Allen-Bradley 1756-EN2TSC User manual

EtherNet/IP Secure Communication
Catalog Number 1756-EN2TSC
User Manual

Important User Information
Read this document and the documents listed in the additional resources section about installation, configuration, and
operation of this equipment before you install, configure, operate, or maintain this product. Users are required to
familiarize themselves with installation and wiring instructions in addition to requirements of all applicable codes, laws,
and standards.
Activities including installation, adjustments, putting into service, use, assembly, disassembly, and maintenance are required
to be carried out by suitably trained personnel in accordance with applicable code of practice.
If this equipment is used in a manner not specified by the manufacturer, the protection provided by the equipment may be
impaired.
In no event will Rockwell Automation, Inc. be responsible or liable for indirect or consequential damages resulting from the
use or application of this equipment.
The examples and diagrams in this manual are included solely for illustrative purposes. Because of the many variables and
requirements associated with any particular installation, Rockwell Automation, Inc. cannot assume responsibility or
liability for actual use based on the examples and diagrams.
No patent liability is assumed by Rockwell Automation, Inc. with respect to use of information, circuits, equipment, or
software described in this manual.
Reproduction of the contents of this manual, in whole or in part, without written permission of Rockwell Automation,
Inc., is prohibited.
Throughout this manual, when necessary, we use notes to make you aware of safety considerations.
Labels may also be on or inside the equipment to provide specific precautions.
Allen-Bradley, Rockwell Software, Rockwell Automation, ControlFLASH, ControlLogix, FactoryTalk, FLEX, Logix5000, POINT I/O, PowerFlex, RSLinx, RSView, Stratix 5900, and Studio 5000 are trademarks of Rockwell
Automation, Inc.
Trademarks not belonging to Rockwell Automation are property of their respective companies.
WARNING: Identifies information about practices or circumstances that can cause an explosion in a hazardous environment,
which may lead to personal injury or death, property damage, or economic loss.
ATTENTION: Identifies information about practices or circumstances that can lead to personal injury or death, property
damage, or economic loss. Attentions help you identify a hazard, avoid a hazard, and recognize the consequence.
IMPORTANT
Identifies information that is critical for successful application and understanding of the product.
SHOCK HAZARD: Labels may be on or inside the equipment, for example, a drive or motor, to alert people that dangerous
voltage may be present.
BURN HAZARD: Labels may be on or inside the equipment, for example, a drive or motor, to alert people that surfaces may
reach dangerous temperatures.
ARC FLASH HAZARD: Labels may be on or inside the equipment, for example, a motor control center, to alert people to
potential Arc Flash. Arc Flash will cause severe injury or death. Wear proper Personal Protective Equipment (PPE). Follow ALL
Regulatory requirements for safe work practices and for Personal Protective Equipment (PPE).

Rockwell Automation Publication ENET-UM003C-EN-P - November 2015 3
Summary of Changes
This manual contains new and updated information. Changes throughout this
revision are marked by change bars, as shown to the right of this paragraph.
New and Updated
Information
This table contains the changes made to this revision.
Topic Page
Updated all web page interface screens from Series A to Series B module
firmware.
Throughout
Added references to the Stratix 5900 Security Appliance 11, 9, 51, 51
Added information about mobile clients 15
Updated information about Transport Layer Security (TLS) 1.2 11
Added new features Throughout
Added Security Configuration Parameter Descriptions 16

4Rockwell Automation Publication ENET-UM003C-EN-P - November 2015
Summary of Changes
Notes:

Rockwell Automation Publication ENET-UM003C-EN-P - November 2015 5
Table of Contents
Preface Additional Resources . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
Chapter 1
Secure Communication Architecture
Considerations. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
Local Chassis Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
Network Access Security. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
IPsec Association . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
Performance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
Traffic Filtering . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
Security Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
Chapter 2
Get Started
Initial Powerup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20
Default Credentials. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
Configuration Overview. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
Assign Network Settings. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
Change Network Settings Via the Module Web Page. . . . . . . . . . . . 23
Create User Accounts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25
Bad Login Attempts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26
Generate HTTPS Certificate . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26
Certificates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
Backup / Restore. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28
Chapter 3
Configure a Secure Connection to a
Microsoft Windows Client
L2TP Connections . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32
Create Windows Client Connection By Using a Windows Profile . . . 35
Configure Mobile Client . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37
Configure an L2TP Connection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38
Configure a Connection from a Microsoft Windows Client . . . . . . . . . 40
Interface Metric . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46
Open the VPN Connection to the 1756-EN2TSC Module. . . . . . . . . . 47
Communicate to the Module Via an RSLinx Driver. . . . . . . . . . . . . . . . . 49
Chapter 4
Configure Secure Communication
Between Two 1756-EN2TSC Modules
Configure the First (Local) Module. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53
Configure the Second (Remote) Module . . . . . . . . . . . . . . . . . . . . . . . . . . . 54
Test the Connection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55
Edit the Security Association. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55
Chapter 5
Configure a Secure Connection to a
VPN Appliance
Configure the Module to Connect to a VPN Appliance . . . . . . . . . . . . . 59
Edit the Security Association. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60

6Rockwell Automation Publication ENET-UM003C-EN-P - November 2015
Table of Contents
Chapter 6
Diagnostics
Diagnostic Web Pages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63
Secure Tunnel Diagnostics Web Page . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 64
Status Indicators . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65
Link (LINK) Status Indicator . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65
Network (NET) Status Indicator . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 66
OK Status Indicator . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 66
Index

Rockwell Automation Publication ENET-UM003C-EN-P - November 2015 7
Preface
The 1756-EN2TSC is a security-enhanced version of the 1756-EN2T
EtherNet/IP communication module. This module is designed for applications
that limit network access to a control system from within the plant network. This
module is not intended to connect any devices in the local 1756 backplane to
devices outside of the plant firewall.
Additional Resources These documents contain additional information concerning related products
from Rockwell Automation.
You can view or download publications at
http://www.rockwellautomation.com/literature/. To order paper copies of
technical documentation, contact your local Allen-Bradley distributor or
Rockwell Automation® sales representative.
Resource Description
1756 ControlLogix® Communication Modules Specifications Technical Data, publication 1756-TD003 Specifications for ControlLogix communication modules
EtherNet/IP Network Configuration User Manual, publication ENET-UM001 Guidelines for configuring EtherNet/IP network parameters
EtherNet/IP Modules Installation Instructions, publication ENET-IN002 Guidelines for installing EtherNet/IP modules
Ethernet Design Considerations Reference Manual, publication ENET-RM002 Guidelines for Ethernet networks
Industrial Automation Wiring and Grounding Guidelines, publication 1770-4.1 Guidelines for installing a Rockwell Automation industrial system
Product Certifications website, http://www.ab.com Declarations of conformity, certificates, and other certification details

8Rockwell Automation Publication ENET-UM003C-EN-P - November 2015
Preface
Notes:

Rockwell Automation Publication ENET-UM003C-EN-P - November 2015 9
Chapter 1
Secure Communication Architecture
Many control systems currently use 1756-EN2T and 1756-ENBT modules to
connect ControlLogix® systems to plant-level systems. A 1756-EN2TSC module
offers the same connectivity and additional security options that help protect
access to resources on the local backplane from the plant network. Use the
1756-EN2TSC module to establish secure tunnels with peer modules,
Windows 7 clients, and VPN appliances.
Topic Page
Local Chassis Security 12
Network Access Security 13
IPsec Association 14
Performance 15
Traffic Filtering 15

10 Rockwell Automation Publication ENET-UM003C-EN-P - November 2015
Chapter 1 Secure Communication Architecture
Figure 1 - 1756-EN2TSC module Establishes Secure Tunnels with Peer Modules, Windows 7 Clients,
and VPN Appliances
The 1756-EN2TSC module provides a level of protection against unauthorized
network access, either malicious or accidental, to a ControlLogix® controller via
an EtherNet/IP connection. The 1756-EN2TSC module uses the Internet
Protocol Security (IPsec) protocol suite to provide a secure communication
tunnel.
The 1756-EN2TSC module is intended for use behind an existing
firewall/DMZ that help protect the plant network from outside access. This
module is not intended to be connected directly to the public Internet or to
provide a mechanism by which remote access is provided to a network. The
module does not provide the ability to expose a private network address range via
IPsec; only the module’s IP address is available.
Enterprise Zone
Levels 4 and 5
Demilitarized Zone (DMZ)
Demilitarized Zone (DMZ)
Manufacturing Zone
Site Manufacturing
Operations and Control
Level 3
Level 0…2
Secure Tunnel Between 1756-EN2TSC
Module and Windows 7 Client.
Peer-to-peer Secure Tunnel
Between 1756-EN2TSC Modules
ControlLogix Chassis with
1756-EN2TSC Module
Secure Tunnel Between 1756-EN2TSC
Module and VPN Appliance
IMPORTANT
HMIs are not supported by the 1756-EN2TSC/B.
HMIs don’t support IPsec.