Setting up a secure VPN Connection between two M812-1 Using a static IP Address

Transcription

1 Configuration Example 07/2015 Setting up a secure VPN Connection between two M812-1 Using a static IP Address SCALANCE M

2 Warranty and Liability Warranty and Liability Note The Application Examples are not binding and do not claim to be complete regarding the circuits shown, equipping and any eventuality. The Application Examples do not represent customer-specific solutions. They are only intended to provide support for typical applications. You are responsible for ensuring that the described products are used correctly. These Application Examples do not relieve you of the responsibility to use safe practices in application, installation, operation and maintenance. When using these Application Examples, you recognize that we cannot be made liable for any damage/claims beyond the liability clause described. We reserve the right to make changes to these Application Examples at any time without prior notice. If there are any deviations between the recommendations provided in these Application Examples and other Siemens publications e.g. Catalogs the contents of the other documents have priority. We do not accept any liability for the information contained in this document. Any claims against us based on whatever legal reason resulting from the use of the examples, information, programs, engineering and performance data etc., described in this Application Example shall be excluded. Such an exclusion shall not apply in the case of mandatory liability, e.g. under the German Product Liability Act ( Produkthaftungsgesetz ), in case of intent, gross negligence, or injury of life, body or health, guarantee for the quality of a product, fraudulent concealment of a deficiency or breach of a condition which goes to the root of the contract ( wesentliche Vertragspflichten ). The damages for a breach of a substantial contractual obligation are, however, limited to the foreseeable damage, typical for the type of contract, except in the event of intent or gross negligence or injury to life, body or health. The above provisions do not imply a change of the burden of proof to your detriment. Any form of duplication or distribution of these Application Examples or excerpts hereof is prohibited without the expressed consent of Siemens AG. Security information Siemens provides products and solutions with industrial security functions that support the secure operation of plants, solutions, machines, equipment and/or networks. They are important components in a holistic industrial security concept. With this in mind, Siemens' products and solutions undergo continuous development. Siemens recommends strongly that you regularly check for product updates. For the secure operation of Siemens products and solutions, it is necessary to take suitable preventive action (e.g. cell protection concept) and integrate each component into a holistic, state-of-the-art industrial security concept. Third-party products that may be in use should also be considered. For more information about industrial security, visit To stay informed about product updates as they occur, sign up for a productspecific newsletter. For more information, visit Entry ID: , V1.0, 07/2015 2

3 Table of Contents Table of Contents Warranty and Liability Task and Solution Task Possible solution Characteristics of the solution Configuration and Project Engineering Setting up the environment Required components and IP address overview SCALANCE M Setting up the infrastructure Configuring the VPN tunnel Integrating the VPN endpoint SCALANCE M812-1 (VPN server) Integrating the VPN endpoint SCALANCE M812-1 (VPN client) Configuring the VPN tunnel Transferring the configuration data VPN configuration in the SCALANCE M Final steps Status of the VPN connection Testing the Tunnel Function History Entry ID: , V1.0, 07/2015 3

4 1 Task and Solution 1 Task and Solution 1.1 Task A service center connected via the Internet is to be able to perform classical applications such as remote programming, parameterization and diagnostics and monitoring of plants installed worldwide. The following customer requirements have to be considered: Protection against spying and data manipulation. Prevention of unauthorized access. Provision of secure remote access for remote maintenance and remote control. Protection of the S7 station and the connected network. High degree of flexibility and independence of the existing infrastructure 1.2 Possible solution Complete overview The figure below shows one way of implementing these customer requirements: Service PC VPN tunnel Industrial Ethernet SCALANCE M81x-1 VPN server Static WAN IP address SCALANCE M81x-1 VPN client Automation cell SIMATIC S7 station The connection between the service PC (or other nodes/network devices) and the automation cell (nodes such as SIMATIC stations, panels, drives, PCs) is protected by a VPN tunnel. In this example, two SCALANCE M81x-1 modules form the two tunnel endpoints for the secure connection. One SCALANCE M81x-1 acts as the VPN server, the other one acts as the VPN client. Access to the SCALANCE M81x-1 (VPN server) from the WAN is predefined by the use of a static WAN IP address. On the client side, ADSL is used for WAN access; the IP address of the WAN port is not relevant. When establishing the VPN tunnel, the roles are defined as follows: Table 1-1 Component SCALANCE M81x-1 SCALANCE M81x-1 VPN role Initiator (VPN client); starts the VPN connection Responder (VPN server); waits for the VPN connection Entry ID: , V1.0, 07/2015 4

5 1 Task and Solution SCALANCE M SCALANCE M812-1 and SCALANCE M816-1 are DSL routers and modems for cost-effective, secure connection of Ethernet-based subnets and programmable controllers to wired telephone or DSL networks that support ADSL2+ (Asynchronous Digital Subscriber Line). These modules are characterized by the following features: IPSec VPN (data encryption and authentication). Protection of the internal networks connected to the PROFINET interface. Up to 20 VPN tunnels can be established simultaneously; therefore, multiple secure connections can run simultaneously and independently of one another. VPN and DSL router/modem in a single device; therefore, it is no longer necessary to use a separate DSL router/modem. Broad range of applications due to high bandwidth, performance and speed. Reduced travel expenses and personnel costs due to remote programming and remote diagnostics via wired telephone or DSL networks. The modules automatically establish and maintain the IP-based online connection to the Internet. 1.3 Characteristics of the solution Controlled, encrypted data traffic between the two SCALANCE M modules. High degree of security for machines and plants through the implementation of the cell protection concept. Integrated network diagnostics via SNMP, Syslog and Web interface. Worldwide use. The DSL router and VPN server settings are made directly in the SCALANCE M81x-1; a separate DSL router is not required. A service employee or plant on the VPN client side can establish the VPN tunnel only when necessary; a permanently established tunnel connection is not necessary. Entry ID: , V1.0, 07/2015 5

6 2 Configuration and Project Engineering 2.1 Setting up the environment Required components and IP address overview Software packages This solution requires the following software packages: Security Configuration Tool V4.1. This software is available as a download under the following Entry ID: Web browser to configure the SCALANCE M. Install these software packages on a PC/PG. Required devices/components: Note To set up the environment, use the following components: Two SCALANCE M812-1 (optional: A DIN rail installed accordingly, including fitting accessories). ADSL access. DSL access with a static WAN IP address. One or two 24V power supplies with cable connector and terminal block plug (the modules can also be operated with a shared power supply). PC on which the Security Configuration Tool and a Web browser are installed. The necessary network cables, TP cables (twisted pair) according to the IE FC RJ45 standard for Industrial Ethernet. The configuration described below refers explicitly to the components listed in Required devices/components. Entry ID: , V1.0, 07/2015 6

7 IP addresses For this example, the IP addresses are assigned as follows: M812-1 M Static WAN IP Dynamic WAN IP Table 2-1 Note Component Port IP address Router Subnet mask M812-1 LAN port M812-1 WAN port Static IP address from provider M812-1 WAN port Dynamic IP address from provider - Assigned by provider - Assigned by provider M812-1 LAN port The internal subnets of the two SCALANCE M modules must be different and must not have the same network ID. Entry ID: , V1.0, 07/2015 7

8 2.1.2 SCALANCE M812-1 Note This chapter shows both global and individual steps for first commissioning of the SCALANCE M. Where necessary, use the parameters defined for the respective SCALANCE M. Factory default To make sure that no old configurations and certificates are stored in the SCALANCE M812-1, reset the modules to factory default. Press the SET button - for approx. 10 seconds - to reset the device to factory default; it can now be accessed via IP address Requirements for Web Based Management The SCALANCE M features an integrated HTTP server for Web Based Management (WBM). In order to use this function without any restrictions, please note the following: Access via HTTPS is enabled. JavaScript is enabled in the Web browser. When the firewall is enabled, TCP port 443 must be enabled for access via HTTPS. Physical connection between PC and SCALANCE M Use the PC to connect to the Web user interface of the SCALANCE M. When the SCALANCE M is set to factory default, the IP address of the internal interface of the module is In this case, change the network settings on the PC as follows: IP address: Subnet mask: Use address to open Web Based Management. Entry ID: , V1.0, 07/2015 8

9 Web Based Management login When you log on for the first time or after setting to factory default, the login data is defined as follows: Name: admin Password: admin 1. Enter the name and password in the appropriate text boxes. 2. Click the Login button or confirm your entries with Enter. 3. When you log on for the first time or after setting to factory default, you are prompted to change the password. Entry ID: , V1.0, 07/2015 9

10 4. Enter the old and new password. 5. Click the Set Values button to complete the operation and activate the new password. 6. After successful logon, the start page appears. Changing the IP address Changing the IP address is demonstrated using the SCALANCE M (VPN server); this applies in the same way to the SCALANCE M (VPN client). To change the IP address of the internal interface of the SCALANCE M, proceed as follows: 1. In the navigation bar, navigate to System > Agent IP and change the IP address as listed in Table Apply the setting with Set Values. 3. Change the network settings on the PC as follows: IP address: Subnet mask: Reload the Web page. The internal interface of the SCALANCE M is set to the desired IP address. Entry ID: , V1.0, 07/

11 Setting the time To establish secure communication, it is essential that the current date and time are always set on the SCALANCE M. Otherwise, the certificates used are interpreted as invalid and secure VPN communication is not possible. 1. In the navigation bar, navigate to System > System Time. 2. Click the Use PC Time button to apply the time setting of the PC. 3. Click the Set Values button. The date and time are applied and Manual is entered in the Last Synchronization Mechanism field. Note When manually setting the time, please note that the time is reset to factory default when the power supply is interrupted. When the power supply has been restored, you have to set the system time once again. Due to this, certificates may lose their validity. Note You also have the option to have the system time automatically synchronized with a time server. A number of time servers from which the exact current time can be retrieved can be found on the Internet. Synchronizing the system time using a public time server causes additional traffic on the connection. Entry ID: , V1.0, 07/

12 Setting up DSL access Access to the Internet requires the following access parameters: User name and password for DSL access VCI / VPI Encapsulation These parameters can be obtained from your Internet service provider. 1. In the navigation pane, click Interfaces > DSL. 2. Check Enable DSL Interface and uncheck Enable PPPoE Passthrough. 3. Enter the user name (Account) and password for DSL access. If necessary, change the values for VCI, VPI and Encapsulation. The settings can be obtained from your DSL provider. 4. Click Set Values. The DSL connection has been set up. After approx. 30 seconds, the device connects to the Internet. Information > DSL allows you to check whether the connection has been established. Entry ID: , V1.0, 07/

13 2.1.3 Setting up the infrastructure Connect all the components involved in this solution. M812-1 M812-1 LAN port WAN port WAN port LAN port Note Table 2-2 Component Local port Partner Partner port SCALANCE M812-1 LAN port E.g., an automation network (does not exist in this solution) SCALANCE M812-1 WAN port ADSL2+ port for operation on public DSL networks. SCALANCE M812-1 WAN port ADSL2+ port for operation on public DSL networks. SCALANCE M812-1 LAN port E.g., an automation network (does not exist in this solution) In all devices in the internal network of the SCALANCE M812-1 (e.g., controllers, panels, etc.), please make sure to enter the IP address of the internal port as the default gateway. 2.2 Configuring the VPN tunnel SCT project Components used The VPN tunnel is configured using the Security Configuration Tool V4.1. Open the tool and select Project > New to create a new project. Define a user name and password. This solution uses the SCALANCE M812-1 security component: Entry ID: , V1.0, 07/

14 2.2.1 Integrating the VPN endpoint SCALANCE M812-1 (VPN server) To integrate the SCALANCE M812-1 component into the Security Configuration Tool, proceed as follows: 1. Use Insert > Module or select the appropriate menu icon to open the module selection dialog. Define the following module: Product type: SCALANCE M Module: SCALANCE M Assign a name to the module. Enter the internal IP address and subnet mask as listed in Table 2-1. Note: The external IP address is irrelevant; you can keep the default setting. Click OK to close the dialog. The SCALANCE M (VPN server) appears as a new module. Entry ID: , V1.0, 07/

15 2.2.2 Integrating the VPN endpoint SCALANCE M812-1 (VPN client) To integrate the SCALANCE M812-1 component into the Security Configuration Tool, proceed as follows: 1. Use Insert > Module or select the appropriate menu icon to open the module selection dialog and define the same module. 2. Assign a name to the module. Enter the internal IP address and subnet mask as listed in Table 2-1. Note: The external IP address is irrelevant; you can keep the default setting. Click OK to close the dialog. The SCALANCE M (VPN client) appears as an additional module. Entry ID: , V1.0, 07/

16 2.2.3 Configuring the VPN tunnel Creating a VPN group All members of a VPN group are authorized to communicate with each other through a VPN tunnel. To create a VPN group, proceed as follows: 1. In the project tree, select the VPN groups item. Use Insert > Group or select the appropriate menu icon to create a new VPN group. 2. One after the other, select the security modules from the All modules list and use drag and drop to insert them into the VPN group. The two security modules have been assigned to VPN group Group1. Certificates are used for authentication. Entry ID: , V1.0, 07/

17 Defining the VPN parameters (VPN server) To establish the VPN tunnel, you have to enter the following information: VPN role WAN IP address Parameterize this information as follows: 1. In the All modules project tree, select the SCALANCE M (VPN server) and double-click to open its properties dialog. 2. In the VPN tab, select the Responder VPN role. In the WAN IP address / FQDN field, enter the WAN IP address of your DSL access point. 3. Click OK to close the dialog and select OK to confirm the message. 4. Save the project. The VPN configuration is complete Transferring the configuration data The Security Configuration Tool creates a configuration guide and exports the required data to a specified location. To transfer the configuration data of the two SCALANCE M modules, proceed as follows: 1. In the All modules project tree, select the module ( M812-Server ) and select the Transfer > To module(s) menu command. 2. Save the <Project name>.m812-server.txt configuration guide and the certificates to your project directory. 3. Enter a password for the.p12 certificate. If you do not assign a password, the project name (not the password of the logged in user) is applied as the password. 4. Repeat the steps for the M812-Client module. 5. Close the Security Configuration Tool. Entry ID: , V1.0, 07/

18 The following files are saved to the project directory: For SCALANCE M (VPN server) For SCALANCE M (VPN client) Entry ID: , V1.0, 07/

19 2.3 VPN configuration in the SCALANCE M812-1 Use the Web user interface of the SCALANCE M to configure it with the aid of the saved Project name>.m812-server.txt or <Project name>.m812-client.txt configuration guide. Configuration guide for the VPN server The configuration guide (here: <Project name>.m812-server.txt ) navigates you to the items in Web Based Management and shows the settings required in WBM: Entry ID: , V1.0, 07/

20 The configuration includes the following steps shown below: Table 2-3 No. Configuration step 1. Enter the certificate password. 2. Load the certificates to the SCALANCE M. 3. Define the VPN remote end. 4. Create the connection. 5. Define the authentication method for the connection. 6. Define the VPN parameters for Phase Define the VPN parameters for Phase Define the VPN role. 9. Enable the VPN function. Physical connection between PC and SCALANCE M Use the PC to connect to the Web user interface of the SCALANCE M (VPN server) (address: For this purpose, change the network settings on the PC as follows: IP address: Subnet mask: After successful logon, the start page appears. Entry ID: , V1.0, 07/

21 Managing the certificate password There are files whose access is password-protected. When saving the configuration files of the SCALANCE M from the Security Configuration Tool, you were prompted to assign a password for the private key of the certificate or use the project name as the password. To successfully download the file to the SCALANCE M, enter the password defined for the file on the WBM page. 1. In the navigation bar, navigate to System > Load&Save > Passwords. 2. In the Password text box, enter the password. In Password Confirmation, reenter the password to confirm it. Check the Enabled option. 3. Click the Set Values button. The password for the private key of the certificate has been defined. Entry ID: , V1.0, 07/

22 Loading the certificates The certificates are required to authenticate the VPN user and therefore to establish a secure VPN connection. Load the two required certificates to the SCALANCE M as described in the following section: 1. In the navigation bar, navigate to System > Load&Save > HTTP. 2. In IPSecCert, click the Load button to start loading. 3. The dialog for loading a file opens. Navigate to your project directory with the configuration files of the SCALANCE M. 4. Select a certificate. For the exact certificate name, please refer to your configuration guide. 5. In the dialog, click the Open button. The file is loaded. 6. Repeat steps 2 through 5 with the other certificate. The required certificates have been loaded to the SCALANCE M. Entry ID: , V1.0, 07/

23 Defining the VPN remote end The VPN tunnel is always established to one or more users. In this example, the only endpoint is the SCALANCE M (VPN client). Configure the remote end as follows: 1. In the navigation bar, navigate to Security > IPSec VPN > Remote End. 2. In the Remote End Name text box, enter a name for the VPN remote end (e.g., M812-Client). Click Create to create a new remote end. 3. Contrary to the configuration guide, set the parameters for the VPN remote end as follows: Remote Mode: Roadwarrior Remote Type: any Remote Address: /0 Remote Subnet: /24 4. Click the Set Values button. The access address of the remote end and the subnet - reachable through the tunnel - have been made known to the SCALANCE M. Entry ID: , V1.0, 07/

24 Creating the VPN connection In this section, you configure the basic settings for the VPN connection. Then you define the security settings. 1. In the navigation bar, navigate to Security > IPSec VPN > Connections. 2. In Connection Name, enter a name for the VPN connection. Click Create to create a new entry. 3. Set the parameters for the VPN connection as described in your configuration guide: Keying Protocol: IKEv1 Remote End: Name of the VPN remote end (here: M812-Client) Local Subnet: /24 4. Click the Set Values button. A VPN connection has been created, the remote end for this connection has been selected and the subnet allowed to communicate with the remote end has been defined. Entry ID: , V1.0, 07/

25 Defining the authentication method For secure communication via VPN, all VPN partners must authenticate each other. This example uses the certificate of the remote end as the authentication method. Note For the exact names of your certificates, please refer to your configuration guide. 1. In the navigation bar, navigate to Security > IPSec VPN > Authentication. 2. Configure authentication with the settings described in your configuration guide: Authentication: Remote Cert Local Certificate: <see configuration guide> Remote Certificate: <see configuration guide> Remote ID: <see configuration guide> 3. Click the Set Values button. The SCALANCE M can authenticate for the shared VPN tunnel with the loaded certificates and accept the remote end as the VPN partner. Entry ID: , V1.0, 07/

26 Defining Phase 1 Phase 1 of authentication involves the encryption agreement and authentication between the VPN users via the standardized IKE (Internet Key Exchange) protocol. For IPSec key management, you have to enter defined protocol parameters. 1. In the navigation bar, navigate to Security > IPSec VPN > Phase Set the protocol parameters as described in your configuration guide: Encryption: 3DES Authentication: SHA1 Key Derivation: DH group 2 Keying Tries: 0 Lifetime [min]: DPD: restart DPD Delay [sec]: default DPD Timeout [sec]: default Aggressive Mode: No 3. Click the Set Values button. Entry ID: , V1.0, 07/

27 Defining Phase 2 Phase 2 is data exchange via the standardized ESP (Encapsulating Security Payload) security protocol. For IPSec data exchange, you have to enter defined protocol parameters. 1. In the navigation bar, navigate to Security > IPSec VPN > Phase Set the protocol parameters as described in your configuration guide: Encryption: 3DES Authentication: SHA1 Key Derivation: DH group 2 Lifetime [min]: 2880 Lifebytes: 0 3. Click the Set Values button. You have defined all the necessary parameters for the IKE and ESP protocols. Entry ID: , V1.0, 07/

28 Establishing the VPN connection The SCALANCE M (VPN server) is configured as the responder of the VPN tunnel and waits for the connection from the SCALANCE M (VPN client). 1. In the navigation bar, navigate to Security > IPSec VPN > Connections. 2. Contrary to the configuration guide, change the mode in the Operation column to wait. 3. Click the Set Values button. The SCALANCE M (VPN server) is the responder of the VPN connection. Entry ID: , V1.0, 07/

29 Activating IPSec For the secure connection between the two SCALANCE M modules, a VPN tunnel is established with IPSec. 1. In the navigation bar, navigate to Security > IPSec VPN > General. 2. Check the Activate IPSec VPN check box to activate IPSec. 3. Click the Set Values button. IPSec is active and used for the VPN tunnel. Entry ID: , V1.0, 07/

30 Configuration guide for the VPN client The configuration guide (here: <Project name>.m812-client.txt ) navigates you to the items in Web Based Management and shows the settings required in WBM: The configuration includes the following steps shown below: Table 2-4 No. Configuration step 1. Enter the certificate password. 2. Load the certificates to the SCALANCE M. 3. Define the VPN remote end. 4. Create the connection. 5. Define the authentication method for the connection. 6. Define the VPN parameters for Phase Define the VPN parameters for Phase Define the VPN role. 9. Enable the VPN function. Entry ID: , V1.0, 07/

31 Physical connection between PC and SCALANCE M Use the PC to connect to the Web user interface of the SCALANCE M (VPN client) (address: For this purpose, change the network settings on the PC as follows: IP address: Subnet mask: After successful logon, the start page appears. Managing the certificate password There are files whose access is password-protected. When saving the configuration files of the SCALANCE M from the Security Configuration Tool, you were prompted to assign a password for the private key of the certificate or use the project name as the password. To successfully download the file to the SCALANCE M, enter the password defined for the file on the WBM page. 1. In the navigation bar, navigate to System > Load&Save > Passwords. 2. In the Password text box, enter the password. In Password Confirmation, reenter the password to confirm it. Check the Enabled option. 3. Click the Set Values button. The password for the private key of the certificate has been defined. Entry ID: , V1.0, 07/

32 Loading the certificates The certificates are required to authenticate the VPN user and therefore to establish a secure VPN connection. Load the two required certificates to the SCALANCE M as described in the following section: 1. In the navigation bar, navigate to System > Load&Save > HTTP. 2. In IPSecCert, click the Load button to start loading. 3. The dialog for loading a file opens. Navigate to your project directory with the configuration files of the SCALANCE M. 4. Select a certificate. For the exact certificate name, please refer to your configuration guide. 5. In the dialog, click the Open button. The file is loaded. 6. Repeat steps 2 through 5 with the other certificate. The required certificates have been loaded to the SCALANCE M. Entry ID: , V1.0, 07/

33 Defining the VPN remote end The VPN tunnel is always established to one or more users. In this example, the only endpoint is the SCALANCE M (VPN server). Configure the remote end as follows: 1. In the navigation bar, navigate to Security > IPSec VPN > Remote End. 2. In the Remote End Name text box, enter a name for the VPN remote end (e.g., M812-Server). Click Create to create a new remote end. 3. Set the parameters for the VPN remote end as described in the configuration guide: Remote Mode: Standard Remote Type: manual Remote Address: WAN IP address Remote Subnet: /24 4. Click the Set Values button. The access address of the remote end and the subnet - reachable through the tunnel - have been made known to the SCALANCE M. Entry ID: , V1.0, 07/

34 Creating the VPN connection In this section, you configure the basic settings for the VPN connection. Then you define the security settings. 1. In the navigation bar, navigate to Security > IPSec VPN > Connections. 2. In Connection Name, enter a name for the VPN connection. Click Create to create a new entry. 3. Set the parameters for the VPN connection as described in your configuration guide: Keying Protocol: IKEv1 Remote End: Name of the VPN remote end (here: M812-Server) Local Subnet: /24 4. Click the Set Values button. A VPN connection has been created, the remote end for this connection has been selected and the subnet allowed to communicate with the remote end has been defined. Entry ID: , V1.0, 07/

35 Defining the authentication method For secure communication via VPN, all VPN partners must authenticate each other. This example uses the certificate of the remote end as the authentication method. Note For the exact names of your certificates, please refer to your configuration guide. 1. In the navigation bar, navigate to Security > IPSec VPN > Authentication. 2. Configure authentication with the settings described in your configuration guide: Authentication: Remote Cert Local Certificate: <see configuration guide> Remote Certificate: <see configuration guide> Remote ID: <see configuration guide> 3. Click the Set Values button. The SCALANCE M can authenticate for the shared VPN tunnel with the loaded certificates and accept the remote end as the VPN partner. Entry ID: , V1.0, 07/

36 Defining Phase 1 Phase 1 of authentication involves the encryption agreement and authentication between the VPN users via the standardized IKE (Internet Key Exchange) protocol. For IPSec key management, you have to enter defined protocol parameters. 1. In the navigation bar, navigate to Security > IPSec VPN > Phase Set the protocol parameters as described in your configuration guide: Encryption: 3DES Authentication: SHA1 Key Derivation: DH group 2 Keying Tries: 0 Lifetime [min]: DPD: restart DPD Delay [sec]: default DPD Timeout [sec]: default Aggressive Mode: No 3. Click the Set Values button. Entry ID: , V1.0, 07/

37 Defining Phase 2 Phase 2 is data exchange via the standardized ESP (Encapsulating Security Payload) security protocol. For IPSec data exchange, you have to enter defined protocol parameters. 1. In the navigation bar, navigate to Security > IPSec VPN > Phase Set the protocol parameters as described in your configuration guide: Encryption: 3DES Authentication: SHA1 Key Derivation: DH group 2 Lifetime [min]: 2880 Lifebytes: 0 3. Click the Set Values button. You have defined all the necessary parameters for the IKE and ESP protocols. Entry ID: , V1.0, 07/

38 Establishing the VPN connection The SCALANCE M (VPN client) is configured as the initiator of the VPN tunnel and establishes the connection to the SCALANCE M (VPN server). 1. In the navigation bar, navigate to Security > IPSec VPN > Connections. 2. In the Operation column, change the mode to start. 3. Click the Set Values button. The SCALANCE M (VPN client) is the initiator of the VPN connection. Entry ID: , V1.0, 07/

39 Activating IPSec For the secure connection between the two SCALANCE M modules, a VPN tunnel is established with IPSec. 1. In the navigation bar, navigate to Security > IPSec VPN > General. 2. Check the Activate IPSec VPN check box to activate IPSec. 3. Click the Set Values button. IPSec is active and used for the VPN tunnel. 2.4 Final steps Connect the internal port of the two SCALANCE M modules to your network (e.g., automation network). For all devices on the internal port of the devices, set the appropriate standard router (IP address of the internal port). Entry ID: , V1.0, 07/

40 2.5 Status of the VPN connection When all security modules have been parameterized, loaded and connected to the Internet, the SCALANCE M (VPN client) initializes the VPN tunnel to the SCALANCE M (VPN server). Diagnostics in the Security Configuration Tool or SCALANCE M's Web Based Management allow you to view the status. In addition, the housing of the SCALANCE M features diagnostic LEDs for modem status and connection control. Web Based Management Status indication via Web Based Management can be accessed as follows: 1. Use the PC to connect to the Web user interface of a SCALANCE M. After successful logon, the start page appears. 2. In the navigation bar, navigate to Information > IPSec VPN. 3. The Status column shows the status of the configured VPN connection. LED display When the VPN tunnel has been established, the green. LED on the device lights up Entry ID: , V1.0, 07/

41 3 Testing the Tunnel Function 3 Testing the Tunnel Function Chapter 2 completes the commissioning of the configuration and the two SCALANCE M modules have established a VPN tunnel for secure communication. You can test the established tunnel connection using a ping command on an internal node. This is described below. 1. Connect the PC to the internal port of the SCALANCE M (VPN server). 2. Change the network settings on the PC as follows: IP address: Subnet mask: Default gateway: On the PC, select Start > All Programs > Accessories > Command Prompt in the start bar. Note 4. In the command line of the Command Prompt window that appears, enter the ping <IP address of internal node of remote end> command at the cursor position. You get a positive response from the internal node. In Windows, the default settings of the firewall may prevent ping commands from passing. You may have to enable the ICMP services of the "Request" and Response type. Entry ID: , V1.0, 07/

42 4 History 4 History Table 4-1 Version Date Modifications V1.0 07/2015 First version Entry ID: , V1.0, 07/