Siemens SCALANCE S623 User manual

Siemens
Scalance S623

Overview
•Basic Configuration
•Standard mode Firewall
•Advanced Firewall
•Password Management
•Advanced Password Management
•VPN with PreShared Key
•VPN with Certificates
•Gateway-to-Gateway VPN
•VPN with User Authentication

Technology Overview
•User Authentication
oOn-device
oConnection with RADIUS server
•VPN
oIPsec end-to-end

Necessary Software
•Siemens Security Configuration Tool
•Siemens SOFTNET Security Client
•Siemens Automation License Manager
•(Optional) Siemens Primary Setup Tool

Basic Configuration
In this example we set the IP addresses of all 3 interfaces on
the Scalance 623
This will demonstrate configuration steps that will be reused
in every following example

Basic Configuration
1. Setting up the network
2. Making IP settings for the PC
3. Creating a project and security module
4. Downloading the configuration to the security module

Basic Configuration
•Connecting the external interface of the Scalance to the
PC
•Scalance interfaces
oExternal network
Red marking = unprotected network area
oInternal network
Green marking = network protected by Scalance
oDMZ port
Yellow marking = unprotected or protected network
1. Setting up the network

Basic Configuration
•Open Control Panel “Start” > “Control Panel”
•Open “Network and Sharing Center”
2. Making IP settings for the PC
PC
IP
address
Subnet
mask
PC
192.168.10.2
255.255.255.0

Basic Configuration
•Select “Change adapter settings”
•Open the Local Area Connection Properties
Doubleclick “Local Area Connection”, then click
“Properties”
2. Making IP settings for the PC
PC
IP
address
Subnet
mask
PC
192.168.10.2
255.255.255.0

Basic Configuration
•Click the “Properties” button
•Select “Use the following IP”
•Enter the values from the
table in the relevant boxes
•Close the dialogs with “Ok”
and close Control Panel
2. Making IP settings for the PC
PC
IP
address
Subnet
mask
PC
192.168.10.2
255.255.255.0

Basic Configuration
•Start the Security Configuration Tool
•Select the “Project” > “New...” menu command
•Create a new user
This user is assigned
the “administrator”
role
•Confirm with “OK”
3. Creating a project and security module

Basic Configuration
•In the “Product type”, “Module” and “Firmware release”
areas, select the following options
oProduct type: Scalance S
oModule: S623
oFirmware release: V4
3. Creating a project and security module

Basic Configuration
•In the “Configuration” area, enter the MAC address
The MAC address is printed on the front of the
SCALANCE
3. Creating a project and security module

Basic Configuration
•In the “Configuration” area, enter the external IP address
(192.168.10.1) and the external subnet mask
(255.255.255.0)
•From the drop-down list,
select the “Routing Mode”
•Enter the internal IP address
(192.168.9.1) and the internal
subnet mask (255.255.255.0)
•Confirm with “OK”
3. Creating a project and security module

Basic Configuration
•Select the security module created and select the “Edit” >
“Properties” menu command, “Interfaces” tab
•Select the “Activate Interface” check
box in the “DMZ port (X3)” area
•Enter the IP address (192.168.8.1)
and the subnet mask (255.255.255.0)
for the DMZ interface
•Confirm with “OK”
3. Creating a project and security module

Basic Configuration
•Select the “Project” > “Save” menu command
•Select the security module in the content area
•Select the “Transfer” > “To module(s)…” menu command
•Start the download with the “Start” button
4. Downloading the configuration to the security module

Basic Configuration
•If the download was completed successfully, the Scalance
is restarted automatically and the configuration activated
•The Scalance is now in productive operation
•Configurations can be download via all interfaces
•The configured IP addresses can be modified
4. Downloading the configuration to the security module

Standard mode Firewall
In this example, the firewall will be configured to allow IP
traffic to only be initiated by the internal network

Standard mode Firewall
1. Setting up the network
2. Making IP settings for the PCs
3. Creating a project and security module
6. Testing the firewall function (ping test/logging)
4. Configuring the firewall
5. Downloading the configuration to the security module

Standard mode Firewall
•Reset the Scalance to factory settings by pressing the
Reset button and holding it down for at least 5 seconds
•Connect the PC with the Security Configuration Tool (PC1)
to the external network interface
•Connect PC2 to the internal network interface
1. Setting up the network