Rockwell Automation Stratix 4300 Bedienungsanleitung

Stratix 4300 Remote Access

Routers

Catalog Number 1783-RA2TGB, 1783-RA5TGB

User Manual Original Instructions

2Rockwell Automation Publication 1783-UM014A-EN-P - October 2021

Stratix 4300 Remote Access Routers User Manual

Important User Information

Read this document and the documents listed in the additional resources section about installation, configuration, and

operation of this equipment before you install, configure, operate, or maintain this product. Users are required to familiarize

themselves with installation and wiring instructions in addition to requirements of all applicable codes, laws, and standards.

Activities including installation, adjustments, putting into service, use, assembly, disassembly, and maintenance are required to

be carried out by suitably trained personnel in accordance with applicable code of practice.

If this equipment is used in a manner not specified by the manufacturer, the protection provided by the equipment may be

impaired.

In no event will Rockwell Automation, Inc. be responsible or liable for indirect or consequential damages resulting from the use

or application of this equipment.

The examples and diagrams in this manual are included solely for illustrative purposes. Because of the many variables and

requirements associated with any particular installation, Rockwell Automation, Inc. cannot assume responsibility or liability for

actual use based on the examples and diagrams.

No patent liability is assumed by Rockwell Automation, Inc. with respect to use of information, circuits, equipment, or software

described in this manual.

Reproduction of the contents of this manual, in whole or in part, without written permission of Rockwell Automation, Inc., is

prohibited.

Throughout this manual, when necessary, we use notes to make you aware of safety considerations.

Labels may also be on or inside the equipment to provide specific precautions.

WARNING: Identifies information about practices or circumstances that can cause an explosion in a hazardous environment, which

may lead to personal injury or death, property damage, or economic loss.

ATTENTION: Identifies information about practices or circumstances that can lead to personal injury or death, property

damage, or economic loss. Attentions help you identify a hazard, avoid a hazard, and recognize the consequence.

IMPORTANT Identifies information that is critical for successful application and understanding of the product.

SHOCK HAZARD: Labels may be on or inside the equipment, for example, a drive or motor, to alert people that dangerous

voltage may be present.

BURN HAZARD: Labels may be on or inside the equipment, for example, a drive or motor, to alert people that surfaces may

reach dangerous temperatures.

ARC FLASH HAZARD: Labels may be on or inside the equipment, for example, a motor control center, to alert people to potential

Arc Flash. Arc Flash will cause severe injury or death. Wear proper Personal Protective Equipment (PPE). Follow ALL Regulatory

requirements for safe work practices and for Personal Protective Equipment (PPE).

Rockwell Automation Publication 1783-UM014A-EN-P - October 2021 3

Table of Contents

Preface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5

About This Publication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5

Additional Resources . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5

Chapter 1

Remote Access Solution Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8

Before You Begin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8

Best Practices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9

Remote Access Routers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10

1783-RA2TGB. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10

1783-RA5TGB . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11

Multi-factor Authentication. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13

Typical Remote Access Architectures. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14

Secure Remote Connectivity - Use Case: Cell/Area Zone SRA. . . . . 14

Secure Remote Connectivity - Use Case: Modem Direct/Isolated

Machine . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19

Chapter 2

Connect Via Ethernet . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21

Add an IP Address. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28

Associate the Router with a Domain . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28

Protect Against Unwanted Domain Change . . . . . . . . . . . . . . . . . . . . . . . 31

Remove and Move Devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31

Firewall Policies. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32

Create a Firewall Policy. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32

Update the System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35

Factory Reset . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35

Router Restart . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36

4Rockwell Automation Publication 1783-UM014A-EN-P - October 2021

Appendix A

Status Indicators. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37

Status Indicators Descriptions. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37

Export Logs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38

Audit Logs. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38

Index . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39

Rockwell Automation Publication 1783-UM014A-EN-P - October 2021 5

Preface

About This Publication This manual describes how to use Stratix® 4300 Remote Access Routers.

Make sure that you are familiar with use of an Ethernet/IP network.

Product compatibility information and release notes are available online

within the Product Compatibility and Download Center.

Additional Resources These documents contain additional information concerning related products

from Rockwell Automation.

You can view or download publications at rok.auto/literature.

Resource Description

Cloud Connectivity to a Converged Plantwide Ethernet Architecture Design Guide,

publication ENET-TD017

Converged Plantwide Ethernet (CPwE) is a collection of architected, tested, and validated

designs. The testing and validation follow the Cisco® Validated Design (CVD) and Cisco Reference

Design (CRD) methodologies.

Converged Plantwide Ethernet (CPwE) Design and Implementation

Guide, publication ENET-TD001

The Implementation Guide represents a collaborative development effort from Cisco Systems

and Rockwell Automation®. It is built on, and adds to, design guidelines from the Cisco Ethernet-

to-the-Factory (EttF) solution and the Rockwell Automation Integrated Architecture®.

Deploying Industrial Firewalls within a Converged Plantwide Ethernet

Architecture Design and Implementation Guide, publication ENET-TD002

The Deploying Industrial Firewalls within a Converged Plantwide Ethernet Architecture Design

and Implementation Guide (DIG) outlines several use cases for designing, deploying and

managing industrial firewalls throughout a plant-wide Industrial Automation and Control System

(IACS) network infrastructure.

EtherNet/IP Network Devices User Manual, publication ENET-UM006 Describes how to configure and use EtherNet/IP™ devices to communicate on the EtherNet/IP

network.

Ethernet Reference Manual, publication ENET-RM002 Describes basic Ethernet concepts, infrastructure components, and infrastructure features.

FactoryTalk Remote Access Help website, rok.auto/help Describes how to use and troubleshoot FactoryTalk® Remote Access.

Industrial Automation Wiring and Grounding Guidelines, publication 1770-4.1 Provides general guidelines for installing a Rockwell Automation industrial system.

Industrial Components Preventive Maintenance, Enclosures, and Contact Ratings

Specifications, publication IC-TD002 Provides a quick reference tool for Allen-Bradley® industrial automation controls and

assemblies.

Product Certifications website, rok.auto/certifications. Provides declarations of conformity, certificates, and other certification details.

Safety Guidelines for the Application, Installation, and Maintenance of Solid-state

Control, publication SGI-1.1

Designed to harmonize with NEMA Standards Publication No. ICS 1.1-1987 and provides general

guidelines for the application, installation, and maintenance of solid-state control in the form of

individual devices or packaged assemblies incorporating solid-state components.

Stratix 4300 Remote Access Routers Installation Instructions,

publication 1783-IN020 Describes how to install a Stratix 4300 Remote Access Router.

Stratix Ethernet Device Specifications Technical Data, publication , 1783-TD002 Describes the technical specifications of Stratix Devices.

System Security Design Guidelines Reference Manual, publication SECURE-RM001 Provides guidance on how to conduct security assessments, implement Rockwell Automation

products in a secure system, harden the control system, manage user access, and dispose of

equipment.

6Rockwell Automation Publication 1783-UM014A-EN-P - October 2021

Notes:

Rockwell Automation Publication 1783-UM014A-EN-P - October 2021 7

Chapter 1

Remote Access Architecture

The Stratix® 4300 remote access router provides the ability for manufactures

and OEMs to apply the appropriate skills and resources independent of their

physical location by enabling our customers to continue to maintain their

operations with remote access via VPN. The solution helps reduce costs, add

value to customer operations, and encourage collaboration between OEMs and

customers.

The Stratix 4300 router:

• Full gigabit router

• Supports configuration via FactoryTalk® Remote Access software

• Uses VPN connections that are optimized for industrial communications

with reduced latency

Factory Talk Remote Access software:

• Manages user and group configurations to segment network access and

permissions

• Provides log and audit trails for activities for established connections

Topic Page

Remote Access Solution Overview 8

Remote Access Routers 10

Multi-factor Authentication 13

Typical Remote Access Architectures 14

8Rockwell Automation Publication 1783-UM014A-EN-P - October 2021

Chapter 1 Remote Access Architecture

Remote Access Solution

Overview

Before You Begin

Remote Access for Industrial Equipment enables connectivity to remote

machines by leveraging optimized VPN technologies. The remote access

solution includes hardware and software.

There are three key components for remote access.

1. The Stratix 4300 Remote Access Router enables access to remote

equipment through a VPN connection.

2. Server infrastructure is a distributed cloud-based server infrastructure

that facilitates the connections.

3. FactoryTalk Remote access is a web-based client that is used to maintain

and initiate remote connections.

Together, these products enable secure access to industrial machines, skids,

and assets.

The Stratix 4300 must be registered to FactoryTalk Remote Access before a

connection can be initiated.

Cloud Server

Infrastructure

Stratix 4300

FactoryTalk

Remote Access

VPN Tunnel

Remote Equipment

Stratix 4300

FactoryTalk Remote Access

Secure Secure

Server

Infrastructure

Rockwell Automation Publication 1783-UM014A-EN-P - October 2021 9

Chapter 1 Remote Access Architecture

Best Practices

• FactoryTalk Remote Access Administrator enforces two-factor-

authentication.

• The FactoryTalk Remote Access software must be up to date in case

security improvements are released.

• Configure strong, complex user passwords.

• Stratix 4300 routers must be connected to the internet through its WAN

port. Stratix 4300 routers do not enable any service through that port and

only need an outgoing connection through to the configured outgoing

port (TCP port 443, 80, or 5935). An additional firewall can provide more

protection.

• Undertake a formal threat and risk assessment in relation to remote

access.

• Use the provided role-based access control.

• Use the provided physical controls to enable or disable remote access.

• Monitor security incidents and logs pro-actively to provide timely

incident response and accurate forensics.

• Conduct regular reviews and assessments of the secure remote access

solution and technologies to maintain compliance with policies and

procedures.

• Apply defense in depth practices for the secure remote access solution,

including practices to secure the remote computer.

10 Rockwell Automation Publication 1783-UM014A-EN-P - October 2021

Chapter 1 Remote Access Architecture

Remote Access Routers 1783-RA2TGB

Figure 1 - 1783-RA2TGB

Table 1 - 1783-RA2TGB Router Front View

1 Restart Status Indicator

2 Server/USB Status Indicator

3 COM RX Status Indicator

4USB2.0

5WAN

6LAN

7COM

8 Power Status Indicator

9 Remote Connect Status Indicator

10 COM TX Status Indicator

Dieses Handbuch passt für folgende Modelle

Inhaltsverzeichnis

Andere Rockwell Automation Netzwerk-Router Handbücher

Rockwell Automation

Rockwell Automation Stratix 5410 Bedienungsanleitung

Beliebte Netzwerk-Router Handbücher anderer Marken

Allnet

Allnet ALL0333AU Bedienungsanleitung

HomeSeer

HomeSeer HT-SEL Bedienungsanleitung

Sercomm

Sercomm Genesis OC3505D Bedienungsanleitung

Billion

Billion BIPAC 5102 Series Bedienungsanleitung

TP-Link

TP-Link TD-8817 Bedienungsanleitung

Motorola

Motorola MR1900 Bedienungsanleitung

Digi

Digi IX14 Bedienungsanleitung

Cisco

Cisco NCS 540 Handbuch

XAVi

XAVi X8821e Bedienungsanleitung

BEC

BEC 6200WZL Bedienungsanleitung

MikroTik

MikroTik hAP ac3 Series Bedienungsanleitung

Korenix

Korenix JetNet 5428G Series Bedienungsanleitung

NETGEAR

NETGEAR FS526T - Switch Bedienungsanleitung

Automated Logic

Automated Logic ZN551 Betriebsanleitung

Cisco

Cisco ASR 1000 Series Bedienerhandbuch

EnGenius

EnGenius ESR-9710 Bedienungsanleitung

Cisco

Cisco 805 Series Bedienungs- und Sicherheitshinweise

LevelOne

LevelOne FBR-1416 Bedienungsanleitung