weidmuller articles

Gigabit Industrial Security Router - Secure Data Communication With Integrated VPN Technology

Weidmuller 3/23/2018
Gigabit Industrial Security Router - Secure Data Communication With Integrated VPN TechnologyYou want to be able to communicate with your machinery and systems securely, reliably, and from anywhere? Should only verified data gain access to your industrial network? Then the new Industrial Security Router from Weidmüller is just the right choice.

Due to the steady increase in networking data and information in office-based communication, a strong trend has evolved where the advantages of Ethernet communication are progressively being used in the area of industrial automation technology.

As well as the standardisation provided by Ethernet technology, vertical data integration from the field/ production level across the office network to the Internet is an important driver for its rapid spread in industrial applications.

In addition to LAN switching technologies, we are seeing increased use of industrial routers for enhanced security and for efficient management of data traffic between LANs.

Routers with integrated VPN technologies are also ideally suited to secure remote access to components and systems in the LAN, via either a wired or wireless Internet connection.

Technical features of Weidmüller routers at a glance:

• Compact and robust industrial-grade metal housing (aluminium die casting)
• Gigabit Ethernet interfaces (LAN/WAN) for high data throughput
• Digital inputs/outputs (24 V DC) with functions for disconnecting WAN port, indicating alarm status, starting/stopping of pre-configured VPN connections and indicating active VPN tunnel
• Supports all standard router functions such as static/dynamic routing, SNMP, DHCP server, Dynamic DNS, event logging or DSL connection (PPPoE) via external DSL modem
• Flexibly configurable stateful inspection firewall with filter functions for both Layer 3 (IP layer) and Layer 2 (MAC address level)
• Extensive configuration options for IP address mapping (1:1 NAT, virtual mapping/ NAT masquerading/port-forwarding/IP address forwarding), e.g. for connecting multiple machine networks in the same IP address range into a primary production network
• Integrated VPN functionality (OpenVPN and IPSec) for secure remote access over the Internet. The router can be used with both VPN technologies, either as a VPN client or a VPN server.
• Variable bandwidth management by prioritising and limiting network traffic to IP and Ethernet protocol level
• Variable user management through multiple user profiles with detailed assignment of rights
• Integrated Modbus/TCP server for controlling and querying the status of the digital inputs and outputs and pre-configured VPN connections with Modbus/ TCP-capable devices (e.g. PLC)
• Client Monitoring for the monitoring of network devices
• “Remote Capture” function for monitoring network traffic via Wireshark, (Network protocol analyser software)
• IE-SR-2GT-UMTS/3G variant - Additional integrated UMTS/3G/HSPA + modem for Internet connection via mobile radio (max. downlink 21.2 Mbps, max. uplink 5.8 Mbps)

Gigabit Industrial Security Router - Secure Data Communication With Integrated VPN Technology

Securely integrate machines in a production network with Gigabit Ethernet

The router enables controlled and secure data exchange between “switched” Ethernet networks (IP routing). The various manifestations of the Network Address Translation function (1:1 NAT, masquerading, virtual mapping, port and IP forwarding) provide controlled access to both sub-networks as well as individual Ethernet devices. In addition, the 1:1 NAT function allows machine networks with the same IP address range to be easily integrated into a primary production network, as is typically the case in series machine manufacturing. The high-speed performance of the Gigabit interface means that the router will have no problems at all handling future increased data loads in the Ethernet network.

Gigabit Industrial Security Router - Secure Data Communication With Integrated VPN Technology

Remote access via secure VPN connections

Weidmüller Industrial Ethernet routers use encrypted VPN connections (OpenVPN and IPsec) to allow access to machines and systems. Diagnosis and error rectification are therefore possible from any location. This means that an onsite service technician can be dispensed with in many cases. The router supports the standard VPN technologies OpenVPN and IPsec, and can be operated either as a VPN client or a VPN server (with no limits on the number of

Gigabit Industrial Security Router - Secure Data Communication With Integrated VPN Technology

Control and monitoring via integrated digital inputs and outputs

The router is equipped with 2 digital inputs (“Cut” and “VPN initiate”) and 2 digital outputs (“Alarm” and “VPN active”). The 24 V input “Cut” allows the RJ45 WAN port to be temporarily disabled, e.g. to prevent unauthorised access by third parties to the WAN network during maintenance work on the LAN network. The 24 V input “VPN initiate” enables a pre-configured VPN instance to be started or stopped (client or server). Connections can be initiated, for example, by an external key switch or via the digital output of a controller (PLC). Once a VPN tunnel is successfully established and activated it is indicated by the digital output “VPN active”. The 24 V output “Alarm” can be used to display the router‘s configurable alarm conditions externally. An alarm can be triggered by a firewall rule or when a network device is no longer accessible (client monitoring).

Gigabit Industrial Security Router - Secure Data Communication With Integrated VPN Technology

Intelligent Firewall: Stateful Packet Inspection

The integrated stateful inspection firewall is used to control incoming and outgoing traffic on all router interfaces (LAN, WAN, UMTS, VPN tunnels) on both Layer 2 (Ethernet frames) and Layer 3 (IP-based).
An “auto-learning” function (“SecureNow!” ) is also incorporated; this performs an automatic analysis of network traffic and generates a set of rules, which the user can then apply or modify as needed.

Gigabit Industrial Security Router - Secure Data Communication With Integrated VPN Technology

User-friendly configuration via web interface

The router can be configured using any standard browser. The clear menu structure provides easy-to-learn and intuitive user guidance. The user interface can be switched between German and English. Configuration support for users is provided by integrated online help (tool tips) with detailed instructions about the various settings. Profiles for different user groups (administrators, restricted users, etc.) can be created with detailed assignment of rights.

Gigabit Industrial Security Router - Secure Data Communication With Integrated VPN Technology

Router Search Utility – search for routers on the network

The freely available Weidmüller Router Search Utility software tool allows Weidmüller routers to be detected on the local network in the case of unrecognised IP addresses. For all devices found, the most important basic data such as network parameters, serial number, device name, etc. are displayed for device identification. In addition, the IP address of a router can be modified or the web interface of a selected router opened directly.