 B /CTS 6 Y /TX 7 Z /RTS RS-232 Serial 1 TX 2 RX 3 GND 4 RTS 5 CTS Network Configuration Note Refer to the section MFA Interface Details for a figure that displays the physical locations of the LAN and WAN Ethernet interfaces. The default WAN and LAN IP addresses of the Mini Field Agent are displayed in the following table. Item WAN LAN IP Address Obtain using DHCP Subnet Mask Obtain using DHCP Gateway Obtain using DHCP Not set WAN connects to the uppermost RJ-45 connector. LAN connects to the three lower RJ-45 connectors and they are switched internally. 14 GFK-2993A Field Agents User Guide

15 2.1.2 Push Button and LEDs The front panel of the MFA contains a blue push button and three indicator LEDs. The LEDs have different behaviors depending on whether the push button is being held. When the push button is not being used, the LEDs behave as follows. ON LED: Flashing green indicates Predix Machine is starting Solid green indicates Predix Machine is running (must be solid before attempting to connect with the web console or iphone interface). ACT LED: Each orange pulse indicates the activity of data being received from a configured Machine Adapter. Cloud LED: Flashing blue indicates Predix Machine is not connected to the Predix Cloud Solid blue indicates Predix Machine is connected to the Predix Cloud The Push Button is used for performing a graceful reboot of the MFA or performing a factory reset depending on how long the button is held and released. These features and the corresponding impact on the LED behavior are documented in the section, Push Button Operations. Each of the four RJ-45 Ethernet connectors contains two LEDs. The green LED indicates an Ethernet connection has been established. The yellow LED indicates packet traffic. MFA Hardware Instructions GFK-2993A 15

16 2.2 Field Agent Sales Catalog GE MFA Orderable Items Catalog Number ICMFA AAAA ICMFAACC001-AA ICMFAACC002-AA IC690PWR024 ICMFAMGTM1YR ICPREDIXSERVICES Description Mini Field Agent Mini Field Agent Panel Mounting Kit 24 V Power Supply Pre-wired with Connector (not for permanent installation) Selectable 115/230 V AC Input, 24 V DC 5A Output, DIN Rail Mount Power Supply Annual Device Management Fee Predix Services As Consumed MFA Accessories The following items are included with the MFA kit (not ordered separately). Accessory Item Wi-Fi Antenna & Cable Assembly Description LS Research center-fed dipole antenna and LS Research U.FL to Reverse Polarity SMA Connector cable Ethertronics Prestta and Johnson Emerson U.FL to U.FL coaxial cable Taoglas FXP C flexible dipole antenna with integrated cable and U.FL connector Battery Rayovac make BR2032-BA BAT,LIT,3V,195MAH,COIN,CELL,-40C,+85C,OPER 16 GFK-2993A Field Agents User Guide

17 2.3 Agency Certifications and Standards Refer to Mini Field Agent (MFA) Installation and Maintenance Requirements (IMR) (GFK-2998) for conformance to these standards. Description Marking Comments North America Safety for Information Technology Equipment North America Safety for Programmable Controller for use in Hazardous locations Class 1 Division 2 Groups ABCD Class 1 Zone 2 Gas Group IIC North American Radio Equipment European Radio Equipment European Restriction of Hazardous Substances (RoHS) European Safety for Explosive Atmospere Equipment Group II, Category 3, Gas Group IIC European Waste & Collection Contains FCC ID: TFB-TIWI-01 Contains IC: 5969A-TIWI101 Certification by Underwriters Laboratories: UL , UL , UL , UL , UL , and ISA CSA C22.2 No , CAN/CSA C22.2 No , CSA C22.2 No. 213 M1987, CAN/CSA-C22.2 No , and CAN/CSA-C22.2 No Equipment Authorization issued by Telecommunication Certification Body under authority of Federal Communications Commission (FCC) and Industry Canada (IC) for intentional transmitters EU-Type Examination by Notified Body (#0673) to European Radio Equipment Directive 2014/53/EU Manufacturer s declaration of conformity in accordance with European RoHS Directive (2011/65/EU) Certification in accordance with to European ATEX Directive 2014/34/EU Compliance with European WEEE Directive 2002/96/EC Amended by 2008/34/EC China Restriction of Hazardous Substances Compliance with Management Methods for the Restriction of the Use of Hazardous Substances in Electrical and Electronic Products. (Jan 21, 2016) Declaration Table provided with equipment Federal Communications Commission (FCC) Caution Changes or modifications not expressly approved by the party responsible for compliance could void the user's authority to operate the equipment. MFA Hardware Instructions GFK-2993A 17

18 2.4 Replacement and Spares Replacement parts may contain static-sensitive components. Therefore, GE ships replacement parts in anti-static bags. When handling electronics, make sure to store them in anti-static bags or boxes and use a grounding strap. Caution Warning To prevent component damage caused by static electricity, treat all boards with static-sensitive handling techniques. Wear a wrist grounding strap when handling boards or components, but only after boards or components have been removed from potentially energized equipment and are at a normally grounded workstation. In addition to information provided here, always follow all wiring and safety codes that apply to your area or your type of equipment. For example, in the United States, most areas have adopted the National Electrical Code standard and specify that all wiring conform to its requirements. In other countries, different codes will apply. For maximum safety to personnel and property you must follow these codes. Failure to do so can lead to personal injury or death, property damage or destruction, or both Replacement Procedure System troubleshooting should be at the module level. The failed module should be removed and replaced with a known good spare. The failed device should be returned to GE for repair. Do not attempt to repair it on site. Caution To prevent equipment damage, do not remove, insert, or adjust board connections while power is applied to the equipment. To replace the MFA 1. Lock Out Tag Out (LOTO) the equipment to isolate power sources. 2. Disconnect the incoming power plug. 3. Disconnect the Ethernet cables. 4. Remove the screws holding the MFA in place. 5. Install the new MFA by reversing steps 4 through GFK-2993A Field Agents User Guide

19 2.4.2 Renewals and Spares Renewals and spares (or those not under warranty) should be ordered by contacting the nearest GE Sales or Service Office, or an authorized GE Sales Representative. Prior to ordering a replacement part: Determine if the part is under warranty Identify the part While ordering, be sure to include the complete part number and revision letter. All digits are important when ordering or replacing any device. The factory may substitute newer versions based on availability and design enhancements, however, GE ensures backward compatibility of replacements. MFA Label Example MFA Hardware Instructions GFK-2993A 19

20 Notes 20 GFK-2993A Field Agents User Guide

21 3 Secure Deployment This chapter provides information that can be used to help improve the cyber security posture of systems that include the GE Field Agents. It is intended for use by control engineers, integrators, IT professionals, and developers responsible for configuring and deploying the Field Agent. Secure deployment information is provided in this manual for the following products. 3.1 Introduction What is Security? Security is the process of maintaining the confidentiality, integrity, and availability of a system: Confidentiality: Ensure only the people you want to see information can see it. Integrity: Ensure the data is what it is supposed to be. Availability: Ensure the system or data is available for use. GE recognizes the importance of building and deploying products with these concepts in mind and encourages customers to take appropriate care in securing their GE products and solutions. As GE product vulnerabilities are discovered and fixed, security advisories are issued to describe each vulnerability in a particular product version as well as the version in which the vulnerability was fixed. GE Product Security Advisories can be found at the following location. kav I have a firewall. Isn t that enough? Firewalls and other network security products, including Data Diodes and Intrusion Prevention Devices, can be an important component of any security strategy. However, a strategy based solely on any single security mechanism will not be as resilient as one that includes multiple, independent layers of security. Therefore, GE recommends taking a Defense in Depth approach to security What is Defense in Depth? Defense in Depth is the concept of using multiple, independent layers of security to raise the cost and complexity of a successful attack. To carry out a successful attack on a system, an attacker would need to find not just a single exploitable vulnerability, but would need to exploit vulnerabilities in each layer of defense that protects an asset. For example, if a system is protected because it is on a network protected by a firewall, the attacker only needs to circumvent the firewall to gain unauthorized access. However, if there is an additional layer of defense, say a username/password authentication requirement, now the attacker needs to find a way to circumvent both the firewall and the username/password authentication. Secure Deployment GFK-2993A 21

22 3.1.4 General Recommendations Adopting the following security best practices should be considered when using GE products and solutions. Care must be taken when connecting hardware to a wide area network including but not limited to a corporate network or the Internet at large. The network segmentation and firewall rules at each network interface must be carefully considered to reduce the allowed traffic to the bare minimum needed for operation. Access rules customized to the site's specific needs must be used to access devices described in this document from outside the local control networks. Care must be taken to control, limit, and monitor all access, using, for example, virtual private networks (VPN) or Demilitarized Zone (DMZ) architectures. If a device is being used in a manner that does not require wide area network access, it is strongly recommended that the device not be connected to any wide area network to reduce attack surface. Harden system configurations by enabling/using the available security features, and by disabling unnecessary ports, services, functionality, and network file shares. Apply all of the latest GE product security updates, SIMs, and other recommendations. Apply all of the latest operating system security patches to control systems PCs. Use anti-virus software on control systems PCs and keep the associated anti-virus signatures up-to-date. Use whitelisting software on control systems PCs and keep the whitelist up-to-date Sample Checklist This section provides a sample checklist to help guide the process of securely deploying GE products. 1. Create or locate a network diagram. 2. Identify and record the required communication paths between nodes. 3. Identify and record the protocols required along each path, including the role of each node. 4. Revise the network as needed to ensure appropriate partitioning, adding firewalls or other network security devices as appropriate. Update the network diagram. 5. Configure firewalls & other network security devices. 6. Enable and/or configure the appropriate security features on each GE product. 7. On each GE product, change every supported password to something other than its default value. 8. Harden the configuration of each GE product, disabling unneeded features, protocols and ports. 9. Test / qualify the system. 10. Create an update/maintenance plan. Note Secure deployment is only one part of a robust security program. This document, including the checklist above, is limited to only providing secure deployment guidance. 22 GFK-2993A Field Agents User Guide

23 3.2 Communication Requirements Communication between different parts of a control system is, and must be, supported. However, the security of a control system can be enhanced by limiting the protocols allowed, and the paths across which they are allowed, to only what is needed. This can be accomplished by disabling every communication protocol that isn t needed on a particular device, and by using appropriately configured and deployed network security devices (e.g. firewalls, routers) to block every protocol (whether disabled or not) that doesn t need to pass from one network/segment to another. GE recommends limiting the protocols allowed by the network infrastructure to the minimum set required for the intended application. Successfully doing this requires knowing which protocol is needed for each system-level interaction. This section describes how the supported serial and Ethernet application protocols are used in the each Mini Field Agent, and indicates the role of each participant in the communication. This information is intended to be used to help guide the specification of the network architecture and to help configure firewalls internal to that network, in order to support only the required communications paths for any particular installation Serial Protocols This subsection indicates which serial protocols are supported by each Field Agent. Some of the supported protocols may not be required in a given system, since the installation may only be using a subset of the available protocols. Interface Available Serial Interfaces Mini Field Agent (MFA) RS-232 RS-485 CAN microsd USB Yes Yes Yes No No Note Currently no available Field Agent serial interfaces have software stacks included by default. Secure Deployment GFK-2993A 23

24 3.2.2 Ethernet Protocols This subsection indicates which Ethernet protocols are supported by each Field Agent. Some of the supported protocols may not be required in a given system, since the installation may only be using a subset of the available protocols. Supported Ethernet Protocols Protocol Mini Field Agent (MFA) Link ARP Yes Internet Transport Application ICMP IGMP IPv4 IPv6 TCP UDP DHCP Client DNS Client HTTPS Server Modbus TCP Master OPC UA Client Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Lower-level Protocols Ethernet communication is typically described using four layers, each with its own set of protocols. At the top of that hierarchy is the Application layer. Below the Application layer are the Transport, Internet, and Link layers. Information on the supported protocols from these three lower layers is summarized here. Link Layer Protocols Protocol ARP EtherType 0x0806 Internet Layer Protocols Protocol EtherType IP Protocol # ICMP 0x ICMP 0x IPv4 0x0800 (n/a) IPv6 0x86DD (n/a) Transport Layer Protocols Protocol EtherType IP Protocol # TCP 0x UDP 0x Note Each of these lower-level protocols is required by one or more of the Application protocols supported on the Mini Field Agent. 24 GFK-2993A Field Agents User Guide

25 Application Layer Protocols Field Agents are capable of acting as a server, responding to requests sent through any of several different protocols. They are also capable of acting as a client, sending requests to other servers using any of several different protocols. The following table, Application Layer Protocols lists the protocols supported by the Mini Field Agent, along with any TCP or UDP ports that are leveraged by those protocols. This table could aid in configuring a firewall between the Mini Field Agent and any clients or servers it communicates with. The table, Supported Ethernet Protocols lists which of these protocols the Mini Field Agent communicates with, when in a client or server role. Application Layer Protocols Protocol Server TCP Port Dest UDP Port DHCP 67 on server 68 on client DNS on server >1023 on client HTTPS 443, 8443 Modbus TCP 502 OPC UA 4840, 4841 Secure Deployment GFK-2993A 25

26 3.3 Security Capabilities This section describes the Systems capabilities and security features which can be used as part of a defense-in-depth strategy to secure your system. Security Capabilities Security Capability Predefined set of Subjects & Access Rights Access Control List Secure Remote Operations Firmware Signatures Software Firewall Mini Field Agent Yes Yes Yes Yes Yes Access Control and Authorization The Access Control process can be divided into two phases: 1. Definition Specifying the access rights for each subject (referred to as Authorization). 2. Enforcement Approving or rejecting access requests This subsection describes the Access Control capabilities supported by Field Agents, which includes its Authorization capabilities Authorization framework The subjects defined and supported by each server protocol are indicated in the following table. Functionality Application Protocol Subjects Available Ethernet Predix Machine Web Console HTTPS predix Enforcement The Field Agent enforces the access rights for the data and services that it provides. An unprivileged user account is leveraged to run Predix Machine and the related services on the Field Agent. This account provides only the minimum privileges needed to operate these services. 26 GFK-2993A Field Agents User Guide

27 3.3.2 Authentication The Field Agent provides password-based authentication for all of its server protocols. The following tables provide a summary of authentication mechanisms supported by the Field Agent for each protocol. Authentication supported by Field Agent Servers Functionality Application Protocol Authentication Options Ethernet Predix Machine Web Console HTTPS Login Credentials Authentication supported by Field Agent Clients Functionality Required Application Protocols Authentication Supported Ethernet Lookup IP addresses by Name DNS None Read data from a Modbus TCP slave Modbus TCP None Read data from an OPC UA server OPC UA None Secure Deployment GFK-2993A 27

28 Authentication Recommendations GE strongly recommends that authentication be used for every enabled protocol that supports authentication, and that all default passwords be changed. Whenever protocols are used with no authentication mechanism, or when authentication is disabled or relies on sending credentials in plaintext across the network, it is critical to control physical and electronic access to the network to prevent unauthorized messages from being sent and acted upon. The following table provides recommended actions to mitigate the risk of external or internal entities accessing a facility network and sending unauthorized messages. Item Personnel Security Protection Authentication Recommendations Recommendations All individuals with permission to physically access end customer systems should have background checks and be trained in the proper use and maintenance of the systems. 1. Whenever possible, there should be no physical network path from a facility network to the Internet. It should not be possible for an attacker to reach a facility network from any Internet-facing computer. Physical Security Perimeter Protection 2. Networks should always be physically segmented as suggested in the Reference Network Architecture diagram in the section Reference Architecture to avoid exposure to facility network. 3. Each asset should be visibly labeled by a unique identifier, with all expected asset identification compiled into an access controlled list. 1. All external access to a facility network should be managed through a Virtual Private Network (VPN) or similar technology leveraging two-factor authentication. 2. Next-Generation Firewalls should be properly configured and deployed at each conduit between physical networks that deny all but the specifically allowed protocol families, source addresses, and destination addresses, and specific application-level commands between the two adjacent networks. For example, a Next-Generation Firewall could prohibit write operations across networks while allowing read operations. 3. If one network node such as MDI servers uses unauthenticated protocols to exchange information or commands with another network node on the same physical network, a Next-Generation Firewall could be deployed between the two network nodes. This Next-Generation Firewall should be configured to explicitly whitelist all expected messages between the two network nodes, and deny all other unexpected messages. Electronic Security Perimeter Protection 4. To detect and alert for unexpected, unauthenticated messages on a given network, an Intrusion Detection System (IDS) could be configured and deployed. Consider configuring the IDS to log all events to a Security Information and Event Management (SIEM) system that aggregates all security information on the ICS network. 5. To detect and actively prevent unexpected, unauthenticated messages on a given network from reaching a given network node, an Intrusion Prevention System (IPS) could be configured and deployed. Consider configuring the IPS to log all events to a Security Information and Event Management (SIEM) system that aggregates all security information on the ICS network. 6. To limit the impact of the compromise of any single user account, it is recommended to divide "administrators" privileges into several user accounts, each for its own operational function. 7. To limit the impact of the compromise of any single set of credentials (user name, password) for any end customer equipment, it is recommended to never re-use credentials for different tools or purposes. 8. Carefully protect sources of and access to credentials (user names, passwords) for all end customer equipment, including switches, routers, firewalls, IDS, IPS, etc. 9. Enforce a policy of rotating credentials for end customer equipment periodically and after personnel changes. Note that products with no support for enforcement of unique passwords over time should be compensated for with policies and procedures that require a history of unique passwords. Passwords Recommendations on password complexity and management can be found in NIST , Guide to Enterprise Password Management. 28 GFK-2993A Field Agents User Guide

29 3.3.3 Password Management Each instance of a server has its own instances of the predefined subjects. As a result, passwords for each subject must be separately managed for each instance of a given kind of server. GE strongly recommends the use of long (10 characters or more), complex passwords wherever passwords are used for authentication. Recommendations on password complexity and management can be found in NIST , Guide to Enterprise Password Management. Changing Passwords Functionality Authenticated Subjects How Passwords Are Assigned Predix Machine Web Console Predix Machine Web Console "predix" user Users are created in Web Console User Administration page. Auto-prompted upon first login using the default password (predix2machine) Also configurable in the Web Console User Administration page Passwords are assigned and modified in the Web Console User Administration page Firewall Each Field Agent has a built-in firewall that is configured to block all incoming traffic other than the protocol types specified in the following table. All outgoing traffic generated by the Field Agent is permitted through the firewall, as is incoming traffic related to an outgoing request. The firewall is configured to block all forwarded traffic, which prevents devices on the same network as the Field Agent from using it as a direct gateway to the wide area network. Incoming Traffic Permitted Through Firewall Physical Port Name Protocol TCP Port Local Area Network (LAN) HTTPS Confidentiality and Integrity Some communications protocols provide features that help protect data while it is in flight actively moving through a network. The most common of these features include: Encryption Protects the confidentiality of the data being transmitted. Message Authentication Codes Ensures message authenticity and integrity by cryptographically detecting message tampering or forgery. This ensures the data originated from the expected source and was not altered since it was transmitted, regardless of whether or not it was malicious. Following are the communications protocols supported by Field Agents provide either of these features, as detailed in the table below. Therefore, compensating controls may be required to meet an installation s security requirements for protecting data in-flight. Protocol-provided Security Capabilities Protocol Data Encryption Message Authentication Codes DHCP No No DNS No No Ethernet HTTPS Yes Yes Modbus TCP No No OPC UA No No Secure Deployment GFK-2993A 29

30 3.4 Configuration Hardening This section is intended to assist in reducing the potential attack surface by providing information that can be used to harden the configuration of Field Agents that are present in a particular installation. Configuration Hardening should be considered in addition to enabling and using security features such as Authentication, Access Control and Authorization. In general, GE recommends disabling all services and protocols that are not required for the intended application Network Configuration The section Configure IP Addresses provides instructions for configuring the Field Agent's Wide Area Network (WAN) and Local Area Network (LAN) IP addresses. It is strongly recommended that the WAN and LAN interfaces each be configured for separate network subnets with no overlap Configure Automatic Field Agent Updates The Mini Field Agent is capable of updating its Linux operating system components and configuration manually or automatically. GE strongly recommends that customers keep the Linux packages on each Field Agent up-to-date. The instructions for performing or scheduling Field Agent updates is provided in the section Update the Field Agent Disable Predix Machine Web Console After Provisioning The Predix Machine Web Console is a tool for local Field Agent management, maintenance, and diagnostics that is enabled by default and hosted by a web server accessible only to the Local Area Network (LAN). Detailed instructions for accessing and logging into the Web Console are in the chapter, Getting Started with the Field Agent. Each Field Agent can be remotely instructed to disable or enabled the Web Console from the Predix Cloud using EdgeManager. GE recommends disabling the Web Console from EdgeManager after the provisioning process is complete to minimize the attack surface by eliminating the local web server as a potential attack vector. Detailed instructions for Field Agent Commands, including the command to disable the Web Console from EdgeManager are in the chapter, Using the Field Agent. 30 GFK-2993A Field Agents User Guide

31 3.5 Network Architecture & Secure Deployment The following figure represents a typical deployment of a Field Agent for a large industrial application, however, the level of segmentation will vary based on the level of risk assessed for the application. Public Internet Predix Cloud Enterprise Network Business Workstations Printers Business Servers DMZ Authentication server (Active Directory, SSO, etc.) Relay server Web server Historian Plant Apps WF/SOA Manufacturing Operations & Supervisory Control Network SCADA Server Engineering Workstations Process Control Network (Zone 1..N) Mini Field Agent (wired) WAN LAN Industrial Control System To IO Devices Secure Deployment GFK-2993A 31

32 3.5.1 Remote Access and Demilitarized Zones (DMZ) The Manufacturing Zone networks (which include the Manufacturing Operations, Supervisory Control, and Process Control networks) are segregated from other untrusted networks such as the Enterprise network (also referred to as the Business network, Corporate network, or Intranet) and the Internet using a Demilitarized Zone (DMZ) architecture. The Process Control networks have limited exposure to traffic from higher-level networks, including other networks in the Manufacturing Zone, as well as from other Process Control networks. The Enterprise network may also reside behind a separate DMZ. A DMZ architecture uses two firewalls to isolate servers that are accessible from untrusted networks. The DMZ should be deployed such that only specific (restricted) communication is allowed between the GE devices and the DMZ, and between the Cloud / Internet and the DMZ Access to Mini Field Agent Networks Ethernet traffic from the Cloud / Internet to the Field Agent networks should be restricted to support only the functionality that is required. However, if a particular protocol is not needed between those regions, then the firewall should be configured to block that protocol. Note Network Address Translation (NAT) and Port Address Translation (PAT) firewalls typically do not expose all of the devices on the trusted side of the firewall to devices on the untrusted side of the firewall. Further, NAT/PAT firewalls rely on mapping the IP address/port on the trusted side of the firewall to a different IP address/port on the untrusted side of the firewall. Since initial provisioning communication to Field Agents may be initiated from a PC on the untrusted side of the Process Control network firewall, protecting a Process Control network using a NAT/PAT firewall may cause additional communication challenges. Before deploying NAT /PAT, carefully consider its impact on the required communications paths. 32 GFK-2993A Field Agents User Guide

33 3.6 Other Considerations Patch Management A strategy for applying security fixes, including patches, firmware updates, and configuration changes, should be included in a facility s security plan. Applying these updates may require that an affected Field Agent be temporarily taken out of service. Finally, some installations require extensive qualification be performed before changes are deployed to the production environment. While this requirement is independent of security, ensuring the ability to promptly apply security fixes while minimizing downtime may drive the need for additional infrastructure to help with this qualification Protocol-specific Guidance Protocol standards bodies may publish guidance on how to securely deploy and use their protocols. Such documentation, when available, should be considered in addition to this document Government Agencies & Standards Organizations Government agencies and international standards organizations may provide guidance on creating and maintaining a robust security program, including how to securely deploy and use industrial control systems and related equipment. Below is a list of common standards and regulations to consider when designing a system s security policy and architecture. Such documentation, when appropriate, should be considered in addition to this document. ISA/IEC (formerly ISA99) for critical infrastructure NIST for federal information systems ISO for information security management ISO for information security management ISO for information security management of electric systems NERC CIP V5 for critical infrastructure specific to electric systems NIST Cyber Security Framework for critical infrastructure Secure Deployment GFK-2993A 33

34 Notes 34 GFK-2993A Field Agents User Guide

35 4 Getting Started with the Field Agent 4.1 Start the Field Agent After providing the Field Agent with power using the instructions in the section, Power Requirements, the Field Agent will begin to boot. The green ON LED will begin flashing when Predix Machine is starting, which is a process that can take approximately one minute. The green ON LED will turn solid once Predix Machine is running. On the first boot, the Field Agent will not be enrolled with the Predix Cloud so the blue Cloud LED will begin flashing. Once enrollment process described in the section, Enroll with Predix Cloud EdgeManager is complete, the blue Cloud LED will turn solid indicating the Field Agent is connected to the Predix Cloud. Note The orange ACT LED indicates data being received from a configured Machine Adapter, which will not occur until a Machine Adapter is configured (as described in the section Remote Monitoring). The section Push Button and LEDs describes their behavior during normal operation. Getting Started with the Field Agent GFK-2993A 35

36 4.2 Log Into the Web Console To log into the web console 1. Connect a computer to the Field Agent s Local Area Network (the MFA is connected to the LAN using port 1, 2, or 3). 2. Configure the computer s network adapter to be an address on the x network (other than , which is the Field Agent s default LAN IP address). For example, use with network mask If using the MFA, verify that the ON LED is solid green. Note Browsing to the Web Console too soon may result in seeing a Authentication Required or similar drop-down/pop-up dialog. Entering a user name and password into this dialog will not permit a log-in to the Web Console. Wait until the ON LED is solid green and re-attempt to browse to the Web Console. Closing the current browser tab or window may also be required. 4. Browse to the Field Agent s Web Console at The Google Chrome browser is recommended for accessing the Web Console. 5. Since the Web Console uses a self-signed certificate, the browser will warn that the connection is not private. When prompted, accept the connection. 6. Login using the default credentials. Default User Name: predix Default Password: predix2machine 7. A prompt to change the default password displays. Complete the form to change the default password. The password complexity requirements display if the chosen password if not sufficiently complex. After changing the password, log in using the new password. Note If the new password is forgotten or lost, use the Factory Reset feature. 36 GFK-2993A Field Agents User Guide

37 8. Verify that the Log Service page displays, which indicates a successful login. Note After some idle time, the Web Console will timeout. If this occurs, the user will need to return to the main page to log back into the console. Session timeout does not automatically redirect the console back to the login page. Getting Started with the Field Agent GFK-2993A 37

38 4.3 Configure the Network IP Addresses By default, the Mini Field Agent s WAN interface is set to acquire an IP address from a DHCP server on the network. The network interface settings that were automatically obtained from the DHCP server can be displayed in the Web Console. To change the WAN IP address 1. If using the MFA, verify that the WAN Ethernet cable is connected to port 0 and that the Cloud LED is solid blue. If a network proxy is needed to connect the field agent to the WAN, refer to the section Configure a Network Proxy. 2. From the Web Console, navigate to the Technician Console, Network Configuration page. 3. Select the WAN tab, then click the Query Current Status button. 4. To switch the WAN interface settings from a DHCP address to a static IP address, select the radio button Use the following IP address, enter the desired IP address and network mask, and click the Save button. Note The DNS servers can also be configured to be obtained automatically or specified statically. Attention It is strongly recommended that the WAN and LAN interfaces each be configured for separate network subnets with no overlap. 38 GFK-2993A Field Agents User Guide

39 By default, the Mini Field Agent s LAN interface is set to the static IP address with network mask and no explicit Gateway or DNS servers. The LAN network interface settings can be seen in the Web Console under Technician Console, Network Configuration when the LAN tab is selected. To make any changes to the LAN interface settings enter or select the desired settings and press the Save button. If the static IP address is changed, the Web Console session will end after the Save button is pressed and a new session will need to be started by browsing to the Web Console URL using the newly chosen static IP address. Note The Mini Field Agent only supports either the WAN or the LAN using DHCP to automatically obtain an IP address not both. Selecting DHCP for both WAN and LAN could cause network routing problems. Getting Started with the Field Agent GFK-2993A 39

40 4.3.2 Configure a Network Proxy A Network Proxy is only required when your network architecture is configured to restrict access directly to the Internet. Contact your network administrator for the Network Proxy information. If a network HTTP/HTTPS proxy server is used to route traffic from the intranet to the Internet, the network proxy must be configured in the Web Console under Technician Console, Network Configuration. To add or update a network proxy server, check the Enable HTTP/HTTPS Proxy check box, enter the proxy server s address and port in the form proxy:port into the Proxy Settings textbox, and press the Save button. my-proxy.com:80 To verify the Field Agent can successfully use the newly configured network proxy to reach the Internet, use the Test Connection feature of the Field Agent Updater page in the Web Console under Technician Console, Field Agent Updater. Internet reachability can be tested by using either the default Update URL or any other desired URL and pressing the Test Connection button. If the URL is reachable, a Test Connection Succeeded message displays below the Test Connection button after the button is pressed. Otherwise, a message will appear indicating that the Test Connection attempt failed. Note On the MFA, the blue Cloud LED remains flashing. 40 GFK-2993A Field Agents User Guide

41 4.3.3 Configure Time Synchronization In order for industrial data time-stamping and Field Agent diagnostic information to operate reliably, it is important for the Field Agent to have an accurate time source. The Field Agent has two methods of synchronizing time either by using a Network Time Protocol (NTP) server or by pulling time from a web page hosted by an HTTPS web server with its own reliable time source. Either method can be configured in the Web Console under Technician Console, Time Sync Configuration Using NTP Time Synchronization By default, time synchronization is configured to use the time.windows.com NTP Server. If a valid network path to the Internet exists, time will be synchronized when the Field Agent boots and continuously while running. The current date and time on the Field Agent is displayed above the Save button on the Time Sync Configuration page when the page loads, and can be updated by pressing the Save button or reloading the page. To change the NTP server to use for time synchronization enter the new NTP server URL in the NTP Server textbox and press the Save button. If the new server was successfully configured, a success statement will be displayed and the updated time will be displayed. If the time and date was more than 20 minutes out of date prior to time synchronization occurring after pressing the Save button, the Web Console session may end and an error message may be presented indicating that the session s timeout had been reached. Log back into the Web Console to verify the time was updated as expected. Getting Started with the Field Agent GFK-2993A 41

42 Using HTTPS Time Synchronization Time synchronization can also be configured to use an HTTPS web server's time by pulling it from the header of the web page it serves. To configure HTTPS time synchronization, select the HTTPS Server radio button on the Time Sync Configuration page, enter a valid HTTPS URL, and press the Save button. If a network proxy is in use, this time synchronization method will only work with HTTPS URLs that do not require a network proxy in order to reach them. If the new HTTPS URL was successfully configured after pressing the Save button, a success statement will be displayed and the updated time will be displayed. If the time and date was more than 20 minutes out of date prior to time synchronization occurring after pressing the Save button, the Web Console session may end and an error message may be presented indicating that the session s timeout had been reached. Log back into the Web Console to verify the time was updated as expected. 42 GFK-2993A Field Agents User Guide

43 4.4 Update the Field Agent The Mini Field Agent s operating system is a custom, embedded, Linux-based operating system called Yogurt that is built using the Yocto Project toolchain. Like many other Linux distributions it is divided into a number of independently maintained and versioned software packages. GE and the Linux community are continuously releasing new versions of these packages to provide feature enhancements, bug fixes, and security patches. Attention GE strongly recommends that customers keep the Linux packages on each Field Agent up-to-date. In order to ensure that Linux package updates do not break the existing Predix functionality running on the Field Agent, GE uses a daily continuous integration process to verify that updates remain compatible with all Field Agent hardware and Predix software before they become available to installed Field Agents. Encryption and digital signatures are used to ensure that only approved package versions are installed on each Field Agent, and that the specific versions used are kept confidential. Customers can choose one of three methods for keeping their Linux packages up-to-date. Customers must select a method while performing the one-time configuration of the Field Agent from its Field Agent Updater web page. Method 1: Manual Local Update Using a Local Area Network Method 2: Manual Cloud Update over the Internet Method 3: Automatic Cloud Update over the Internet Getting Started with the Field Agent GFK-2993A 43

44 4.4.1 Access the Field Agent Updater Prerequisites Successfully logged into the web console Successfully configured the network To access the Field Agent Updater 1. From the Log Service page, select Technician Console, Field Agent Updater. 44 GFK-2993A Field Agents User Guide

45 2. Verify that the Field Agent Updater page displays. Getting Started with the Field Agent GFK-2993A 45

46 4.4.2 Method 1: Manual Local Update Using a Local Area Network Attention This is the recommended method for updating the Field Agent for the first time on a newly provisioned unit. After this initial update, it is recommended to use Automatic Cloud Updates over the Internet. It is possible to update the Field Agent while it is not connected to the Internet. Below are several reasons this may be desired: If the Field Agent is significantly out of date, it may not be desirable to connect it to the Internet before applying security patches. If one or more Field Agents are significantly out of date, it may not be desirable for each Field Agent to consume bandwidth independently updating Linux packages. If a specific version of the Field Agent is desired for compatibility with a customer s domain application or for any other reason, this is the easiest method for specifying the Field Agent version. If the Field Agent is being used in an environment without Internet connectivity, this is the only method for updating the Field Agent s Linux packages. To manually initiate a local update using a Local Area Network connection 1. Using a computer that can be connected to the Field Agent's Local Area Network, navigate to the Mini Field Agent Firmware Image page ( and download the desired Field Agent package version, which ends with a.max file extension. Note Since the computer's browser will upload the file to the Field Agent, the connection speed between the computer and Field Agent and the Field Agent package file location relative to the computer will impact the speed with which the upload completes. To minimize this upload delay and prevent a session timeout in the Predix Machine Web Console (which defaults to 20 minutes), it is recommended that the Field Agent package reside on the computer performing the upload and that the connection speed be 100 Mbps. 2. Access the Field Agent Updater. 3. In the Local Update section of the Field Agent Updater, click Choose File, then browse to and select the downloaded Field Agent image (.MAX) file. 4. Click the Local Update Now button. An Update In Progress... message displays. Wait while the update is verified and applied. The update process may take up to 10 minutes to complete. 5. Verify that the status label beneath the Local Update Now button has changed to indicate that the update succeeded. Verify that and that the Current Field Agent Version and Last Successful Field Agent Update labels at the top section of the Field Agent Updater page have also updated. 46 GFK-2993A Field Agents User Guide

47 4.4.3 Method 2: Manual Cloud Update over the Internet Attention Before setting up an Automatic Cloud Update schedule using Method 3 below, it is recommended that this method be used to verify connectivity to the selected Update URL and network proxy settings. If the Field Agent has a network path to the Internet, customers can choose to manually initiate an on-demand update of the Field Agent over the Internet. This method is also valuable for diagnosing and verifying the connection between the Field Agent and the Predix Cloud. To manually initiate a cloud update over the Internet 1. Access the Field Agent Updater. 2. Under Cloud Update, the default Update URL will contain the standard location of Field Agent Update packages in the Predix Cloud. If a network proxy server is configured in the Network Configuration but the Update URL is only reachable by bypassing this proxy server, then check Bypass Proxy Server. 3. Click the Test Connection button to verify the Field Agent is capable of reaching the Update URL using the current network settings. 4. Under Manual Cloud Updates, click the Cloud Update Now button. A message displays to indicate that the update is in progress. Wait while the update is retrieved, verified, and installed. 5. After the update completes, verify that the status label beneath the Cloud Update Now button has changed to indicate that the update succeeded. Verify that the Current Field Agent Version and Last Successful Field Agent Update labels at the top of the Field Agent Updater page have also updated. Note On the MFA, the blue Cloud LED remains flashing and only go solid after Enrollment. Getting Started with the Field Agent GFK-2993A 47

48 4.4.4 Method 3: Automatic Cloud Update over the Internet Attention This is the recommended long-term method for updating the Field Agent. Field Agents with a network path to the Internet can be configured to update themselves automatically on a daily or weekly cadence by specifying a date and/or time for the update to occur. Customers should consider their operational processes and their network connection speed and reliability before choosing the update cadence, as the update may require a download of several megabytes of data for each Field Agent. To configure automatic cloud updates over the Internet 1. Access the Field Agent Updater. 2. Under Cloud Update, the default Update URL will contain the standard location of Field Agent Update packages in the Predix Cloud. If a network proxy server is configured in the Network Configuration but the Update URL is only reachable by bypassing this proxy server, then check Bypass Proxy Server. 3. Click the Test Connection button to verify the Field Agent is capable of reaching the Update URL using the current network settings. 4. Under Automatic Cloud Updates, check Enable Automatic Updates. Select the Automatic Update Frequency, enter the Time of Day (in UTC time), then click Save Settings. Note The Restore Settings button reverts to the currently persisted update schedule settings. At the specified time, the Field Agent will automatically use the Update URL to locate, retrieve, validate, and install only the Linux packages containing available updates. If the Field Agent Updater page is viewed while this process is automatically occurring, the user will see an indication that an update is in progress. When the update completes, the Current Field Agent Version and Last Successful Field Agent Update labels at the top of the Field Agent Updater page are updated. 48 GFK-2993A Field Agents User Guide

49 4.5 Enroll with Predix Cloud EdgeManager EdgeManager provides a single point of entry for deploying and monitoring devices remotely. You can also administer your apps and configuration files at both a device and fleet level, which helps you keep your device software current and up to date. For the EdgeManager to perform Device and Fleet Management operations on Field Agents and connected hardware, each Field Agent must enroll with EdgeManager. The enrollment process involves the following activities. 1. The Administrator logs into the EdgeManager and creates one of the following: Two user accounts - one with the Operator role and the other with the Technician role One user account with both the Operator and Technician roles 2. From the customer s EdgeManager URL, the Operator logs into the EdgeManager and creates a Field Agent device representation with the desired Device Name and Device ID. 3. The Operator assigns the newly created Field Agent device to an EdgeManager user with the Technician role. 4. The Technician obtains the following enrollment information from the Operator: The EdgeManager Enrollment URL The User Authentication and Authorization (UAA) URL used to authenticate the Technician The Device ID selected by the Operator The device s Activation Code 5. The Technician logs into the Web Console on the Field Agent to be enrolled, and navigates to the Predix Cloud Enrollment page under Technician Console, Predix Cloud Enrollment. 6. The Technician enters the enrollment information, presses the Enroll Device button, and authorizes the enrollment (which may include providing the Technician s EdgeManager Username and Password). 7. From the EdgeManager, the Operator verifies that the Field Agent is displayed as Reachable Create Accounts for Operator and Technician Roles Each customer is provided their own EdgeManager space and their own User Authentication and Authorization (UAA) service that allows customers to define which users in their organization have access to EdgeManager and what operations each user can perform. Each customer is assigned at least one predefined account with the Administrator role, which can be used for adding new users and assigning permissions. In order to enroll a Field Agent with EdgeManager, two different roles are needed. The Operator role must be assigned to the individual responsible for creating device instances in EdgeManager with the appropriate Device Name, Device ID, and Device Model according to how the Field Agents should be identified. The Technician role must be assigned to the individual responsible for performing the enrollment activity in the Web Console of each Field Agent. If desired, both of these roles can be assigned to the same individual s user account. To create the account or accounts needed, the Administrator must log into EdgeManager, navigate to the User Manager tab, and click the Create button. After entering the new account s username, address, and initial password, the Administrator must select the roles to be assigned to this account by checking the corresponding check boxes. The roles to be assigned can be any combination of Administrator, Operator, and/or Technician. The Administrator must then press the Create button to create the account, and provide the user account information including initial password to the individual assigned to the account. Upon first login, the user will be forced to change their password. Getting Started with the Field Agent GFK-2993A 49

50 4.5.2 Create a Device Representation in EdgeManager The Operator can create a device representation in EdgeManager from the Devices page of the Device Manager tab by pressing the Add button. In the new dialog that appears, fill in the device details and press the Add button. If it is desired that this device be a member of a group, the group can be created on the Groups page of the Device Manager tab. Then, the new group must be selected on the Devices page before pressing the Add button. To select the group, use the small downward facing triangle to the right of the ALL DEVICES text on the Devices page. The Device Name is used to list and filter the device in EdgeManager. The Device Name should be unique and descriptive, and can consist of upper and lower case characters and numbers. The Device ID is used to enroll the device in EdgeManager. While the Device ID is typically a serial number, another option is using the MAC address of the WAN interface, which is available on the Field Agent s physical label and is auto-populated on the Predix Cloud Enrollment page in the Field Agent s Web Console. The Device ID can consist of lower case characters and numbers. Any upper case characters entered during device creation will be converted to lower case. The Device Model is the Field Agent model type. Currently the only supported Field Agent Device Model is Mini Field Agent. The Version field must be set to E. 50 GFK-2993A Field Agents User Guide

51 4.5.3 Assign the Technician to the Field Agent In the Device Manager, the Operator assigns the Field Agent to a Technician by: 1. From the Devices page, check the check box to the left of the corresponding Device Name. 2. Click the Assign button. 3. Select the Technician from the drop-down menu. 4. Enter a brief Description of the reason for assignment. 5. Click the Assign button. The Technician s account name should then appear under the Assigned Technician column for the Field Agent device. If a Technician attempts to enroll a Field Agent without being assigned to the device by an Operator, the enrollment will fail and a message will indicate that the Technician was not authorized to perform this operation. Getting Started with the Field Agent GFK-2993A 51

52 4.5.4 Obtain Enrollment Information The four pieces of information needed for enrollment are listed below along with where they can be found in EdgeManager. EdgeManager Enrollment URL is available in EdgeManager Settings behind the initial splash screen User Authentication and Authorization (UAA) URL is available in EdgeManager Settings behind the initial splash screen (click the X in the upper right corner of the initial splash screen). The following is an example of this information. Device ID is available in the EdgeManager Device Manager by clicking the Device Name hyperlink of the Field Agent to enroll Activation Code is available in the EdgeManager Device Manager. From the Devices page, click the Name link. 52 GFK-2993A Field Agents User Guide

53 This is the location of the Activation Code Log into Predix Cloud Enrollment Page in Field Agent Web Console Follow the steps to Log Into the Web Console for the Field Agent being enrolled, and navigate to the Predix Cloud Enrollment page under Technician Console, Predix Cloud Enrollment Enter Enrollment Information and Trigger Enrollment Enter the enrollment information into the Predix Cloud Enrollment page. If the Technician is using a computer that has network access to both the Field Agent LAN (e.g. via wired Ethernet) and the Internet (e.g. via wireless Ethernet), then the Technician can copy this information from EdgeManager and paste it into the Predix Cloud Enrollment page. The following is an example of where information is copied from EdgeManager into the Predix Cloud Enrollment page. Getting Started with the Field Agent GFK-2993A 53

54 54 GFK-2993A Field Agents User Guide

55 After pressing the Enroll Device button, the Technician will be prompted to authorize the enrollment. If an active EdgeManager session is not detected, the Technician will also be prompted to provide EdgeManager credentials. If the EdgeManager Enrollment URL is not accessible from the Field Agent, or if the Technician is not assigned to this Field Agent, a failure message will be displayed in the Predix Cloud Enrollment page. If enrollment succeeds, a success message will be displayed in the Predix Cloud Enrollment page and the enrollment fields will become hidden Verify the Field Agent is Reachable in EdgeManager Within 20 seconds of completing the enrollment process, the Technician should notice a solid blue cloud LED. This indicates that the Field Agent is connected to the Predix Cloud. The Operator should verify that the Field Agent is listed as Reachable under the Status column of the EdgeManager's Device Manager. At this point, the Field Agent is available for Device and Fleet Management operations. Getting Started with the Field Agent GFK-2993A 55

56 Notes 56 GFK-2993A Field Agents User Guide

57 5 Using the Field Agent 5.1 Device Management Field Agent Health Status and Resource Usage The Device Manager in EdgeManager displays several health indications for each Field Agent including reachability, processor utilization, memory utilization, and disk utilization. In the Devices page of the Device Manager, the Status column shows the reachability of each Field Agent. The meanings of each status are displayed in the following table. Status Unreachable Inventory Unreachable Enrolled Reachable Meaning The Field Agent has not yet been enrolled The Field Agent is enrolled but is currently not connected to EdgeManager The Field Agent is enrolled and currently connected to EdgeManager By clicking the Device Name hyperlink on the Devices page, additional health information specific to the Field Agent can be seen on the Summary tab. Under the Health Status section, the reachability status is repeated along with a date and time of the communication with the Field Agent. Under the Resource Usage section, the processor utilization, memory utilization, and disk utilization percentages are shown. If the Field Agent is not currently Reachable, the Resource Usage values shown represent the values sent from the Field Agent when it was last Reachable Field Agent Commands EdgeManager can be used to send commands to one or more Field Agents. The list of available commands is extensible, but the core list of commands and meanings are listed below. Additional information on Commands, including how to add and delete Custom Commands, can be found here: Command Container: Refresh Container: Restart HTTP Tunnel: Disable HTTP Tunnel: Enable Predix Machine: Get Log Predix Machine: Set Polling Interval Predix Machine: Upload Config Technician Console: Disable Technician Console: Enable Meaning Restarts the OSGi bundles while leaving the rest of the Predix Machine container running Restarts the entire Predix Machine container including all bundles Not supported on the Mini Field Agent Not supported on the Mini Field Agent Downloads the Predix Machine log file from the Field Agent to EdgeManager, which is then accessible in the user s browser Updates the rate at which Predix Machine contacts the Predix Cloud to report status and retrieve operations to run Downloads the Predix Machine configuration directory from the Field Agent to the EdgeManager Repository Disables the Web Console, closing TCP port 8443 on the LAN Enables the Web Console, opening TCP port 8443 on the LAN Using the Field Agent GFK-2993A 57

58 Using the Device Manager in EdgeManager, commands can be sent to one Field Agent at a time or to several Field Agents or groups of Field Agent at a time. Commands can also be scheduled to occur immediately for Reachable Field Agents, or scheduled to occur at any future date and time for Reachable or Unreachable Field Agents. If a command is scheduled to occur immediately for an Unreachable Field Agent, or at a date or time that the Field Agent becomes Unreachable, then the command will be executed the next time the Field Agent connects and becomes Reachable. The specific instructions to send commands from Device Manager to Field Agents can be found here: Each Field Agent maintains a history of each command run against it and the corresponding command status. This history can be seen by navigating to the device page for the Field Agent and selecting the Commands tab. Command operation failures on Reachable Field Agents can be diagnosed either by reading the error entry in the Log Service of the Field Agent s Predix Machine Web Console or by reading the error entry in the Predix Machine log file retrieved using the Predix Machine: Get Log command. 58 GFK-2993A Field Agents User Guide

59 5.1.3 Configuration Management Many Predix Machine bundles use configuration files to specify their behavior. These configuration files can be managed both from EdgeManager across multiple Field Agents and, under limited circumstances, from the Predix Machine Web Console for an individual Field Agent. In both cases, a default set of configuration files must be obtained as a starting place for making modifications and additions. The Predix Machine configuration files that ship on the Mini Field Agent can be obtained from the following location: EdgeManager Configuration Management Attention Not all configuration files that ship with Predix Machine will be applied when deployed from EdgeManager. For example, the identity configuration file is unique to each Field Agent, and is therefore left unaffected on the Field Agent even if a new identity configuration file is deployed from EdgeManager. The following is a complete list of Predix Machine configuration files that are not applied to the field agent: com.ge.dspmicro.predixcloud.identity.config com.proximetry.osgiagent.impl.devicesservice.cfg com.ge.dspmicro.storeforward-*.config com.ge.dspmicro.device.techconsole.config org.apache.http.proxyconfigurator-0.config Note Since these configuration files will not be overwritten, they are NOT included in the configuration ZIP from the URL displayed in the section, Configuration Management. Instructions for modifying these configuration files to send Modbus TCP or OPC UA data from a connected industrial device to the Predix Time Series Database can be found in the section, Remote Monitoring. In order to make a group of configuration files available in EdgeManager to deploy to one or more Field Agents, the entire outer configuration directory must be compressed into a ZIP file such that decompression will result in a configuration directory with all contents contained within. Refer to the section, Compression Utilities for more information. Upload Zip File The configuration ZIP file must then be uploaded to EdgeManager in the Repository tab. With the Repository tab selected, perform the following steps: 1. Press the Upload button on the Repository tab to make the Upload dialog appear 2. In the Name field, enter a name for the configuration 3. In the Type field, select configuration 4. In the Version field, enter a version number in the form x.y.z 5. Optionally enter a Vendor name 6. Optionally enter a Description 7. In the File field, click the Choose File button, browse to the configuration ZIP and select it 8. Press the Upload button on the Upload form to commit the configuration ZIP to the EdgeManager Repository Using the Field Agent GFK-2993A 59

60 Once a configuration is uploaded to the EdgeManager Repository, it can be deployed to one or more Field Agents from the Device Manager. Add one or more Field Agents or groups of Field Agents to the Selected Items list and press the Deploy Configuration button. Check the check box of the configuration to deploy, and press the Schedule button. Select the date and time for the update to occur and press the Submit button. If a configuration deployment is scheduled to occur immediately for an Unreachable Field Agent, or at a date or time that the Field Agent becomes Unreachable, then the configuration will be deployed the next time the Field Agent connects and becomes Reachable. Each Field Agent maintains a history of each configuration deployment run against it and the corresponding deployment status. This history can be seen by navigating to the device page for the Field Agent and selecting the Configuration tab. Configuration deployment failures on Reachable Field Agents can be diagnosed either by reading the error entry in the Log Service of the Field Agent s Predix Machine Web Console or by reading the error entry in the Predix Machine log file retrieved using the Predix Machine: Get Log command Compression Utilities Most compression utilities that support the zip format will create zip files that are compatible with the MFA. When creating a zip archive, always use the default compression-level settings. The following are recommended methods for creating zip files using built-in functionality on each platform. Windows: Windows Explorer includes a built-in file compression utility. To create a zip file: 1. Open Windows Explorer. 2. Browse to and right-click on the configuration directory you wish to compress. 3. Select the Send to > Compressed (zipped) folder. 60 GFK-2993A Field Agents User Guide

61 Mac OS X: Note The Compress feature found in the Mac OS Finder creates zip files that are incompatible with the MFA. Some third-party applications, which use the same compression library as the Finder, will also create incompatible zip files. The Mac OS Terminal can be used to create a zip file compatible with the MFA. To create a zip file: 1. Open the Terminal application (in /Applications/Utilities). 2. Change to the directory containing the configuration directory. If you drag a folder from the Finder and drop it on the Terminal window, the path to that folder will be added at the cursor location. 3. Use the following command: zip -r -X <archive_name>.zip <directory name> (replace <archive_name> with the name for the zip file and <directory name> with the name of the directory). If your file name contains spaces, you will need to surround the entire file name (including the.zip) with quotes ( ). Note If you are not comfortable using the Terminal, the following third-party utilities have been verified to create zip files compatible with the MFA: StuffIt 16 ( WinZip ( Both of these utilities can be found in the Apple App Store. Linux: A compatible zip file can be created from the shell. To create a zip file: 1. Open the shell of your choice. 2. Change to the directory containing the configuration directory. 3. Use the following command: zip -r -X <archive_name>.zip <directory name> (replace <archive_name> with the name for the zip file and <directory name> with the name of the directory). If your file name contains spaces, you will need to surround the entire file name (including the.zip) with quotes ( ) Predix Machine Web Console Configuration Management Once the configuration and machine ZIPs provided in have been deployed to a Field Agent, two additional Predix Machine Web Console services are enabled that simplify the process of adjusting the configuration of an individual Field Agent. These services can be used to prototype configuration adjustments for given applications before packaging them into a configuration ZIP to be uploaded to the EdgeManager Repository and deployed to multiple Field Agents. The Technician Console, Configuration page allows individual configuration files to be deleted and uploaded. Using the Field Agent GFK-2993A 61

62 Note Depending on the configuration file that is deleted or modified, restarting the Predix Machine container may be required. This can be performed by pressing the Restart Container button in the upper right hand corner, or by sending the Container: Restart command from EdgeManager. It is not recommended to disable the Predix Machine Web Console by checking the Disable Web Console check box. It is instead recommended to disable and enable the Predix Machine Web Console using the corresponding commands from EdgeManager. 62 GFK-2993A Field Agents User Guide

63 The OSGi, Configuration page allows for fine tune adjustments of parameters within most of the available configuration files. To adjust any of the parameters in a given configuration file, click the row corresponding to the bundle to be updated, edit the parameters, and press the Save button Application Management In addition to configuring existing Predix Machine OSGi bundles to perform activities like sending Time Series data to the Predix Cloud, Field Agents can have their application capabilities expanded by adding and running new applications. These application bundles can be managed both from EdgeManager for multiple Field Agents and, under limited circumstances, from the Predix Machine Web Console for an individual Field Agent. In both cases, a default set of application bundles must be obtained as a starting place for making additions. The Predix Machine application bundles that ship on the Mini Field Agent can be obtained from the following location: EdgeManager Application Management Note Before an application can be deployed from EdgeManager to a Field Agent, a configuration must first be deployed from EdgeManager to the Field Agent. In order to make a group of application bundles available in EdgeManager to deploy to one or more Field Agents, the entire outer machine directory must be compressed into a ZIP file such that decompression will result in a machine directory with all contents contained within. Refer to the section, Compression Utilities for more information. The machine ZIP file must then be uploaded to EdgeManager in the Repository tab. With the Repository tab selected, perform the following steps: Using the Field Agent GFK-2993A 63

64 1. Press the Upload button on the Repository tab to make the Upload dialog appear 2. In the Name field, enter a name for the application 3. In the Type field, select application 4. In the Version field, enter a version number in the form x.y.z 5. Optionally enter a Vendor name 6. Optionally enter a Description 7. In the File field, click the Choose File button, browse to the machine ZIP and select it 8. Press the Upload button on the Upload form to commit the application ZIP to the EdgeManager Repository Once an application is uploaded to the EdgeManager Repository, it can be deployed to one or more Field Agents from the Device Manager. Add one or more Field Agents or groups of Field Agents to the Selected Items list and press the Deploy Software button. Check the check box of the application to deploy, and press the Schedule button. Select the date and time for the update to occur and press the Submit button. If an application deployment is scheduled to occur immediately for an Unreachable Field Agent, or at a date or time that the Field Agent becomes Unreachable, then the application will be deployed the next time the Field Agent connects and becomes Reachable. Each Field Agent maintains a history of each application deployment run against it and the corresponding deployment status. This history can be seen by navigating to the device page for the Field Agent and selecting the Software tab. Application deployment failures on Reachable Field Agents can be diagnosed either by reading the error entry in the Log Service of the Field Agent s Predix Machine Web Console or by reading the error entry in the Predix Machine log file retrieved using the Predix Machine: Get Log command Predix Machine Web Console Application Management Once the configuration and machine ZIPs provided in have been deployed to a Field Agent, one additional Predix Machine Web Console service is enabled that simplifies the process of adding or removing application bundles on an individual Field Agent. This service can be used to develop and debug new application bundles before packaging them into a machine ZIP to be uploaded to the EdgeManager Repository and deployed to multiple Field Agents. The OSGi, Bundles page allows individual application bundles to be installed, updated, and removed. 64 GFK-2993A Field Agents User Guide

65 To install or update an application bundle, click the Install/Update button in the upper right-hand corner to open the Upload/Install Bundles dialog. Click the Choose File button, browse to the JAR file of the application bundle, and click the Open button. If the bundle should be started immediately, check the Start Bundle check box. If the list of available packages should be refreshed automatically when the bundle is installed or updated, click the Refresh Packages check box. Click the Install or Update button to perform the installation. To delete an application bundle, click the trash can button to the far right of the bundle row. To stop an application bundle, click the stop sign button to the far right of the bundle row. When an application bundle is stopped, the stop sign button is replaced with a start sign button. To start the application bundle, click the start sign button. Using the Field Agent GFK-2993A 65