Setting up a VPN Connection between a Tablet (ios) and the SINEMA Remote Connect Server SINEMA Remote Connect https://support.industry.siemens.com/cs/ww/en/view/109479577 Siemens Industry Online Support

Siemens AG 2018 All rights reserved Legal information Legal information Use of application examples Application examples illustrate the solution of automation tasks through an interaction of several components in the form of text, graphics and/or software modules. The application examples are a free service by Siemens AG and/or a subsidiary of Siemens AG ("Siemens"). They are non-binding and make no claim to completeness or functionality regarding configuration and equipment. The application examples merely offer help with typical tasks; they do not constitute customer-specific solutions. You yourself are responsible for the proper and safe operation of the products in accordance with applicable regulations and must also check the function of the respective application example and customize it for your system. Siemens grants you the non-exclusive, non-sublicensable and non-transferable right to have the application examples used by technically trained personnel. Any change to the application examples is your responsibility. Sharing the application examples with third parties or copying the application examples or excerpts thereof is permitted only in combination with your own products. The application examples are not required to undergo the customary tests and quality inspections of a chargeable product; they may have functional and performance defects as well as errors. It is your responsibility to use them in such a manner that any malfunctions that may occur do not result in property damage or injury to persons. Disclaimer of liability Siemens shall not assume any liability, for any legal reason whatsoever, including, without limitation, liability for the usability, availability, completeness and freedom from defects of the application examples as well as for related information, configuration and performance data and any damage caused thereby. This shall not apply in cases of mandatory liability, for example under the German Product Liability Act, or in cases of intent, gross negligence, or culpable loss of life, bodily injury or damage to health, non-compliance with a guarantee, fraudulent non-disclosure of a defect, or culpable breach of material contractual obligations. Claims for damages arising from a breach of material contractual obligations shall however be limited to the foreseeable damage typical of the type of agreement, unless liability arises from intent or gross negligence or is based on loss of life, bodily injury or damage to health. The foregoing provisions do not imply any change in the burden of proof to your detriment. You shall indemnify Siemens against existing or future claims of third parties in this connection except where Siemens is mandatorily liable. By using the application examples you acknowledge that Siemens cannot be held liable for any damage beyond the liability provisions described. Other information Siemens reserves the right to make changes to the application examples at any time without notice. In case of discrepancies between the suggestions in the application examples and other Siemens publications such as catalogs, the content of the other documentation shall have precedence. The Siemens terms of use (https://support.industry.siemens.com) shall also apply. Security information Siemens provides products and solutions with Industrial Security functions that support the secure operation of plants, systems, machines and networks. In order to protect plants, systems, machines and networks against cyber threats, it is necessary to implement and continuously maintain a holistic, state-of-the-art industrial security concept. Siemens products and solutions constitute one element of such a concept. Customers are responsible for preventing unauthorized access to their plants, systems, machines and networks. Such systems, machines and components should only be connected to an enterprise network or the Internet if and to the extent such a connection is necessary and only when appropriate security measures (e.g. firewalls and/or network segmentation) are in place. For additional information on industrial security measures that may be implemented, please visit https://www.siemens.com/industrialsecurity. Siemens products and solutions undergo continuous development to make them more secure. Siemens strongly recommends that product updates are applied as soon as they are available and that the latest product versions are used. Use of product versions that are no longer supported, and failure to apply the latest updates may increase customer s exposure to cyber threats. To stay informed about product updates, subscribe to the Siemens Industrial Security RSS Feed at: https://www.siemens.com/industrialsecurity. Entry-ID: 109479577, V1.1, 06/2018 2

Siemens AG 2018 All rights reserved Table of contents Table of contents Legal information... 2 1 Task and Solution... 4 1.1 Task... 4 1.2 Possible solution... 4 1.3 Characteristics of the solution... 5... 6 2.1 Setting up the environment... 6 2.1.1 Required components and IP address overview... 6 2.1.2 WLAN router on the VPN client... 8 2.1.3 Tablet... 8 2.1.4 Router on the VPN server... 9 2.1.5 SINEMA Remote Connect Server... 10 2.2 Setting up remote access... 13 2.2.1 Creating a user account on the SINEMA Remote Connect Server... 13 2.2.2 Modifying the.ovpn configuration file... 17 2.2.3 Setting up the remote connection on the tablet... 19 2.3 Establishing the VPN connection... 21 3 Appendix... 22 3.1 Service and support... 22 3.2 Links and literature... 23 3.3 Change documentation... 23 Entry-ID: 109479577, V1.1, 06/2018 3

Siemens AG 2018 All rights reserved 1 Task and Solution 1 Task and Solution 1.1 Task The task is to provide a service employee with secure remote access to the SINEMA Remote Connect Server for maintenance, control and diagnostic purposes. SINEMA Remote Connect is used for secure, central management of the tunnel connections. The following customer requirements have to be considered: Prevention of unauthorized access to the SINEMA Remote Connect Server. Protection against data manipulation and spying. Flexible access for the service employee (regardless of the user s location). 1.2 Possible solution Complete overview The figure below shows one way of implementing the customer requirements: Control Center Service Technician with Mobile Device SINEMA Remote Connect Server VPN Server Internet Router Static WAN IP Address WAN Internet Router VPN Tunnel Industrial Ethernet VPN Client The connection between the control center and the service technician is protected by a VPN tunnel. Client access from the mobile device (tablet/smartphone) to the SINEMA Remote Connect Server is established via the "OpenVPN Connect app, a VPN client software product. Access to the SINEMA Remote Connect Server (VPN server) is predefined by the use of a static IP address. Access on the client side is flexible; the external IP address of the router is not relevant. When establishing the VPN tunnel, the roles are defined as follows: Table 1-1 Component Mobile device SINEMA Remote Connect Server VPN role Initiator (VPN client); starts the VPN connection Responder (VPN server); waits for the VPN connection Entry-ID: 109479577, V1.1, 06/2018 4

Siemens AG 2018 All rights reserved 1 Task and Solution SINEMA Remote Connect SINEMA Remote Connect is a management platform for remote networks that centrally manages secure tunnel connections. It allows convenient and secure maintenance of widely distributed plants or machines via remote access. Even if the machines are integrated in third-party networks. For example, in the plants of end customers of machine manufacturers. Parts of a solution with SINEMA Remote Connect are: SINEMA Remote Connect as the VPN server Terminal units (VPN client): Industrial Security Appliances: SCALANCE S-600 und SC-600 Mobilfunkgeräte SCALANCE M-800 SIMATIC RTU3030C SIMATIC CP1243-1 SIMATIC CP1543-1 SINEMA Remote Connect Client SINEMA Remote Connect Server is a server application that provides integrated connection management of distributed networks via the Internet. It coordinates secure connection establishment between users, widely distributed plants and machines. The SINEMA Remote Connect Server performs the following functions: Management and establishment of encrypted connections using OpenVPN. Verification via CA certificate or fingerprint. User management with rights configuration. Establishment of permanent or event-based connections (established via a wake-up SMS text message or a signal at the digital input). Provision of secure remote access to lower-level networks for maintenance, control and diagnostic purposes. Web Based Management (WBM) to configure the server. 1.3 Characteristics of the solution User management and connection management via a central server application. Secure and easy dial-in to the plants from anywhere in the world. Controlled, encrypted data traffic between users, widely distributed plants and machines. Low investment and operating costs for monitoring and controlling remotely connected substations. High degree of security for machines and plants through the implementation of the cell protection concept. Easy integration into existing networks and protection of devices that do not have their own security functions. Note This configuration example describes only how a user can connect to the SINEMA Remote Connect Server using a tablet. Access to lower-level networks/devices is not part of this guide. In this case, consult the other configuration examples for SINEMA Remote Connect. For an overview, please refer to Entry ID 26662448. Entry-ID: 109479577, V1.1, 06/2018 5

Siemens AG 2018 All rights reserved 2.1 Setting up the environment 2.1.1 Required components and IP address overview Software packages This solution is based on SINEMA Remote Connect Appliance and requires the SINEMA Remote Connect Server as software. Install this software on a PC without an operating system. Please consider the requirements necessary for the installation. During the installation, you have to enter the server s IP address. Use the IP address from Table 2-1. The tablet requires the "OpenVPN Connect app. Download the free app from the store and install it on your tablet. NOTICE The installation of the SINEMA Remote Connect Server includes its own operating system. If you are using a PC on which an operating system already exists, the hard disk will be formatted and stored data will be lost. Required devices/components: To set up the environment, use the following components: A PC on which the "SINEMA Remote Connect Server is installed. A tablet with the "ios operating system and the "OpenVPN Connect app. This example was created with an ipad (ios version 11.3). DSL access with a dynamic WAN IP address and a DSL router with WLAN functionality. DSL access with a static WAN IP address and a DSL router. A PC on which a web browser and a text editor (e.g., Notepad) are installed. The necessary network cables, TP cables (twisted pair) according to the IE FC RJ45 standard for Industrial Ethernet. Note You can also use a different Internet access method (e.g., UTMS). The configuration described below refers explicitly to the components listed in "Required devices/components. Entry-ID: 109479577, V1.1, 06/2018 6

Siemens AG 2018 All rights reserved IP addresses For this example, the IP addresses are assigned as follows: Control Center Service Technician with Mobile Device SINEMA Remote Connect Server Internet Router WAN Internet Router 172.16.1.52 172.16.0.1 Static WAN IP Dynamic WAN IP 192.168.178.1 192.168.178.100 Table 2-1 Component Port IP address Router Subnet mask SINEMA Remote Connect Server PC (not shown in the figure) LAN port 172.16.1.52 172.16.1.0 255.255.0.0 LAN port 172.16.1.100-255.255.0.0 Router on the VPN server LAN port 172.16.1.0-255.255.0.0 Router on the VPN server WAN port Static IP address from provider Router on the VPN client WAN port Dynamic IP address from provider - Assigned by provider - Assigned by provider Router on the VPN client LAN port 192.168.178.1-255.255.255.0 Tablet WLAN 192.168.178.100 192.168.178.1 255.255.255.0 Setting up the infrastructure Table 2-2 Connect all the components involved in this solution. Component Local port Partner Partner port SINEMA Remote Connect Server LAN port Router on the VPN server PC LAN port Router on the VPN server Tablet WLAN interface Router on the VPN client LAN port LAN port WLAN interface Entry-ID: 109479577, V1.1, 06/2018 7

Siemens AG 2018 All rights reserved 2.1.2 WLAN router on the VPN client The router is used to connect the tablet to the LAN via the WLAN. VPN WLAN If VPN connections are configured and enabled on your router, close them. Set up the WLAN on the router. On the LAN port, use a static IP address as shown in Table 2-1. 2.1.3 Tablet Time VPN WLAN To check the time validity of certificates, it is important that the tablet always maintains the current date and time. Check the time on your tablet and change it, if necessary. If other VPN connections are configured and enabled on your tablet, close them. On the tablet, set up the WLAN according to your router configuration. Use a static IP address as shown in Table 2-1. Entry-ID: 109479577, V1.1, 06/2018 8

Siemens AG 2018 All rights reserved 2.1.4 Router on the VPN server Static IP address for the DSL router WAN access of the tablet (VPN client) to the SINEMA Remote Connect Server (VPN server) is implemented using a fixed public IP address. This IP address must be requested from the provider and then stored in the DSL router. Port forwarding on the DSL router To allow smooth exchange of tunnel packets between the tablet and the SINEMA Remote Connect Server, make sure that PORT forwarding for OpenVPN and https with TCP and UDP (TCP/443,UDP/1194,TCP/5443,TCP/6220) is enabled and forwarding to the SINEMA Remote Connect Server is possible. Note In the SINEMA Remote Connect Server, these ports can be changed; therefore, the port numbers are only correct if you keep the default settings. Either only UDP or TCP is used for OpenVPN. Where possible, always prefer UDP as it is faster/performs better. Entry-ID: 109479577, V1.1, 06/2018 9

Siemens AG 2018 All rights reserved 2.1.5 SINEMA Remote Connect Server Opening Web Based Management Use the PC to connect to the web user interface of the SINEMA Remote Connect Server. The IP address was defined during the installation. Use address https://172.16.1.52 to open Web Based Management. Web Based Management login When you log in for the first time or after setting to factory default, the login data is defined as follows: Name: admin Password: admin 1. Enter the name and password in the appropriate text boxes. Click the "Login button. 2. When you log in for the first time or after setting to factory default, you are prompted to change the password. 3. Enter the old and new password. The new password must be at least 8 characters long and include at least one special character, upper/lower case letters and numbers. 4. Click the "Save button to complete the operation and activate the new password. 5. After successful login, the start page appears. Entry-ID: 109479577, V1.1, 06/2018 10

Siemens AG 2018 All rights reserved Setting the time Result The password for the "admin user has been changed. From now on, log in with the changed password. To establish secure communication, it is essential that the current date and time are always set on the SINEMA Remote Connect Server. Otherwise, the certificates used are interpreted as invalid and secure VPN communication is not possible. 1. In the navigation bar, navigate to "System > "System Time. 2. Click the "Use PC time button to apply the time setting of the PC. Result The date and time are applied and displayed in the "System time field. Note You also have the option to have the system time automatically synchronized with an NTP time server. A number of time servers from which the exact current time can be retrieved can be found on the Internet. Entry-ID: 109479577, V1.1, 06/2018 11

Siemens AG 2018 All rights reserved Checking the interface 1. In the navigation pane, click "Security > "Network and in the content pane, click the "Interfaces tab. 2. In "Port, select "WAN. The port configuration is displayed. Check the WAN port settings. Check "SINEMA RC is located behind a NAT device to enter the required external WAN IP address for the router. In "WAN IP address, enter the WAN IP address of the router. 3. Click "Save to save the settings. Note Keep the default settings if the SINEMA Remote Connect Server is in a local network. Entry-ID: 109479577, V1.1, 06/2018 12

Siemens AG 2018 All rights reserved 2.2 Setting up remote access To enable the tablet to access the SINEMA Remote Connect Server, configuration steps must be performed on both systems. Note This configuration example describes only how a user can connect to the SINEMA Remote Connect Server using a tablet. Access to lower-level networks/devices is not part of this guide. In this case, consult the other configuration examples for SINEMA Remote Connect. For an overview, please refer to Entry ID 26662448. 2.2.1 Creating a user account on the SINEMA Remote Connect Server Defining a new user In this example, access via the tablet is performed by a service technician. To do this, the service technician needs a user name and password. 1. On the PC, open the SINEMA Remote Connect Server s Web Based Management ("https://172.16.1.52 ) and log in with the "admin user and the appropriate password. Note: Only the "admin user type has write access to the configuration data in the SINEMA Remote Connect Server. 2. In the navigation pane, click "User accounts > "Users and roles. Click "Create. The "New user page opens. Entry-ID: 109479577, V1.1, 06/2018 13

Siemens AG 2018 All rights reserved 3. Enter the user name, e.g. MobileService, and click "Continue. 4. The "Rights tab is displayed. You have the following option to assign rights to the user: a. Rights assignment through role assignment: Select an existing role. The associated rights are automatically assigned to the user; for additional rights, check the check boxes. b. Rights assignment without role assignment: If you have not selected a role, check the check boxes to enable the appropriate rights. In this example, the user does not need explicit rights to perform, for example, configurations on the SINEMA Remote Connect Server. Therefore, do not assign any rights at this point. Click "Continue. Entry-ID: 109479577, V1.1, 06/2018 14

Siemens AG 2018 All rights reserved 5. The "Group memberships tab is displayed. If you have already created participant groups, you can assign the new user to such a participant group. Click "Continue. Note: Participant groups allow you to define the communication relationships between the groups. 6. The next step is to define the password for the new user. The password must be at least 8 characters long and include at least one special character, upper/lower case letters and numbers. 7. Select "Finish to complete the user creation process. Note: The new user can change the assigned password later. Result The "MobileService user has been created and appears as a new user. Entry-ID: 109479577, V1.1, 06/2018 15

Siemens AG 2018 All rights reserved Loading the user configuration Creating a user automatically generates a configuration file with the *.ovpn extension. The file contains different parameters that are necessary for a connection to the server. The file must be loaded to the participant in the remote network that establishes a VPN connection to the SINEMA Remote Connect Server. 1. Log off of Web Based Management as the administrator and log back on with the new user data you have just created. 2. In the navigation pane, click "My account > "User certificate. Go to the "Exports tab. 3. Click the appropriate format to load the following files to a local directory on your PC. This includes: a. PEM: Certificate and key as Base64-coded ASCII text. b. OVPN: OpenVPN configuration for user. Result All required certificates have been saved in the local directory. Entry-ID: 109479577, V1.1, 06/2018 16

Siemens AG 2018 All rights reserved 2.2.2 Modifying the.ovpn configuration file Now the.ovpn file is modified for use with the "OpenVPN Connect app. 1. Open the "MobileService.ovpn and "MobileService@5.1.pem files with an editor (e.g., Notepad++). 2. Click on any position in the file "MobileService@5.1.pem" and select everything with the hot key "<STRG> A". 3. Copy the marked text with the hot key "<STRG> C" into the clipboard. Entry-ID: 109479577, V1.1, 06/2018 17

Siemens AG 2018 All rights reserved 4. In the file "MobileService.ovpn" click into the free line before the tag <pkcs12>. Add on this position with the hot key "<STRG> V" the content of the clipboard. 5. Save the modifications in the "MobileService.ovpn file Result You integrated the content of the file "MobileService@5.1.pem" into the configurationfile "MobileService.ovpn". Entry-ID: 109479577, V1.1, 06/2018 18

Siemens AG 2018 All rights reserved 2.2.3 Setting up the remote connection on the tablet Remote access between the tablet and the SINEMA Remote Connect Server is protected by an OpenVPN connection. The "OpenVPN Connect app installed on the tablet is the initiator of the connection. Open the app on your tablet. Transferring the configuration data The modified configuration file must be transferred to the tablet. The "OpenVPN Connect app offers the following options: Import via an OpenVPN Access Server. Data synchronization via itunes. Transfer by email; in this case, ensure a secure transfer, for example, using appropriate encryption. 1. Import the file "MobileService.ovpn", for example, via itunes. 2. When you open the "MobileService.ovpn file, you will be asked if you want to open it using the app. Confirm this dialog box. The "OpenVPN Connect app offers you the new configuration and allows you to apply it. Click the green plus icon. With your ipad-code you must confirm, that you allow the OpenVPN App to build up VPN connections. Entry-ID: 109479577, V1.1, 06/2018 19

Siemens AG 2018 All rights reserved 3. The profile opens. The password for the certificate is required. In the appropriate field, enter the password you have defined for the new user in the SINEMA Remote Connect Server (see chapter 2.2.1). Entry-ID: 109479577, V1.1, 06/2018 20

Siemens AG 2018 All rights reserved 2.3 Establishing the VPN connection When all the components have been configured, you can initialize the VPN tunnel between the tablet ("OpenVPN Connect app) and the SINEMA Remote Connect Server. To do this, move the "Connection button to the right. Once the connection has been established, the status is displayed as "Connected. Result Now you can use the tablet to open the SINEMA Remote Connect Server s Web Based Management and log in as the "MobileService user. Depending on the assigned rights, you now have different remote access options. Entry-ID: 109479577, V1.1, 06/2018 21

Siemens AG 2018 All rights reserved 3 Appendix 3 Appendix 3.1 Service and support Industry Online Support Do you have any questions or need assistance? Siemens Industry Online Support offers round the clock access to our entire service and support know-how and portfolio. The Industry Online Support is the central address for information about our products, solutions and services. Product information, manuals, downloads, FAQs, application examples and videos all information is accessible with just a few mouse clicks: https://support.industry.siemens.com/ Technical Support The Technical Support of Siemens Industry provides you fast and competent support regarding all technical queries with numerous tailor-made offers ranging from basic support to individual support contracts. Please send queries to Technical Support via Web form: https://www.siemens.com/industry/supportrequest SITRAIN Training for Industry We support you with our globally available training courses for industry with practical experience, innovative learning methods and a concept that s tailored to the customer s specific needs. For more information on our offered trainings and courses, as well as their locations and dates, refer to our web page: https://www.siemens.com/sitrain Service offer Our range of services includes the following: Plant data services Spare parts services Repair services On-site and maintenance services Retrofitting and modernization services Service programs and contracts You can find detailed information on our range of services in the service catalog web page: https://support.industry.siemens.com/cs/sc Industry Online Support app You will receive optimum support wherever you are with the "Siemens Industry Online Support" app. The app is available for Apple ios, Android and Windows Phone: https://support.industry.siemens.com/cs/ww/en/sc/2067 Entry-ID: 109479577, V1.1, 06/2018 22

Siemens AG 2018 All rights reserved 3 Appendix 3.2 Links and literature Table 3-1 No. \1\ Siemens Industry Online Support https://support.industry.siemens.com Topic \2\ Link to this entry page of this application example https://support.industry.siemens.com/cs/ww/en/view/109479577 \3\ 3.3 Change documentation Table 3-2 Version Date Modifications V1.0 09/2015 First version V1.1 06/2018 Modify chapter 2.2.2 Entry-ID: 109479577, V1.1, 06/2018 23