ABB Relion REX610, Manual

Page: 17 / 36

Ethernet ports are by default activated as those are used for protection relay
engineering. The front port is segregated from rear ports' station bus
communication.
3.3 TCP/IP based protocols and used IP ports
IP port security depends on specific installation, requirements and existing
infrastructure. The required external equipment can be separate devices or devices
that combine firewall, router and secure VPN functionality. When the network is
divided into security zones, it is done with substation devices having firewall
functionality or with dedicated firewall products. Security zone boundaries are
inside the substation or between the substation and the outside world.
To set up an IP firewall the following table summarizes the IP ports used by the
device. All closed ports can be opened in the configuration. Ports which are by
default open are used for configuring the protection relay.
Table 2: IP ports used by the relay
Port number Type Default state Description
20, 21 TCP Open File transfer protocol
(FTP/FTPS)
102 TCP Open IEC 61850
502 TCP Closed Modbus TCP
FTP/FTPS and IEC 61850 are primary services needed for relay configuration and
those cannot be disabled. Additionally, the protection relay uses layer 2
communications in GOOSE, which needs to be taken into account when designing
the network.
In addition to the FTP/FTPS protocol, the relay supports two Ethernet-based
substation automation communication protocols, IEC 61850 and Modbus. IEC
61850 is always enabled, and the relay can be ordered with one additional station
bus protocol. Additional protocols must be enabled in the configuration, otherwise
the communication protocol TCP port is closed and unavailable. If the protocol
service is configured, the corresponding port is open all the time.
See the technical manual and the corresponding protocol documentation for
configuring a certain communication protocol.
In Modbus it is possible to assign the TCP port number if required and it is also
possible to allow connection requests only from a configured client IP address.
2NGA000818 A
Section 3
Secure system setup
REX610 11
Cyber Security Deployment Guideline