User Manual

Network Security Controls

Protected System Configuration Concept

A6V11646120_enUS_b_40

29 | 85

2.1.3 Firewall Rules

The firewall rules table shows a list of required ports and services needed to allow the

communication between different network zones of a protected system configuration.

In general, all the protective controls for data connections/network traffic at zone

boundaries must be configured as follows:

● Deny by default.

● Allow only ports/services that are required to operate Desigo CC.

The following list exemplifies the allowed ports/services for a typical system

configuration. Depending on system configuration on site, divergent set of rules may

result.

Ideally, an advanced Firewall should:

● Identify and control applications on any port

● Identify and control anomalous behavior

● Decrypt outbound SSL/TLS and control SSH

(1)

● Provide application function control

● Systematically manage unknown traffic

● Scan for viruses and malware in all applications, on all ports

● Enable the same application visibility and control for all users and devices

● Make network security simpler, not more complex, with the addition of application

control

See the description of the certificate usage in the sections that follow.

Firewall Settings

When using Desigo CC with a firewall, the execution of processes that open ports for

the communication are Unrestricted by the firewall.

You must add the following ports as exceptions to the firewall if you are installing

Desigo CC on a server. Configuring your firewall settings allows the access between

the server and all its client stations and also between the server and field panels.

The table below lists the TCP and UDP ports you should add to the server firewall and

any network firewalls between the server and clients and the server and field panels.

NOTICE

Do not open a port for a program you do not recognize. The following table lists all

the ports required for safe operation of the system. Ports that are not required for

system operation must be closed for security risks.