Belden HIRSCHMANN HiOS-2A, User Manual

Page: 21 / 66

Security planning
1.4 Impact of device requirements on system planning
21
UM Security BRS-2A
Release 8.7 05/2022
1.4.6 VLAN plan considerations depending on redundancy protocols
Network availability can be an important base for the security of the superordinate system. The
device offers redundancy protocols for this purpose.
The redundancy protocols HIPER Ring and Ring/Network Coupling employ the fixed VLAN ID 1 for
their protocol packets. Using the VLAN ID 1 exclusively for these redundancy protocols can help
enhance network availability. A VLAN plan (see on page 17 “VLAN plan”) that takes this peculiarity
into account may require the use of VLAN IDs ≥2 for payload traffic and device management.
1.4.7 Network time synchronization considerations
Network time synchronization can be required for several reasons, including secure logging. The
protocols NTP and PTP implicitly trust the time source. To make network time synchronization more
secure, planning an overarching network time synchronization policy is recommended.
Parameters of this policy may include:

The choice of the network protocol for time distribution

The choice of the primary time sources

The choice of time synchronization paths based on precision, availability and security
considerations

Requirements for controlling or tuning the chosen network time protocol on the nodes in the time
synchronization path

The choice of Multicast or Unicast packets on the network layer
As the protocols NTP and PTP implicitly trust the time source, plan suitable mitigation concepts.
E.g., restrict the time sources a given device accepts.
Based on the chosen policy, determine which settings are necessary for the individual devices.