Rockwell Automation Stratix 4300 User manual

Stratix 4300 Remote Access
Routers
Catalog Number 1783-RA2TGB, 1783-RA5TGB
User Manual Original Instructions

2Rockwell Automation Publication 1783-UM014A-EN-P - October 2021
Stratix 4300 Remote Access Routers User Manual
Important User Information
Read this document and the documents listed in the additional resources section about installation, configuration, and
operation of this equipment before you install, configure, operate, or maintain this product. Users are required to familiarize
themselves with installation and wiring instructions in addition to requirements of all applicable codes, laws, and standards.
Activities including installation, adjustments, putting into service, use, assembly, disassembly, and maintenance are required to
be carried out by suitably trained personnel in accordance with applicable code of practice.
If this equipment is used in a manner not specified by the manufacturer, the protection provided by the equipment may be
impaired.
In no event will Rockwell Automation, Inc. be responsible or liable for indirect or consequential damages resulting from the use
or application of this equipment.
The examples and diagrams in this manual are included solely for illustrative purposes. Because of the many variables and
requirements associated with any particular installation, Rockwell Automation, Inc. cannot assume responsibility or liability for
actual use based on the examples and diagrams.
No patent liability is assumed by Rockwell Automation, Inc. with respect to use of information, circuits, equipment, or software
described in this manual.
Reproduction of the contents of this manual, in whole or in part, without written permission of Rockwell Automation, Inc., is
prohibited.
Throughout this manual, when necessary, we use notes to make you aware of safety considerations.
Labels may also be on or inside the equipment to provide specific precautions.
WARNING: Identifies information about practices or circumstances that can cause an explosion in a hazardous environment, which
may lead to personal injury or death, property damage, or economic loss.
ATTENTION: Identifies information about practices or circumstances that can lead to personal injury or death, property
damage, or economic loss. Attentions help you identify a hazard, avoid a hazard, and recognize the consequence.
IMPORTANT Identifies information that is critical for successful application and understanding of the product.
SHOCK HAZARD: Labels may be on or inside the equipment, for example, a drive or motor, to alert people that dangerous
voltage may be present.
BURN HAZARD: Labels may be on or inside the equipment, for example, a drive or motor, to alert people that surfaces may
reach dangerous temperatures.
ARC FLASH HAZARD: Labels may be on or inside the equipment, for example, a motor control center, to alert people to potential
Arc Flash. Arc Flash will cause severe injury or death. Wear proper Personal Protective Equipment (PPE). Follow ALL Regulatory
requirements for safe work practices and for Personal Protective Equipment (PPE).

Rockwell Automation Publication 1783-UM014A-EN-P - October 2021 3
Table of Contents
Preface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
About This Publication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
Additional Resources . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
Chapter 1
Remote Access Solution Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
Before You Begin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
Best Practices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
Remote Access Routers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
1783-RA2TGB. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
1783-RA5TGB . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
Multi-factor Authentication. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
Typical Remote Access Architectures. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
Secure Remote Connectivity - Use Case: Cell/Area Zone SRA. . . . . 14
Secure Remote Connectivity - Use Case: Modem Direct/Isolated
Machine . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
Chapter 2
Connect Via Ethernet . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
Add an IP Address. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28
Associate the Router with a Domain . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28
Protect Against Unwanted Domain Change . . . . . . . . . . . . . . . . . . . . . . . 31
Remove and Move Devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31
Firewall Policies. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32
Create a Firewall Policy. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32
Update the System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35
Factory Reset . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35
Router Restart . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36

4Rockwell Automation Publication 1783-UM014A-EN-P - October 2021
Appendix A
Status Indicators. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37
Status Indicators Descriptions. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37
Export Logs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38
Audit Logs. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38
Index . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39

Rockwell Automation Publication 1783-UM014A-EN-P - October 2021 5
Preface
About This Publication This manual describes how to use Stratix® 4300 Remote Access Routers.
Make sure that you are familiar with use of an Ethernet/IP network.
Product compatibility information and release notes are available online
within the Product Compatibility and Download Center.
Additional Resources These documents contain additional information concerning related products
from Rockwell Automation.
You can view or download publications at rok.auto/literature.
Resource Description
Cloud Connectivity to a Converged Plantwide Ethernet Architecture Design Guide,
publication ENET-TD017
Converged Plantwide Ethernet (CPwE) is a collection of architected, tested, and validated
designs. The testing and validation follow the Cisco® Validated Design (CVD) and Cisco Reference
Design (CRD) methodologies.
Converged Plantwide Ethernet (CPwE) Design and Implementation
Guide, publication ENET-TD001
The Implementation Guide represents a collaborative development effort from Cisco Systems
and Rockwell Automation®. It is built on, and adds to, design guidelines from the Cisco Ethernet-
to-the-Factory (EttF) solution and the Rockwell Automation Integrated Architecture®.
Deploying Industrial Firewalls within a Converged Plantwide Ethernet
Architecture Design and Implementation Guide, publication ENET-TD002
The Deploying Industrial Firewalls within a Converged Plantwide Ethernet Architecture Design
and Implementation Guide (DIG) outlines several use cases for designing, deploying and
managing industrial firewalls throughout a plant-wide Industrial Automation and Control System
(IACS) network infrastructure.
EtherNet/IP Network Devices User Manual, publication ENET-UM006 Describes how to configure and use EtherNet/IP™ devices to communicate on the EtherNet/IP
network.
Ethernet Reference Manual, publication ENET-RM002 Describes basic Ethernet concepts, infrastructure components, and infrastructure features.
FactoryTalk Remote Access Help website, rok.auto/help Describes how to use and troubleshoot FactoryTalk® Remote Access.
Industrial Automation Wiring and Grounding Guidelines, publication 1770-4.1 Provides general guidelines for installing a Rockwell Automation industrial system.
Industrial Components Preventive Maintenance, Enclosures, and Contact Ratings
Specifications, publication IC-TD002 Provides a quick reference tool for Allen-Bradley® industrial automation controls and assemblies.
Product Certifications website, rok.auto/certifications. Provides declarations of conformity, certificates, and other certification details.
Safety Guidelines for the Application, Installation, and Maintenance of Solid-state
Control, publication SGI-1.1
Designed to harmonize with NEMA Standards Publication No. ICS 1.1-1987 and provides general
guidelines for the application, installation, and maintenance of solid-state control in the form of
individual devices or packaged assemblies incorporating solid-state components.
Stratix 4300 Remote Access Routers Installation Instructions,
publication 1783-IN020 Describes how to install a Stratix 4300 Remote Access Router.
Stratix Ethernet Device Specifications Technical Data, publication , 1783-TD002 Describes the technical specifications of Stratix Devices.
System Security Design Guidelines Reference Manual, publication SECURE-RM001 Provides guidance on how to conduct security assessments, implement Rockwell Automation
products in a secure system, harden the control system, manage user access, and dispose of
equipment.

6Rockwell Automation Publication 1783-UM014A-EN-P - October 2021
Notes:

Rockwell Automation Publication 1783-UM014A-EN-P - October 2021 7
Chapter 1
Remote Access Architecture
The Stratix® 4300 remote access router provides the ability for manufactures
and OEMs to apply the appropriate skills and resources independent of their
physical location by enabling our customers to continue to maintain their
operations with remote access via VPN. The solution helps reduce costs, add
value to customer operations, and encourage collaboration between OEMs and
customers.
The Stratix 4300 router:
• Full gigabit router
• Supports configuration via FactoryTalk® Remote Access software
• Uses VPN connections that are optimized for industrial communications
with reduced latency
Factory Talk Remote Access software:
• Manages user and group configurations to segment network access and
permissions
• Provides log and audit trails for activities for established connections
Topic Page
Remote Access Solution Overview 8
Remote Access Routers 10
Multi-factor Authentication 13
Typical Remote Access Architectures 14

8Rockwell Automation Publication 1783-UM014A-EN-P - October 2021
Chapter 1 Remote Access Architecture
Remote Access Solution
Overview
Before You Begin
Remote Access for Industrial Equipment enables connectivity to remote
machines by leveraging optimized VPN technologies. The remote access
solution includes hardware and software.
There are three key components for remote access.
1. The Stratix 4300 Remote Access Router enables access to remote
equipment through a VPN connection.
2. Server infrastructure is a distributed cloud-based server infrastructure
that facilitates the connections.
3. FactoryTalk Remote access is a web-based client that is used to maintain
and initiate remote connections.
Together, these products enable secure access to industrial machines, skids,
and assets.
The Stratix 4300 must be registered to FactoryTalk Remote Access before a
connection can be initiated.
Cloud Server
Infrastructure
Stratix 4300
FactoryTalk
Remote Access
VPN Tunnel
Remote Equipment
Stratix 4300
FactoryTalk Remote Access
Secure Secure
Server
Infrastructure

Rockwell Automation Publication 1783-UM014A-EN-P - October 2021 9
Chapter 1 Remote Access Architecture
Best Practices
• FactoryTalk Remote Access Administrator enforces two-factor-
authentication.
• The FactoryTalk Remote Access software must be up to date in case
security improvements are released.
• Configure strong, complex user passwords.
• Stratix 4300 routers must be connected to the internet through its WAN
port. Stratix 4300 routers do not enable any service through that port and
only need an outgoing connection through to the configured outgoing
port (TCP port 443, 80, or 5935). An additional firewall can provide more
protection.
• Undertake a formal threat and risk assessment in relation to remote
access.
• Use the provided role-based access control.
• Use the provided physical controls to enable or disable remote access.
• Monitor security incidents and logs pro-actively to provide timely
incident response and accurate forensics.
• Conduct regular reviews and assessments of the secure remote access
solution and technologies to maintain compliance with policies and
procedures.
• Apply defense in depth practices for the secure remote access solution,
including practices to secure the remote computer.

10 Rockwell Automation Publication 1783-UM014A-EN-P - October 2021
Chapter 1 Remote Access Architecture
Remote Access Routers 1783-RA2TGB
Figure 1 - 1783-RA2TGB
1
2
3
4
5
6
7
8
9
10
Table 1 - 1783-RA2TGB Router Front View
1 Restart Status Indicator
2 Server/USB Status Indicator
3 COM RX Status Indicator
4USB2.0
5WAN
6LAN
7COM
8 Power Status Indicator
9 Remote Connect Status Indicator
10 COM TX Status Indicator