Applikationen & Tools. Network Address Translation (NAT) and Network Port Address Translation (NAPT) SCALANCE W. Application Description July 2009

Transcription

1 Cover Sheet Network Address Translation (NAT) and Network Port Address Translation (NAPT) SCALANCE W Application Description July 2009 Applikationen & Tools Answers for industry.

2 Warranty, Liability and Support Warranty, Liability and Support Note The Application Examples are not binding and do not claim to be complete regarding the circuits shown, equipping and any eventuality. The Application Examples do not represent customer-specific solutions. They are only intended to provide support for typical applications. You are responsible for ensuring that the described products are used correctly. These application examples do not relieve you of the responsibility to use sound practices in application, installation, operation and maintenance. When using these Application Examples, you recognize that we cannot be made liable for any damage/claims beyond the liability clause described. We reserve the right to make changes to these Application Examples at any time without prior notice. If there are any deviations between the recommendations provided in these application examples and other Siemens publications e.g. Catalogs the contents of the other documents have priority. We do not accept any liability for the information contained in this document. Any claims against us based on whatever legal reason resulting from the use of the examples, information, programs, engineering and performance data etc., described in this Application Example shall be excluded. Such an exclusion shall not apply in the case of mandatory liability, e.g. under the German Product Liability Act ( Produkthaftungsgesetz ), in case of intent, gross negligence, or injury of life, body or health, guarantee for the quality of a product, fraudulent concealment of a deficiency or breach of a condition which goes to the root of the contract ( wesentliche Vertragspflichten ). The damages for a breach of a substantial contractual obligation are, however, limited to the foreseeable damage, typical for the type of contract, except in the event of intent or gross negligence or injury to life, body or health. The above provisions do not imply a change of the burden of proof to your detriment. Any form of duplication or distribution of these Application Examples or excerpts hereof is prohibited without the expressed consent of Siemens Industry Sector. If you have any questions concerning this document please us to the following address: online-support.automation@siemens.com Industry Automation and Drives Technologies Service & Support Portal This article is taken from the Service Portal of Siemens AG, Industry Automation and Drives Technologies. The following link takes you directly to the download page of this document. 2 V1.0, Entry ID:

3 Automation Task 1.1 Overview Table of Contents 1 Automation Task Overview Automation Solution Overview of the overall solution Description of the core functionality Hardware and software components used Function Mechanisms of this Application Network Address Translation (NAT) NAPT (Network Address and Port Translation) Installation Hardware and software installation Configuration and Settings Configuring the client station Configuration of the SCALANCE W746-1 client module Configuration of the SCALANCE X Configuration of the central station Operating the Application Testing the wireless connection Testing the Network Address Translation (NAT) service Testing the Network Address and Port Translation (NAPT) service Bibliography Bibliographic References Internet Links History V1.0, Entry ID:

4 Automation Task 1.1 Overview 1 Automation Task 1.1 Overview Introduction The rapid spread of wireless networks (IWLAN) in automation technology requires an increasing number of IP addresses. Furthermore, the safety problems for wireless networks are getting more and more severe. This calls for the implementation of mechanisms for optimizing IWLAN infrastructure and safety mechanisms in wireless networks. Overview of the automation task The figure below gives an overview of the automation task. Figure 1-1 identical transport vehicles Transport vehicle 1 local network controller Central Station Transport vehicle 2 local network controller wireless connection Data management external network Transport vehicle 3 local network controller Description of the automation problem In a transport system several identical transport vehicles access joint resources via a wireless connection in order to file collected data in the central station or fetch new job sets. The devices of the transport vehicles and the central station are located in different IP subnets. Therefore a gateway from the local network of the transport vehicles to the external network of the central station is required. For the wireless network in the transport system the following points must apply: Identical setup and configuration of the transport vehicles, i.e. in each transport vehicle the same devices and the same local network with the same IP addresses is used. Safe access from local network of the transport vehicles to the external network Safe access from the external network to the local network 4 V1.0, Entry ID:

5 Automation Solution 2.1 Overview of the overall solution 2 Automation Solution 2.1 Overview of the overall solution The services NAT (Network Address Translation) and NAPT (Network Address and Port Translation) are used as safety mechanisms. The NAT and NAPT services enable: Safe access from the local network of the transport vehicles to a resource in the central station Safe access from the external network of the central station to a resource in the transport vehicle via a defined port Uniform configuration of the local network in the transport vehicles. Overview Figure 2-1 Client Station 1 / local network SIMATIC Field PG1 The figure below shows the components of the solution: 3 Gateway: SCALANCE X Gateway: SCALANCE W746-1 Client Module Gateway NAT SSID: NAT local external Client Station 2 / local network SIMATIC Field PG1 SCALANCE X208 Secure access to a resource in the central station Central Station / external network SCALANCE W788-2PRO Access Point 3 Gateway: SIMATIC Field PG Gateway: SCALANCE W746-1 Client Module Gateway NAT SSID: NAT local external SSID: NAT SCALANCE X V1.0, Entry ID:

6 Automation Solution 2.1 Overview of the overall solution Figure 2-2 Client Station 1 / local network SIMATIC Field PG1 3 Gateway: SCALANCE X Gateway: SCALANCE W746-1 Client Module Gateway NAPT SSID: NAT local external Client Station 2 / local network SIMATIC Field PG1 3 Gateway: SCALANCE X Gateway: SCALANCE W746-1 Client Module Gateway NAPT SSID: NAT local external Secure access to a resource in one of the client stations via a defined port Central Station / external network SCALANCE W788-2PRO Access Point SIMATIC Field PG2 SSID: NAT SCALANCE X Setup of the client station (local network) The identical transport vehicles are mobile client stations. They each consist of a client module SCALANCE W746-1, a SCALANCE X208 and a SIMATIC Field PG. These devices are physically interconnected via Industrial Ethernet cables. The SCALANCE X208 and the SIMATIC Field PG are located in the local network of the client station. In each identical mobile client station of the transport system, the client module is used as gateway the local network to the external network of the central station, i.e. the client module has an external and a local IP address and belongs to the local and external network. It is gateway for all devices in the local network of the client station. In the SCALANCE W746-1 client module the NAT and NAPT services are activated. The NAT and NAPT services are available for the following model variants of the SCALANCE W products: SCALANCE W746-1PRO SCALANCE W746-1 SCALANCE W747-1RR SCALANCE W747-1 SCALANCE W747-1 SCALANCE W78x in client mode. You can use these SCALANCE W products alternatively to the SCALANCE W V1.0, Entry ID:

7 Automation Solution 2.2 Description of the core functionality Setup of the central station (external network) In the central station a SCALANCE W788-2PRO Access Point, a SCALANCE X208 and a SIMATIC Field PG are employed. These devices are physically interconnected via Industrial Ethernet lines and have external, official IP addresses. 2.2 Description of the core functionality In this application example we illustrate the following: Configuration of a wireless connection between two SCALANCE W Activation and configuration of the services NAT (Network Address Translation) and NAPT (Network Address and Port Translation) in the SCALANCE W746-1 client module Configuration of the devices in the local network of the client station. Testing of NAT and NAPT services Process sequence of main functionality The NAT and NAPT services enable the following network access: Safe access from the local network of the client station to the external network of the central station using the NAT service. Safe access from the external network of the central station to the local network of the mobile client station using the NAPT service. Table 2-1 Access direction mobile Client Station Central Station mobile Client Station - NAPT Central Station NAT - For safe access from the local network of the mobile client station to the external network of the central station using the NAT service, the local IP addresses are rewritten to the external IP address of the client module, i.e. it is a N:1 conversion of the IP addresses (see Figure 3-1). During safe access from the external network of the central station to the local network of the client station using the NAPT service not only the IP addresses but also the ports are rewritten. The access from the external network to a local IP address is only possible via a defined port, i.e. one port is assigned to each local IP address, via which the access from the external network is possible. This 1:1 conversion means additional safety (see Figure 3-2). V1.0, Entry ID:

8 Automation Solution 2.2 Description of the core functionality Advantages of this solution The solution introduced here offers you the following advantages: You can use an identical setup and configuration for all client stations, i.e. in all client stations the same devices are used with the same local IP addresses. You save external IP addresses since local IP addresses are used in the client stations and only one external IP address is required for the client module. The local networks are more secured against accesses from the external network. 8 V1.0, Entry ID:

9 Automation Solution 2.3 Hardware and software components used 2.3 Hardware and software components used The application was generated with the following components: Hardware components Table 2-2 Component Qty. MLFB / order number Note SCALANCE W746-1 SCALANCE W788-2PRO 1 6GK5746-1AA30-4AA0 Client module with FW V4.2.4 or higher 1 6GK5788-2AA60-2AA0 Access Point with FW V4.2.4 or higher SCALANCE X GK5208-0BA10-2AA3 Software components Table 2-3 Component Qty. MLFB / order number Note PST V4.0 1 Download: SuperScan The SuperScan 3.00 tool is available as freeware for download on the internet. V1.0, Entry ID:

10 Function Mechanisms of this Application 3.1 Network Address Translation (NAT) 3 Function Mechanisms of this Application Here you find background information on the topics NAT (Network Address Translation) and NAPT (Network Address and Port Translation). 3.1 Network Address Translation (NAT) Overview Figure 3-1 local network (subnet A) SIMATIC Field PG1 3 SCALANCE W746-1 Client Module SCALANCE W788-2PRO Access Point external network (subnetb) SIMATIC Field PG Gateway local external external Package Source address: 3 Target address: local Subnet boundary NAT external Package Source address: Target address: Application With the NAT (Network Address Translation) service the local source IP address is rewritten to the external IP address of the gateway with each outgoing telegram. In this application example the SCALANCE W746-1 client module is used as gateway. The local IP addresses are rewritten to the external IP address of the client module, i.e. it is a N:1 conversion of the IP addresses. Example Data is sent from the SIMATIC Field PG1 with the local IP address 3 (source IP address) to the SIMATIC Field PG2 with the external IP address (target IP address). Here the source IP address 3 is rewritten to the external IP address of the SCALANCE W The incoming response message from the external network is transmitted to the original source IP address via the NAT table in the gateway. The original source IP address 3 is now the target IP address. The external IP address of the SCALANCE W746-1 is exchanged by the target IP address. 10 V1.0, Entry ID:

11 Function Mechanisms of this Application 3.2 NAPT (Network Address and Port Translation) 3.2 NAPT (Network Address and Port Translation) Overview Figure 3-2 local network (subnet A) external network (subnet B) SCALANCE X208 SCALANCE W746-1 Client Module SCALANCE W788-2PRO Access Point SIMATIC Field PG Gateway local external external Subnet boundary Package Source address: Source port: 80 Target address: Target port: 80 NAPT local Port external Port Package Source address: Source port: 80 Target address: Target port: Application The NAPT (Network Address Port Translation) is a special form of NAT. In addition to the IP addresses the ports are also rewritten. For NAPT a port of the gateway is assigned to each IP address of the local network, hence to each device in the local network. The defined ports enable the access from the external network to the assigned local IP addresses. It is a 1:1 conversion. Example In SCALANCE W746-1 the port is assigned to the SCALANCE X208 with local IP address This enables you to access the SCALANCE X208 in the local network via the external IP address of SCALANCE W746-1 and the port V1.0, Entry ID:

12 Installation 4.1 Hardware and software installation 4 Installation 4.1 Hardware and software installation This chapter describes which hardware and software components have to be installed. It is also important to read the descriptions, manuals and any delivery information supplied with the products. Installation of the hardware The hardware components are listed in chapter 2.3 Hardware and software components used. The following table provides an overview of the local and external IP addresses as well as devices used in the hardware setup of the application. Note Table 4-1 Device Local IP address External IP address Client Module SCALANCE W SCALANCE X SIMATIC Field PG Access Point SCALANCE W788-2PRO SCALANCE X SIMATIC Field PG The setup guidelines for SCALANCE W must generally be followed. Further information on the setup guidelines for SCALANCE W are available in the configuration manual. This is available as a download via the following link: Installing the software For the configuration of the network components SCALANCE X and SCALANCE W you require the standard software Primary Setup Tool (PST). Note The Primary Setup Tool is available to you as a download via the following link: 12 V1.0, Entry ID:

13 Configuration and Settings 5.1 Configuring the client station 5 Configuration and Settings 5.1 Configuring the client station Configuration of the SCALANCE W746-1 client module Figure 5-1 SCALANCE X208 SIMATIC Field PG SCALANCE W746-1 Client Module Gateway NAT / NAPT SSID: NAT local external Table 5-1 Connect the SCALANCE W746-1 and the SIMATIC Field PG1 to the SCALANCE X208 using the Industrial Ethernet cable. Configure the SCALANCE W746-1 according to the following instruction: No Action Comment 1 Use the Primary Setup Tool (PST) to assign the external IP address to SCALANCE W746-1 according to the configuration (see Figure 5-1). V1.0, Entry ID:

14 Configuration and Settings 5.1 Configuring the client station No Action Comment 2 Assign a new IP address, which is located in the same IP subnet as the SCALANCE W746-1, to the network card of the SIMATIC Field PG1. To do this you open the Properties dialog of the Local Area Network (LAN) in the Network Connections of Windows. Enter the IP address and the subnet mask Start the Web Based Management, by entering the IP address of the SCALANCE W746-1 in the web browser, e.g. internet explorer. Log in at the SCALANCE W The default user name and the default password are: User name: Admin Password: admin 4 In the Web Based Management under System you select the Country code according to the country where the SCALANCE W746-1 is used, e.g. GERMANY. Adopt the settings with Set Values. 14 V1.0, Entry ID:

15 Configuration and Settings 5.1 Configuring the client station No Action Comment 5 In the Web Based Management at Interfaces WLAN you leave the default parameters. According to demand you can set the wireless mode to b. 6 In the Web Based Management at Interfaces WLAN SSID List you add the SSID NAT. Adopt the settings with Set Values. 7 In the Web Based Management at Bridge NAT you activate the IP Network Address Translation service by selecting Enable. For the SCALANCE W746-1 you enter the local IP address and the subnet mask Adopt the settings with Set Values. Then click on the New button to configure the NAPT service. 8 Port is assigned to the local IP address The target port of the Hypertext Transfer Protocol (HTTP) is 80. Therefore you specify port 80 as the local port. Acknowledge the input with OK. V1.0, Entry ID:

16 Configuration and Settings 5.1 Configuring the client station No Action Comment 9 The target port for the access with STEP 7 is port 102. Therefore you enter port 102 as the global and local port. Acknowledge the input with OK. 10 Now the configuration of the NAT and NAPT services has been completed. 11 Restart the SCALANCE W746-1 in the Web Based Management via System Restart to accept the new settings. 12 After the restart of the SCALANCE W746-1 the SIMATIC Field PG1 with IP address is no longer in the same IP subnet as the SCALANCE W The SCALANCE W746-1 is visible with the local IP address in the Primary Setup Tool. 16 V1.0, Entry ID:

17 Configuration and Settings 5.1 Configuring the client station No Action Comment 13 Change the IP address of the SIMATIC Field PG1. To do this you open the Properties dialog of the Local Area Network (LAN) in the Network Connections of Windows. Enter the IP address 3 and the subnet mask The SIMATIC Field PG1 is located again in the same IP subnet as the SCALANCE Start the Web Based Management, by entering the local IP address of the SCALANCE W746-1 in the web browser, e.g. internet explorer. Log in at the SCALANCE W The default user name and the default password are: User name: Admin Password: admin The connection between SCALANCE W746-1 and the SIMATIC Field PG1 has been restored Configuration of the SCALANCE X208 Figure 5-2 SCALANCE W746-1 Client Module SCALANCE X208 Gateway NAT / NAPT SSID: NAT local external Gateway: SIMATIC Field PG V1.0, Entry ID:

18 Configuration and Settings 5.1 Configuring the client station Table 5-2 Connect the SCALANCE W746-1 and the SIMATIC Field PG1 to the SCALANCE X208 using the Industrial Ethernet cable. For all devices in the local network you enter the local IP address of the SCALANCE W as default gateway. Configure the SCALANCE W746-1 according to the following instruction: No Action Comment 1 Use the Primary Setup Tool (PST) to assign the IP address to SCALANCE X208 according to the configuration (see Figure 5-2). 2 Assign a new IP address, which is located in the same IP subnet as the SCALANCE X208, to the network card of the SIMATIC Field PG1. To do this you open the Properties dialog of the Local Area Network (LAN) in the Network Connections of Windows. Enter the IP address 3 and the subnet mask V1.0, Entry ID:

19 Configuration and Settings 5.2 Configuration of the central station No Action Comment 3 Start the Web Based Management, by entering the IP address of the SCALANCE X208 in the web browser, e.g. internet explorer. Log in at the SCALANCE X208. The default user name and the default password are: User name: admin Password: admin 4 In the Web Based Management under Agent you enter the local IP address of the SCALANCE W746-1 as a default gateway to enable access from the local network to the external network. Adopt the settings with Set Values. 5.2 Configuration of the central station Figure 5-3 SCALANCE W788-2PRO Access Point SIMATIC Field PG2 SCALANCE X V1.0, Entry ID:

20 Configuration and Settings 5.2 Configuration of the central station Table 5-3 Connect the SCALANCE W788-2PRO and the SIMATIC Field PG2 to the SCALANCE X208 using the Industrial Ethernet cable. Configure the SCALANCE W788-2PRO according to the following instruction: No Action Comment 1 Use the Primary Setup Tool (PST) to assign the IP address to SCALANCE W788-2PRO according to the configuration (see Figure 5-3). 2 Assign a new IP address, which is located in the same IP subnet as the SCALANCE W788-2PRO, to the network card of the SIMATIC Field PG2. To do this you open the Properties dialog of the Local Area Network (LAN) in the Network Connections of Windows. Enter the IP address and the subnet mask Start the Web Based Management, by entering the IP address of the SCALANCE W788-2PRO in the web browser, e.g. internet explorer. Log in at the SCALANCE W788-2PRO. The default user name and the default password are: User name: Admin Password: admin 20 V1.0, Entry ID:

21 Configuration and Settings 5.2 Configuration of the central station No Action Comment 4 In the Web Based Management at System you select the device mode Access Point. Select the Country code according to the country where the SCALANCE W788 2PRO is used, e.g. GERMANY. Adopt the settings with Set Values. 5 In the Web Based Management at Interfaces WLAN you enter the SSID NAT. In the client module and in the access point you must configure the same SSID. Adopt the settings with Set Values. 6 Restart the SCALANCE W788-2PRO in the Web Based Management via System Restart to accept the new settings. V1.0, Entry ID:

22 Operating the Application 5.2 Configuration of the central station 6 Operating the Application Overview The following figure gives an overview of the setup used for testing the configuration of a wireless connection as well as the configuration of the NAT and NAPT services. Figure 6-1 Client Station 1 / local network SIMATIC Field PG1 SCALANCE X208 3 Gateway: Gateway: SCALANCE W746-1 Client Modul local external Wireless connection Central Station / external network SCALANCE W788-2PRO Access Point SCALANCE X SIMATIC Field PG IP address SIMATIC Field PG1 Assign a new IP address, which is located in the local network of the client station, to the network card of the SIMATIC Field PG1. To do this you open the Properties dialog of the Local Area Network (LAN) in the Network Connections of Windows. Enter the IP address 3 and the subnet mask Furthermore, enter the local IP address of the client module SCALANCE W as default gateway. 22 V1.0, Entry ID:

23 Operating the Application 5.2 Configuration of the central station Figure 6-2 IP address SIMATIC Field PG2 For testing a wireless connection as well as testing the NAT and NAPT services you assign an IP address located in the external network to the SIMATIC Field PG2. To do this you open the Properties dialog of the Local Area Network (LAN) in the Network Connections of Windows. Enter the IP address and the subnet mask V1.0, Entry ID:

24 Operating the Application 6.1 Testing the wireless connection Figure Testing the wireless connection Table 6-1 For testing the wireless connection you follow the instruction below: No Action Comment 1. Start the Web Based Management of the client module SCALANCE W746-1 on the SIMATIC Field PG2, by entering the IP address of the SCALANCE W746-1 in the web browser, e.g. internet explorer. Log in at the SCALANCE W The default user name and the default password are: User name: Admin Password: admin 24 V1.0, Entry ID:

25 Operating the Application 6.1 Testing the wireless connection No Action Comment 2. In the Web Based Management at Information Available WLAN you see the configured wireless connection with SSID NAT. The access point is connected to client module. 3. Start the Web Based Management of the access point SCALANCE W788-2PRO on the SIMATIC Field PG2, by entering the external IP address of the SCALANCE W788-2PRO in the web browser, e.g. internet explorer. Log in at the SCALANCE W788-2PRO. The default user name and the default password are: User name: Admin Password: admin 4. In the Web Based Management at Information Clients List you see the MAC address of the connected client module. V1.0, Entry ID:

26 Operating the Application 6.2 Testing the Network Address Translation (NAT) service 6.2 Testing the Network Address Translation (NAT) service Table 6-2 If the wireless connection and the NAT service have been configured correctly, access to the external network is possible from the local network of the client station. This can be tested using the Ping function. In this application example the SuperScan 3.00 tool is used for executing the Ping. This tool is available as freeware for download on the internet. On the other hand it s not possible to ping the local IP addresses in the client station from the external network. The NAT hence guarantees a certain security when accessing the local network from the external network. For testing the NAT with the SuperScan 3.00 tool proceed according to the following instruction: No Action Comment 1 On the SIMATIC Field PG1 you start the SuperScan 3.00 tool. 2 In the SuperScan 3.00 tool you enter the external IP address range, e.g to The Ping to the existing IP addresses in the specified IP address range is performed successfully. 3 Start SuperScan 3.00 tool on the SIMATIC Field PG2. 4 In the SuperScan 3.00 tool you enter the local IP address range, e.g. to The devices in the local network of the client station cannot be reached via Ping. 26 V1.0, Entry ID:

27 Operating the Application 6.3 Testing the Network Address and Port Translation (NAPT) service 6.3 Testing the Network Address and Port Translation (NAPT) service Table 6-3 Test the NAPT service by accessing the SCALANCE X208 with the local IP address using the Hypertext Transfer Protocol (http) via the external IP address of the client module and port For testing the NAPT service you follow the instruction below: No Action Comment 1 On the SIMATIC Field PG2 you open the Web Browser, e.g. Internet Explorer, and access the SCALANCE X208 in the local network via the external IP address of the client module SCALANCE W746-1 and port Log in at the SCALANCE X208. The default user name and the default password are: User name: admin Password: admin 2 After you logged on at the Web Based Management of the SCALANCE X208 in the local network, the access from the external network to the SCALANCE X208 in the local network using http has been completed. V1.0, Entry ID:

28 Bibliography 7 Bibliography 7.1 Bibliographic References This list is by no means complete and only provides a selection of appropriate sources. Table 7-1 Topic Title /1/ SCALANCE W SCALANCE W-700 configuration manual Internet Links This list is by no means complete and only provides a selection of appropriate sources. Table 7-2 Topic \1\ Firmware V4.2 SCALANCE W \2\ Primary Setup Tool \3\ Siemens I IA/DT Customer Support Title V1.0, Entry ID:

29 History 8 History Table 8-1 History Version Date Modification V First issue V1.0, Entry ID: