Hirschmann HiSecOS EAGLE20 User manual

RM GUI HiSecOS EAGLE20/30
Release 3.0 09/2015
Technical Support
https://hirschmann-support.belden.eu.com
Reference Manual
Graphical User Interface
HiSecOS EAGLE20/30 (Industrial ETHERNET Firewall)

The naming of copyrighted trademarks in this manual, even when not specially indicated, should
not be taken to mean that these names may be considered as free in the sense of the trademark
and tradename protection law and hence that they may be freely used by anyone.
© 2015 Hirschmann Automation and Control GmbH
Manuals and software are protected by copyright. All rights reserved. The copying, reproduction,
translation, conversion into any electronic medium or machine scannable form is not permitted,
either in whole or in part. An exception is the preparation of a backup copy of the software for
your own use. For devices with embedded software, the end-user license agreement on the
enclosed CD/DVD applies.
The performance features described here are binding only if they have been expressly agreed
when the contract was made. This document was produced by Hirschmann Automation and
Control GmbH according to the best of the company's knowledge. Hirschmann reserves the right
to change the contents of this document without prior notice. Hirschmann can give no guarantee
in respect of the correctness or accuracy of the information in this document.
Hirschmann can accept no responsibility for damages, resulting from the use of the network
components or the associated operating software. In addition, we refer to the conditions of use
specified in the license contract.
You can get the latest version of this manual on the Internet at the Hirschmann product site
(http://www.hirschmann.com).
Hirschmann Automation and Control GmbH
Stuttgarter Str. 45-51
72654 Neckartenzlingen
Germany
Tel.: [phone]
Rel. 3.0 - 09/2015 – 08.10.2015

Contents
RM GUI HiSecOS EAGLE20/30
Release 3.0 09/2015 3
Contents
Safety instructions 11
About this Manual 13
Key 15
Graphical User Interface 17
1 Basic Settings 29
1.1 System 30
1.2 Network 36
1.3 Software 39
1.4 Load/Save 42
1.5 External Memory 55
1.6 Port 58
1.6.1 Configuration 59
1.6.2 Statistics 63
1.7 Restart 65
2Time 67
2.1 Basic Settings 68
2.2 NTP 70
2.3 Global 71
2.4 Server 74
2.5 Multicast Groups 76
3 Device Security 79
3.1 User Management 80
3.2 Authentication List 85
3.3 LDAP 89
3.4 LDAP Configuration 90

Contents
4RM GUI HiSecOS EAGLE20/30
Release 3.0 09/2015
3.5 LDAP Role Mapping 95
3.6 Management Access 98
3.7 Server 99
3.7.1 Information 100
3.7.2 SNMP 102
3.7.3 HTTP 104
3.7.4 HTTPS 106
3.7.5 SSH 110
3.8 IP Access Restriction 116
3.9 Web 119
3.10 Command Line Interface 120
3.10.1 Global 121
3.10.2 Login Banner 123
3.11 SNMPv1/v2 Community 125
3.12 Pre-login Banner 127
4 Network Security 129
4.1 Network Security Overview 130
4.2 Packet Filter 132
4.3 Packet Filter Global 134
4.4 Firewall Learning Mode 136
4.4.1 Configuration 137
4.4.2 Rules 139
4.5 Packet Filter Rule 144
4.6 Packet Filter Assignment 151
4.7 Packet Filter Overview 154
4.8 Deep Packet Inspection 159
4.9 Deep Packet Inspection Modbus Enforcer 160
4.9.1 Function Code Configurator 165
4.9.2 Function Code Configurator – Basic Configuration 165
4.9.3 Function Code Configurator – Advanced
Configuration 167
4.9.4 Meaning of the Function Code values 168
4.10 Deep Packet Inspection OPC Enforcer 169
4.11 RADIUS 172
4.12 RADIUS Global 173

Contents
RM GUI HiSecOS EAGLE20/30
Release 3.0 09/2015 5
4.13 RADIUS Authentication Server 175
4.14 RADIUS Authentication Statistics 177
4.15 DoS 179
4.16 DoS Global 180
4.17 ACL 184
4.18 ACL IPv4 Rule 186
4.19 ACL MAC Rule 193
4.20 ACL Assignment 200
5 Virtual Private Network 203
5.1 VPN Overview 204
5.1.1 Overview 204
5.1.2 Diagnostics 207
5.1.3 Connection Errors 209
5.2 Virtual Private Network Certificates 210
5.3 Connections 213
5.3.1 Wizard 227
6 Switching 243
6.1 Switching Global 244
6.2 Rate Limiter 246
6.3 Filter for MAC Addresses 249
6.4 QoS/Priority 252
6.5 Global 253
6.6 Port Configuration 255
6.7 802.1D/p Mapping 256
6.8 VLAN 258
6.9 VLAN Global 259
6.10 VLAN Configuration 260
6.11 VLAN Port 263
7WAN 265
7.1 SHDSL/EFM 266

Contents
6RM GUI HiSecOS EAGLE20/30
Release 3.0 09/2015
7.2 SHDSL/EFM Configuration 267
7.3 SHDSL/EFM Statistics 270
7.3.1 Port 270
7.3.2 PME 272
8 Routing 275
8.1 Routing Global 276
8.2 Interfaces 279
8.3 Configuration 280
8.3.1 Wizard 283
8.4 Secondary Interface addresses 286
8.5 ARP 288
8.6 ARP Global 289
8.7 ARP Current 291
8.8 ARP Static 293
8.8.1 Wizard 295
8.9 Open Shortest Path First 297
8.10 OSPF Global 299
8.10.1 General 299
8.10.2 Configuration 304
8.10.3 Redistribution 308
8.11 OSPF Areas 311
8.12 OSPF Stub Areas 313
8.13 OSPF Not So Stubby Areas 315
8.14 OSPF Interfaces 318
8.15 OSPF Virtual Links 324
8.16 OSPF Ranges 328
8.17 OSPF Diagnostics 330
8.17.1 Statistics 331
8.17.2 Link State Database 334
8.17.3 Neighbors 337
8.17.4 Virtual Neighbors 340
8.17.5 External Links State Database 344
8.18 Routing Table 346
8.19 Tracking 350

Contents
RM GUI HiSecOS EAGLE20/30
Release 3.0 09/2015 7
8.20 Tracking Configuration 351
8.21 Applications 356
8.22 Loopback Interface 357
8.23 L3-Redundancy 359
8.24 VRRP 360
8.25 VRRP Configuration 361
8.25.1 Wizard 366
8.26 VRRP Statistics 372
8.27 Tracking 374
8.28 NAT 377
8.29 NAT Global 378
8.30 1:1 NAT 380
8.31 Rule 382
8.32 Destination NAT 385
8.33 Destination NAT Rule 388
8.34 Destination NAT Mapping 393
8.35 Destination NAT Overview 395
8.36 Masquerading NAT 397
8.37 Masquerading NAT Rule 400
8.38 Masquerading NAT Mapping 403
8.39 Masquerading NAT Overview 405
8.40 Double NAT 407
8.41 Double NAT Rule 410
8.42 Double NAT Mapping 413
8.43 Double NAT Overview 415
9 Diagnostics 417
9.1 Status Configuration 418
9.2 Device Status 419
9.2.1 Global 420
9.2.2 Port 423
9.2.3 Status 424

Contents
8RM GUI HiSecOS EAGLE20/30
Release 3.0 09/2015
9.3 Security Status 425
9.3.1 Global 426
9.3.2 Port 432
9.3.3 Status 433
9.4 Signal Contact 434
9.5 Signal Contact 1 / Signal Contact 2 435
9.5.1 Global 436
9.5.2 Port 440
9.5.3 Status 441
9.6 Alarms (Traps) 442
9.7 System 444
9.8 System Information 445
9.9 Configuration Check 446
9.10 ARP Table 448
9.11 Selftest 449
9.12 Syslog 451
9.13 Ports 453
9.14 SFP 454
9.15 LLDP 455
9.16 Configuration 456
9.17 Topology Discovery 460
9.18 Report 462
9.19 Global 463
9.20 Persistent Logging 467
9.21 System Log 470
9.22 Audit Trail 471
10 Advanced 473
10.1 DNS 474
10.2 DNS Client 475
10.3 DNS Client Global 476
10.4 DNS Client Current 477
10.5 DNS Client Static 478

Contents
RM GUI HiSecOS EAGLE20/30
Release 3.0 09/2015 9
10.6 DNS Cache 480
10.7 DNS Cache Global 481
10.8 Command Line Interface 483
A Appendix 485
A.1 Technical Data 486
A.2 List of RFCs 488
A.3 Underlying IEEE Standards 490
A.4 Maintenance 491
A.5 Literature references 492
A.6 Copyright of Integrated Software 493
B Readers’ Comments 525
C Index 527
D Further Support 529

Contents
10 RM GUI HiSecOS EAGLE20/30
Release 3.0 09/2015

Safety instructions
RM GUI HiSecOS EAGLE20/30
Release 3.0 09/2015 11
Safety instructions
WARNING
UNCONTROLLED MACHINE ACTIONS
To avoid uncontrolled machine actions caused by data loss, configure all
the data transmission devices individually.
Before you start any machine which is controlled via data transmission, be
sure to complete the configuration of all data transmission devices.
Failure to follow these instructions can result in death, serious injury,
or equipment damage.

Safety instructions
12 RM GUI HiSecOS EAGLE20/30
Release 3.0 09/2015

About this Manual
RM GUI HiSecOS EAGLE20/30
Release 3.0 09/2015 13
About this Manual
The “GUI” reference manual contains detailed information on using the
graphical interface to operate the individual functions of the device.
The “Command Line Interface” reference manual contains detailed
information on using the Command Line Interface to operate the individual
functions of the device.
The “Installation” user manual contains a device description, safety
instructions, a description of the display, and the other information that you
need to install the device.
The “Basic Configuration” user manual contains the information you need to
start operating the device. It takes you step by step from the first startup
operation through to the basic settings for operation in your environment.
The “Routing Configuration User Manual” document contains the information
you need to start operating the routing function. The manual enables you to
configure your router by following the examples.
The document “HiView User Manual” contains information about the GUI
application HiView. This application offers you the possibility to use the
graphical user interface without other applications such as a Web browser or
an installed Java Runtime Environment (JRE).

About this Manual
14 RM GUI HiSecOS EAGLE20/30
Release 3.0 09/2015
The Industrial HiVision network management software provides you with
additional options for smooth configuration and monitoring:
ActiveX control for SCADA integration
Auto-topology discovery
Browser interface
Client/server structure
Event handling
Event log
Simultaneous configuration of multiple devices
Graphical user interface with network layout
SNMP/OPC gateway

Key
RM GUI HiSecOS EAGLE20/30
Release 3.0 09/2015 15
Key
The designations used in this manual have the following meanings:
List
Work step
Subheading
Link Cross-reference with link
Note: A note emphasizes an important fact or draws your attention to a dependency.
Courier ASCII representation in the graphical user interface

Key
16 RM GUI HiSecOS EAGLE20/30
Release 3.0 09/2015

Graphical User Interface
RM GUI HiSecOS EAGLE20/30
Release 3.0 09/2015 17
Graphical User Interface
System requirements
Use HiView to open the graphical user interface. This application offers you
the possibility to use the graphical user interface without other applications
such as a Web browser or an installed Java Runtime Environment (JRE).
Alternatively you have the option to open the graphical user interface in a
Web browser, e.g. in Mozilla Firefox version 3.5 or higher or Microsoft
Internet Explorer version 6 or higher. You need to install the Java Runtime
Environment (JRE) in the most recently released version. You can find
installation packages for your operating system at http://java.com.
Starting the graphical user interface
The prerequisite for starting the graphical user interface is that the IP
parameters are configured in the device. The “Basic Configuration” user
manual contains detailed information that you need to specify the IP
parameters.
Start the graphical user interface in HiView:
Start HiView.
In the URL field of the start window, enter the IP address of your device.
Click "Open".
HiView sets up the connection to the device and displays the login window.

Graphical User Interface
18 RM GUI HiSecOS EAGLE20/30
Release 3.0 09/2015
Start the graphical user interface in the Web browser:
– This requires that Java is enabled in the security settings of your Web
browser.
Start your Web browser.
Write the IP address of the device in the address field of the Web browser.
Use the following form: https://xxx.xxx.xxx.xxx
The Web browser sets up the connection to the device and displays the login
window.
Figure 1: Login window
Select the user name and enter the password.
Select the language in which you want to use the graphical user interface.
Click "Ok".
The Web browser displays the graphical user interface.

Graphical User Interface
RM GUI HiSecOS EAGLE20/30
Release 3.0 09/2015 19
Figure 2: Graphical user interface of the device

Graphical User Interface
20 RM GUI HiSecOS EAGLE20/30
Release 3.0 09/2015
Layout of the graphical user interface
The graphical user interface of the device is divided as follows:
Tab area (at the upper edge)
Menu section (left)
Status line
Dialog section (right).
Figure 3: Graphical user interface of the device