Setting up a secure VPN Connection between SCALANCE S and CP x43-1 Adv. Using a static IP Address. SCALANCE S, CP Advanced, CP Advanced

Transcription

1 Configuration Example 09/2014 Setting up a secure VPN Connection between SCALANCE S and CP x43-1 Adv. Using a static IP Address SCALANCE S, CP Advanced, CP Advanced

2 Warranty and liability Warranty and liability Note The Application Examples are not binding and do not claim to be complete regarding the circuits shown, equipping and any eventuality. The Application Examples do not represent customer-specific solutions. They are only intended to provide support for typical applications. You are responsible for ensuring that the described products are used correctly. These application examples do not relieve you of the responsibility to use safe practices in application, installation, operation and maintenance. When using these Application Examples, you recognize that we cannot be made liable for any damage/claims beyond the liability clause described. We reserve the right to make changes to these Application Examples at any time without prior notice. If there are any deviations between the recommendations provided in these application examples and other Siemens publications e.g. Catalogs the contents of the other documents have priority. We do not accept any liability for the information contained in this document. Siemens AG 2014 All rights reserved Any claims against us based on whatever legal reason resulting from the use of the examples, information, programs, engineering and performance data etc., described in this Application Example shall be excluded. Such an exclusion shall not apply in the case of mandatory liability, e.g. under the German Product Liability Act ( Produkthaftungsgesetz ), in case of intent, gross negligence, or injury of life, body or health, guarantee for the quality of a product, fraudulent concealment of a deficiency or breach of a condition which goes to the root of the contract ( wesentliche Vertragspflichten ). The damages for a breach of a substantial contractual obligation are, however, limited to the foreseeable damage, typical for the type of contract, except in the event of intent or gross negligence or injury to life, body or health. The above provisions do not imply a change of the burden of proof to your detriment. Any form of duplication or distribution of these Application Examples or excerpts hereof is prohibited without the expressed consent of Siemens Industry Sector. Security information Siemens provides products and solutions with industrial security functions that support the secure operation of plants, solutions, machines, equipment and/or networks. They are important components in a holistic industrial security concept. With this in mind, Siemens products and solutions undergo continuous development. Siemens recommends strongly that you regularly check for product updates. For the secure operation of Siemens products and solutions, it is necessary to take suitable preventive action (e.g. cell protection concept) and integrate each component into a holistic, state-of-the-art industrial security concept. Third-party products that may be in use should also be considered. For more information about industrial security, visit To stay informed about product updates as they occur, sign up for a productspecific newsletter. For more information, visit Entry ID: , V1.0, 09/2014 2

3 Table of Contents Siemens AG 2014 All rights reserved Table of Contents Warranty and liability Task and Solution Task Possible solution Characteristics of the solution Configuration and Project Engineering Setting up the environment Required components and IP address overview SCALANCE S DSL access for SCALANCE S612 (DSL router2) SIMATIC S7-300 station Setting up the infrastructure Configuring the VPN tunnel Integrating the VPN endpoint CP Advanced Integrating the VPN endpoint SCALANCE S Configuring the VPN tunnel Loading the components Final steps Status of the VPN connection Testing the Tunnel Function History Entry ID: , V1.0, 09/2014 3

4 1 Task and Solution 1 Task and Solution 1.1 Task The task is to allow a service center access to an automation system via the Internet or a company's internal network. The following customer requirements have to be considered: Protection against spying and data manipulation. Prevention of unauthorized access. Provision of secure remote access for remote maintenance and remote control. Network protection without additional security appliances on the automation side. 1.2 Possible solution Complete overview The figure below shows one way of implementing the customer requirements: Siemens AG 2014 All rights reserved Service PC VPN Tunnel Industrial Ethernet SCALANCE S VPN Server Internet Router Static WAN IP Address Internet Modem/Router Automation Cell SIMATIC S7-300 or S7-400 with CP x43-1 Advanced VPN Client The connection between the service PC (or other nodes/network devices) and the automation cell (nodes such as a SIMATIC station, panels, drives, PCs) is protected by a VPN tunnel. In this example, the SCALANCE S612 and a CP 343-1/CP Advanced form the tunnel endpoints for the secure connection. The SCALANCE S612 acts as the VPN server, the CP acts as the VPN client. Access to the SCALANCE S612 from the WAN is predefined by the use of a static WAN IP address. WAN access on the client side is flexible; the IP address of the WAN port is not relevant. When establishing the VPN tunnel, the roles are defined as follows: Table 1-1 SCALANCE S Component CP x43-1 Advanced VPN role Responder (VPN server); waits for the VPN connection Initiator (VPN client); starts the VPN connection Entry ID: , V1.0, 09/2014 4

5 1 Task and Solution CP x43-1 Advanced The CP x43-1 Advanced (version 3 or higher) is a communications processor with security functions. For the SIMATIC S7-300/S7-400, it is the bridge between the field level and the MES level and integrates seamlessly with the security structures of the office and IT world. The module provides protection of the data transmission between devices or network segments against data manipulation/spying and unauthorized access. In addition to the basic communications services, it offers the following functions: High-quality stateful inspection firewall with filtering of IP- and MAC-based data traffic. HTTPS, FTPS, NTP (secure). IPSec VPN (data encryption and authentication). Protection of the S7 station in which the CP is operated. Protection of the internal networks connected to the PROFINET interface. Support of multiple VPN tunnels at a time. Siemens AG 2014 All rights reserved SCALANCE S The security modules of the SCALANCE S family are designed specifically for use in automation but integrate seamlessly with the security structures of the office and IT world. They provide the following functions: High-quality stateful inspection firewall with filtering of IP- and MAC-based data traffic. User-specific IP firewall to distinguish and differentiate access to specific plant parts. Router functionality (PPPoE, DNS). IPSec VPN (data encryption and authentication). Protection of all devices of an Ethernet network. Flexible, reaction-free and protocol-independent protection. Support of multiple VPN tunnels at a time. 1.3 Characteristics of the solution VPN tunnel for flexible access to the automation cell - possible, for example, for a service employee. Controlled, encrypted data traffic between SCALANCE S and CP x43-1 Advanced. High degree of security for machines and plants through the implementation of the cell protection concept. Integrated network diagnostics via SNMP or Syslog. Easy integration into existing networks and protection of devices that do not have their own security functions. Protection of the SIMATIC controller without an additional security module. Entry ID: , V1.0, 09/2014 5

6 2 Configuration and Project Engineering 2.1 Setting up the environment Required components and IP address overview Software packages This solution requires the following software packages: "Security Configuration Tool V4". This software is included in the scope of delivery of the security modules or available as a download under the following Entry ID: "STEP 7 V5.5", Service Pack 2 or higher, Hotfix 1. The required HSP (HSP 1058) is included in the scope of delivery of the CP Advanced or available under the following Entry ID: Install this software on a PC/PG. Siemens AG 2014 All rights reserved Required devices/components: To set up the environment, use the following components: A SCALANCE S612 (firmware V4) (optional: A DIN rail installed accordingly, including fitting accessories). A CP Advanced (article number: 6GK7343-1GX31-0XE0). A CPU PN/DP (article number: 6ES7315-2EH14-0AB0) with an MMC. DSL access with a dynamic WAN IP address and a DSL router. DSL access with a static WAN IP address and a DSL router. One or two 24V power supplies with cable connector and terminal block plug (the modules can also be operated with a shared power supply). A DIN rail with fitting accessories for the S PC on which the "Security Configuration Tool" and "STEP 7 V5.5" are installed. The necessary network cables, TP cables (twisted pair) according to the IE FC RJ45 standard for Industrial Ethernet. Note Another S7-300 PROFINET CPU can also be used. For the device environment in which the CP can be operated with the range of functions described here, please refer to the appropriate chapter of the CP Advanced manual: &Language=en-EN&TopicId= &guiLanguage=en Note You can also use a different SCALANCE S type (except SCALANCE S602) or Internet access method (e.g., UMTS). The configuration described below refers explicitly to the components listed in "Required devices/components". Entry ID: , V1.0, 09/2014 6

7 IP addresses For this example, the IP addresses are assigned as follows: S612 DSL Router2 DSL Router1 SIMATIC S7-300 with CP Advanced Static WAN IP Dynamic WAN IP Table 2-1 Component Port IP address Router Subnet mask Siemens AG 2014 All rights reserved S612 Internal port S612 External port DSL router2 LAN port DSL router2 WAN port Static IP address from provider DSL router1 WAN port Dynamic IP address from provider - Assigned by provider - Assigned by provider DSL router1 LAN port CP Adv. Gigabit port CP Adv. PROFINET port CPU PROFINET port SCALANCE S To make sure that no old configurations and certificates are stored in the SCALANCE S612, reset the module to factory default. For the appropriate chapter in the SCALANCE S manual, please use the following link: 339&Language=en-EN&TopicId= &guiLanguage=en. The configured state is indicated by the fact that the Fault LED lights up orange. If problems occur when accessing the SCALANCE S or rebooting, please refer to the appropriate troubleshooting chapter: 339&Language=en-EN&TopicId= &guiLanguage=en Entry ID: , V1.0, 09/2014 7

8 2.1.3 DSL access for SCALANCE S612 (DSL router2) Static IP address for DSL router2 WAN access of the CP Advanced to the SCALANCE S612 is implemented using a fixed public IP address. This IP address must be requested from the provider and then stored in DSL router2. Port forwarding on DSL router2 VPN function Due to the use of a DSL router as an Internet gateway, you have to enable the following ports on DSL router2 and forward the data packets to the S612 (VPN server; external IP address): UDP Port 500 (ISAKMP) UDP Port 4500 (NAT-T) If the DSL routers themselves are VPN-capable, make sure that this function is disabled SIMATIC S7-300 station Siemens AG 2014 All rights reserved Connection between PC and controller Factory default Connect the PC on which STEP 7 V5.5 is installed to a PROFINET port of the CPU and change the network settings on the PC as follows: IP address: Subnet mask: To make sure that no old configurations and certificates are stored in the CP Advanced, reset the module to factory default. For the appropriate chapter in the CP Advanced manual, please use the following link: 395&Language=en-EN&TopicId= Changing the IP address of the CPU To download the project data to the CPU, it is useful to first change the IP address of the CPU as shown in Table 2-1Fehler! Verweisquelle konnte nicht gefunden werden.. The STEP 7 function "Edit Ethernet Node " is suitable for assigning the IP address. For more information, please refer to the manual, Entry ID: Entry ID: , V1.0, 09/2014 8

9 STEP 7 project Use the STEP 7 configuration software to create a new project and create a hardware configuration with the modules you are using. For the required IP addresses for the CP Advanced (Gigabit port and PROFINET port) and the CPU (PROFINET port), please refer to Table 2-1. Interface configuration of the CPU: Siemens AG 2014 All rights reserved Entry ID: , V1.0, 09/2014 9

10 Interface configuration of the CP (Gigabit port): Siemens AG 2014 All rights reserved Entry ID: , V1.0, 09/

11 Interface configuration of the CP (PROFINET port): Siemens AG 2014 All rights reserved Entry ID: , V1.0, 09/

12 Time-of-day synchronization In the OFF state, the CP Advanced loses the current time step and, by default, is set to To establish secure communication, it is essential that the current date and time is always set on the CP. Otherwise, the certificates used are interpreted as invalid and secure VPN communication is not possible. The CP provides the following modes for time-of-day synchronization: SIMATIC Mode (used in this example) NTP Mode (Network Time Protocol) Time-of-day synchronization for the S7-300 station is configured in the hardware configuration. Proceed as follows: 1. In the SIMATIC Manager, open your STEP 7 project and the hardware configuration of the S7-300 station. Siemens AG 2014 All rights reserved 2. In the STEP 7 object properties of the CP Advanced, "Time-of-Day Synchronization" tab, check the "Accept time of day on CP" check box and select "Automatic". Entry ID: , V1.0, 09/

13 3. Close the dialog with "OK". 4. In the STEP 7 object properties of the CPU, "Diagnostics/Clock" tab, set the "As master" synchronization type and the "1 minute" time interval for synchronization in the automation system. Siemens AG 2014 All rights reserved 5. Close the dialog with "OK". Note More information on these modes and the configuration can be found in Chapter of the Configuration Manual for SIMATIC S7 CPs (Entry ID: ). Loading the controller 1. Select "Station" > "Save and Compile" to save and compile your project. 2. Use "PLC" > "Download " to download the configuration to your CPU. Entry ID: , V1.0, 09/

14 Adjusting the system time in the CPU Due to the "SIMATIC Mode" time-of-day synchronization, the CPU cyclically passes on its system time to the CP Advanced. The CPU clock must no longer be in the default state. It must have been set once. Time-of-day synchronization as the time-of-day master does not start before the time of day has been set via SFC 0 "SET_CLK" or using the PG function. Note In the following cases, the CPU clock has not yet been set: In the as-supplied state. After resetting to the as-supplied state using the mode selector switch. After a firmware update. 1. In the SIMATIC Manager, open your STEP 7 project and the hardware configuration of the S7-300 station. 2. Select the CPU and select "PLC" > "Set Time of Day" to open the dialog where you can set the time of day. Siemens AG 2014 All rights reserved 3. Check the "Take from PG/PC" check box and confirm your selection. 4. Select "Close" to close the dialog. Result The CPU's time of day has been set to the current PG time. Entry ID: , V1.0, 09/

15 2.1.5 Setting up the infrastructure Connect all the components involved in this solution. S612 DSL Router2 DSL Router1 SIMATIC S7-300 with CP Advanced Internal Port External Port LAN Port WAN Port WAN Port LAN Port Gigabit Port PROFINET Port Siemens AG 2014 All rights reserved Note Table 2-2 Component Local port Partner Partner port S612 Internal port E.g., a PC in the service center (does not exist in this solution) S612 External port DSL router2 LAN port CP Adv. Gigabit port DSL router1 LAN port CP Adv. PROFINET port E.g., an automation network (does not exist in this solution) In all devices in the internal network of the CP Advanced (e.g., controllers, panels, etc.), please make sure to enter the IP address of the internal port or PROFINET port as the default gateway. Entry ID: , V1.0, 09/

16 2.2 Configuring the VPN tunnel SCT project Components used The VPN tunnel configuration is performed using the Security Configuration Tool V4 integrated in STEP 7 and started when enabling the security function in the CP Advanced. This solution uses the following security components: SCALANCE S612 (firmware V4) and CP Advanced (version 3 or higher) Integrating the VPN endpoint CP Advanced Overview To integrate the CP into the Security Configuration Tool, perform the following steps: Enable the security function of the CP. Create a user and password for the SCT project integrated in STEP 7. Siemens AG 2014 All rights reserved Proceed as follows: 1. In the SIMATIC Manager, open your STEP 7 project and the hardware configuration of the S7-300 station. 2. In the STEP 7 object properties of the CP Advanced, "Security" tab, check the "Enable security" check box. 3. In the following dialog, create a new user with a user name and the associated password. The user is automatically assigned the "Administrator" role. Entry ID: , V1.0, 09/

17 4. Confirm your entries with "OK". 5. Close the STEP 7 object properties with "OK". 6. Confirm the following security message with "OK". Result You have created a new security project. Opening the SCT project In HW Config, select the "Edit" > "Security Configuration Tool " menu command to open the Security Configuration Tool. Result The security module is displayed in the list of configured modules. Siemens AG 2014 All rights reserved Entry ID: , V1.0, 09/

18 2.2.2 Integrating the VPN endpoint SCALANCE S612 To integrate the SCALANCE S612 component into the Security Configuration Tool, proceed as follows: 1. Use "Insert" > "Module" or select the appropriate menu icon to open the module selection dialog. Define the following module: Product type: SCALANCE S Module: S612 Firmware release: V4 2. Assign a name to the module and apply the MAC address from the S612 housing to the appropriate text box. Enter the external IP address and subnet mask as shown in Table 2-1. Siemens AG 2014 All rights reserved Entry ID: , V1.0, 09/

19 3. Change the mode of the SCALANCE S to Routing. Enter the internal IP address and subnet mask as shown in Table 2-1. Siemens AG 2014 All rights reserved 4. Close the dialog with "OK". Result The S612 appears as an additional module. Entry ID: , V1.0, 09/

20 2.2.3 Configuring the VPN tunnel Creating a VPN group All members of a VPN group are authorized to communicate with each other through a VPN tunnel. To create a VPN group, proceed as follows: 1. In the project tree, select the "VPN groups" item. Use "Insert" > "Group" or select the appropriate menu icon to create a new VPN group. Siemens AG 2014 All rights reserved 2. One after the other, select the security modules from the "All modules" list and use drag and drop to insert them into the VPN group. Result The two security modules have been assigned to VPN group Group1. Certificates are used for authentication. Entry ID: , V1.0, 09/

21 Defining the VPN parameters To establish the VPN tunnel, you have to enter the following information: Standard router WAN IP address of the DSL router Parameterize this information as follows: 1. In the "All modules" project tree, select the S612 and double-click to open its properties dialog. 2. In the "Routing" tab, enter the standard router as shown in Table 2-1. Siemens AG 2014 All rights reserved 3. In the "VPN" tab, change the VPN role of the S612 to "Responder". Enter the WAN IP address of your DSL access point (DSL router2). 4. Close the dialog with "OK". 5. Confirm the message with "OK". 6. Save the project. Result The VPN configuration is complete. Entry ID: , V1.0, 09/

22 2.2.4 Loading the components Preparation The configuration data is transferred to the SCALANCE S and CP Advanced security components directly from the Security Configuration Tool. As a WAN is used as an external public network, the security modules with factory default cannot be configured via this WAN. In this case, configure the security modules from the local network: Connect the PC on which the Security Configuration Tool is installed to the internal port of the SCALANCE S or the PROFINET port of the CPU and change the network settings on the PC as follows: To load the S612 (VPN server) IP address: Subnet mask: To load the CP Advanced: IP address: Subnet mask: Siemens AG 2014 All rights reserved SCALANCE S The SCALANCE S612 is loaded as follows: 1. Connect the PC to the internal port of the SCALANCE S612 and customize the network configuration of the PC. 2. In the Security Configuration Tool, select the S612 and select the "Transfer" > "To module(s) " menu command. 3. When a configuration is downloaded for the first time after the installation of the Security Configuration Tool, a dialog appears where you can select the network adapter. In this dialog, explicitly select the network adapter via which you are actually connected to the module. 4. Clicking the "Start" button in the "Download configuration data to security module" dialog transfers the configuration to the SCALANCE S module. Entry ID: , V1.0, 09/

23 5. If downloading has completed without errors, the SCALANCE S module is automatically restarted and the new configuration is activated. 6. Close the Security Configuration Tool. CP Advanced Result Now the S612 has been configured and can communicate at the IP level. This mode is indicated by the fact that the Fault LED lights up green. The CP Advanced is loaded as follows: 1. Connect the PC to the PROFINET interface of the CPU and customize the network configuration of the PC. 2. In the SIMATIC Manager, HW Config, select the "Station" > "Save and Compile" menu. 3. Use "PLC" > "Download " to download the new configuration to the controller. Siemens AG 2014 All rights reserved 4. If downloading has completed without errors, the security module starts automatically and the new configuration has been activated. Result The security module is in productive mode Final steps Connect the internal port of the SCALANCE S612 or the PROFINET port of the CP Advanced to your network (e.g., automation network). For all devices on the internal port/profinet port of the devices, set the appropriate standard router (IP address of the internal port/profinet port). Entry ID: , V1.0, 09/

24 2.3 Status of the VPN connection When all security modules have been parameterized, loaded and connected to the appropriate DSL routers, the CP Advanced initializes the VPN tunnel to the S612. Diagnostics in the Security Configuration Tool or NCM diagnostics allow you to view the status. Security Configuration Tool For diagnostics via the Security Configuration Tool, proceed as described below: 1. Connect the PC with the Security Configuration Tool to the internal port of the SCALANCE S and change the network settings on the PC as follows: IP address: Subnet mask: In HW Config of your STEP 7 project, select the "Edit" > "Security Configuration Tool " menu command to open the Security Configuration Tool. Siemens AG 2014 All rights reserved 3. Use the "View" > "online" menu command to activate "Online" mode. 4. In the content area, select the SCALANCE S Select the "Edit" > "Online diagnostics " menu command. Entry ID: , V1.0, 09/

25 6. The "Communications status" tab displays the communication status. Siemens AG 2014 All rights reserved NCM diagnostics When the VPN tunnel between the security modules has been established, NCM diagnostics allow you to access the CP343-1 Advanced. Proceed as follows: 1. In the SIMATIC Manager, open your STEP 7 project and the hardware configuration of the S7-300 station. 2. Select "Station" > "Open ONLINE" to switch to the Online view. 3. Select the Gigabit port of the CP as the access point. (IP address: ) Result The Online view opens. Entry ID: , V1.0, 09/

26 4. Open the STEP 7 module properties of the CP Advanced and open Special Diagnostics. Siemens AG 2014 All rights reserved 5. In the navigation overview, select "Security" and open "Expanded security diagnostics". Entry ID: , V1.0, 09/

27 6. The "Communications status" tab displays the communication status. Siemens AG 2014 All rights reserved Entry ID: , V1.0, 09/

28 3 Testing the Tunnel Function 3 Testing the Tunnel Function Chapter 2 completes the commissioning of the configuration and the security modules have established a VPN tunnel for secure communication. You can test the established tunnel connection using a ping command on an internal node. This is described below. Alternatively, you can also use other methods to test the configuration (e.g., by opening the internal Web page of the CP Advanced with address or loading the S7 controller from STEP 7). 1. Connect the PC with the Security Configuration Tool to the internal port of the SCALANCE S and change the network settings on the PC as follows: IP address: Subnet mask: Gateway address: On the PC, select "Start" > "All Programs" > "Accessories" > "Command Prompt" in the start bar. Siemens AG 2014 All rights reserved 3. In the command line of the "Command Prompt" window that appears, enter the "ping " command at the cursor position. Result You get a positive response from the internal node. Note In Windows, the default settings of the firewall may prevent ping commands from passing. You may have to enable the ICMP services of the "Request" and "Response" type. Entry ID: , V1.0, 09/

29 4 History 4 History Table 4-1 Version Date Modifications V1.0 09/2014 First version Siemens AG 2014 All rights reserved Entry ID: , V1.0, 09/