Siemens SIMATIC NET SCALANCE SC-600 Instruction sheet

SCALANCE SC-600 Web Based Management (WBM)
SIMATIC NET
Industrial Ethernet Security
SCALAN
CE SC-600 Web Based
Management (WBM)
Configuration Manual
10/2021
C79000
-G8976-C475-03
Introduction
Security
recommendations
1
Description
2
Technical basics
3
Configuring with Web
Based Management
4
Upkeep and maintenance
5
Exchange of configuration
data with STEP7
6
Appendix A
A

Siemens AG
Digital Industries
Postfach 48 48
90026 NÜRNBERG
GERMANY
C79000-G8976-C475-03
Ⓟ
10/2021 Subject to change
Copyright © Siemens AG 2017 -
2021.
All rights reserved
Legal information
Warning notice system
This manual contains notices you have to observe in order to ensure your personal safety, as well as to
prevent damage to property. The notices referring to your personal safety are highlighted in the manual by a
safety alert symbol, notices referring only to property damage have no safety alert symbol. These notices
shown below are graded according to the degree of danger.
DANGER
indicates that death or severe personal injury will result if proper precautions are not taken.
WARNING
indicates that death or severe personal injury may result if proper precautions are not taken.
CAUTION
indicates that minor personal injury can result if proper precautions are not taken.
NOTICE
indicates that property damage can result if proper precautions are not taken.
If more than one degree of danger is present, the warning notice representing the highest degree of danger
will be used. A notice warning of injury to persons with a safety alert symbol may also include a warning
relating to property damage.
Qualified Personnel
The product/system described in this documentation may be operated only by personnel qualified for the
specific task in accordance with the relevant documentation, in particular its warning notices and safety
instructions. Qualified personnel are those who, based on their training and experience, are capable of
identifying risks and avoiding potential hazards when working with these products/systems.
Proper use of Siemens products
Note the following:
WARNING
Siemens products may only be used for the applications described in the catalog and in the relevant
technical documentation. If products and components from other manufacturers are used, these must be
recommended or approved by Siemens. Proper transport, storage, installation, assembly, commissioning,
operation and maintenance are required to ensure that the products operate safely and without any
problems. The permissible ambient conditions must be complied with. The information in the relevant
documentation must be observed.
Trademarks
All names identified by ® are registered trademarks of Siemens AG. The remaining trademarks in this
publication may be trademarks whose use by third parties for their own purposes could violate the rights of
the owner.
Disclaimer of Liability
We have reviewed the contents of this publication to ensure consistency with the hardware and software
described. Since variance cannot be precluded entirely, we cannot guarantee full consistency. However, the
information in this publication is reviewed regularly and any necessary corrections are included in
subsequent editions.

SCALANCE SC-600 Web Based Management (WBM)
Configuration Manual, 10/2021, C79000-G8976-C475-03 3
Introduction
Validity of the configuration manual
This Configuration Manual covers the following products:
•SCALANCE SC622-2C
•SCALANCE SC632-2C
•SCALANCE SC636-2C
•SCALANCE SC642-2C
•SCALANCE SC646-2C
This Configuration Manual applies to the following software version:
•Firmware as of version V2.2
Purpose of the Configuration Manual
This Configuration Manual is intended to provide you with the information you require to
install, commission and operate the security appliances SCALANCE SC-600. It provides
you with the information you require to configure the Security Appliances SCALANCE
SC-600.

Introduction
SCALANCE SC-600 Web Based Management (WBM)
4Configuration Manual, 10/2021, C79000-G8976-C475-03
Designations used
Classification
Description
Term
Product line
If information applies to all product groups within the
product line, the term SCALANCE SC-600 is used.
•SCALANCE SC-600
Product group
If information applies to all devices of a product
group, a suitable term is used.
•SCALANCE SC622-2C and SC626-2C
•SCALANCE SC622-2C, SC632-2C and SCALANCE
SC642-2C
•SCALANCE SC626-2C, SCALANCE SC636-2C and
SCALANCE SC646-2C
•SCALANCE SC632-2C and SCALANCE SC636-2C
•SCALANCE SC642-2C and SCALANCE SC646-2C
•SC62x-2C
•SC6x2-2C
•SC6x6-2C
•SC63x-2C
•SC64x-2C
Device
If information relates to a specific device, the device
name is used. •SCALANCE SC622-2C
•SCALANCE SC626-2C
•SCALANCE SC632-2C
•SCALANCE SC636-2C
•SCALANCE SC642-2C
•SCALANCE SC646-2C
New in this edition
•Support of SCALANCE SC626-2C
•Protection against brute force attacks: Limit failed login attempts
•Support of PRESET PLUG
•"Firmware on PLUG" function enabled as default
•Dynamic firewall: Time triggered and login to RADIUS server
•Advanced SNMP configuration
•Configurable password policies
•802.1X Port Status as event
•Firewall State Sync
•Redundant NAT
Replaced edition
Edition 06/2020

Introduction
SCALANCE SC-600 Web Based Management (WBM)
Configuration Manual, 10/2021, C79000-G8976-C475-03 5
Orientation in the documentation
Apart from this configuration manual, the products also have the following
documentation:
•Configuration Manual:
–SCALANCE SC-600 Command Line Interface (CLI)
This document contains the CLI commands that are supported by the Security
Appliances SCALANCE SC-600 .
•Operating instructions:
–SCALANCE SC-600
–Pluggable transceiver SFP/SFP+/SCP/STP
These documents contain information on installing and connecting up and approvals
for the products.
•Getting Started SCALANCE S615
Based on examples, these documents explain the configuration of the SCALANCE
S615 and can also be used for the Security Appliances SCALANCE SC-600.
You will find the documentation here:
•On the data medium that ships with some products:
–Product CD / product DVD
–SIMATIC NET Manual Collection
•On the Internet pages of Siemens Industry Online Support:
Link: (https://support.industry.siemens.com/cs/ww/en/ps/15327/man)
Further documentation
In the system manuals "Industrial Ethernet / PROFINET Industrial Ethernet" and
"Industrial Ethernet / PROFINET passive network components", you will find information
on other SIMATIC NET products that you can operate along with the devices of this
product line in an Industrial Ethernet network.
There, you will find among other things optical performance data of the communications
partner that you require for the installation.

Introduction
SCALANCE SC-600 Web Based Management (WBM)
6Configuration Manual, 10/2021, C79000-G8976-C475-03
You will find the system manuals here:
•On the data medium that ships with some products:
–Product CD / product DVD
–SIMATIC NET Manual Collection
•On the Internet pages of Siemens Industry Online Support:
–Industrial Ethernet / PROFINET Industrial Ethernet System Manual
Link: (https://support.industry.siemens.com/cs/ww/en/view/27069465)
–Industrial Ethernet / PROFINET - Passive Network Components System Manual
Link: (https://support.industry.siemens.com/cs/ww/en/view/84922825)
SIMATIC NET manuals
You will find the SIMATIC NET manuals here:
•On the data medium that ships with some products:
–Product CD / product DVD
–SIMATIC NET Manual Collection
•On the Internet pages of Siemens Industry Online Support:
Link: (https://support.industry.siemens.com/cs/ww/en/ps/15247)
License conditions
Note
Open source software
Read the license conditions for open source software
carefully before using the product.
You will find the license conditions as a loadable file on the WBM pages of the device.
You will find the description of opening and loading license conditions in section File list
(Page 133) of the configuration manuals.
You can find the file with the license conditions for open source software under the
following name:
•OSS_Readme.zip

Introduction
SCALANCE SC-600 Web Based Management (WBM)
Configuration Manual, 10/2021, C79000-G8976-C475-03 7
Security information
Siemens provides products and solutions with industrial security functions that support
the secure operation of plants, systems, machines and networks.
In order to protect plants, systems, machines and networks against cyber threats, it is
necessary to implement –and continuously maintain –a holistic, state-of-the-art
industrial security concept. Siemens’ products and solutions constitute one element of
such a concept.
Customers are responsible for preventing unauthorized access to their plants, systems,
machines and networks. Such systems, machines and components should only be
connected to an enterprise network or the internet if and to the extent such a connection
is necessary and only when appropriate security measures (e.g. firewalls and/or network
segmentation) are in place.
For additional information on industrial security measures that may be implemented,
please visit
https://www.siemens.com/industrialsecurity
(https://www.siemens.com/industrialsecurity).
Siemens’ products and solutions undergo continuous development to make them more
secure. Siemens strongly recommends that product updates are applied as soon as they
are available and that the latest product versions are used. Use of product versions that
are no longer supported, and failure to apply the latest updates may increase customer’s
exposure to cyber threats.
To stay informed about product updates, subscribe to the Siemens Industrial Security
RSS Feed under
https://www.siemens.com/industrialsecurity
(https://www.siemens.com/industrialsecurity).
Firmware
The firmware is signed and encrypted. This ensures that only firmware created by
Siemens can be downloaded to the device.
Device defective
If a fault develops, please send the device to your Siemens representative for repair.
Repairs on-site are not possible.
Decommissioning
Shut down the device properly to prevent unauthorized persons from accessing
confidential data in the device memory.
To do this, restore the factory settings on the device.
Also restore the factory settings on the storage medium.

Introduction
SCALANCE SC-600 Web Based Management (WBM)
8Configuration Manual, 10/2021, C79000-G8976-C475-03
Recycling and disposal
The product is low in pollutants, can be recycled and meets the requirements of the
WEEE directive 2012/19/EU "Waste Electrical and Electronic Equipment".
Do not dispose of the product at public disposal sites. For environmentally friendly
recycling and the disposal of your old device contact a certified disposal company for
electronic scrap or your Siemens contact.
Keep to the local regulations.
You will find information on returning the product on the Internet pages of Siemens
Industry Online Support:
Link: (https://support.industry.siemens.com/cs/ww/en/view/109479891)
SIMATIC NET glossary
Explanations of many of the specialist terms used in this documentation can be found in
the SIMATIC NET glossary.
You will find the SIMATIC NET glossary on the Internet at the following address:
Link: (https://support.industry.siemens.com/cs/ww/en/view/50305045)

SCALANCE SC-600 Web Based Management (WBM)
Configuration Manual, 10/2021, C79000-G8976-C475-03 9
Table of contents
Introduction .................................................................................................................................................3
1 Security recommendations .................................................................................................................... 15
2 Description ............................................................................................................................................... 23
2.1 Function ............................................................................................................................................. 23
2.2 Requirements for operation ........................................................................................................... 25
2.2.1 Use in a PROFINET environment.................................................................................................. 26
2.3 System functions.............................................................................................................................. 26
2.4 Configuration limits for WBM and CLI......................................................................................... 28
2.5 PLUG .................................................................................................................................................. 29
2.5.1 PRESET PLUG .................................................................................................................................. 31
3 Technical basics ...................................................................................................................................... 33
3.1 IP address.......................................................................................................................................... 33
3.1.1 Structure of an IPv4 address ......................................................................................................... 33
3.1.2 IPv4 ..................................................................................................................................................... 35
3.1.3 Initial assignment of an IP address.............................................................................................. 36
3.1.4 Address assignment with DHCP................................................................................................... 36
3.2 MAC address..................................................................................................................................... 37
3.3 ICMP ................................................................................................................................................... 38
3.4 VLAN................................................................................................................................................... 40
3.4.1 VLAN tagging .................................................................................................................................... 41
3.5 SNMP.................................................................................................................................................. 43
3.6 Redundancy....................................................................................................................................... 45
3.6.1 HRP ..................................................................................................................................................... 45
3.6.2 MRP .................................................................................................................................................... 46
3.6.3 Spanning Tree................................................................................................................................... 48
3.6.4 RSTP................................................................................................................................................... 49
3.7 Routing function ............................................................................................................................... 50
3.7.1 Routing ............................................................................................................................................... 50
3.7.2 VRRPv3............................................................................................................................................... 50
3.7.3 Static routing..................................................................................................................................... 51
3.8 Security functions ............................................................................................................................ 51
3.8.1 Adapting the MTU for IPsec VPN and SINEMA RC .................................................................. 51
3.8.2 User management............................................................................................................................ 51
3.8.3 Firewall............................................................................................................................................... 54
3.8.3.1 Firewall rules SC600........................................................................................................................ 54
3.8.4 NAT ..................................................................................................................................................... 57
3.8.5 NAT and firewall............................................................................................................................... 58
3.8.6 Certificates ........................................................................................................................................ 59

Table of contents
SCALANCE SC-600 Web Based Management (WBM)
10 Configuration Manual, 10/2021, C79000-G8976-C475-03
3.8.7 VPN......................................................................................................................................................60
3.8.7.1 IPsec VPN...........................................................................................................................................60
3.8.7.2 OpenVPN............................................................................................................................................63
3.8.7.3 VPN connection establishment .....................................................................................................64
4 Configuring with Web Based Management.......................................................................................... 69
4.1 Web Based Management................................................................................................................69
4.2 Starting and logging in.....................................................................................................................71
4.3 "Information" menu ..........................................................................................................................75
4.3.1 Start page...........................................................................................................................................75
4.3.2 Versions ..............................................................................................................................................81
4.3.3 Identification & Maintenance.........................................................................................................82
4.3.4 ARP Table...........................................................................................................................................83
4.3.5 Log Tables..........................................................................................................................................84
4.3.5.1 Event Log............................................................................................................................................84
4.3.5.2 Security Log .......................................................................................................................................86
4.3.5.3 Firewall Log........................................................................................................................................88
4.3.6 Faults...................................................................................................................................................89
4.3.7 DHCP Server......................................................................................................................................90
4.3.8 LLDP....................................................................................................................................................91
4.3.9 Fiber Monitoring Protocol ...............................................................................................................93
4.3.10 Routing................................................................................................................................................94
4.3.11 Redundancy .......................................................................................................................................95
4.3.11.1 Spanning Tree ...................................................................................................................................95
4.3.11.2 VRRPv3 Statistics .............................................................................................................................98
4.3.11.3 Sync Firewall State........................................................................................................................ 101
4.3.11.4 Ring redundancy ............................................................................................................................ 102
4.3.12 Unicast............................................................................................................................................. 103
4.3.13 Multicast.......................................................................................................................................... 104
4.3.14 SNMP ............................................................................................................................................... 105
4.3.15 Security............................................................................................................................................ 105
4.3.15.1 Overview .......................................................................................................................................... 105
4.3.15.2 Supported Function Rights .......................................................................................................... 108
4.3.15.3 Roles................................................................................................................................................. 109
4.3.15.4 Groups.............................................................................................................................................. 110
4.3.15.5 802.1X Port Status......................................................................................................................... 111
4.3.15.6 MAC Authentication ...................................................................................................................... 112
4.3.16 IPSec VPN (SC64x-2C)................................................................................................................. 113
4.3.17 SINEMA RC ..................................................................................................................................... 115
4.3.18 OpenVPN ......................................................................................................................................... 116
4.3.18.1 Client ................................................................................................................................................ 116
4.3.18.2 Server ............................................................................................................................................... 117
4.4 "System" menu............................................................................................................................... 118
4.4.1 Configuration .................................................................................................................................. 118
4.4.2 General............................................................................................................................................. 124
4.4.2.1 Devices ............................................................................................................................................ 124
4.4.2.2 Coordinates..................................................................................................................................... 125
4.4.3 DNS .................................................................................................................................................. 127
4.4.3.1 DNS client ....................................................................................................................................... 127
4.4.3.2 DNS proxy ....................................................................................................................................... 128
4.4.3.3 DDNS client .................................................................................................................................... 128

Table of contents
SCALANCE SC-600 Web Based Management (WBM)
Configuration Manual, 10/2021, C79000-G8976-C475-03 11
4.4.3.4 DNS Records...................................................................................................................................130
4.4.4 Restart.............................................................................................................................................. 131
4.4.5 Load&Save ......................................................................................................................................133
4.4.5.1 File list..............................................................................................................................................133
4.4.5.2 HTTP................................................................................................................................................. 135
4.4.5.3 TFTP ................................................................................................................................................. 138
4.4.5.4 SFTP ................................................................................................................................................. 142
4.4.5.5 Passwords .......................................................................................................................................146
4.4.6 Events ............................................................................................................................................... 147
4.4.6.1 Configuration...................................................................................................................................147
4.4.6.2 Severity Filters................................................................................................................................151
4.4.7 SMTP client.....................................................................................................................................152
4.4.7.1 General............................................................................................................................................. 152
4.4.7.2 Receiver............................................................................................................................................ 155
4.4.8 DHCP ................................................................................................................................................156
4.4.8.1 DHCP Client ....................................................................................................................................156
4.4.8.2 DHCP Server ...................................................................................................................................158
4.4.8.3 DHCP options .................................................................................................................................160
4.4.8.4 Static Leases................................................................................................................................... 163
4.4.9 SNMP................................................................................................................................................ 165
4.4.9.1 General............................................................................................................................................. 165
4.4.9.2 SNMPv3 Users................................................................................................................................167
4.4.9.3 SNMPv3 User to Group mapping................................................................................................170
4.4.9.4 SNMPv3 Access ............................................................................................................................. 171
4.4.9.5 SNMPv3 Views ............................................................................................................................... 173
4.4.9.6 Notifications....................................................................................................................................175
4.4.10 System time..................................................................................................................................... 177
4.4.10.1 Manual Setting ...............................................................................................................................178
4.4.10.2 DST Overview .................................................................................................................................180
4.4.10.3 DST Configuration ......................................................................................................................... 182
4.4.10.4 SNTP Client..................................................................................................................................... 185
4.4.10.5 NTP Client ....................................................................................................................................... 189
4.4.10.6 SIMATIC Time Client.....................................................................................................................193
4.4.10.7 NTP server.......................................................................................................................................194
4.4.11 Auto logout ......................................................................................................................................196
4.4.12 Button............................................................................................................................................... 197
4.4.13 Syslog client ....................................................................................................................................198
4.4.14 Ports..................................................................................................................................................200
4.4.14.1 Overview...........................................................................................................................................200
4.4.14.2 Configuration...................................................................................................................................203
4.4.15 Fault monitoring ............................................................................................................................. 208
4.4.15.1 Power supply................................................................................................................................... 208
4.4.15.2 Link Change ....................................................................................................................................209
4.4.16 PLUG ................................................................................................................................................ 211
4.4.16.1 Configuration...................................................................................................................................211
4.4.16.2 License ............................................................................................................................................. 214
4.4.17 Ping ...................................................................................................................................................216
4.4.18 DCP Discovery................................................................................................................................217
4.4.19 Port diagnostics.............................................................................................................................. 220
4.4.19.1 Cable tester..................................................................................................................................... 220
4.4.19.2 SFP diagnostics.............................................................................................................................. 221
4.4.20 cRSP / SRS...................................................................................................................................... 223

Table of contents
SCALANCE SC-600 Web Based Management (WBM)
12 Configuration Manual, 10/2021, C79000-G8976-C475-03
4.4.21 Proxy server .................................................................................................................................... 225
4.4.22 SINEMA RC ..................................................................................................................................... 227
4.5 "Layer 2" menu............................................................................................................................... 230
4.5.1 Configuration .................................................................................................................................. 230
4.5.2 VLAN ................................................................................................................................................ 231
4.5.2.1 General............................................................................................................................................. 231
4.5.2.2 Port Based VLAN ........................................................................................................................... 234
4.5.3 Dynamic MAC Aging...................................................................................................................... 236
4.5.4 Ring redundancy (SC6x6-2C)...................................................................................................... 237
4.5.4.1 Ring................................................................................................................................................... 237
4.5.5 Spanning Tree ................................................................................................................................ 238
4.5.5.1 General............................................................................................................................................. 238
4.5.5.2 ST general ....................................................................................................................................... 239
4.5.5.3 ST Port ............................................................................................................................................. 241
4.5.6 LLDP................................................................................................................................................. 244
4.5.7 Fiber Monitoring Protocol ............................................................................................................ 246
4.5.8 Unicast............................................................................................................................................. 248
4.5.8.1 Filtering............................................................................................................................................ 248
4.5.8.2 Locked Ports................................................................................................................................... 250
4.5.8.3 Blocking ........................................................................................................................................... 252
4.5.9 Multicast.......................................................................................................................................... 253
4.5.9.1 Groups.............................................................................................................................................. 253
4.5.9.2 Blocking ........................................................................................................................................... 255
4.5.10 Inter-VLAN Bridge (SC63x/SC64x) ............................................................................................ 256
4.5.10.1 Overview .......................................................................................................................................... 256
4.5.10.2 Configuration .................................................................................................................................. 258
4.6 "Layer 3" menu............................................................................................................................... 259
4.6.1 Subnets............................................................................................................................................ 259
4.6.1.1 Overview .......................................................................................................................................... 259
4.6.1.2 Configuration .................................................................................................................................. 262
4.6.2 NAT................................................................................................................................................... 263
4.6.2.1 NAT General ................................................................................................................................... 263
4.6.2.2 Masquerading................................................................................................................................. 264
4.6.2.3 NAPT ................................................................................................................................................ 264
4.6.2.4 Source NAT..................................................................................................................................... 266
4.6.2.5 NETMAP .......................................................................................................................................... 268
4.6.3 Static routes.................................................................................................................................... 272
4.6.4 VRRPv3 ............................................................................................................................................ 274
4.6.4.1 Router............................................................................................................................................... 274
4.6.4.2 Configuration .................................................................................................................................. 277
4.6.4.3 Addresses Overview...................................................................................................................... 279
4.6.4.4 Address Configuration .................................................................................................................. 280
4.6.4.5 Interface Tracking.......................................................................................................................... 281
4.6.4.6 Address tracking ............................................................................................................................ 282
4.7 "Security" menu ............................................................................................................................. 284
4.7.1 Users ................................................................................................................................................ 284
4.7.1.1 Local Users ..................................................................................................................................... 284
4.7.1.2 Roles................................................................................................................................................. 287
4.7.1.3 Groups.............................................................................................................................................. 289
4.7.2 Passwords....................................................................................................................................... 292
4.7.2.1 Passwords....................................................................................................................................... 292

Table of contents
SCALANCE SC-600 Web Based Management (WBM)
Configuration Manual, 10/2021, C79000-G8976-C475-03 13
4.7.3 AAA....................................................................................................................................................293
4.7.3.1 General............................................................................................................................................. 293
4.7.3.2 RADIUS client ................................................................................................................................. 294
4.7.3.3 802.1X Authenticator..................................................................................................................... 297
4.7.4 Certificates ...................................................................................................................................... 303
4.7.4.1 Overview........................................................................................................................................... 303
4.7.4.2 Certificates ......................................................................................................................................304
4.7.5 Firewall............................................................................................................................................. 306
4.7.5.1 General............................................................................................................................................. 306
4.7.5.2 Predefined ....................................................................................................................................... 307
4.7.5.3 Dynamic Rules................................................................................................................................309
4.7.5.4 IP services ....................................................................................................................................... 313
4.7.5.5 ICMP services ................................................................................................................................. 314
4.7.5.6 IP protocols .....................................................................................................................................315
4.7.5.7 IP rules ............................................................................................................................................. 316
4.7.5.8 Pre-defined MAC rules ................................................................................................................. 319
4.7.5.9 MAC services .................................................................................................................................. 320
4.7.5.10 MAC rules ........................................................................................................................................321
4.7.5.11 Firewall State Sync ........................................................................................................................323
4.7.6 IPsec VPN (SC64x-2C).................................................................................................................. 324
4.7.6.1 General............................................................................................................................................. 324
4.7.6.2 Remote End.....................................................................................................................................325
4.7.6.3 Connections ....................................................................................................................................327
4.7.6.4 Authentication................................................................................................................................. 330
4.7.6.5 Phase 1.............................................................................................................................................332
4.7.6.6 Phase 2.............................................................................................................................................334
4.7.7 OpenVPN ......................................................................................................................................... 337
4.7.7.1 General............................................................................................................................................. 337
4.7.7.2 Connections ....................................................................................................................................338
4.7.7.3 Client................................................................................................................................................. 340
4.7.7.4 Authentication................................................................................................................................. 341
4.7.7.5 Server................................................................................................................................................ 342
4.7.8 Brute Force Prevention.................................................................................................................343
5 Upkeep and maintenance..................................................................................................................... 347
5.1 Device configuration with PRESET-PLUG................................................................................347
5.2 Firmware update using WBM not possible...............................................................................349
5.3 Restoring the factory settings ..................................................................................................... 352
6 Exchange of configuration data with STEP7 ..................................................................................... 353
6.1 Exchange of configuration data with STEP 7 Basic/Professional using a file ..................353
6.2 Message: SINEMA configuration not yet accepted ................................................................354
A Appendix A.............................................................................................................................................. 357
A.1 Structure of the Syslog messages ..............................................................................................357
A.2 Tags in Syslog messages ............................................................................................................. 358
A.3 Syslog messages............................................................................................................................ 359
Index ........................................................................................................................................................ 369

Table of contents
SCALANCE SC-600 Web Based Management (WBM)
14 Configuration Manual, 10/2021, C79000-G8976-C475-03

SCALANCE SC-600 Web Based Management (WBM)
Configuration Manual, 10/2021, C79000-G8976-C475-03 15
Security recommendations
1
To prevent unauthorized access to the device and/or network, observe the following
security recommendations.
General
•You should make regular checks to make sure that the device meets the following
recommendations and other internal security guidelines if applicable.
•Evaluate your plant as a whole in terms of security. Use a cell protection concept with
suitable products.
Link: (https://www.industry.siemens.com/topics/global/en/industrial-
security/Seiten/default.aspx)
•Check regularly for security updates of the products and use them.
•Check the user documentation of other Siemens products that are used together with
the device for additional security recommendations.
•Check regularly for news on the Siemens Internet pages.
–You can find information on Industrial Security here:
Link: (http://www.siemens.com/industrialsecurity)
–You can find information on security in industrial communication here:
Link: (http://w3.siemens.com/mcms/industrial-communication/de/ie/industrial-
ethernet-security/Seiten/industrial-security.aspx)
•Keep the software up to date. Always use the latest software version of the device.
Information regarding product news and new software versions is available at the
following address:
Link: (https://support.industry.siemens.com/cs/ww/en/ps/15327/pm)
Authentication
Note
Accessibility risk
- Risk of data loss
Do not lose the passwords for the device. Access to the device can only be restored by
resetting the device to factory settings w
hich completely removes all configuration data.
•Replace the default passwords for all user accounts, access modes and applications
(if applicable) before you use the device.
•Define rules for the assignment of passwords.

Security recommendations
SCALANCE SC-600 Web Based Management (WBM)
16 Configuration Manual, 10/2021, C79000-G8976-C475-03
•Use passwords with a high password strength. Avoid weak passwords, (e.g.
password1, 123456789, abcdefgh) or recurring characters (e.g. abcabc).
This recommendation also applies to symmetrical passwords/keys configured on the
device.
•Make sure that passwords are protected and only disclosed to authorized personnel.
•Do not use the same passwords for multiple user names and systems.
•Store the passwords in a safe location (not online) to have them available if they are
lost.
•Regularly change your passwords to increase security.
•A password must be changed if it is known or suspected to be known by unauthorized
persons.
•When user authentication is performed via RADIUS, make sure that all
communication takes place within the security environment or is protected by a
secure channel.
•Watch out for link layer protocols that do not offer their own authentication between
endpoints, such as ARP or IPv4. An attacker could use vulnerabilities in these
protocols to attack hosts, switches and routers connected to your layer 2 network, for
example, through manipulation (poisoning) of the ARP caches of systems in the
subnet and subsequent interception of the data traffic. Appropriate security measures
must be taken for non-secure layer 2 protocols to prevent unauthorized access to the
network. Physical access to the local network can be secured or secure, higher layer
protocols can be used, among other things.
Certificates and keys
This section deals with the security keys and certificates you require to set up TLS, VPN
(IPsec, OpenVPN) and SINEMA RC.
•The device contains a pre-installed X.509 certificate with key. Replace this certificate
with a self-made certificate with key. Use a certificate signed by a reliable external or
internal certification authority. You can install the certificate via the WBM ("System >
Load and Save").
•Use the certification authority including key revocation and management to sign the
certificates.
•Make sure that user-defined private keys are protected and inaccessible to
unauthorized persons.
•If there is a suspected security violation, change all certificates and keys immediately.
•SSH and SSL keys are available for admin users. Make sure that you take appropriate
security measures when shipping the device outside of the trusted environment:
–Replace the SSH and SSL keys with disposable keys prior to shipping.
–Decommission the existing SSH and SSL keys. Create and program new keys
when the device is returned.
•Use password-protected certificates in the format "PKCS #12".
•Use certificates with a key length of 4096 bits.

Security recommendations
SCALANCE SC-600 Web Based Management (WBM)
Configuration Manual, 10/2021, C79000-G8976-C475-03 17
•Verify certificates based on the fingerprint on the server and client side to prevent
"man in the middle" attacks. Use a second, secure transmission path for this.
•Before sending the device to Siemens for repair, replace the current certificates and
keys with temporary disposable certificates and keys, which can be destroyed when
the device is returned.
Physical/remote access
•Restrict physical access to the device to qualified personnel.
•The storage medium (C-PLUG, KEY-PLUG) contains sensitive data such as
certificates, keys, etc. that can be read out and modified.
•Using the button, you can reset the device to the factory defaults.
•If the device is publicly accessible, disable the functions of the button using the
software.
•Lock unused physical ports on the device. Unused ports can be used to gain
forbidden access to the plant.
•We strongly recommend that you leave Brute Force Prevention (BFP) enabled to
protect the device from unauthorized access. For more information, see the
configuration manuals, section "Brute Force Prevention (Page 343)".
•For data transmission via a non-secure network, use an encrypted VPN tunnel (IPsec,
OpenVPN) to encrypt and authenticate communication.
•When you establish a secure connection to a server (for example for an upgrade),
make sure that strong encryption methods and protocols are configured for the
server.
•Terminate management connections correctly (WBM, SSH etc.).
•Using remote logging, ensure that the system protocols are forwarded to a central
logging server. Make sure that the server is within the protected network and check
the protocols regularly for potential security violations or vulnerabilities.
•With communication via non-secure networks, use the authentication options offered
by the protocol.
Hardware/Software
•The option of VLAN structuring provides protection against DoS attacks and
unauthorized access. Check whether this is practical or useful in your environment.
•Restrict access to the device using firewall rules.
•Use a central logging server to log changes and access operations. Operate your
logging server within the protected network area and check the logging information
regularly.
•Selected services are enabled by default in the firmware. It is recommended to enable
only the services that are absolutely necessary for your installation.
For more information on available services, see "List of available services (Page 15)".

Security recommendations
SCALANCE SC-600 Web Based Management (WBM)
18 Configuration Manual, 10/2021, C79000-G8976-C475-03
•Ensure that the latest firmware version is installed, including all security-related
patches.
You can find the latest information on security patches for Siemens products at the
Industrial Security (https://www.siemens.com/industrialsecurity) or ProductCERT
Security Advisories website.
For updates on Siemens product security advisories, subscribe to the RSS feed on the
ProductCERT Security Advisories website or follow @ProductCert on Twitter.
•For optimum security, use SNMPv3 authentication and encryption mechanisms
whenever possible, and use strong passwords.
•Configuration files can be downloaded from the device. Ensure that configuration files
are adequately protected. The options for achieving this include digitally signing and
encrypting the files, storing them in a secure location, or transmitting configuration
files only through secure communication channels.
Configuration files can be password protected during download. You enter passwords
on the WBM page "System > Load & Save > Passwords".
•When using SNMP (Simple Network Management Protocol):
–Configure SNMP to generate a notification when authentication errors occur.
For more information, see WBM "System > SNMP > Notifications".
–Ensure that the default values of the community strings are changed.
–Use SNMPv3 whenever possible. SNMPv1 and SNMPv2c are considered non-
secure and should only be used when absolutely necessary.
–If possible, prevent write access above all.
Interfaces security
•Disable unused interfaces.
•Use IEEE 802.1X for interface authentication.
•Use the function "Locked Ports" to block interfaces for unknown nodes.
•Use the configuration options of the interfaces, e.g. the "Edge Type".
•Configure the receive ports so that they discard all untagged frames ("Tagged Frames
Only").
Secure/non-secure protocols
•Use secure protocols if access to the device is not prevented by physical protection
measures.
•Restrict the use of non-secure protocols. While some protocols are secure (e.g.
HTTPS, SSH, 802.1X, etc.), others were not designed for the purpose of securing
applications (e.g. SNMPv1/v2c, RSTP, etc.).
Therefore, take appropriate security measures against non-secure protocols to
prevent unauthorized access to the device/network. Use non-secure protocols on the
device with caution.

Security recommendations
SCALANCE SC-600 Web Based Management (WBM)
Configuration Manual, 10/2021, C79000-G8976-C475-03 19
•If non-secure protocols and services are required, ensure that the device is operated
in a protected network area.
•Check whether use of the following protocols and services is necessary:
–Non-authenticated and unencrypted ports
–MRP, HRP
–IGMP Snooping
–Syslog
–RADIUS
–Broadcast pings
–ICMP (redirect)
–LLDP
–DHCP Options 66/67
–SNTP
–NTP
–TFTP
–GMRP and GVRP
–VRRPv3
–DNS
–SNMPv1/V2c
•If a secure alternative is available for a protocol, use it.
The following protocols provide secure alternatives:
–SNMPv1/v2 → SNMPv3
Check whether use of SNMPv1/v2c is necessary. SNMPv1/v2c are classified as
non-secure. Use the option of preventing write access. The device provides you
with suitable setting options.
If SNMP is enabled, change the community names. If no unrestricted access is
necessary, restrict access with SNMP.
Use the authentication and encryption mechanisms of SNMPv3.
–HTTP → HTTPS
–Telnet → SSH
–NTP → Secure NTP
–TFTP → SFTP
•Restrict the services and protocols available to the outside to a minimum.
•If you use RADIUS for management access to the device, enable secure protocols and
services.
•For the DCP function, leave the "Read-Only" mode after commissioning.

Security recommendations
SCALANCE SC-600 Web Based Management (WBM)
20 Configuration Manual, 10/2021, C79000-G8976-C475-03
Available protocols
The following list provides you with an overview of the open protocol ports.
The table includes the following columns:
•Protocol
•Port
•Factory setting
–Open
The factory setting of the port is "Open".
–Closed
The factory setting of the port is "Closed".
•Port status
–Open
The port is always open and cannot be closed.
–Open (when configured)
The port is open if it has been configured.
•Authentication
Specifies whether or not the protocol is authenticated.
•Encryption
Specifies whether or not the transfer is encrypted.
List of available services
The following is a list of all available protocols and services as well as their ports through
which the device can be accessed.
The table includes the following columns:
•Service/Protocol
The services/protocols that the device supports.
•Protocol / Port number
Port number assigned to the protocol.
•Default port status
The port status on delivery (factory setting) distinguishes between local and external
access.
–Local access: The port is accessed via a local connection (vlan1).
–External access: The port is accessed via an external connection (vlan2).
•Configurable port/service
Indicates whether the port number or the service can be configured via WBM / CLI.