Industrial Security Router / Firewall IE-SR-2GT-LAN IE-SR-2GT-LAN-FN IE-SR-2GT-LTE/4G (EU/US) IE-SR-6GT-LAN IE-SR-6GT-LTE/4G (EU/US) IE-SR-2GT-LTE/4G-EU-M IE-SR-2GT-LAN-M Manual Version 2.0.4 March 2020 Important notes: This document will be updated continuously. This version refers to Router firmware version 3.5.0 and above. This document, new firmware or additional product information can be downloaded using following link: http://www.weidmueller.
Industrial Security Router / Firewall Manual The software described in this manual is furnished under a license agreement and may be used only in accordance with the terms of that agreement. Copyright Notice Copyright 2020 Weidmüller Interface GmbH & Co. KG All rights reserved. Reproduction without permission is prohibited. Disclaimer Information in this document is subject to change without notice and does not represent a commitment on the part of Weidmüller.
Table of Contents INDUSTRIAL SECURITY ROUTER / FIREWALL ............................................................................................................... 1 1. INTRODUCTION................................................................................................................................................... 5 1.1 Proper and intended usage............................................................................................................................. 5 1.
.2.6 Configuration → Access Control .................................................................................................................43 Access Control → User accounts ...................................................................................................................................... 43 Access Control → Permissions..........................................................................................................................................
1. Introduction 1.1 Proper and intended usage The Router is intended for use in industrial (IP20) environments. It is equipped with Ethernet interface ports and is used solely for connecting components within a network. By connecting network components, the Router enables network nodes to exchange data between the LAN and WAN port. By connecting an external DSL modem (via PPPoE) at WAN the Router can provide a direct connection to the Internet.
Caution - This device is designed only for an operating voltage range from 7 to 36 V DC. Do not use a higher voltage; this could destroy the Router and other devices. - The Security Router does not have an on/off switch. The operating voltage must be switched on by the facility in which the device is integrated.
1.4 Mounting the device Caution - This device is designed only for an operating voltage range from +7 to 36 VDC. Do not use a higher voltage; this could destroy the Router and other devices. - Connecting plugs should never be connected or disconnected from electrical devices if they are carrying a live load. Be sure to first disconnect all poles of the plug. Remember to disconnect all plugs from the Router before it is installed or removed.
1.5 Technical data Operation mode • IP-Router • • • • IP-Router (extended)* • • 2-Port-Variants: IPv4-Routing between the interfaces (LAN port / WAN port / optional 4G modem). 6-Port-Variants: IPv4-Routing between LAN ports (group), WAN ports (group) and 4G modem (optional). LAN-Ports 1..4 and WAN-Ports 1..2 behave each as an unmanaged switch. Static or dynamic routing according to RIPv2 or OSPF protocol. Each RJ45 port can be configured individually as an IPv4 network.
Configuration Management • • • • • • • Configuration with web interface (HTTP/HTTPS) Web interface selectable in English or German language Configuration support through wizard Configuration support through detailed help information (tooltip) Configurable Multi-user access with definable rights Support for SNMP v1/v3/v3 Event log / syslog Other features Modbus/TCP (Slave mode) The integrated Modbus/TCP Slave provides control functions sent by a Modbus/TCP master.
Technical data (housing) Housing • Metal, protection IP20 Mounting • TS35 (DIN rail) Figure 1: Dimensional drawings (cm) of 2-Port models Figure 2: Dimensional drawings (cm) of 6-Port models Version 2.
Environmental conditions Operating Temperature • -20°C to +70°C Storage Temperature • -20°C to + 85°C Ambient Humidity • 5 to 90% non-condensing DSL and 4G/LTE DSL • DSL Internet access by connecting to an external DSL modem via LAN or WAN port • Free configuration of the PPPoE login DynDNS • Support for automatic DNS registration (DynDNS.
• IEC 60945, DNVGL sec.
2. Hardware related functional descriptions 2.
2.2 Interfaces of 2-Port models Description of device interfaces at top and front side Connectors for LTE/4G antennas at top side; Connector type: SMA female (Only model IE-SR-6GT-LTE/4G) USB 2.
Description of device interfaces at rear side for 2-Port models SCM slot / socket SIM memory card reader for external backup and restore of the Router configuration Connectors for LTE/4G antenna of type SMA female (only 4G/LTE models). 2 x SMA connectors, MAIN and AUX (AUX = Diversity / MIMO) External antennas: 4G slot / socket EMEA/Australia - Operating bands - Ant.
2.
Pin assignment of Smartcard Reader (ISO 7816 Standard) The integrated SIM card reader is intended for saving and restoring the configuration data. Pin number SIGNAL NAME 1 VCC 5 Volt 2 RESET 3 CLOCK 4 n/c 5 GND 6 n/c 7 I/O 8 n/c Pin assignment serial interface COM (RS232)* The serial interface is used for digital data transmission. The RS232 interface can be connected by using a commercially available 9-pin SUB-D cable.
3. Initial start-up / Getting Started 3.1 Configuration of the Router by using an Internet browser Note The configuration of the device can be done either via LAN or WAN RJ45 ports. Connect the unit to a 24V DC (3-pin plug) power source. The corresponding plug is included. During the initial boot phase, the PWR LED is flashing. The Router is ready when the PWR LED is lit constantly (after about 30 seconds). Connect the Router to the Ethernet interface of a configuration PC using a RJ45 network cable.
2. Now the login prompt of the Router should appear for input User name and Password. Default values (factory settings) for Login: User name: admin Password: Detmold Confirm your input by pressing the Log in button. Now the Router homepage is displayed. This page corresponds to the menu item "Diagnostics → System State." On this page the most important configuration and status information are summarized.
3.3 Default factory settings of the Router: Note Some fields are linked with a hyperlink to jump directly into the corresponding menu item. Language English Operation Mode IP Router IP address LAN Port(s) 192.168.1.110 (static value) Subnet Mask 255.255.255.0 NAT (Masquerading) on LAN Port Not activated IP address WAN Port 2-Port variants: 192.168.2.110 (static value) 6-Port variants: DHCP Subnet Mask 255.255.255.
3.5 Using the Weidmüller Router-Search-Utility The software tool Weidmüller Router-Search-Utility can be used to find Weidmüller Routers and detect their IP addresses within a switched network. This software is very helpful if you don’t know the current IP address of a Router. This can e.g. happen in cases that you have forgotten the current IP configuration, or you have lost the Router access in case of configuring an unintended IP address.
3.
4. Web Configuration 4.1 Section Diagnostics 4.1.1 Diagnostics → System State Menu Diagnostics → System State Function Startup screen of the web interface after login. Displays current configuration and status data. System name Name of the device, default “-” Device type Article Name Serial No.
4.1.2 Diagnostics → Event Log (Tab State) Menu Diagnostics → Event Log →Tab State Function Display events and error messages that have occurred in chronological order. Message syntax: : Message 4.1.3 Diagnostics → Event Log (Tab Configuration) Menu Diagnostics → Event Log →Tab Configuration Function Event and error messages can be sent to a syslog server (PC on the network) or sent as emails.
4.1.4 Diagnostics → WAN Menu Diagnostics → WAN Function Displays the current status of the WAN ports Diagnose the WAN-port. At the 6-Port routers in extended router mode you can choose the WAN interface via the tabs (WAN-1 and WAN-2) at the top of the web interface. 4.1.5 Diagnostics → LAN Menu Diagnostics → LAN Function Displays the current status of the LAN ports. Diagnose the LAN-port.
4.1.6 Diagnostics → 4G Menu Diagnostics → 4G Function Displays the current status of the 4G mobile connection. Menu available for IE-SR-2GT-LTE/4G and IE-SR-6GT-LTE/4G only. Reload Refreshes the page with actual values (Re)Connect (Re)establishes the 4G connection. Network Scan Performs a scan of networks available Version 2.
Network Scan A network scan shows available networks. It can be used to determine a fitting network for the place of installation.
4.1.7 Diagnostics → Ping test Menu Diagnostics → Ping test Function Allows sending of ICMP packets (ping) to test network connections between the Router and other Ethernet devices. To test internet connection, to use u-link Remote Access Service for example, try to ping a well-known internet IP address like 8.8.8.8, the DNS server of google. To test if your DNSserver is working use a hostname such as www.google.com Example of result of a ping test: Version 2.
4.1.8 Diagnostics → Remote capture Menu Diagnostics → Remote capture Function By using the "remote capture" function data packets on both the LAN and the WAN port of the Router can be recorded for diagnostic purposes. The receiver of the diagnostic data is a PC/Server which must have installed the tool "Wireshark" listening on Port 2002. How to use please refer to application note in Appendix A.
4.2 Section Configuration 4.2.1 Configuration → IP Configuration IP Configuration → Operational mode “IP Router” Screenshot shows factory default operation mode ‘IP Router’. At factory default all 2-Port Routers do have configured static IP 192.168.2.110 at WAN port. At factory default all 6-Port Routers do have configured the DHCP mode for getting an IP address. At factory default all Router variants do have configured static IP 192.168.1.110 at LAN port.
Menu Configuration → IP configuration Function This is the main configuration window for setting the operating mode and the network configuration (Assignment of IP data on LAN / WAN ports and optional 4G interface). Operational mode Transparent bridge: The device is acting like a layer 2 bridge and is transparent within a switched network. All Ethernet ports (LAN and WAN) behave like a common unmanaged Ethernet Switch. Only 1 IP address will be configured for accessing the web interface.
NAT (Masquerading) Enable network address translation (NAT) on this interface. Any outgoing traffic, it’s source address will be replaced with the IP address of this interface. NAT is always activated for 4G modem. Gateway via 4G If activated as soon as mobile connection is active (Online) it will be used as the Router’s default gateway. Preferred Network Mode Select a network mode which will be used automatically when connection is sufficient.
IP Configuration → Operational mode “IP Router (Extended)” The extended routing mode is only available for 6-Port Router variants. Each interface (LAN 1…4, WAN 1..2, optional 4G modem) can be configured as individual IP network (Static, DHCP, DHCP + fallback or PPPoE). When using this mode then generally each router function (Firewall, Forwarding, NAT, etc.) can be applied to each interface same as it can be done to the standard LAN/WAN ports of a 2-Port Router.
IP Configuration → Operational mode “Transparent bridge” In operation mode ‘Transparent bridge’ the device is acting like a layer 2 bridge and is invisible to clients. All Ethernet ports (LAN and WAN) behave like a common unmanaged Ethernet Switch. Only 1 IP address will be configured for accessing the web interface independent of the Ethernet port to which the configuration PC is connected.
4.2.2 Configuration → SecureNow! (Learning Firewall) Menu Configuration → SecureNow! Function This is an auxiliary function for "independent learning" firewall rules based on temporary recording of data traffic. Depending on your model and operation mode you can choose the security levels for each group of interfaces.
Screenshot of a started traffic analysis: Menu Configuration → SecureNow! (started analysis) Function By pressing the button "Start Analysis" the Router begins to analyze the network traffic (ports LAN, WAN and opt. LTE/4G) until “Stop Analysis” is triggered.
4.2.3 Configuration → Packet filter (Firewall) Packet filter → Tab Layer 3 Menu Configuration → Packet filter → Tab „Layer 3” Function This is the window for the manual configuration of firewall filter rules based on Layer 3 (IP layer). The screenshot shows the firewall settings as delivered with the default rule "Allow_L3*". This rule says that any IP protocol (*) and any traffic regardless the direction (source and destination=*) is allowed.
Packet filter → Tab Status Menu Configuration → Packet filter → Tab „Status“ Function Overview of transmit and receive activities of the physical and virtual interfaces. 4.2.4 Configuration → Cut & Alarm Cut & Alarm → Tab Configuration Menu Configuration → Cut & Alarm → Tab „Configuration“ Function In this menu, it can be configured how the events "Cut" and "Alarm" - after they have been triggered – will be reset.
Cut & Alarm → Tab State Menu Configuration → Cut & Alarm → Tab „State“ Function Displays the current status of the events "Internal Cut" → triggered by a special firewall rule "External Cut" → Input of 24 VDC at 4-pin connector (at front side of the Router) "Alarm" → triggered by a special firewall rule or by the function „Client monitoring“ With „Reset Cut Signal“ and „Reset Alarm Signal“ you can manually reset the events „Internal Cut“ and „Alarm“.
General settings → Date & Time Date & Time → Tab Configuration Menu Configuration → General settings → Date & time Function Setting of date, time and time zone. Alternatively, the date/time setting can be configured using the "Network Time Protocol" NTP and accessing an external NTP server. When NTP time server relay is activated, the device will be act as a NTP time server for other services. Note The Router has no battery-buffered, but a capacity-buffered system clock.
General settings → User Interface Configuration → General settings → User interface Menu Function Language Setting the language (German or English) of the Web interface. Save and apply: • Apply immediately and do not save Changes will be immediately activated but not saved. The new activated changes have to be saved explicitly in menu System → Save. • Save only and do not apply Using this mode all changes will only be saved but not activated. The changes come into effect after a restart.
General settings → SCEP (Tab Configuration) Menu Configuration → General settings → SCEP Function Configuration of the Router for online access to certificates which are stored on a centralized online certificate server (SCEP Simple Certification Enrollment Protocol). When setting up certificate-based VPN connections, the necessary certificates can be obtained directly from a SCEP server. Server URL e.g. http://192.168.1.1/certsrv/mscep.
4.2.6 Configuration → Access Control Access Control → User accounts Menu Configuration → Access control → User accounts Function Create and delete other user accounts Note: The Administrator account always has full access. It cannot be deleted. Access Control → Permissions Menu Configuration → Access control → Permissions Function Detailed assignment of individual rights for each created user account. Note: The Administrator account always has full access. It cannot be changed or deleted.
Access Control → Web access Menu Configuration → Access control → Web access Function Select the possible access modes of the web interface (via http and / or https) for the different interfaces. For cellular models additional checkboxes named „4G“ will be displayed to control access to the Web interface via 4G connection. In extended routing mode or if VPN is used, all interfaces will be displayed if they represent different subnets. 4.2.
If the interface for accessing the Internet (e.g. WAN port) is configured statically then you must configure at least one accessible DNS server for resolving DNS names (e.g Google’s name server with IP 8.8.8.8). st nd 1 , 2 , 3rd DNS server If the Interface for Internet access is set to DHCP then typically the DNS server will be retrieved from DHCP server. In this case you do not need to enter the IP address of a DNS server.
Network → IP Routing (Tab Configuration) Menu Configuration → Network → IP Routing → Tab „Configuration“ Function Registration of static IP routes and activating/deactivating of dynamic routing. For dynamic routing, both can be selected the RIP and the OSPF protocol. Please note that dynamic routing can be set per interface. Cellular routers, or routers in extended routing mode, will have more interfaces to define dynamic routing. Up to 20 static IP routes can be configured.
Displays all configured static routes Static Routing Routing Table Static routing forwards IP packets belonging to the specified network to the given gateway. The network is defined by an IP address and a subnet mask, which tells how many bits counted from the left are fixed. For example, IP 192.168.5.0 and subnet mask 24 means, that any IP of the format 192.168.5.xxx belongs to the network (3 bytes = 3 * 8 bit = 24 bits). Another example is 192.168.0.0 and subnet mask 16. Any IP of the format 192.168.
Network → IP Routing (Tab State) Use this menu for checking the Router’s current routing table. Menu Configuration → Network → IP Routing → Tab „State“ Function Displays currently valid routing table. The line with text “default via….
Note: If the Router - for Internet access - has to pass the corporate Router/Firewall and Security systems (controlled by company IT) then often the configuration of a HTTP proxy is necessary. In those cases, please ask the responsible IT department for parameters and credentials for proxy settings. Network → Forwarding Screenshot shows 3 defined Forwardings. Current Router IP settings: LAN IP 192.168.1.110 / 24, WAN IP 192.168.99.
Local IP Enter a free available IP address which will behave as an additional (virtual) IP address of the selected “Public Interface” (mostly WAN). In case of physical interfaces this address is most likely one of the public interface range. In case of OpenVPN or IPsec interfaces it should be one of the VPN address range. The device will take this additional IP address as its own and will forward the traffic - addressed to this IP – to defined Target IP. This option cannot be used on 4G or DSL links.
Network → 1:1 NAT Menu Configuration → Network → 1:1 NAT Function With 1:1 NAT you can map a private subnet to the public subnet defined in the IP configuration. This allows you to resolve conflicts between identical networks. E.g. if all LAN ports in extended IP routing mode are connected to equal subnets, they can be accessed uniquely via the public subnet without the need for changing any configuration of the private subnets. 1:1 NAT can be configured for all active (physical and virtual) interfaces.
Network → Network Groups Menu Configuration → Network → Network groups Function Creating groups with "speaking" names for ranges of IP addresses (Layer 3). A network group always contains a range of IP addresses with specified subnet (e.g. 192.168.1.0/24). A network group can contain a set of single IP addresses and complete IP address ranges. Network groups can be used instead of IP address ranges if you will create firewall filtering rules (See menu Configuration → Packet filters → Layer 3).
Menu Configuration → Network → Hardware groups Function Creating groups with "speaking" names based on MAC addresses (layer 2). A hardware group can contain any number of MAC addresses (for example, 00:15:7E:D9:09:00). Hardware groups can be used for better readability than individual MAC addresses if you will create firewall filtering rules (See menu Configuration → 4.2.3 Configuration → Packet filter (Firewall→ Layer 2).
4.2.8 Configuration → VPN VPN → u-link (Tab Configuration) Menu Configuration → VPN → u-link → Tab “Configuration” Enable u-link instance Enables the routers connectivity service to be used for the Weidmüller u-link Remote Access Service. Initiation by digital input (VPN initiate): Allows/Denies to establish a VPN connection to the u-link platform by setting 24 VDC on digital input “VPN initiate”.
VPN→ u-link (Tab State) Menu Configuration → VPN → u-link → Tab “State” Function Displays u-link Remote Access Service status. Status Registration u-link portal “registered” or “not registered” WWH communication The World-Wide Heartbeat (WWH) is a https connection to the u-link platform which submits status information. The WWH normally refreshes every 170 seconds. If WWH communication is not possible the router may not have an internet connection.
VPN→ u-link (Tab Registration) Menu Configuration → VPN → u-link → Tab “Registration” Function Register or unregister the device at the u-link platform. For this an internet connection of the device is necessary. To register, type in the unique Router Activation code generated in the u-link portal (https://u-link.weidmueller.com ) by adding a new router-item or the code of a previously used router-item in section Administration → Device management.
Function The OpenVPN menu allows to create and establish virtual private network connections based on the Open-VPN implementation. The Router can be configured both as OpenVPN client and OpenVPN server either based on Layer 2 (Bridging) or on Layer 3 (Routing). A maximum of 10 OpenVPN connections (either as client or as server) can be configured and started at the same time. Each VPN connection can be configured individually at Tab’s VPN1…VPN10.
The OpenVPN interface may operate on two different layers: Layer Ethernet Layer (Layer 2), i.e. will be bridged with >LAN (interface)< IP Layer (Layer 3) with its own IP address which must be configured on the IP configuration page. OpenVPN device type L3 interfaces can either be run as TUN or TAP devices. The letter is default on the device type. TUN connections will always use the OpenVPN topology subnet.
VPN→ OpenVPN (Tab State) Menu Configuration → VPN → OpenVPN → Tab „State“ Function Displays the status of configured and activated OpenVPN instances (1…10) and whether they are connected or disconnected VPN→ IPsec (Tab Configuration) Menu Configuration → VPN → IPsec → Tab „Configuration“ Function The IPsec menu allows to create and establish virtual private network connections based on the standard IPsec implementation. The Router can be configured both as IPsec client and IPsec server.
Enable NAT traversal NAT traversal is required when a router between the local and remote side does Network Address Translation (NAT) Note: IPsec pass through will break NAT traversal! If your router supports it, you must disable IPsec pass through! Limit MTU NAT traversal requires encapsulation of IP packets which possibly increases fragmentation leading to less network performance. If this happens it may help to slightly reduce the size of outgoing packets (MTU).
None: Will log no messages through the Event Log Log level Info: Log only some information and critical errors Debug: Log state information too Verbose: Log all possible messages VPN LED/output controller The selected device controls the state of the VPN LED and of the digital VPN output.
The peer will identify (not authenticate) itself with this ID depending on the chose authentication method. PSK: If no remote id is given the IP address of the remote site is checked. Entering the IP address is not the same as leaving the field empty! The remote ID must not contain blanks. Remote ID Certificate: The complete certificate info of the peer must be specified. In case of another Weidmüller Security Router you can copy and paste the certificate info (C=… ST=… ) from its certificates page.
4.2.9 Configuration → Services Services → DHCP Server (Tab Configuration) Menu Configuration → Services → DHCP Server → Tab “Configuration” Function In operating mode "IP Router", the built-in DHCP server can be used for allocating IP addresses on both LAN-side and WAN side. By default, the DHCP server is switched off. Activate DHCP server Enables the DHCP service. The device will answer to DHCP requests on the selected interfaces with the supplied IP address range and name server configuration.
Services → DHCP Server (Tab State) Menu Configuration → Services → DHCP Server → Tab “Status” Function Displays all DHCP clients of the device Services → Dynamic DNS Menu Configuration → Services → Dynamic DNS Function This feature allows the Router - if connected to the Internet using dynamic IP address allocation - to be accessed by a „speaking“-name via the public Dynamic DNS service of provider „DynDNS.org“. User name Username registered on http://www.dyndns.org service.
Services → Web server Menu Configuration → Services → Web server Function Via this menu item the access protocol to the Web interface (http or https) can be configured. Services → SNMP Menu Configuration → Services → SNMP Function Activation / deactivation of the SNMP protocol (Simple Network Management Protocol). Versions v1/v2/v3 are supported. Router data can be requested using Standard MIB-II. SNMPv1/v2 Use SNMPv1 or SNMPv2 protocol specifications.
Community IP Restricted access with the given community name to the following IPAddress. Use 0.0.0.0 for any source. Community network mask Network mask for the IP given above. Use 32 for a single host or 24 for a classic class C network. User name SNMPv3 only: Username for SNMPv3. More than 4 alphanumerical characters are required. Password SNMPv3 only: Password for SNMPv3. Authentication Protocol: MD5. More than 8 alphanumerical characters are required.
General information about implemented ModbusTCP functionality: 1. ModbusTCP server is running as a ModbusTCP slave. 2. Via the ModbusTCP protocol only following settings and status requests can be done: - Monitor, start and stop pre-defined VPN connections (IPsec, OpenVPN, u-link) - Acknowledge/Reset of CUT& ALARM 3. The server port can be selected freely. If no port is specified, the default port for ModbusTCP (502) waits for incoming requests. 4.
Status registers: 0x10 0x11 0x12 0x13 0x14 0x15 …. 0x1D 0x1E 0x20 0x21 0x22 0x23 0x24 0x25 …. 0x2D 0x2E Status registers: Status registers: CUT&ALARM Not used reserved IPsec OpenVPN1 OpenVPN2 … OpenVPN10 u-link VPN CUT&ALARM Not used reserved IPsec OpenVPN1 OpenVPN2 … OpenVPN10 u-link VPN Read-only and cannot be written. The content is similar for all connection-specific status registers contains information indicating whether the connection is defined at all, i.e.
Registers IPsec 0x13 (Status) Read-Only 0x23 (Set) Read/Write Bits Meaning Explanation 0 IPSec defined At least one connection is defined 1 Activated IPsec generally is activated (Enabled) 2 Connected At least one tunnel is established 3-7 Not used 8-15 Active tunnel Number of currently established IPsec tunnels This register can be written either with values: 0x0000 Deactivate all defined IPsec connections 0x0001 Activate all defined IPsec connections Registers OpenVPN OpenVPN-1 0x14 (Status) 0x24 (S
Services → Client Monitoring Menu Configuration → Services → Client Monitoring Function Allows the monitoring (still alive?) of network devices via a cyclic query using the ICMP protocol (ping request). As an action if a monitored Ethernet device is no longer available an „Alarm“ or „Cut“ event can be triggered. Additionally, the connection to a mail server and a target mail address can be configured to send the information about a lost connection of a monitored device by mail.
Services → SMS Service Menu Configuration → Services → SMS Service Functions Router sends information via SMS messages (output). Router can be controlled via SMS messages (input). Menu available for IE-SR-2GT-LTE/4G and IE-SR-6GT-LTE/4G only. Enable SMS service Enables or disables generally the use of text messages for control functions (SMS input) and sending information (SMS output).
Reboot Allows/denies a device reboot via SMS command. Commands: #password?reboot or ?reboot if no password is set. Note: For feedback about a successful reboot please activate SMS trap “Send SMS after power up / reboot”. Establish/Cancel mobile network connection Allows/denies establishing or cancel the Internet connection of the mobile interface via SMS command. Commands: #password?MobileConnection=on/off or ?MobileConnection=on/off if no password is set.
Trap: Send this message when digital output (Alarm) changes to "On". If enabled the message : will be sent to the defined mobile numbers 1-3 after changing of digital output (Alarm) to ON. Trap: Send this message when digital output (Alarm) changes to "OFF". If enabled the message : will be sent to the fined mobile numbers 1-3 after changing of digital output (Alarm) to OFF.
4.2.10 Configuration → Prioritization Prioritization → LAN Screenshot shows LAN-related Prioritization menu of a 6-Port Router having in extended routing mode 4 LAN interfaces (LAN1…4) Menu Configuration → Prioritization → LAN Function With this feature, outgoing traffic on the LAN interfaces can be classified and prioritized. The prioritization ("traffic shaping") can be configured on both Layer 2 (based on MAC addresses) and at Layer 3 (IP addresses and protocols).
Guaranteed bandwidth available to this class, independent of priority. If greater than the interface bitrate limit, it is reduced to the interface limit internally. Bitrate Note: In addition to the minimum rate defined here, a class may lend bandwidth from other classes. If you want this value to be the maximum bitrate for a class. Make sure that the sum of all classes bitrates is one plus the bandwidth of the interface as defined above.
Prioritization → LAN Screenshot shows LAN-related Prioritization menu of a 6-Port Router having in extended routing mode 2 WAN interfaces (WAN1…2) Menu Configuration → Prioritization → WAN Function With this feature, outgoing traffic on the WAN interface can be classified and prioritized. The prioritization ("traffic shaping") can be configured on both Layer 2 (based on MAC addresses) and at Layer 3 (IP addresses and protocols).
4.3 Section System 4.3.1 System → Backup settings Menu System → Backup settings Function With this menu item, the Router configuration can be stored or restored to/from the file system of the connected computer. The exported configuration file is of extension type .cf2 and encrypted. Note For creating a configuration backup file (.cf2) always the configuration currently stored in the Flash memory will be used. Please save the configuration to Flash memory before creating a backup file. 4.3.
Update the device with a firmware from a remote HTTP/FTP/TFTP server. Update protocol: Protocol of the remote server which will serve the firmware file. FTP is only supported by using anonymous user. You can choose between HTTP, FTP and TFTP. Specify update from firmware server Server address: HTTP/FTP/TFTP server address. Valid values are hostnames and IP addresses optionally combined with a port number i.e. 192.168.0.1:8080 or ftp.fw-server.net.
4.3.4 System → Save Menu System → Save Function Save the configuration into flash memory of the device. If a SIM memory card is inserted in the memory card slot (SCM) at the rear side of the router, then additionally the device configuration will be stored on the SIM memory card. Note This icon (disk symbol) starts flashing if the configuration has been changed and activated but not saved.
4.4 Section Information 4.4.1 Information → General Menu Information → General Function Displays information about Weidmüller and the device. 4.4.2 Information → Sitemap Menu Information → Sitemap Function Displays the sitemap of the user interface and includes links to the menus Version 2.
5. Appendix A (Configuration examples) A1 – Restore configuration from USB stick This chapter describes how to restore a configuration from a backup file (*.cf2) via the USB port. How to do: 1. 2. 3. 4. Copy the cf2-backup file to an USB stick (FAT or FAT32) into directory named settings. Plug USB stick into the Router and power-up / reboot the device (Router automatically will load the cf2-file).
Important note if you will use this method for replacement of an already registered u-link Router! Before replacing a registered u-link Router by another Router (e.g. in case of a defective device) you need to release the assigned activation code for additional activation. Do following steps before restoring the new Router with a backup file via USB stick. Step 1: Login (as administrator or user) into the u-link web portal. Step 2: Open menu Administration → Device Management.
A2 – Basic Router configuration to connect 2 networks with different IP address ranges Application requirements: There are 2 industrial Ethernet networks which shall be connected by the Router. Each network has its own IP address range. Each Ethernet node of both networks shall have the possibility to communicate with each other. This application can be done with all router models. No special firewall filter rules shall be configured. In this example the IP address ranges are set to 192.168.10.0 / 255.255.
How to configure the Router The Router is set to factory default values and can be accessed using the LAN port by IP address 192.168.1.110. 1. Connect the configuration PC to Router LAN Port. Note: Use auto-negotiation on the Ethernet Interface of the PC 2. Change the IP address of the PC to one of the range 192.168.1.0 / 24 e.g. IP address 192.168.1.99 Subnet mask 255.255.255.0 Standard gateway can be left blank due to direct cable connection 3.
Now the configured parameters will be activated (but not saved). After a few seconds the web interface displays the new IP addresses as shown below. Please keep in mind that you now have lost the Router connection due to changing the IP address range of your connected LAN port. 5. Change the IP address of the configuration PC according to the connected network 192.168.10.0 / 24 ► To reconnect to the Router now set the IP address of the PC to the new values IP address: 192.168.10.99 Subnet mask: 255.255.
Now the configuration of the Router is finished! Testing the accessibility between Ethernet Devices of both networks 1. Run 3 Ping commands from a device of Ethernet network 1 (192.168.10.0/24) using below described addresses (members of network 2) → ping 192.168.20.100 → ping 192.168.20.101 → ping 192.168.20.102 Result: All sent “pings” should be answered by the requested IP addresses correctly. 2. Run 3 Ping commands from a device of Ethernet network 2 (192.168.20.
A3 - Connecting 2 Ethernet networks with activated NAT masquerading and using IP address forwarding Application requirements: There are 2 industrial Ethernet networks which are connected by the Router. Each network has its own IP address range. For security reasons the IP addresses of network 1 shall be hidden against devices of network 2. As an exception 2 devices (C and D) of network 1 should be accessible directly from devices of network 2. This application can be done with all router models.
Network diagram of below described application scenario How to configure the Router Starting situation The Router is set with factory default values and can be accessed either using the LAN port by IP address 192.168.1.110 or using the WAN port by IP address 192.168.2.110. 1. Connect the configuration PC to the Router using the LAN Port (this port will be used in the example). Note: Use autonegotiation on the Ethernet Interface of the PC 2. Change the IP address of the PC to one of the range 192.168.1.
Operational mode: IP Router IP address parameters WAN Port: Static 192.168.20.254 255.255.255.0 (Class C) NAT (masquerading) SET IP address parameters LAN Port: Static 192.168.10.254 255.255.255.0 (Class C) NAT (masquerading) NOT SET Default gateway Can be left blank because there exists no further target network ► Click button “Apply settings” to activate the new settings. Now the configured parameters will be activated (but not saved).
Figure 3: Empty IP forwarding table ► Click icon + to add a new line to enter IP forwarding values ► Select or fill the values as shown in the upper entry of Figure 4 → Ensure that each input will be completed by clicking the icon .
Testing the configured IP address forwarding 1. Run a “ping” request from a device of Ethernet network 2 (e.g. 192.168.20.100) with destination dress 192.168.20.202 (Note: Real IP address is 192.168.10.102) ad- Result: The sent “ping” request should be answered correctly (displayed return address: 192.168.20.202) 2. Run a “ping” request from a device of Ethernet network 2 (e.g. 192.168.20.100) with destination address 192.168.20.203 (Note: Real IP address is 192.168.10.
A4 - Configuring the Router to connect 2 networks with different IP address ranges and additional firewall rules Application requirements: There are 2 industrial Ethernet networks which are connected by a Router. Each network has its own IP address range. All Ethernet nodes in both networks shall have the possibility to communicate with each other except that devices B and C of network 1 cannot be accessed by a ping request (ICMP protocol). This application can be done with all router models.
How to configure the Router Starting situation The Router is set to factory default values and can be accessed either using the LAN port by IP address 192.168.1.110 or using the WAN port by using the Router Search Utility. 1. Connect the configuration PC to the Router using the LAN Port (this port will be used in the example). Note: Use autonegotiation on the Ethernet Interface of the PC 2. Change the IP address of the PC to one of the range 192.168.1.0 / 24 → e.g. IP address 192.168.1.
► Again login into the Web interface of the Router using a Web browser Use IP address 192.168.10.254 (http://192.10.1.254) on LAN port User: admin Password: Detmold 6. Step-by-step description of creating a new packet filter (firewall rules) to prohibit ping requests from devices of network 2 to devices B and C of network 1 General description of the Packet filter The feature „Packet filter“ can be used to create firewall rules for IP address (Layer 3) and MAC address level ( Layer 2).
Figure 6: Create a new rule-set Figure 7: Define additional parameters of the new rule-set Completing the rule-set which will be used as container for a maximum of 10 rules. The inbound and Outbound interface-rules will be applied before all other rules of this rule-set. The available in- and outbound interfaces are depending on router model, operation mode and active virtual interfaces.
Figure 9: Define additional parameters of the first rule Figure 10: Define influence of other signals on the packet filter To allow ping messages via VPN there could be a rule which allows ICMP packages if VPN Key is turned and/or VPN tunnel is up. Figure 11: Action and name of the rule Version 2.
Figure 12: Creation of first rule completed Figure 13: Description of the rule-set Figure 14: Time limitations on filter rule-sets Set time and date limitations for the rule-set. Version 2.
Figure 15: Overview of Packet filter rules New rule-sets will be generated at the bottom of the list by default. The rule-sets are displayed in hierarchical order. To get the new rule effective, it must be at the top of the list. In default mode, the “Allow_L3” would overrule the “Block_Ping”. Now the firewall configuration (packet filter) is finished! Testing the result that Ethernet Devices B (192.168.10.101) and C (192.168.10.
A5 – Firewall application example: Securing the access to Modbus TCP devices by Layer-2 firewall rules Task: The communication between Modbus Master devices and Modbus slave devices inside of the same switched network shall be controlled and secured by Firewall rules. The Router shall act as a Layer-2 firewall (controlling MAC-based Ethernet frames) and being transparent for the devices inside of the switched network. Figure 16: Example network topology Communication requirements / restrictions: 1.
A5-1 Configuration of initial parameters ►Goto menu Configuration → IP configuration Figure 18: IP configuration factory defaults ►Change operational mode to “Transparent bridge”. • Router is now working in bridging mode on Layer 2 (Ethernet frames / MAC address based). ►Change LAN IP address as desired (in bridging mode only needed for Web access). • In this example we use 192.168.99.178. • If the Router shall be accessed also from another IP network please configure the default gateway.
Figure 20: New System name Configuration of an access to a DNS server (Optional step) ►Goto menu Configuration → Network → DNS. ►Enter at least one DNS server if you want to get/update the Router’s time via a NTP request (e.g. typically gateway IP or Google’s DNS server 8.8.8.8). ►Click “Apply Settings”. Figure 21: First DNS server (or DNS server relay) is 192.168.99.1 Configuration of date / time settings (Optional step) ►Goto menu Configuration → General Settings → Date & Time. ►Select your time zone.
Figure 22: Date & Time settings ►Change to tab “State” to check if an NTP server could be accessed. Figure 23: Tab “State” – showing NTP server statistics Version 2.
A5-2 Configuration of the packet filter (Firewall) 1. General information about behavior and settings of the packet filter settings If the traffic (Layer 2: Ethernet frames, Layer 3: IP packets) is passing the Router from one interface (e.g. LAN, WAN, 4G) to any other then the firewall checks the data packets according to the defined rules / rulesets in the order from top to down.
2. Configuring the packet filter (firewall) according to the above mentioned “Communication requirements” Note: Since the Router is running in mode “Transparent bridge” we only need to configure new rules on tab “Layer 2”. 2. 1 Configuration of a rule-set containing one rule to allow Modbus TCP (protocol TCP and port 502) traffic initiated from WAN port to LAN port. ►Go to menu Configuration → Packet filter. ►Select Tab “Layer 2”. ►Click ‘+’ icon to add a new rule set.
►Now define the criteria for investigating an IPv4 packet (check for Modbus communication = TCP/502) . Note: Use always wild character * for source port because it will be created dynamically by the sender (to be used for unique re-addressing of an answer packet by a recipient). ►Click ‘Next’. ►Select ‘Auto’ for Connection control (Packet filter acts as a stateful inspection firewall and recognizes/allows automatically an answer based on an initiated request). ►Click ‘Next’. ►No signal check and setting.
►Click Next to finish this rule-set (containing 1 rule). Now the new rule-set Modbus_L2 is displayed in the Layer-2 filter list. Figure 11: Layer-2 filter list containing new rule-set “Modbus_L2” As next steps we configure all other necessary firewall settings. After that we will organize all rule-sets in the order (from top to down) and will apply the settings. 2.
►Enter wild character * for source and destination MAC addresses. ►Select protocol IPv4 to be checked inside of the passing Ethernet frames. ►Click Next. ►Now define the criteria for investigating an IPv4 packet (check for PTP communication UDP/319). Note: Use always wild character * for source port because it will be created dynamically by the sender (to be used for unique re-addressing of an answer packet by a recipient). ►Click ‘Next’. ►Select auto for Connection control.
►Enter wild character * for source and destination MAC addresses ►Select protocol IPv4 to be checked inside of the passing Ethernet frames. ►Click ‘Next’. ►Now define the criteria for investigating an IPv4 packet (check for PTP communication UDP/320). Note: Use always wild character * for source port because it will be created dynamically by the sender (to be used for unique re-addressing of an answer packet by a recipient). ►Click ‘Next’. ►Select auto for Connection control.
►Enter the description text. ►Click ‘Next’. The rule-set is prepared. ►Click ‘Close’. Figure 12: Layer-2 filter list containing new rule-set “PTP_L2” 2.3 Configuration of a rule-set containing 1 rule which allows any NTP communication (network time protocol) initiated from devices connected at LAN port (Protocol UDP / Port 123). ►Click ‘+’ icon to add a new rule-set. ►Add a name for the new rule-set (here NTP_L2). ►Click ‘Next’. ►Select inbound and outbound interface. ►Click ‘Add’ to add a new rule.
►Enter wild character * for source and destination MAC addresses ►Select protocol IPv4 to be checked inside of the passing Ethernet frames. ►Click ‘Next’. ►Define the criteria for investigating an IPv4 packet (check for NTP communication UDP/123) Note: Use always wild character * for source port because it will be created dynamically by the sender (to be used for unique re-addressing of an answer packet by a recipient). ►Click ‘Next’. ►Select auto for Connection control.
►Enter the description text. ►Click ‘Next’. ►Click ‘Close’. Figure 27: Layer-2 filter list containing new rule-set “NTP_L2” Finally we have to remove the factory default rule-set “Allow_L2*” which allows each traffic to pass. ►Click the ‘trashcan’ button of row “Allow_L2*” to remove this rule-set. Now all necessary rules are defined. ►Click button “Apply settings” to activate the configured settings. Version 2.
Figure 28: Final list of Layer-2 filter Note: You do not need to configure a special “Block all” rule at the end of the filter list. If a data packet does not match any of these defined rules then it will be silently dropped (because of the “white list” behavior). A5-3 Save the configuration ►Goto menu System → Save. ►Click ‘Save settings’. Now the settings are saved in the flush memory. A5-4 Create a backup file of the configuration ►Goto menu System → Backup Settings.
A6 - Connecting 2 networks with same IP ranges to another network using 1:1 NAT and IP routing (extended) Application scenario: There are 2 machine networks and one upper-level production network. Both machine networks are connected to the production network by a 6-port Security Router in extended routing mode. The production network itself is connected to the corporate network via its own Router. Both machine networks have the same IP address range 192.168.1.
Short description how to solve the task by using 1:1 NAT: Router 1 must be connected by WAN port to the production network 172.16.1.0. The IP addresses of the WAN ports will be set to 172.16.1.253 / 255.255.0.0 The LAN ports of the Router is to be connected to their corresponding machine network. Due to the fact that each machine network uses the same IP address range each LAN port of the Routers is to be configured with 2 IP addresses, one as a public and one as private address.
connecting a further machine network to the production network. This would be automatically done by RIPor OSPF-based dynamic IP routing. → The alternative method using dynamic routing is described in chapter A7 - Using dynamic IP routing alternatively to manually configured static routes. Starting situation All Routers have the factory default configuration and can be accessed either using the LAN port by IP address 192.168.1.110 or using the WAN port and find the IP address with the Router Search Utility.
Configuration Router 2: Operational mode: IP Router IP address parameters WAN Port: Static 10.1.1.254 255.255.0.0 (Class B) NAT (masquerading) NOT SET IP address parameters LAN Port: Static 172.16.1.254 255.255.0.0 (Class C) NAT (masquerading) NOT SET Default gateway leave field empty (not necessary in this example) ► Click button “Apply settings” to activate the new settings. Now the configured parameters will be activated (but not saved).
Note: The private IP address 192.168.1.254 now is the new IP address of the Router from the perspective of connected devices at the LAN port. All devices connected to the LAN port must be configured in the private IP range 192.168.1.0 with subnet mask 255.255.255.0. The 1:1 NAT (address translation) is working in that way that every address of the private Class C network will be changed to the corresponding public address.
9. Saving the new configuration ► Select menu System → Save ► Click on button “Save settings” to save the current configuration to the non-volatile flash memory of the Router. If a SIM memory card is installed the configuration additionally will be stored on the SIM memory card. Additionally, the configuration can be stored on the file system of the PC.
A7 - Using dynamic IP routing alternatively to manually configured static routes (refers to example A6) Instead of configuring static routes on Router 2 it is more comfortable to use the “dynamic IP routing” feature to announce the routes of all Router network interfaces to each Router. For announcing the routing information the protocols RIP or OSPF can be used. Note If dynamic routing is activated but e.g.
Note 1. If there are several Routers with activated RIP but only the Routers 1 and 2 should exchange their routing tables, then you must use the same password for each Router. 2. You should always use the same value for “Type” on both ports (LAN and WAN). For example, if you leave Type=disabled on LAN port and you activate only the parameters Type=RIP and Active interface=set on WAN port, then the Router will not announce (outgoing WAN port) the configured network connected to its LAN port.
A8 - How to use feature “Remote Capture” with Wireshark to analyse Router’s LAN/WAN traffic The function “Remote Capture” can be used to record the traffic at Router’s LAN- or WAN port using a remote connected PC running Wireshark. The PC is located somewhere in the network and must be able to access one of the IP addresses of the Router. Step-by-step guidance 1.
4. Click button “Options” 5. Click button “Manage Interfaces” and change to tab “Remote Interfaces” 6. Click button “Add” Version 2.
7. Enter the IP address of the Router to field “Host” Note: You can enter either the IP address of LAN or WAN port. The import fact is that the Routers IP address is accessible by the Wireshark-PC. 8. Enter into field “Port” the value 2002 (will be filled automatically if you enter an IP address) 9. Click button OK Now both Interfaces of the Router (= Host 172.16.1.20) should be displayed. 10. Click button Close The “remote capture interfaces” will be displayed in the list of selectable interfaces.
In this example we want to capture the traffic at WAN port. 11. Double-Click the line rpcap//[172.16.1.20]:2002/WAN 12. Click button “Remote Settings” 13. Clear the checkbox “Do not capture own RPCAP traffic” 14. Click button “OK” 15. Again click button “OK” to close the window “Edit Interface Settings” Version 2.
16. Activate the checkbox in line rpcap//[172.16.1.20]:2002/WAN 17. Click button “Start” to record the traffic at Routers WAN port Version 2.
A9 - u-link Remote Access Service → VPN based connection to remote locations General: Weidmüller is providing the cloud-based ‘u-link Remote Access Service’ which can be used with all Weidmüller Router models having implemented VPN functionality. What is u-link? Web based Portal application for an easy and secure remote access. • Provides a central switching agency (VPN-Server / Meeting-Point) for the VPN client communication (Service PC → Router/Remote network).
Available u-link versions Entry Version • Can be used free of charge and timely unlimited. • Max. configuration of 50 Routers (Access point to remote network). • Unlimited configuration of user accounts (Service user). • All defined users belong to same group “Service group”. • All defined Routers are members of the same “Device container” and can be accessed from all Service users.
