Contemporary Controls EIGR Series User guide

AG-EIGR0000-AA0
Application Guide – EIGR Series
EIGR – Skorpion Gigabit Wired IP Routers
EIGR Skorpion Gigabit IP Router Features …
• Web page conguration
• 10/100/1000 Mbps WAN port
• 4-port 10/100/1000 Mbps Ethernet LAN switch
• PAT, NAT and Port Forwarding and Port Range Forwarding
• NAT Loopback
• Remote Router Access and Whitelist
• Stateful rewall (can be disabled)
• DHCP client (WAN) and DHCP server (LAN)
• DIN-rail mounting
• Diagnostic LEDs
• CE Mark, RoHS, UL 508, C22.2 No. 142-M1987
• 24 VAC/VDC powered
• Operates over 0 to 60°C (EIGR Series)
• Operates over -40 to + 75°C (EIGR-X Series)
EIGR Series
The EIGR series of high-speed routers link two 10/100/1000
Mbps Internet Protocol (IPv4) networks together — passing
appropriate trac while blocking all other trac. One
network is the local-area-network (LAN) and the other is the
wide-area-network (WAN). The built-in stateful rewall passes
communication initiated on the LAN-side while blocking
WAN-side initiated communication. The EIGR incorporates an
Ethernet switch for multiple LAN-side connections. An
external Ethernet cable or DSL modem attached to the
WAN-side can be used to connect to the Internet.

AG-EIGR0000-AA0
Application Guide – EIGR Series
2
EIGR – Skorpion Gigabit IP Router
With a DIN-rail mounting clip, rugged metal enclosure and
the ability to be powered from a low-voltage power source,
the EIGR is ideal for automation systems.
Although the EIGR has many of the same features found in
high-end routers, it is simple to install and commission. A
resident DHCP server on the LAN-side will provide IP
addresses to LAN-side clients while a DHCP client on the
WAN-side will accept IP address assignments from the
attached network. Static addressing is accommodated as
well. Conguration is via a web browser using
authentication.
The lower portion of the router connects the local-area-
network or the LAN side. The upper portion of the router
connects the wide-area-network or the WAN side. A
rewall - which can be disabled by the user - separates the
two portions. A stateful rewall makes decisions based
upon the structure of the message and who is initiating
and who is responding.
Built-in Ethernet Switch
connect up to four 10/100/1000
Mbps Ethernet devices with
auto-negotiation and Auto-MDIX
Power LED
Power OK indicator
Reset Switch
returns the EIGR to its
default IP address settings
Writeable Label
for a helpful record of
connected IP devices
Diagnostic LEDs
indicate the status of
Link and Activity
Quick Disconnect 4-pin Power Connector
provides connections to a DC or AC source and a
connection for a backup source
35 mm Din-rail Clip
for convenient control
panel installation
Metal Enclosure
rugged packaging
for tough environments

AG-EIGR0000-AA0
Application Guide – EIGR Series
3
Web Page Conguration
Resident Help Screens
provide immediate assistance
on any feature on any screen
For More Information
each screen has a convenient link
to our website
Menu Bar
provides quick access
to all main screens
Setup Menu
displays the screen
shown on this page

AG-EIGR0000-AA0
Application Guide – EIGR Series
4
Secure Login – From Any IP-connected Computer
Default Username is“admin”
Entering a new value is recommended.
Default restored if reset switch is used.
Default Password is “admin”
Entering a new value is recommended.
Default restored if reset switch is used.
Administration Menu
displays this screen
Stateful Firewall – Promotes Secure Communication
The lower part of the router connects the LAN side (the local-area-
network). The upper part connects the WAN side(wide-area-
network). A rewall (which can be disabled by the user) separates
the two parts.
A rewall controls the passing of messages from one side of a
router to the other. A stateful rewall acts on the structure of the
message and who is initiating and who is responding.
Originating requests from the LAN side and corresponding
responses from the WAN side pass through the rewall. But trac
originating from the WAN side is blocked from the LAN side unless
the rewall is adjusted to allow it. This protects the LAN side from
unauthorized WAN access.
Remote Router Access
Disabled by default. Enable if conguration is desired
from a web browser on either LAN side or WAN side.
Administration Port
Default setting of 8080 can be changed after Remote Router Access
is enabled, but well-known ports are not recommended.
Save or Retrieve
Conguration
STATUS PWR
RESET
1
2
3
4
WAN
H
L
LAN
LAN
inbound or
outbound
requests
or replies
WAN
inbound or
outbound
trafc
WAN requests
are blocked
unless rewall
is changed to
allow them.

AG-EIGR0000-AA0
Application Guide – EIGR Series
5
Status and Conguration Report – Just a Click Away
Status Menu
displays the screen shown on this page
If the EIGR is enabled as a DHCP Server,
clicking the View LAN DHCP Clients button brings up another
window to view the status of the LAN devices being served.

AG-EIGR0000-AA0
Application Guide – EIGR Series
6
Whitelist
Up to 10 public devices can
initiate messages to LAN devices
when the rewall and port
forwarding are enabled.
Advanced Features – for Demanding Situations
Port Range Forwarding
Devices on the WAN port can initiate
messages to LAN devices using
an IP port in one of the 20 ranges
when the rewall is enabled.
Advanced Menu
displays these menu options
Firewall Enabled by Default
This can be disabled to allow
customised routing situations.
Port Forwarding (Port Mapping)
Devices on the WAN port can
initiate messages to LAN devices
using up to 100 specied IP ports
when the rewall is enabled.
Network Address Translation
Specify up to 30 NAT entries.
NAT Loopback
Allows a LAN-side device to
target the router’s WAN-side
IP address and use its Port
Forwarding table to access other
LAN-side devices.

AG-EIGR0000-AA0
Application Guide – EIGR Series
7
Application #1 – A Cable Modem Connection to the Internet
In the WAN Setup, the default Connection Type is DHCP
– where a DHCP server on the WAN side will automatically
assign an IP address, subnet mask, default gateway
address and one or more DNS addresses to the WAN side
of the IP router. Some cable modems have DHCP server
functionality.
If a DHCP server is unavailable on the WAN network, you
must make static IP entries for the WAN side of the router.
Enter the IP address, subnet mask, default gateway
address and one or more DNS addresses when using the
Static IP option.
Application #2 – A DSL Modem Connection to the Internet
With DSL modems, the PPPoE protocol must be
selected — and a username and password
provided. Once a connection is established, the
ISP furnishes all the needed WAN IP address
assignments.
192.168.92.1
192.168.92.1
192.168.92.101
192.168.92.101
192.168.92.102
192.168.92.102
STATUS PWR
RESET
1
2
3
4
WAN
H
L
LAN
STATUS PWR
RESET
1
2
3
4
WAN
H
L
LAN

AG-EIGR0000-AA0
Application Guide – EIGR Series
8
When attaching BACnet devices to IP networks it is
possible that the IP network has been sub-netted through
the use of IP routers. Most IP routers will not pass broadcast
messages which are crucial to BACnet’s operation. The
solution is to incorporate BACnet/IP Broadcast
Management Device (BBMD) functionality within the
BACnet internetwork.
The BBMD concept requires that a broadcast message
originating on one subnet be encapsulated into a directed
message and sent to all remote subnets since these
directed messages will pass through IP routers. Once the
encapsulated messages are received on the remote
subnets, a BBMD device will decode the message and
resend it on its local subnet as a broadcast message.
Therefore, it would appear that a BBMD device must be
present on each subnet in order to provide this encoding
and decoding function.
However, this is not the case if all the BACnet/IP devices
support Foreign Device Registration (FDR). At a minimum,
one BBMD device is required to be located on one of the
subnets with FDR devices registering to this one BBMD.
This is what is shown in the example with a BAS Router
providing BBMD functionality while allowing for foreign
devices registration. Notice that connecting to a BACnet
MS/TP network is an option.
Application #3 – Cascaded Routers for Additional Isolation
For increased security and isolation, IP routers can be
cascaded. Make sure that each LAN-side subnet address is
unique when cascading IP routers. The left-most IP router
can have its WAN-side IP address assigned using DHCP
client or by using static IP address assignment.
The illustration shows a pair of EIGR routers, but the
right-most router could also be some other type of router
— perhaps one already existing in the business system —
because the EIGR supports standard Internet protocols.
Application #4 – Limiting BACnet Trac
192.168.92.1 192.168.93.1
192.168.93.101
192.168.93.102
192.168.92.102
192.168.92.101
STATUS PWR
RESET
1
2
3
4
WAN
H
L
LAN
STATUS PWR
RESET
1
2
3
4
WAN
H
L
LAN
STATUS PWR
RESET
1
2
3
4
WAN
H
L
LAN
Route between
BACnet/IP and
BACnet MS/TP
BASRT-B
BASRT-B
EIGR
Route between
IP Subnets
Automation
Controller
Automation
Controller
Automation
Controller
Automation
Controller
Field
Controller
Field
Controller
Field
Controller
Field
Controller
Internet
Gateway
(rewall)

AG-EIGR0000-AA0
Application Guide – EIGR Series
9
Application #5 – Disable the Firewall for Unrestricted Routing
There are times when you may want to disable the rewall.
The rewall controls the passing of messages from the
public (WAN) side of the router to the private (LAN) side
— and normally this protects the private side from
unauthorized public access.
Under the Advanced Tab, you may choose to disable the
rewall. Typically, the rewall is disabled when the LANs on
both sides of the router are within one organization. That is,
there is no public side — both sides are essentially private,
so no rewall is needed.
LAN IP Address WAN IP Address
192.168.92.1/24 192.168.80.10/24
192.168.92.2/24 192.168.80.20/24
192.168.92.3/24 192.168.80.30/24
PWR
1
2
3
4
5
H
L
STATUS PWR
RESET
1
2
3
4
WAN
H
L
LAN
192.168.80.10/24
192.168.80.10
192.168.80.20
192.168.80.30
192.168.80.20/24
192.168.80.30/24
192.168.92.3/24
192.168.92.2/24
192.168.92.1/24

AG-EIGR0000-AA0
Application Guide – EIGR Series
10
Application #6 – Port Forwarding to Access a Private Web Server
The rewall will normally block all WAN-side requests. Port
forwarding allows computers on the WAN side to access
devices on the LAN side by opening up selected WAN IP
ports. The only WAN-side requests that will be forwarded
through the IP router are those that specify both the router’s
WAN address and a destination IP port number that exists in
the router’s IP port forwarding table. When this match is
made, the message is forwarded to the indicated IP address
on the LAN side.
This is very useful when only one public IP address is
available, but there is a need to access multiple LAN-
side devices. In this example, we want to access a private
web server at 192.168.92.101 which is normally invisible from
the Internet. Using port forwarding, we allow a WAN-side
request made to the router’s public (WAN) address. For
additional security, the port numbers have been translated.
You can also select Port Range Forwarding to allow an entire
range of addresses through the rewall. Note that any
WAN-side device can use port forwarding — but you can
greatly enhance security by creating a whitelist of allowed
WAN-side devices. This is illustrated at the bottom of the
page.
Internal IP Address LAN IP Port WAN IP Port External IP Address
192.168.92.101/24 80 8080 1.2.3.4
Enhance Security with a Whitelist
Specify which WAN-side devices
can use port forwarding.
STATUS PWR
RESET
1
2
3
4
WAN
H
L
LAN
192.168.92.101:80
192.168.92.1
192.168.92.102
192.168.92.101
1.2.3.4:8080
WAN Request