Networks and Security Great Demo Stratix 5700

Demo 1 – Network Address Translation (NAT) in Layer 2 Architecture ?

NAT Implementation in a layer 2 vs. Layer 3 Device Typically a software implementation NAT device acts as the default gateway (router) for the devices on the inside network NAT device will intercept traffic, perform translation, and route traffic Translations are handled by the NAT CPU Performance of translation directly tied to the loading of the NAT CPU Hardware based implementation NAT device does not act as a router and utilizes 2 translations tables – inside to outside & outside to inside Performance is at wire speed throughout switch loading Supports multiple VLANs through NAT boundary enhancing segmentation flexibility (Communication between VLANS requires a separate layer 3 device) *Layer 2 NAT is available only in the Stratix 5700

Demo 1 - Applying NAT using the Layer 2 Stratix 5700 4 – Specify the Public to Private address translation. 3 – Specify the Private (smaller “inside” network) to Public (larger “outside” network) address translation. 2 – Open the NAT tab and add a new instance 1 - Inside the Studio 5000 project open the AOP for the Stratix 5700

Demo 1 – NAT in action

Demo 2 – Network segmentation using VLANs Every broadcasting device sends frames to every corner of the Network.

Demo 2 – Affected equipment Red line is communications with PAC Blue line is broadcast traffic Circled spikes take traffic over 600 frames a second, causing failures in this particular case

Demo 2 – Solution, segment network with VLANs A router or layer 3 switch breaks up broadcast domains, limiting the reach of broadcast frames

Demo 2 – Solution, segment network with VLANs The effect of network broadcast are nearly negligible.

Demo 2 – Applying Network segmentation using Stratix 5700 5 – Enable routing in the device manager 4 – Assign VLANs to switch ports 2 – Select the Smartports and VLANs tab and click on New VLAN 1 – Inside the Studio 5000 project, open the AOP for the Stratix 5700 3 – Create VLAN10 and VLAN20

Demo 3 – Zone security In order for the production line to request delivery of steam or air, its controls need to communicate to the utilities supplier controls. The protocol they use to communicate is CIP. All other traffic going to or coming from this zone should be restricted. For situation where we want to restrict network traffic between certain areas (zones) of our plant. Like in the case, illustrated here, where company XYZ has its utilities like steam and compressed air managed by a third party vendor. The solution is implementing a Stratix 5900, which is a services router that can be used as a zone-based policy Firewall. 192.168.10.5 CIP traffic like: Open steam valve Current steam pressure: 40PSI Any traffic not explicitly allowed 192.168.20.5

Demo 3 – Zone security result Ping, blocked HTTP, forbidden 192.168.10.5 RSLinx (CIP) allowed 192.168.20.5

Demo 3 – Applying Zone Security with the Stratix 5900 2 – Assign the VLANs to inside and outside zones 1 - Open the Stratix 5900 Configurator software and add 2 VLANs to differentiate between internal (inside) and external (outside) traffic.

Demo 3 – Applying Zone Security with the Stratix 5900 3 – Create two user defined Port to application mappings One for CIP Class 1, used for example for Logix Controller I/O and produced and consumed data transfers And one for CIP Class 3, used for example for RSLinx communications between Studio 5000 and the Logix Controller

Demo 3 – Applying Zone Security with the Stratix 5900 4 – Create a firewall policy that implements rules which enforce the user defined CIP port to application mappings we just setup

Demo 4 – Wireless communications As a WGB, the Stratix 5100 operates in the WLAN as a single wireless client of an access point (root AP). The WGB learns MAC addresses of its wired clients on the Ethernet interface and reports them to the root AP In autonomous mode, the Stratix 5100 can function as: In Access Point mode, the Stratix 5100 is accepting connections from wireless client. Access Point (AP) Or Workgroup Bridge (WGB)

Demo 4 – Configuring the Stratix 5100 as a Wireless Access Point 1 – Log into the Stratix 5100 device manager and configure basic settings like AP IP address and Host name And SSID

Demo 4 – Configuring the Stratix 5100 as a Wireless Access Point 2 – Enable encryption … And apply WPA to the SSID

Demo 4 – Configuring the Stratix 5100 as a Wireless Access Point 3 – Enable the radio

Demo 4 – Configuring the Stratix 5100 as a Wireless Access Point