Moxa Technologies EtherDevice EDR-G903 User manual

EDR-G903 User’s Manual
Second Edition, January 2011
www.moxa.com/product
© 2011 Moxa Inc. All rights reserved.
Reproduction without permission is prohibited.

EDR-G903 User’s Manual
The software described in this manual is furnished under a license agreement and may be used only in accordance with
the terms of that agreement.
Copyright Notice
Copyright ©2011 Moxa Inc.
All rights reserved.
Reproduction without permission is prohibited.
Trademarks
The MOXA logo is a registered trademark of Moxa Inc.
All other trademarks or registered marks in this manual belong to their respective manufacturers.
Disclaimer
Information in this document is subject to change without notice and does not represent a commitment on the part of
Moxa.
Moxa provides this document as is, without warranty of any kind, either expressed or implied, including, but not limited
to, its particular purpose. Moxa reserves the right to make improvements and/or changes to this manual, or to the
products and/or the programs described in this manual, at any time.
Information provided in this manual is intended to be accurate and reliable. However, Moxa assumes no responsibility for
its use, or for any infringements on the rights of third parties that may result from its use.
This product might include unintentional technical or typographical errors. Changes are periodically made to the
information herein to correct such errors, and these changes are incorporated into new editions of the publication.
Technical Support Contact Information
www.moxa.com/support
Moxa Americas
Toll-free: 1-888-669-2872
Tel: [phone]
Fax: [phone]
Moxa China (Shanghai office)
Toll-free: 800-820-5036
Tel: [phone]
Fax: [phone]
Moxa Europe
Tel: [phone]
Fax: [phone]
Moxa Asia-Pacific
Tel: [phone]
Fax: [phone]

Table of Contents
1. Introduction ...................................................................................................................................... 1-1
Overview ...........................................................................................................................................1-2
Package Checklist ...............................................................................................................................1-2
Features ............................................................................................................................................1-2
Industrial Networking Capability....................................................................................................1-2
Designed for Industrial Applications ...............................................................................................1-2
Useful Utility and Remote Configuration .........................................................................................1-2
2. Getting Started ................................................................................................................................. 2-1
RS-232 Console Configuration (115200, None, 8, 1, VT100) ....................................................................2-2
Using Telnet to Access the EDR-G903’s Console .....................................................................................2-4
Using a Web Browser to Configure the EDR-G903 ...................................................................................2-5
3. Features and Functions ..................................................................................................................... 3-1
Configuring Basic Settings ...................................................................................................................3-3
System Identification ...................................................................................................................3-3
Accessible IP...............................................................................................................................3-4
Password ...................................................................................................................................3-5
Time..........................................................................................................................................3-6
SettingCheck ..............................................................................................................................3-8
System File Update—by Remote TFTP ............................................................................................3-9
System File Update—by Local Import/Export ................................................................................ 3-10
Restart..................................................................................................................................... 3-11
Reset to Factory Default............................................................................................................. 3-11
Network Settings .............................................................................................................................. 3-11
Mode Configuration ................................................................................................................... 3-11
WAN1 Configuration .................................................................................................................. 3-12
WAN2 Configuration (includes DMZ Enable) .................................................................................. 3-15
Using DMZ Mode ....................................................................................................................... 3-18
LAN Interface ........................................................................................................................... 3-18
DHCP Server............................................................................................................................. 3-19
Static DHCP List ........................................................................................................................ 3-20
Dynamic DNS ........................................................................................................................... 3-20
Communication Redundancy .............................................................................................................. 3-21
How Dual WAN Backup Works..................................................................................................... 3-21
WAN Backup Configuration ......................................................................................................... 3-22
Static Routing and Dynamic Routing ................................................................................................... 3-23
Static Routing ........................................................................................................................... 3-24
RIP (Routing Information Protocol) .............................................................................................. 3-24
Routing Table ........................................................................................................................... 3-25
Network Address Translation (NAT)..................................................................................................... 3-26
NAT Concept............................................................................................................................. 3-26
N-to-1 NAT............................................................................................................................... 3-26
Port Forwarding ........................................................................................................................ 3-27
1-to-1 NAT ............................................................................................................................... 3-28
Firewall Settings ............................................................................................................................... 3-30
Firewall Policy Concept............................................................................................................... 3-30
Firewall Policy Overview ............................................................................................................. 3-30
Firewall Policy Configuration ....................................................................................................... 3-31
Layer 2 Policy Setup .................................................................................................................. 3-32
Quick Automation Profile ............................................................................................................ 3-34
PolicyCheck .............................................................................................................................. 3-35
Denial of Service (DoS) function.................................................................................................. 3-37
VPN (Virtual Private Network) ............................................................................................................ 3-38
Overview.................................................................................................................................. 3-38
IPSec Configuration ................................................................................................................... 3-39
X.509 Certification..................................................................................................................... 3-44
L2TP (Layer 2 Tunnel Protocol) ................................................................................................... 3-46
Examples for Typical VPN Applications ......................................................................................... 3-47
Traffic Prioritization........................................................................................................................... 3-49
How Traffic Prioritization Works................................................................................................... 3-49
Traffic Prioritization Configuration................................................................................................ 3-50
Configuring SNMP ............................................................................................................................. 3-53
Using Auto Warning .......................................................................................................................... 3-55
Using Diagnosis ................................................................................................................................ 3-58
Using Monitor................................................................................................................................... 3-59
Using System Log ............................................................................................................................. 3-60
Using HTTPs/SSL .............................................................................................................................. 3-62
A. MIB Groups ....................................................................................................................................... A-1

1
1. Introduction
Welcome to the Moxa EDR-G903 Series of Gigabit Firewall/VPN secure routers designed for connecting
Ethernet-enabled devices in industrial field applications.
The following topics are covered in this chapter:

Overview

Package Checklist

Features
Industrial Networking Capability
Designed for Industrial Applications
Useful Utility and Remote Configuration

EDR-G903 Introduction
1-2
Overview
As the world’s network and information technology becomes more mature, the trend is to use Ethernet as the
major communications interface in many industrial communications and automation applications. In fact, a
whole new industry has sprung up to provide Ethernet products that comply with the requirements of
demanding industrial applications.
The EDR-G903 series is a Gigabit speed, all-in-one Firewall/VPN/Router for Ethernet security applications in
sensitive remote control and monitoring networks. The EDR-G903 supports one WAN, one LAN, and a
user-configurable WAN/DMZ interface that provides high flexibility for different applications, such as WAN
redundancy or Data/FTP server security protection.
The Quick Automation Profile function of the EDR-G903’s firewall supports most common Fieldbus protocols,
including EtherCAT, EtherNet/IP, FOUNDATION Fieldbus, Modbus/TCP, and PROFINET. Users can easily create
a secure Ethernet Fieldbus network from a user-friendly web UI with a single click. In addition, wide
temperature models are available that operate reliably in hazardous, -40 to 75°C environments.
Package Checklist
The EDR-G903 is shipped with the following items. If any of these items are missing or damaged, please
contact your customer service representative for assistance.
•1 Moxa EDR-G903 secure router
•RJ45 to DB9 console port cable
•Protective caps for unused ports
•DIN-Rail mounting kit (attached to the EDR-G903’s rear panel by default)
•Hardware Installation Guide (printed)
•CD-ROM with User’s Manual and Windows Utility
•Moxa Product Warranty statement
Features
Industrial Networking Capability
•Router/Firewall/VPN all in one
•1 WAN, 1 LAN, and 1 user-configurable WAN or DMZ interface
•Network address translation (N-to-1, 1-to-1, and port forwarding)
Designed for Industrial Applications
•Dual WAN redundancy function
•Firewall with Quick Automation Profile for Fieldbus protocols
•Intelligent PolicyCheck and SettingCheck tools
•-40 to 75°C operating temperature (T models)
•Long-haul transmission distance of 40 km or 80 km (with optional mini-GBIC)
•Redundant, dual 12 to 48 VDC power inputs
•IP30, rugged high-strength metal case
•DIN-Rail or panel mounting ability
Useful Utility and Remote Configuration
•Configurable using a Web browser and Telnet/Serial console
•Send ping commands to identify network segment integrity

2
2. Getting Started
This chapter explains how to access the EDR-G903 for the first time. There are three ways to access the switch:
(1) serial console, (2) Telnet console, or (3) web browser. The serial console connection method, which
requires using a short serial cable to connect the EDR-G903 to a PC’s COM port, can be used if you do not know
the EDR-G903’s IP address. The Telnet console and web browser connection methods can be used to access the
EDR-G903 over an Ethernet LAN, or over the Internet. A web browser can be used to perform all monitoring
and administration functions, but the serial console and Telnet console only provide basic functions.
The following topics are covered in this chapter:

RS-232 Console Configuration (115200, None, 8, 1, VT100)

Using Telnet to Access the EDR-G903’s Console

Using a Web Browser to Configure the EDR-G903

EDR-G903 Getting Started
2-2
RS-232 Console Configuration (115200, None, 8,
1, VT100)
NOTE Connection Caution!
We strongly suggest that you do NOT use more than one connection method at the
same time. Following this
advice will allow you to maintain better control over the configuration of your EDR-G903
NOTE We recommend using Moxa PComm Terminal Emulator, which can be downloaded free of charge from Moxa’
s
website.
Before running PComm Terminal Emulator, use an RJ45 to DB9-F (or RJ45 to DB25-F) cable to connect the
EDR-G903’s RS-232 console port to your PC’s COM port (generally COM1 or COM2, depending on how your
system is set up).
After installing PComm Terminal Emulator, perform the following steps to access the RS-232 console utility.
1. From the Windows desktop, click Start Programs PCommLite1.3 Terminal Emulator.
2. Select Open in the Port Manager menu to open a new connection.
3. The Communication Parameter page of the Property window will appear. Select the appropriate COM
port for Console Connection, 115200 for Baud Rate, 8 for Data Bits, None for Parity, and 1 for Stop Bits

EDR-G903 Getting Started
2-3
4. Click the Terminal tab, and select VT100 for Terminal Type. Click OK to continue.
5. Type 1to select ansi/VT100 terminal type, and then press Enter.
6. The Console login screen will appear. Use the keyboard to enter the login account (admin or user),
and then press Enter to jump to the Password field. Enter the console Password (this is the same as
the Web Browser password; leave the Password field blank if a console password has not been set), and
then press Enter.
7. Enter a question mark (?) to display the command list in the console.
The following table shows a list of commands that can be used when the EDR-G903 is in console (serial or
Telnet) mode:
Login by Admin account:
Command Parameter/Example Description
disable Switch the Admin mode to User mode
exit/quit Exit this consol mode connection
lan lan ip address (A.B.C.D) netmask (A.B.C.D)
Example:
lan ip address 192.168.127.10 netmask
255.255.255.0
Set the IP address of LAN interface
list Print command list
no no password admin Set the admin password to null
no password user Set the user password to null
password password admin (password)
Example:
Password admin 1234
Set the admin password
password user (password)
Example:
Password user 1234
Set the user password
ping ping (IP address)
Example:
ping 192.168.127.10
Send echo message
reboot Reboot this device
reload default-config Reload default configuration and Reboot this
device
show show lan Show running system information

EDR-G903 Getting Started
2-4
telnet telnet (IP address)
Example:
telnet 192.168.127.10
Open a telnet connection
telnet (IP address) (port number)
Example:
telnet 192.168.127.10 23
Open a telnet connection with port number
ssh ssh (IP address)
Example:
ssh 192.168.127.10
Open a ssh connection
Login by User account:
Command Parameter/Example Description
exit/quit Exit this consol mode connection
list Print command list
ping ping (IP address)
Example:
ping 192.168.127.10
Ping remote device via IP
show show lan Show running system information
ssh ssh (IP address)
Example:
ssh 192.168.127.10
Open a ssh connection
telnet telnet (IP address)
Example:
telnet 192.168.127.10
Open a telnet connection
telnet (IP address) (port number)
Example:
telnet 192.168.127.10 23
Open a telnet connection with port number
Using Telnet to Access the EDR-G903’s Console
You may use Telnet to access the EDR-G903’s console utility over a network. To access the EDR’s functions
over the network (by either Telnet or a web browser) from a PC host that is connected to the same LAN as the
EDR-G903, you need to make sure that the PC host and the EDR-G903 are on the same logical subnet. To do
this, check your PC host’s IP address and subnet mask. By default, the EDR-G903’s LAN IP address is
192.168.127.254 and the EDR-G903’s subnet mask is 255.255.255.0 (for a Class C subnet). If you do not
change these values, and your PC host’s subnet mask is 255.255.0.0, then its IP address must have the form
192.168.xxx.xxx. On the other hand, if your PC host’s subnet mask is 255.255.255.0, then its IP address must
have the form, 192.168.127.xxx.
NOTE To use the EDR-G903’s management and
monitoring functions from a PC host connected to the same LAN as
the EDR-G903, you must make sure that the PC host and the EDR-G903 are connected to the same logical
subnet.
NOTE Before accessing the console utility via Telnet, first connect the EDR-G903’
s RJ45 Ethernet LAN ports to your
Ethernet LAN, or directly to your PC’s Ethernet card (NIC). You can use either a straight-through or cross-
over
Ethernet cable.
NOTE The EDR-G903’s default LAN IP address is 192.168.127.254.

EDR-G903 Getting Started
2-5
Perform the following steps to access the console utility via Telnet.
1. Click Start ( Run, and then telnet to the EDR-G903’s IP address from the Windows Run window. (You
may also issue the telnet command from the MS-DOS prompt.).
2. Refer to instructions 6 and 7 in the RS-232 Console Configuration (115200, None, 8, 1, VT100) section
on page 2-3.
Using a Web Browser to Configure the
EDR-G903
The EDR-G903’s web browser interface provides a convenient way to modify the switch’s configuration and
access the built-in monitoring and network administration functions. The recommended web browser is
Microsoft Internet Explorer 6.0 with JVM (Java Virtual Machine) installed.
NOTE To use the EDR-G903’s management and monitoring functions from a PC host connected to the sa
me LAN as
the EDR-G903, you must make sure that the PC host and the EDR-G903 are connected to the same logical
subnet.
NOTE Before accessing the EDR-G903’s web browser, first connect the EDR-G903’
s RJ45 Ethernet LAN ports to your
Ethernet LAN, or directly to your PC’s Ethernet card (NIC). You can use either a straight-through or cross-
over
Ethernet cable.
NOTE The EDR-G903’s default LAN IP address is 192.168.127.254.
Perform the following steps to access the EDR-G903’s web browser interface.
1. Start Internet Explorer and type the EDR-G903’s LAN IP address in the Address field. Press Enter to
establish the connection.
2. The web login page will open. Select the login account (Admin or User) and enter the Password (this
is the same as the Console password), and then click Login to continue. Leave the Password field blank
if a password has not been set.

EDR-G903 Getting Started
2-6
NOTE By default, the EDR-G903’s password is not set (i.e., is blank).
You may need to wait a few moments for the web page to be downloaded to your computer. Use the menu tree
on the left side of the window to open the function pages to access each of the router’s functions.

3
3. Features and Functions
In this chapter, we explain how to access the EDR-G903’s configuration options, perform monitoring, and use
administration functions. There are three ways to access these functions: (1) RS-232 console, (2) Telnet
console, and (3) web browser.
The web browser is the most user-friendly way to configure the EDR-G903, since you can both monitor the
EDR-G903 and use administration functions from the web browser. An RS-232 or Telnet console connection
only provides basic functions. In this chapter, we use the web browser to introduce the EDR-G903’s
configuration and monitoring functions.
The following topics are covered in this chapter:

Configuring Basic Settings

Network Settings

Communication Redundancy

Static Routing and Dynamic Routing

Network Address Translation (NAT)

Firewall Settings

VPN (Virtual Private Network)

Traffic Prioritization

Configuring SNMP

Using Auto Warning

Using Diagnosis

Using Monitor

Using System Log

Using HTTPs/SSL

EDR-G903 Features and Functions
3-2
The Overview page is divided into three major parts: Interface Status, Basic function status, and Recent 10
Event logs, and gives users a quick overview of the EDR-G903’s current settings.
Click More…at the top of the Interface Status table to see detailed information about all interfaces.

EDR-G903 Features and Functions
3-3
Click More…at the top of the “Recent 10 Event Log” table to open the EventLogTable page.
Configuring Basic Settings
The Basic Settings group includes the most commonly used settings required by administrators to maintain and
control the EDR-G903.
System Identification
The system identification section gives you an easy way to identify the different switches connected to your
network.
Router name
Setting Description Factory Default
Max. 30 Characters This option is useful for specifying the role or application of
different EDR-G903 units.
E.g., Factory Router 1.
Firewall/VPN router
[Serial No. of this
switch]
Router Location
Setting Description Factory Default
Max. 80 Characters To specify the location of different EDR-G903 units.
E.g., production line 1.
Device Location
Router Description
Setting Description Factory Default
Max. 30 Characters Use this field to enter a more detailed description of the
EDR-G903 unit.
None

EDR-G903 Features and Functions
3-4
Maintainer Contact Info
Setting Description Factory Default
Max. 30 Characters Enter the contact information of the person responsible for
maintaining this EDR-G903
None
Web Configuration
Setting Description Factory Default
http or https Users can connect to the EDR-G903 router via http or https
protocol.
http or https
https only Users can connect to the EDR-G903 router via https protocol
only.
Accessible IP
The EDR-G903 uses an IP address-based filtering method to control access to EDR-G903 units.
Accessible IP Settings allows you to add or remove “Legal” remote host IP addresses to prevent unauthorized
access. Access to the EDR-G903 is controlled by IP address. If a host’s IP address is in the accessible IP table,
then the host will have access to the EDR-G903. You can allow one of the following cases by setting this
parameter:
•Only one host with the specified IP address can access this device.
E.g., enter “192.168.1.1/255.255.255.255” to allow access to just the IP address 192.168.1.1.
•Any host on a specific subnetwork can access this device.
E.g., enter “192.168.1.0/255.255.255.0” to allow access to all IPs on the subnet defined by this IP
address/subnet mask combination.
•Any host can access the EDR-G903. (Disable this function by deselecting the Enable the accessible IP list
option.)
•Any LAN can access the EDR-G903. (Disable this function by deselecting the LAN option to not allow any IP
at the LAN site to access this device.)
E.g., If the LAN IP Address is set to 192.168.127.254/255.255.255.0, then IP addresses 192.168.127.1 /24
to 192.168.127.253/24 can access the EDR-G903.

EDR-G903 Features and Functions
3-5
The following table shows additional configuration examples:
Allowable Hosts Input Format
Ay host Disable
192.168.1.120 192.168.1.120 / 255.255.255.255
192.168.1.1 to 192.168.1.254 192.168.1.0 / 255.255.255.0
192.168.0.1 to 192.168.255.254 192.168.0.0 / 255.255.0.0
192.168.1.1 to 192.168.1.126 192.168.1.0 / 255.255.255.128
192.168.1.129 to 192.168.1.254 192.168.1.128 / 255.255.255.128
The Accessible IP list controls which devices can connect to the EDR-G903 to change the configuration of the
device. In the example shown below, the Accessible IP list in the EDR-G903 contains 10.10.10.10, which is the
IP address of the remote user’s PC.
The remote user’s IP address is shown below in the EDR-G903’s Accessible IP list.
Password
The EDR-G903 provides two levels of access privilege: “admin privilege” gives read/write access to all
EDR-G903 configuration parameters, and “user privilege” provides read access only. You will be able to view
the configuration, but will not be able to make modifications.

EDR-G903 Features and Functions
3-6
•ATTENTION!
•By default, the Password field
is blank. If a Password is already set, then you will be required to
type the Password when logging into the RS-232 console, Telnet console, or web browser
interface.
Account
Setting Description Factory Default
Admin “admin” privilege allows the user to modify all configurations. Admin
User “user” privilege only allows viewing device configurations.
Password
Setting Description Factory Default
Old password
(max. 16 Characters)
Type current password when changing the password None
New password
(max. 16 Characters)
Type new password when changing the password None
Retype password
(max. 16 Characters)
If you type a new password in the Password field, you will be
required to retype the password in the Retype new password
field before updating the new password.
None
Time
The Time configuration page lets users set the time, date, and other settings. An explanation of each setting
is given below.
The EDR-G903 has a time calibration function based on information from an NTP server or user specified Time
and Date information. Functions such as Auto warning “Email” can add real-time information to the message.

EDR-G903 Features and Functions
3-7
NOTE The EDR-G903 has a real time clock so the user d
oes not need to update the Current Time and Current Date
to set the initial time for the EDR-G903 after each reboot. This is especially useful
when the network does not
have an Internet connection for an NTP server, or there is no NTP server on the network.
Current Time
Setting Description Factory Default
User adjustable Time The time parameter allows configuration of the local time in
local 24-hour format.
None (hh:mm:ss)
Current Date
Setting Description Factory Default
User adjustable date. The date parameter allows configuration of the local date in
yyyy/mm/dd format
None
(yyyy/mm/dd)
Daylight Saving Time
Daylight Saving Time (also know as DST or summer time) involves advancing clocks 1 hour during the summer
to provide an extra hour of daylight in the evening.
Start Date
Setting Description Factory Default
User adjustable date. The Start Date parameter allows users to enter the date that
daylight saving time begins.
None
End Date
Setting Description Factory Default
User adjustable date. The End Date parameter allows users to enter the date that
daylight saving time begins.
None
Offset
Setting Description Factory Default
User adjustable date. The offset parameter indicates how many hours forward the
clock should be advanced.
None
System Up Time
Indicates the ED-G903’s up time from the last cold start. The unit is seconds.
Time Zone
Setting Description Factory Default
User selectable time
zone
The time zone setting allows conversion from GMT (Greenwich
Mean Time) to local time.
GMT
NOTE Changing the time zone will automatically correct the current time. You should configure the time zone
before setting the time.
Enable NTP/SNTP Server
Enable this function to configure the EDR-G903 as a NTP/SNTP server on the network.
Enable Server synchronize
Enable this function to configure the EDR-G903 as a NTP/SNTP client, It will synchronize the time information
with another NTP/SNTP server.

EDR-G903 Features and Functions
3-8
Time Server IP/Name
Setting Description Factory Default
1st Time Server
IP/Name
IP or Domain address (e.g., 192.168.1.1, time.stdtime.gov.tw,
or time.nist.gov).
None
2nd Time Server
IP/Name
The EDR-G903 will try to locate the 2nd NTP Server if the 1st
NTP Server fails to connect.
SettingCheck
SettingCheck is a safety function for industrial users using a secure router. It provides a double confirmation
mechanism for when a remote user changes the security policies, such as Firewall filter, NAT, and
Accessible IP list. When a remote user changes these security polices, SettingCheck provides a means of
blocking the connection from the remote user to the Firewall/VPN device. The only way to correct a wrong
setting is to get help from the local operator, or go to the local site and connect to the device through the
console port, which could take quite a bit of time and money. Enabling the SettingCheck function will execute
these new policy changes temporarily until doubly confirmed by the user. If the user does not click the confirm
button, the EDR-G903 will revert to the previous setting.
Firewall Policy
Enables or Disables the SettingCheck function when the Firewall policies change.
NAT Policy
Enables or Disables the SettingCheck function when the NAT policies change.
Accessible IP List
Enables or Disables the SettingCheck function when the Accessible IP List changes.
Layer 2 Fiber
Enable or disable the SettingCheck function when the Layer 2 filter changes.
Timer
Setting Description Factory Default
10 to 3600 sec. The timer waits this amount of time to double confirm when the
user changes the policies
180 (sec.)
For example, if the remote user (IP: 10.10.10.10) connects to the EDR-G903 and changes the accessible IP
address to 10.10.10.12, or deselects the Enable checkbox accidently after the remote user clicks the Activate
button, connection to the EDR-G903 will be lost because the IP address is not in the EDR-G903’s Accessible IP
list.

EDR-G903 Features and Functions
3-9
If the user enables the SettingCheck function with the Accessible IP list and the confirmer Timer is set to 15
seconds, then when the user clicks the Activate button on the accessible IP list page, the EDR-G903 will execute
the configuration change and the web browser will try to jump to the SettingCheck Confirmed page
automatically. Because the new IP list does not include the Remote user’s IP address, the remote user cannot
connect to the SettingCheck Confirmed page. After 15 seconds, the EDR-G903 will roll back to the original
Accessible IP List setting, allowing the remote user to reconnect to the EDR-G903 and check what’s wrong with
the previous setting.
If the new configuration does not block the connection from the remote user to the EDR-G903, the user will see
the SettingCheck Confirmed page, shown in the following figure. Click Confirm to save the configuration
updates.
System File Update—by Remote TFTP
The EDR-G903 supports saving your configuration file to a remote TFTP server or local host to allow other
EDR-G903 routers to use the same configuration at a later time, or saving the Log file for future reference.
Loading pre-saved firmware or a configuration file from the TFTP server or local host is also supported to make
it easier to upgrade or configure the EDR-G903.