Moxa Technologies EDR-G9010 Series User manual

EDR-G9010 Series User Manual
Version 2.0, September 2022
www.moxa.com/products
© 2022 Moxa Inc. All rights reserved.

EDR-G9010 Series User Manual
The software described in this manual is furnished under a license agreement and may be used only in accordance
with the terms of that agreement.
Copyright Notice
© 2022 Moxa Inc. All rights reserved.
Trademarks
The MOXA logo is a registered trademark of Moxa Inc.
All other trademarks or registered marks in this manual belong to their respective manufacturers.
Disclaimer
•Information in this document is subject to change without notice and does not represent a commitment
on the part of Moxa.
•Moxa provides this document as is, without warranty of any kind, either expressed or implied, including,
but not limited to, its particular purpose. Moxa reserves the right to make improvements and/or
changes to this manual, or to the products and/or the programs described in this manual, at any time.
•Information provided in this manual is intended to be accurate and reliable. However, Moxa assumes no
responsibility for its use, or for any infringements on the rights of third parties that may result from its
use.
•This product might include unintentional technical or typographical errors. Changes are periodically
made to the information herein to correct such errors, and these changes are incorporated into new
editions of the publication.
Technical Support Contact Information
www.moxa.com/support

Table of Contents
1. Introduction .........................................................................................................................................6
Overview .............................................................................................................................................. 6
Package Checklist .................................................................................................................................. 6
Features ...............................................................................................................................................6
Defend Against Malicious Threats With Advanced Cybersecurity Features ..............................................7
Simplify Configurations With the User-friendly Interface and Quick Settings ..........................................7
Industrial-grade Design to Ensure Uninterrupted Network Connectivity ................................................. 7
Virtual Patching and Intelligent Threat Protection ...............................................................................7
2. Getting Started .....................................................................................................................................8
RS-232 Console Configuration (115200, None, 8, 1, VT100) ....................................................................... 8
Using Telnet to Access the Industrial Secure Router’s Console ................................................................... 11
Using a Web Browser to Configure the Industrial Secure Router ................................................................ 12
3. Device Summary and Setup Wizard ....................................................................................................15
Function Introduction ........................................................................................................................... 15
Device Summary ................................................................................................................................. 17
Model Information ........................................................................................................................ 18
Panel Status ................................................................................................................................ 18
Event Summary (Last 3 Days) ....................................................................................................... 19
CPU Usage History (%) ................................................................................................................. 20
Memory Usage History (%)............................................................................................................ 21
Setup Wizard ...................................................................................................................................... 21
Step 1: Port Type ......................................................................................................................... 21
Step 2: Interface.......................................................................................................................... 22
Step 3: Service ............................................................................................................................ 24
Step 4: Confirm ........................................................................................................................... 24
4. System ...............................................................................................................................................26
System Management............................................................................................................................ 26
Information Settings..................................................................................................................... 27
Firmware Upgrade........................................................................................................................ 28
Software Package Management...................................................................................................... 30
Configuration Backup and Restore .................................................................................................. 32
Account Management ........................................................................................................................... 37
User Accounts.............................................................................................................................. 37
Password Policy............................................................................................................................ 41
License Management............................................................................................................................ 42
Management Interface ......................................................................................................................... 44
User Interface.............................................................................................................................. 45
Hardware Interface....................................................................................................................... 47
SNMP.......................................................................................................................................... 47
MXsecurity .................................................................................................................................. 50
Time .................................................................................................................................................. 51
System Time ............................................................................................................................... 51
NTP/SNTP Server ......................................................................................................................... 56
Setting Check...................................................................................................................................... 57
5. Network Configuration .......................................................................................................................59
Ports .................................................................................................................................................. 59
Port Settings................................................................................................................................ 60
Link Aggregation .......................................................................................................................... 63
Layer 2 Switching ................................................................................................................................ 65
VLAN .......................................................................................................................................... 66
MAC Address Table ....................................................................................................................... 74
QoS............................................................................................................................................ 75
Rate Limiting ............................................................................................................................... 81
Multicast ..................................................................................................................................... 82
Network Interface................................................................................................................................ 88
LAN ............................................................................................................................................ 88
WAN ........................................................................................................................................... 90
Bridge Group Interface.................................................................................................................. 97

Secondary IP ............................................................................................................................. 100
6. Redundancy......................................................................................................................................102
Layer 2 Redundancy........................................................................................................................... 102
Spanning Tree ........................................................................................................................... 102
Turbo Ring V2............................................................................................................................ 106
Layer 3 Redundancy........................................................................................................................... 110
VRRP ........................................................................................................................................ 110
7. Network Service ...............................................................................................................................114
DHCP Server ..................................................................................................................................... 114
General Settings ........................................................................................................................ 114
DHCP........................................................................................................................................ 115
MAC-based IP Assignment ........................................................................................................... 117
Port-based IP Assignment ........................................................................................................... 119
Lease Table ............................................................................................................................... 120
Dynamic DNS.................................................................................................................................... 121
8. Routing.............................................................................................................................................122
Unicast Route.................................................................................................................................... 122
Static Routes ............................................................................................................................. 122
RIP (Routing Information Protocol) ............................................................................................... 124
OSPF (Dynamic Routing With Open Shortest Path First) .................................................................. 125
Multicast Route.................................................................................................................................. 132
Multicast Route Settings.............................................................................................................. 133
Static Multicast Route ................................................................................................................. 133
Broadcast Forwarding......................................................................................................................... 135
9. NAT (Network Address Translation) .................................................................................................137
NAT Concept ..................................................................................................................................... 137
1-to-1 NAT Overview.......................................................................................................................... 137
1-to-1 NAT........................................................................................................................................ 139
NAT Loopback............................................................................................................................ 141
Bidirectional 1-to-1 NAT ..................................................................................................................... 142
Double NAT ............................................................................................................................... 142
N-to-1 NAT ....................................................................................................................................... 143
PAT (Port Address Translation) ............................................................................................................ 144
Advance ........................................................................................................................................... 146
10. Object Management..........................................................................................................................150
Overview .......................................................................................................................................... 150
Create a New Object .......................................................................................................................... 150
Create an IP Address and Subnet Object ....................................................................................... 151
Create a Network Service Object .................................................................................................. 153
Create an Industrial Application Service Object .............................................................................. 155
Create a User-defined Service Object............................................................................................ 156
Modify an Existing Object ................................................................................................................... 159
Delete an Object................................................................................................................................ 159
Search for an Object .......................................................................................................................... 160
11. Firewall.............................................................................................................................................161
Policy Concept................................................................................................................................... 161
Layer 2 Policy.................................................................................................................................... 162
Create a New Layer 2 Policy ........................................................................................................ 162
Layer 3 - 7 Policy............................................................................................................................... 165
Create a New Layer 3 - 7 Policy ................................................................................................... 166
Malformed Packets............................................................................................................................. 169
Session Control ................................................................................................................................. 170
DoS (Denial of Service) Policy ............................................................................................................. 173
Advanced Protection .......................................................................................................................... 175
Dashboard................................................................................................................................. 176
Configuration ............................................................................................................................. 177
Protocol Filter Policy ................................................................................................................... 195
ADP (Anomaly Detection & Protection) .......................................................................................... 197
IPS (Intrusion Prevention System)................................................................................................ 199
12. VPN (Virtual Private Network)..........................................................................................................205
Overview .......................................................................................................................................... 205

IPsec Configuration............................................................................................................................ 206
Global Settings .......................................................................................................................... 206
IPsec Settings............................................................................................................................ 207
IPsec Use Case Demonstration..................................................................................................... 213
IPsec Status .............................................................................................................................. 217
L2TP Server (Layer 2 Tunnel Protocol).................................................................................................. 217
L2TP Server Setting (WAN).......................................................................................................... 217
L2TP User Name Settings ............................................................................................................ 218
Site-to-site IPsec VPN tunnel with Pre-Shared Key ......................................................................... 219
Site-to-site IPsec VPN tunnel with Juniper systems......................................................................... 220
Site-to-site IPsec VPN tunnel with Cisco systems............................................................................ 221
L2TP for Remote User Maintenance............................................................................................... 222
13. Certificate Management....................................................................................................................223
Local Certificate................................................................................................................................. 223
Import a Certificate .................................................................................................................... 224
Import a Certificate From CSR ..................................................................................................... 225
Import a Certificate from PKCS#12 .............................................................................................. 226
Trusted CA Certificate ........................................................................................................................ 227
Import a CA Certificate ............................................................................................................... 227
Certificate Signing Request ................................................................................................................. 227
Key Pair Generate ...................................................................................................................... 228
CSR Generate ............................................................................................................................ 229
14. Security ............................................................................................................................................231
Device Security ................................................................................................................................. 231
Login Policy ............................................................................................................................... 232
Trusted Access........................................................................................................................... 233
SSH & SSL ................................................................................................................................ 235
Network Security ............................................................................................................................... 236
IEEE 802.1X .............................................................................................................................. 236
RADIUS ............................................................................................................................................ 240
MXview Alert Notification .................................................................................................................... 241
Security Notification Setting ........................................................................................................ 241
Security Status .......................................................................................................................... 242
15. Diagnostics .......................................................................................................................................243
System Status................................................................................................................................... 243
Utilization.................................................................................................................................. 244
Fiber Check ............................................................................................................................... 244
Network Status ................................................................................................................................. 246
Network Statistics ...................................................................................................................... 246
LLDP......................................................................................................................................... 251
ARP Table.................................................................................................................................. 252
Event Logs and Notifications ............................................................................................................... 252
Event Log.................................................................................................................................. 253
Event Notifications...................................................................................................................... 257
Syslog ...................................................................................................................................... 263
SNMP Trap/Inform...................................................................................................................... 264
Email Settings............................................................................................................................ 267
Tools................................................................................................................................................ 268
Port Mirror................................................................................................................................. 268
Ping.......................................................................................................................................... 270
A. MIB Groups.......................................................................................................................................271
B. Account Privileges List......................................................................................................................272
User Role Privileges ........................................................................................................................... 272

EDR-G9010 Series User Manual
6
1. Introduction
Welcome to the Moxa EDR-G9010 Industrial Secure Router Series. These all-in-one Firewall/NAT/VPN secure
routers are designed for connecting Ethernet-enabled devices with network IP security.
Overview
As the world’s network and information technology becomes more mature, the trend is to use Ethernet as
the major communications interface in many industrial communications and automation applications. In
fact, an entirely new industry has sprung up to provide Ethernet products that comply with the
requirements of demanding industrial applications.
Moxa’s Industrial Secure Router series is a Gigabit speed, all-in-one Firewall/VPN/Router for Ethernet
security applications in sensitive remote control and monitoring networks.
The Quick Automation Profile function of the Industrial Secure Router’s firewall supports most common
Fieldbus protocols, including EtherCAT, EtherNet/IP, FOUNDATION Fieldbus, Modbus/TCP, and PROFINET.
Users can easily create a secure Ethernet Fieldbus network from a user-friendly web UI with a single click.
In addition, wide temperature models are available that operate reliably in hazardous, -40 to 75°C
environments.
The EDR-G9010 Series is a set of highly integrated industrial multi-port secure routers with
firewall/NAT/VPN and managed Layer 2 switch functions. These devices are designed for Ethernet-based
security applications in critical remote control or monitoring networks. These secure routers provide an
electronic security perimeter to protect critical cyber assets including substations in power applications,
pump-and-treat systems in water stations, distributed control systems in oil and gas applications, and
PLC/SCADA systems in factory automation.
Package Checklist
The Industrial Secure Routers are shipped with the following items. If any of these items are missing or
damaged, please contact your customer service representative for assistance.
•1 Moxa Industrial Secure Router
•USB-C-to-DB9 cable
•Protective caps for unused ports
•DIN-rail mounting kit (attached to the Industrial Secure Router’s rear panel by default)
•Quick installation guide (printed)
•Warranty card
Features
•10-port Gigabit all-in-one firewall/NAT/VPN/router/switch
•Industrial-grade Intrusion Prevention/Detection System (IPS/IDS)
•Visualize OT security with the MXsecurity management software
•Secure remote access tunnel with VPN
•Examine industrial protocol data with Deep Packet Inspection (DPI) technology
•Easy network setup with Network Address Translation (NAT)
•RSTP/Turbo Ring redundant protocol enhances network redundancy
•Security features based on IEC 62443/NERC CIP
•Supports secure boot for checking system integrity
•-40 to 75°C operating temperature range (-T model)

EDR-G9010 Series User Manual
7
Defend Against Malicious Threats With Advanced
Cybersecurity Features
The EDR-G9010 Series’ embedded firewall uses policy rules to control network traffic between trusted zones
while Network Address Translation (NAT) shields the internal network from unauthorized access by outside
hosts. The Virtual Private Networking (VPN) functionality further provides users with secure communication
tunnels when accessing the private network from the public Internet. To help protect your OT assets from
cyberattacks, the EDR-G9010 Series supports Deep Packet Inspection (DPI) to examine the data portion of
network packets for various OT-specific protocols.
Simplify Configurations With the User-friendly Interface and
Quick Settings
The EDR-G9010 Series’ “Interface Type Quick Settings” provide an easy way for users to set up WAN, LAN,
and Bridge ports for routing functionality in just four steps. In addition, the “Quick Automation Profile”
feature gives engineers a simple way to configure the firewall filtering function for general automation
protocols, including EtherNet/IP, Modbus TCP, EtherCAT, FOUNDATION Fieldbus, and PROFINET.
Industrial-grade Design to Ensure Uninterrupted Network
Connectivity
The EDR-G9010 Series’ rugged hardware makes these secure routers ideal for harsh industrial
environments, featuring wide-temperature models that are built to operate reliably in hazardous conditions
and extreme temperatures of -40 up to 75°C. Moreover, the EDR-G9010 Series supports comprehensive
Layer 2 and Layer 3 redundancy mechanisms to ensure that your network stays connected at all times.
Virtual Patching and Intelligent Threat Protection
Patching remains a major challenge in OT environments because OT applications cannot afford interrupting
operations by shutting down systems to apply patches. Virtual patching technology can help complement
existing patch management processes by shielding known and unknown vulnerabilities. In addition, the
EDR-G9010 features intelligent IPS functionality for continuous protection against cyberthreats which uses
pattern-based detection to identify and block known attacks.

EDR-G9010 Series User Manual
8
2. Getting Started
This chapter explains how to access the Industrial Secure Router for the first time. There are three ways to
access the router: (1) serial console, (2) Telnet console, and (3) web browser. The serial console connection
method, which requires using a short serial cable to connect the Industrial Secure Router to a PC’s COM
port, can be used if you do not know the Industrial Secure Router’s IP address. The Telnet console and web
browser connection methods can be used to access the Industrial Secure Router over an Ethernet LAN, or
over the Internet. A web browser can be used to perform all monitoring and administration functions, but
the serial console and Telnet console only provide basic functions.
RS-232 Console Configuration (115200, None,
8, 1, VT100)
ATTENTION
We strongly suggest that you do NOT use more than one connection method at the same time. Following
this advice will allow you to maintain better control over the configuration of your Industrial Secure Router.
NOTE
We recommend using Moxa PComm Terminal Emulator, which can be downloaded free of charge from
Moxa’s website.
Before running PComm Terminal Emulator, use a USB-C-to-DB9-F (or USB-C-to-DB25-F) cable to connect
the Industrial Secure Router’s RS-232 console port to your PC’s COM port (generally COM1 or COM2,
depending on how your system is set up).
After installing PComm Terminal Emulator, perform the following steps to access the RS-232 console utility.
1. From the Windows desktop, click Start > Moxa > PComm Terminal Emulator.
2. Click Open in the Port Manager menu to open a new connection.

EDR-G9010 Series User Manual
9
3. The Communication Parameter page of the Property window will appear. Select the appropriate
COM port from the Serial Parameters list and configure the following values:
Baud Rate: 115200
Data Bits: 8,
Parity: None
Stop Bits: 1.
4. Click the Terminal tab, select VT100 for Terminal Type, then click OK to continue.

EDR-G9010 Series User Manual
10
5. The Console screen will appear. Press Enter to input the login account (admin or user) and press
Enter again to jump to the Password field. Enter the console password, or if no password has been
configured before, enter the default password “moxa” and press Enter.
6. Enter a question mark (?) to display the command list.
The following table lists the commands that can be used when the Industrial Secure Router is in console
(serial or Telnet) mode:
Admin Account Commands
Command
Description
quit
Exit the Command Line Interface
exit
Exit the Command Line Interface
reload
Halt and perform a cold restart
terminal
Configure the terminal page length
copy
Import or export a file
config-file
Configure a file
no
Negate a command or reset to its defaults
save
Save the running configuration to flash
ping
Send echo messages
tcpdump
Dump traffic on a network
clear
Clear information
show
Show system information
configure
Enter Configuration Mode
sslcertgen
Generate a SSL certificate
sshkeygen
Generate a SSH host key

EDR-G9010 Series User Manual
11
Using Telnet to Access the Industrial Secure
Router’s Console
You may use Telnet to access the Industrial Secure Router’s console utility over a network. To access the
EDR’s functions over the network (by either Telnet or a web browser) from a PC host that is connected to
the same LAN as the Industrial Secure Router, you need to make sure that the PC host and the Industrial
Secure Router are on the same logical subnet. To do this, check your PC host’s IP address and subnet mask.
By default, the LAN IP address is 192.168.127.254 and the Industrial subnet mask is 255.255.255.0 (for a
Class C subnet). If you do not change these values, and your PC host’s subnet mask is 255.255.0.0, then its
IP address must have the form 192.168.xxx.xxx. On the other hand, if your PC host’s subnet mask is
255.255.255.0, then its IP address must have the form, 192.168.127.xxx.
NOTE
To use the Industrial Secure Router’s management and monitoring functions from a PC host connected to
the same LAN as the Industrial Secure Router, you must make sure that the PC host and the Industrial
Secure Router are connected to the same logical subnet.
NOTE
Before accessing the console utility via Telnet, first connect one of the Industrial Secure Router’s RJ45
Ethernet LAN ports to your Ethernet LAN, or directly to your PC’s Ethernet card (NIC). You can use either a
straight-through or cross-over Ethernet cable.
NOTE
The Industrial Secure Router’s default LAN IP address is 192.168.127.254.
Perform the following steps to access the console utility via Telnet.
1. Click Start > Windows System > Run from the Windows desktop.

EDR-G9010 Series User Manual
12
2. Enter “telnet 192.168.127.254” and click OK to connect to the Industrial Secure Router’s IP address.
You may also issue the Telnet command from the MS-DOS prompt.
3. The Console login screen will appear. Enter the login account (admin or user) and press Enter to
jump to the Password field. Enter the console password, or if no password has been configured before,
enter the default password “moxa” and press Enter.
4. Enter a question mark (?) to display the command list.
Using a Web Browser to Configure the
Industrial Secure Router
The Industrial Secure Router’s web browser interface provides a convenient way to modify the router’s
configuration and access the built-in monitoring and network administration functions. The recommended
web browser is Microsoft Internet Explorer 6.0 with JVM (Java Virtual Machine) installed.
NOTE
To use the Industrial Secure Router’s management and monitoring functions from a PC host connected to
the same LAN as the Industrial Secure Router, you must make sure that the PC host and the Industrial
Secure Router are connected to the same logical subnet.

EDR-G9010 Series User Manual
13
NOTE
Before accessing the Industrial Secure Router’s web browser, first connect one of the Industrial Secure
Router’s RJ45 Ethernet LAN ports to your Ethernet LAN, or directly to your PC’s Ethernet card (NIC). You
can use either a straight-through or cross-over Ethernet cable.
NOTE
The Industrial Secure Router’s default LAN IP address is 192.168.127.254.
Perform the following steps to access the Industrial Secure Router’s web browser interface.
1. Open a web browser and type the Industrial Secure Router’s LAN IP address (192.168.127.254) in the
address bar and press Enter.
2. The web login page will open. Enter the username (Admin or User) and password (the same as the
Console password) and click LOG IN to continue. Enter the default password “moxa” if a password has
not been set yet.
You may need to wait a few moments for the web interface to appear. If you have logged in before, a
system message will appear showing the details of the last successful login. Click CLOSE to close this
message.

EDR-G9010 Series User Manual
14
After successfully connecting to the router, the Device Summary screen will automatically appear. Use the
menu tree on the left side of the window to open the function pages to access each of the router’s functions.

EDR-G9010 Series User Manual
15
3. Device Summary and Setup Wizard
In this chapter, we explain how to access the Industrial Secure Router’s configuration options, perform
monitoring, and use administration functions. There are three ways to access these functions: (1) RS-232
console, (2) Telnet console, and (3) web browser.
The web browser is the most user-friendly way to configure the Industrial Secure Router since you can both
monitor the Industrial Secure Router and use administration functions from the web browser. An RS-232 or
Telnet console connection only provides basic functions. In this chapter, we use the web browser to
introduce the Industrial Secure Router’s configuration and monitoring functions.
Function Introduction
1. Clicking in the top-left will close or expand the function menu.
2. Enter the name of a function in the Search Bar to quickly find a specific function.
3. Click on a function name in the Function Menu on the left-hand side to view or configure the function.
4. All the configuration options and information of the selected function will be shown here.
5. This shows the name of the logged in user.

EDR-G9010 Series User Manual
16
6. Clicking in the top-right will expand the drop-down menu shown below.
Reboot
Click RESTART to reboot the Industrial Secure Router.
Reset to Defaults
The Reset to Defaults option gives users a quick way of restoring the Industrial Secure Router’s
configuration settings to their factory default values. This function is available in both the console utility
(serial or Telnet) and the web browser interface.
Check the Keep certificate database and configuration option to keep certificate database and
configuration information. Leaving this option unchecked will delete all information on the device and reset
everything to its factory default value.
Click RESET to reset the Industrial Secure Router to the factory default settings. Be aware that all your
configuration settings will be permanently deleted.
NOTE
After resetting the device, you will need to use the default network settings to re-establish a web-browser
or Telnet connection to your Industrial Secure Router.

EDR-G9010 Series User Manual
17
Log Out
Click LOG OUT to log out of the Industrial Secure Router.
Device Summary
When logging in to the Industrial Secure Router, you will be presented with the Device Summary page.
This overview page contains basic activity and performance information of the device. If you are on another
configuration page, click Device Summary from the Function Menu to jump to the summary page.
See the following sections for a more detailed description of each widget on the summary page.

EDR-G9010 Series User Manual
18
Model Information
This panel shows basic information for the Industrial Secure Router, including product model name, serial
number, firmware version, system uptime, etc.
Panel Status
This panel illustrates the panel status. For example, the connecting ports will be shown in green, while the
disconnected ports will be shown in gray. Click to view more detailed information. Click
to hide the details.

EDR-G9010 Series User Manual
19
Panel View
Click the icon in the Panel Status widget to view the device port status on a representative image of the
device. Click the icon in the upper-right corner to close the panel view.
The panel view figure varies depending on the product model you are using.
Event Summary (Last 3 Days)
This panel shows the event summary for the past three days.
Click to go to the Event Log page, where you can view all event logs in more detail.

EDR-G9010 Series User Manual
20
For Event Log settings, refer to the Event Log section.
CPU Usage History (%)
This panel shows the device’s CPU usage. The data will be shown as a percentage over time. Click the
icon to refresh the graph.