Quick information and setup overview. Remote Engineer ServiceGate

Transcription

1 Quick information and setup overview Remote Engineer ServiceGate

2 Remote Engineer ServiceGate Remote Engineer has developed a safe and easy way to enable remote technical support to the installed equipment on-site. Because our past experience shows that many customers struggle with setting up a secure Virtual Private Network to allow remote access to installations, either due to technical problems or security reasons, we created a simple and safe solution: The provided solution is based on a dedicated VPN router. This router is provided by your supplier and will be maintained by your suppliers personnel. This means it does not require any additional (technical) knowledge of our customers. Numerous ServiceGates have been rolled out to the vast majority of our customers, varying from small factories to international operating groups. For the ServiceGate to operate correctly, it solely needs one RJ45 10/100Mbps Ethernet connection that is able to connect to the internet. It is just like connecting a normal workstation to you company s network and allow people to browse the internet on it. The only details that your supplier requires are the following (they are the same as the IT department normally will set to any newly installed workstation with internet access): Does the connection run DHCP? Just let us know that everything is assigned automatically, no further details are needed in this scenario. In the case of a statically assigned IP address, please provide: - The dedicated private IP address that is reserved for the ServiceGate. - The network s subnet mask. - The company s default gateway address. - The company s DNS server address. Proxy server details if applicable (note that it is highly recommended to have provide the ServiceGate with a proxy-less internet connection, you can for example physically bypass the proxy server). If you cannot provide a connection without using a proxy server, consider getting an external dedicated internet line (cable/xdsl) of the ServiceGate. As a last resort, your supplier can try to make the connection through your proxy server. Provide all login details and open up full internet access to the list of addresses depicted below. It is important that the unit has unrestricted (outgoing) access to the internet over port 443 TCP or 1193 UDP and can receive data from established connections. Of course your supplier understands that security to your network is of absolute importance. This is why Remote Engineer has implemented one of the safest methods of remote access available. The ServiceGate works with an ultra secure encryption algorithm using a 2048 bits private/public key authentication method.

3 Instead of allowing people all around the world to log in to the Remote Engineer solution reverses the connection establishment sequence and lets the ServiceGate login to one of Remote Engineer s central servers (homing). This means the ServiceGate is invisible to the rest of the internet when installed behind a common NAT equipped network. The ServiceGate s internal firewall increases the security level even further. It separates the box from the rest the factory s network. The firewall disallows any traffic sent to and/or received from the client s corporate network. The only exceptions to this rule are traffic to the specified default gateway and DNS server. In other words, your company s network is not exposed to your suppliers personnel. Extra remark: If you need even more confidence that your supplier will/cannot access your network, you can implement your company s network in a way that the ServiceGate is unable to access your corporate network at all. As long as the unit has internet access, it is ready to operate. This means you can either assign a separate public IP address to the ServiceGate or connect it to a separate physical port on your firewall. Of course you can assign it to another VLAN segment of the network as well. As an extra convenience for on-site maintenance, the ServiceGate is equipped with a wireless Ethernet connection, secured with the highest encryption available (WPA2). This allows personnel to log in to the systems wirelessly while performing physical maintenance on your site. As we understand that wireless access can be a potential security breach, we will disable the wireless interface of the ServiceGate by default. It has to be enabled by physically pressing a button on the ServiceGate. After leaving the site, the wireless connection will be disabled again to keep top notch security. This setup enables your supplier to increase our productivity and servicing response times dramatically, keeping your company s network running at top level security. Even though we suggest leaving full internet access available to the ServiceGate (so our engineers onsite can access the internet for referencing and downloading updates), we can understand that you want to restrict access anyway. Please make sure that the ServiceGate is able to reach these (safe) addresses at all times, and all ports. rencon01.rencon06.remoteengineer.eu TCP 443/UDP 1193 We hope the ServiceGate will provide you with the benefits that our other customers already experience.

4 How does it work? If a proxy server is used, provide all login/address details (however ServiceGate access to internet without proxy server is strongly recommended). Also open up access to the addresses provided below. The ServiceGate has its own very strict firewall: all traffic from and to machines on the client s network will be blocked by default. The only default exceptions are: the company s default gateway and the company s DNS server. We would like the ServiceGate to have full (unfirewalled) access to the internet, either direct or via NAT. If you insist on firewalling, please allow the ServiceGate to fully access to these addresses: rencon01.rencon06.remoteengineer.eu TCP 443/UDP Remote Engineer Customer Secure Service Server FIREWALL INTERNET Customer Switch/HUB Customer computers Customer internet gateway Customer Site (factory) Customer s end-point This RJ45 10/100Mbps Ethernet connection must grant internet access on a static/dhcp provided IP. Please notify your supplier as soon as possible about the connection details. MACHINE If DHCP is used, just notify your supplier that this is the case. SERVICEGATE MACHINE In case of static IP, please provide: - Reserved private IP address - Subnet mask - Default Gateway - DNS Server Section managed by Remote Engineer

5 Also available on your desktop, smartphone and tablet VNC RDP HTTP SSH Offer quick service and support and perform secure maintenance worldwide Remote Engineer B.V. De Parse 11, 8491 PJ, Akkrum The Netherlands