Weidmuller Ie-sr-2gt-lan User manual

Industrial Security Router / Firewall

IE-SR-2GT-LAN

IE-SR-2GT-UMTS/3G

Manual

Version 1.2.4

September 2013

Important notes:

This document continously will be updated and completed step-by-step.

This version refers to Router firmware version 2.3.1 and above.

You may download a new version from the Weidmüller web site using the following path:

1. Open http://www.weidmueller.com/IE

2. Select section „Industrial Ethernet“ „Documents”

3. Select category „Manuals“

4. Download “ Manual_IE-SR-2GT-LAN-3G-UMTS_EN_Vx_yy.pdf

Industrial Security Router / Firewall

IE-SR-2GT-LAN

IE-SR-2GT-UMTS/3G

The software described in this manual is furnished under a license agreement and may be used only in ac-

cordance with the terms of that agreement.

Reproduction without permission is prohibited.

Disclaimer

Information in this document is subject to change without notice and does not represent a commitment on

the part of Weidmüller.

Weidmüller provides this document "as is," without warranty of any kind, either expressed or implied, includ-

ing, but not limited to, its particular purpose. Weidmüller reserves the right to make improvements and/or

changes to this manual, or to the products and/or the programs described in this manual, at any time.

Information provided in this manual is intended to be accurate and reliable. However, Weidmüller assumes

no responsibility for its use, or for any infringements on the rights of third parties that may result from its use.

This product might include unintentional technical or typographical errors. Changes are periodically made to

the information herein to correct such errors, and these changes are incorporated into new editions of the

publication.

Contact Information

Weidmüller Interface GmbH & Co. KG

PO box 3030

32760 Detmold

Klingenbergstrasse 16

32758 Detmold

Germany

Phone +49 (0) 5231 14-0

Fax +49 (0) 5231 14-2083

E-Mail info@weidmueller.com

Internet www.weidmueller.com

Table of Contents

Industrial Security Router / Firewall.................................................................................1

1. Introduction .......................................................................................................................................5

Proper and intended usage.................................................................................................................5

2. Package Checklist.............................................................................................................................5

3. Safety instructions............................................................................................................................6

4. Mounting the device..........................................................................................................................7

5. Technical data ...................................................................................................................................8

6. Hardware related functional descriptions ....................................................................................11

Pin assignment of power supply connector.......................................................................................13

Pin assignment of RJ45 Ethernet ports (LAN and WAN)..................................................................13

Pin assignment of 4-pin connector for „VPN initiate“ and „VPN active“............................................13

Pin assignment of 4-pin connector for „Cut WAN port“ and „Signalize Alarm“ .................................13

Pin assignment of USB 2.0 connector ..............................................................................................14

Pin assignment of Smartcard Reader (ISO 7816 Standard).............................................................14

7. Initial start-up / Getting Started .....................................................................................................14

Configuration of the Router by using an Internet browser ................................................................14

Starting the Web interface.................................................................................................................15

8. Reset to factory default settings by external push button .........................................................17

Default factory settings of the Router:...............................................................................................17

9. Using the Weidmüller Router-Search-Utility ................................................................................18

10. Basic description of the configuration interface (menu items)..................................................19

Section Diagnostics...........................................................................................................................19

Section Configuration........................................................................................................................19

Section System .................................................................................................................................19

Section Informations..........................................................................................................................19

11. Explanation of the menu items of web interface in chronological order ..................................20

A. Application scenarios (Uses cases) for Routing, NAT and Firewalling ...............................................47

A1 - Configuring the Router to connect 2 networks with different IP address ranges ...........................47

A2 - Connecting 2 Ethernet networks with activated NAT masquerading and using IP address

forwarding........................................................................................................................................53

A3 - Configuring the Router to connect 2 networks with different IP address ranges and additional

firewall rules ....................................................................................................................................59

A4 - Connecting 2 Ethernet networks with the same IP address range to another network using 1:1

NAT address translation.................................................................................................................70

A5 - Using dynamic IP routing as an alternative for manually configuring static routes.......................82

B. Application scenarios (Uses cases) for VPN (Virtual private networks)..............................................85

B1 - OpenVPN based remote access application via “Meeting Point” .....................................................85

Description of a remote access application to allow a communication between protected, not

directly accessible machine networks and remote Service-PC’s by using a public OpenVPN-Server

as „Meeting-Point“ .............................................................................................................................85

B2 - Configuring an OpenVPN remote access scenario using a Weidmüller Router as OpenVPN-

Server ...............................................................................................................................................85

B3 - Configuring an IPsec scenario between 2 Routers (Client and Server)............................................85

C. Additional application notes.....................................................................................................................86

C1- How to start and stop a pre-defined OpenVPN connection by external 24 VDC input.....................86

C2- Description how to disable the Ethernet connection at WAN port.....................................................88

C3- Description how to use the feature “Remote Capture” with Wireshark to analyze the LAN/WAN

traffic of the Router.........................................................................................................................96

C4- Description how to configure the Internet access of a PC via a 3G Router............................101

1. Introduction

Proper and intended usage

The Router is intended for use in industrial (IP20) environments. It is equipped with Ethernet interface ports

and is used solely for connecting components within a network.

By connecting network components, the Router enables network nodes to exchange data. The Router also

allows an industrial IP network to access the Internet via an external DSL modem (via PPPoE). The Router is

responsible for routing IP packets between an industrial network and an external network (such as the Inter-

net). Internet access is automatically activated when needed. The Router can be configured on-site using an

IP network on both Ethernet ports (LAN or WAN).

The Router has implemented extensive security standards to enable different networks to work together

smoothly

Additionally VPN (virtual private network) connections can be used to connect the Router as a VPN-Client or

a VPN-Server with other VPN devices.

2. Package Checklist

Models IE-SR-2GT-LAN and IE-SR-2GT-UMTS/3G

1 x Industrial Security Router (IE-SR-2GT-LAN or IE-SR-2GT-UMTS/3G)

1 x 3-pin connector for power supply

2 x 4-pin connectors for special digital inputs and output signals (Alarm, CUT, VPN)

1 x Ethernet cable ( Length 1 m, Color red)

1 x Hardware Installation Guide

Additional for model IE-SR-2GT-UMTS/3G (with an additional 3G modem)

1 x antenna for mobile connection

If any of these items are missing or damaged, please contact your customer service representative for assis-

tance.

3. Safety instructions

Warning

- Using the selected device for purposes other than those specified or failure to

observe the operating instructions and warning notes can lead to serious malfunc-

tions that may result in personal injury or damage to property.

- If this product malfunctions, it is no longer possible to predict the behaviour of

neighbouring networked facilities and their connected devices. Personal injury and

property damage can occur as a result of malfunctions. Only carry out changes to

the settings when you are certain of the consequences such changes will have on

all connected networks, facilities and devices.

- Personal injury and property damage can occur as a result if this product is used

improperly. Adjustments and setting changes to this product should only be carried

out by sufficiently qualified personnel.

Caution

- This device is designed only for an operating voltage range from 7 to 36 V DC. Do

not use a higher voltage; this could destroy the Router and other devices.

- The Security Router does not have an on/off switch. The operating voltage must

be switched on by the facility in which the device is integrated.

Caution

You should activate and synchronise the time server or set the system time manu-

ally if you are using certificates in virtual private networks (VPNs) or simple network

management protocol (SNMP). An inaccuracy in the system time can cause the

virtual private network (VPN) to malfunction.

You should synchronise the system time with a time server after each Router re-

boot and after you load the default settings. Or you can set the system time manu-

ally.

Caution

- The default system access information for the Security Router is included in this

document. Unauthorized individuals can use this access data to gain access to the

Router's web browser and cause damage. Be sure to change these system default

access settings.

- Some services may be blocked by a firewall. You may need to deactivate the

firewall. By deactivating the firewall, the PC is no longer protected against viruses

or other attacks. Only deactivate the firewall when your PC is sufficiently protected

by other measures.

- A single port can only properly execute one service. If multiple services are as-

signed to a port, the port can no longer execute any service. Be sure to assign only

one service to any port.

4. Mounting the device

Caution

- This device is designed only for a operating voltage range from +7 to 36 VDC. Do

not use a higher voltage; this could destroy the Router and other devices.

- Connecting plugs should never be connected or disconnected from electrical de-

vices if they are carrying a live load. Be sure to first disconnect all poles of the plug.

Remember to disconnect all plugs from the Router before it is installed or removed.

- Electrical devices should not be installed or removed during operations. Never

install or remove the Router while it is running.

Caution

- It is important to provide sufficient clearance between devices which cause strong

electromagnetic interference (such as frequency converters, transformers or motor

regulators). The clearance gap between such devices and the Router should be as

wide as possible. The Router can be further shielded by using a mu-metal partition.

- The Router is designed to be mounted on a top-hat rail that is compliant with the

EN 50022 standard. This Router will not have a secure mount if any other type of

rail is used. Use a top-hat rail that complies with the EN 50022 standard. Be sure to

observe the mounting information provided by the manufacturer.

Note

- A minimum of 2 inch (5 cm) gap should be kept between the Router and

neighbouring devices from the top and bottom. This will ensure that the Router is

sufficiently ventilated and prevent induction from developing.

- The top-hat rail should be located in a horizontal position along the vertical rear

wall of the electrical cabinet. This ensures that the Router can be adequately venti-

lated from below to above.

Note

- The IP protocol reserves certain IP address ranges for special purposes (such as

multicasting). Do not assign IP addresses in the range from 127.0.0.0 –

127.255.255.255 or 224.0.0.0 –255.255.255.255.

- This device is intended for use in applications as described in the operating in-

structions only. Using this device in non-approved applications will lead immedi-

ately to the expiration of all guarantee and warranty claims on the part of the op-

erator against the manufacturer.

DIN-rail mounting:

Insert the top of the DIN-rail clip behind the upper edge of the DIN-

rail (1). Then open the latch at bottom of the device by using a flat-

bladed screwdriver and fix the device on the DIN-rail by gently

pressing on the bottom (2).

To remove the Router from the DIN-Rail, simply reverse the steps

as described above.

5. Technical data

Operation mode

IP-Router

Static or dynamic routing according to

RIPv2 or OSPF protocol

Transparent Bridge

2-Port-Switch with additional Layer-2 fil-

ter

Network Services

DHCP Server / DHCP Relay

DNS-Relay

NTP-Client

DynDNS (DHCP-Client nach RFC 2136)

Firewall

IPv4 Stateful inspection Firewall

NAT-Masquerading, 1:1 NAT,

Portforwarding

Layer-2/3-Filter (VLAN ID, VLAN QoS

Tag, MAC adddress based, Ethertype

Frame)

"Auto-Learning"-function to create new

packet filter rules (Analysis of the net-

work traffic)

Layer 2/3 packet priorizitation (Ethernet

Frame, IP Header, VLAN Tag)

VPN

OpenVPN

Configurable as OpenVPN server or cli-

ent (Layer 2 and Layer 3)

Authentication with X.509 Certificates

Tunnel support via HTTP-Proxy

A maximum of 10 different server con-

figurations

Unlimited number of client connections in

server mode

IPsec

Can be configured as an IPsec server or

client

Authentication with PSK (user ID, pass-

word) or X.509 certificates

Hardware encryption for faster data flow

rate

A maximum of 64 simultaneous connec-

tions (subnet with subnet or as IPsec

server)

Encryption algorithms DES-56, 3DES-

168, AES 128, AES 192, AES-256

Management

Configuration with web interface

(HHTP/HTTPS)

Web interface selectable in english or

german language

Configuration support through detailed

help information (tooltip)

Configurable Multi-user access with de-

finable rights

Support for SNMP v1/v3/v3

Event log / syslog

Other features

Modbus/TCP

The Modbus/TCP interface enables the con-

trol of the Router by a PLC. Following func-

tions are imaged in the registers:

Cut & Alarm, status request & acknowl-

edgment

IPsec, on/off switchable generally

OpenVPN, separate status request and

activation / deactivation of the 10 possi-

ble OpenVPN connections

Diagnosis

„Remote Capture“- feature for network

diagnostics via a connected PC (Wire-

shark)

Monitoring

Client monitoring via ICMP protocol (ping

request) with alarm function in case of er-

ror

Interfaces

RJ45-Ports

2 * 10/100/1000BaseT(X)

USB-Port

option for future expansion

SCM card Reader

Save and restore the configuration using

a smart card (SIM card without mobile

provider data, only the storage capacity

of the chip will be used)

LED display

Signaling the status for power, device

status, Cut, Alarm, active VPN connec-

tion and an active 3G connection

Digital Outputs

"Alarm" -> Indicates a configurable net-

work status or error (24V out)

"VPN-active" -> Indicates an active VPN

connection (24 V out)

Digital Inputs

"Cut" -> Disconnects physically (link

down) the WAN port (24 V In)

"VPN-initiate" -> Enables a pre-

configured VPN connection (24 V In)

Reset-Button

Restore to the factory settings

Power

Input Voltage

1* 24 VDC (7 bis 36 Volt)

Current consumption

max. 600mA @ 24 VDC

Technical data (housing)

Housing

Metal, protection IP20

Dimensions (width, height, depth)

35 * 159 * 134 mm (without antenna)

35 * 255 * 134 mm (with 3G antenna)

Mounting

TS35 (DIN rail)

Environmental conditions

Operating Temperature

-20°C to +70°C

Storage Temperature

-20°C to + 85°C

Ambient Humidity

6 to 90% noncondensing

DSL and 3G/HSDPA

DSL

DSL Internet access by connecting an

external DSL modem via LAN or WAN

port

Free configuration of the PPPoE login

DynDNS

Support for automatic registration

UMTS/3G

(Only model IE-SR-2GT-UMTS/3G)

Built-in quad-band 3G / HSPA modem

21.1 Mbps peak downlink

5.8 Mbps peak uplink

GSM, GPRS, EDGE: 850 MHz, 900

MHz, 1800 MHz, 1900 MHz

UMTS, WCDMA, HSDPA, HSUPA: 850

MHz, 900 MHz, 1900 MHz, 2100 MHz

FCC, CE, FCC, IC, NCC, PTCRB, Bell,

AT&T

Approvals

Security

cULus (UL508)

EMC

FCC Part 15 Class A, EN 55022 Class A

EN61000-4-2 (ESD)

EN61000-4-3 (RS),

EN61000-4-4 (EFT)

EN61000-4-5 (Surge)

EN61000-4-6 (CS)

This manual suits for next models

Table of contents

Other Weidmuller Network Router manuals

Weidmuller

Weidmuller IE-SW-VL08M Series User manual

Weidmuller

Weidmuller IE-SW-VL09T-6TX-3SC Manual

Weidmuller

Weidmuller IE-SW-VL16-16TX Manual

Weidmuller

Weidmuller IE-SW-PL18M-2GC-16TX Manual

Weidmuller

Weidmuller IE-SW-PL09M-5GC-4GT Manual

Popular Network Router manuals by other brands

TRENDnet

TRENDnet TEW-435BRM - 54MBPS 802.11G Adsl Firewall M Quick installation guide

Siemens

Siemens SIMOTICS CONNECT 400 manual

Alfa Network

Alfa Network ADS-R02 Specifications

Barracuda Networks

Barracuda Networks Link Balancer quick start guide

ZyXEL Communications

ZyXEL Communications ES-2024PWR Support notes

HPE

HPE FlexNetwork 5510 HI Series Openflow configuration guide

Allied Telesis

Allied Telesis AT-AR236E quick start guide

ADTRAN

ADTRAN NetVanta 3458-PoE quick start

C&H Technologies

C&H Technologies EM405-8 manual

Huawei

Huawei WiFi Mesh 3 Product description

Addonics Technologies

Addonics Technologies ISC8P2G-S Quick install guide

Atel

Atel W02 Arch+ Faqs

Allnet

Allnet ALL0333AU user guide

Sercomm

Sercomm Genesis OC3505D Quick installation guide

Billion

Billion BIPAC 5102 Series user manual

TP-Link

TP-Link TD-8817 QIG

Motorola

Motorola MR1900 user guide

Cisco

Cisco SOHO Series Regulatory compliance and safety information

Weidmuller IE-SR-2GT-LAN User manual

Popular Network Router manuals by other brands