manualshive.com logo in svg

CONTROL SOLUTIONS Babel Buster 3 BB3-6101-GW, User Manual, Page: 52 / 56

Share
Download
CONTROL SOLUTIONS Babel Buster 3 BB3-6101-GW User Manual Download Page 52

Appendix D        SSL Certificates for Secure Web
(HTTPS)

The secure web server (HTTPS) requires SSL certificates in order to establish secure
connections. The HTTPS certificates are only required if HTTPS is enabled on the
Network configuration page in the Babel Buster BB3-6101/MX-61.

D.1       X.509 Auto-Certificate Generation

The Babel Buster BB3-6101/MX-61 Gateway will automatically generate X.509
certificates if no external certificates are found or could not be loaded correctly. These
will be generated one time and saved in the Flash file system for subsequent reuse.
When the self-generated X.509 certificates are in use, this will be indicated at the
bottom of the Network configuration page.

If there is a need to delete the self-generated certificates, you can do so by logging in
via FTP. Change directory to /FLASH0, then to .cfg. The two certificate files that were
self-generated are ssl.cert and ssl.key.

D. SSL Certificates for Secure Web (HTTPS)

file:///C:/AAA_CSI/Literature/2021 User Guides/BB3-6101-MX-61 Use...

1 of 5

5/4/2021, 9:58 AM

Summary of Contents for Babel Buster 3 BB3-6101-GW

Page 1: ...s 3 3 Network Configuration 3 3 1 IPv4 IPv6 Settings 3 3 2 NTP Time Server Settings 3 3 3 Port Settings 3 4 Resource Allocation 3 5 User Login Passwords 4 Accessing RTU Devices from TCP 4 1 Set Mode and Port Parameters 4 2 How It Works 5 Accessing TCP Devices from RTU 5 1 Set Mode and Port Parameters 5 2 Create TCP Device Map 5 3 How It Works 6 Error Counts and Packet Log 6 1 Reviewing Error Count...

Page 2: ...dix D SSL Certificates for Secure Web HTTPS D 1 X 509 Auto Certificate Generation D 2 External Certificates D 3 Certificate Generation Script Linux Babel Buster BB3 6101 and MX 61 Gateway file C AAA_CSI Literature 2021 User Guides BB3 6101 MX 61 Use 2 of 2 5 4 2021 9 54 AM ...

Page 3: ...By using ANY Control Solutions Inc product the user has agreed to assume all risk and responsibility for proper system design as well as any consequence for improper system design 1 3 Warranty This documentation is provided as is without warranty of any kind either expressed or implied including but not limited to the implied warranties of fitness or merchantability for a particular purpose Contro...

Page 4: ...by customer are not covered under warranty Damage caused by incorrect electrical connection is not covered under warranty Removing circuit boards from their enclosures will void the warranty the complete product with all of its original circuit boards and components must be returned for warranty consideration 1 Introduction file C AAA_CSI Literature 2021 User Guides BB3 6101 MX 61 Use 2 of 2 5 4 2...

Page 5: ...r Guide Be sure to review the remainder of this section Online videos are also available to demonstrate key operations in setting up the BB3 6101 GW or MX 61 GW If you get stuck you can open a support ticket at https ticket csimn com where response time is generally 24 hours or less and often as little as 2 hours and at no cost NOTE Screen shots throughout this User Guide illustrate BB3 6101 GW ho...

Page 6: ...nd MX 61 GW are non mapping Modbus gateways used to simply forward Modbus RTU requests and responses to Modbus TCP and vice versa Most Control Solutions gateways involve mapping and the gateway itself contains registers or objects which hold copies of data found in other devices This intermediate data buffering is what allows access to the same data from multiple protocols The non mapping gateway ...

Page 7: ...ate an association between RTU slave addresses and TCP IP addresses 2 3 What is New in Model BB3 6101 MX 61 The BB3 6101 is a significant enhancement over its predecessor the BB2 6010 The MX 61 is the equivalent enhancement over its predecessor the SPX The hardware includes a faster processor and hardware encryption engine for efficient rendering of secure web pages The software includes numerous ...

Page 8: ...ector Ethernet activity LED is the green LED integrated into the CAT5 connector Refer to Appendix A for additional detail pertaining to connections and indicators as well as optional internal jumper settings 2 5 Opening the Web User Interface The default IP address as shipped is 10 0 0 101 Open your browser and enter http 10 0 0 101 in the address window You should see a page with the Babel Buster...

Page 9: ...101 MX 61 to show you what the default root password is If you have lost track of it make a note of the MAC address and open a support ticket at https ticket csimn com to request the default root password you will need to provide the MAC address in order to obtain the password To change the IP address of the gateway go to the Network page under System System Setup The following page should appear ...

Page 10: ...an IP address permanent you must select your file select the Save XML Config File action and then click Execute on the File Manager page Refer to Section 3 for more about the File Manager NOTE The BB3 6101 GW and MX 61 GW require rather minimal configuration compared to mapping gateways In some cases you might not need any configuration file at all Refer to sections 4 and 5 as applicable for your ...

Page 11: ...more responsive and in the interest of extending the life of the Flash configuration is only saved to Flash when you direct it to do so The File Manager is used primarily to manage your XML configuration files but you can also upload SSL certificates here NOTE Most Babel Buster gateways include a significant amount of configuration and the gateway has little use without the content of an XML file ...

Page 12: ...SSL certificates Display all files There are several file related actions you may take To take action with a certain file select that file from the File Directory list and click Select That file should now show up in the Selected File window Once a file has been selected choose your action from the Action list and click Execute 3 System Configuration and Resources file C AAA_CSI Literature 2021 Us...

Page 13: ...following power up Restart To restart the gateway check Confirm and click Restart This is a hard reset that will accomplish the same thing as a power cycle without physically disconnecting and reconnecting power 3 1 1 Load Save Create XML Configuration File NOTE Configuration files from a BB2 6010 GW or SPX GW can be loaded into the BB3 6101 GW or MX 61 GW but will be saved in a new format when sa...

Page 14: ...here are errors they will be displayed If there are errors in the file but you do not fix them then the gateway will not fully start up the next time it restarts The web user interface will be available but it will not be talking to Modbus devices 3 1 3 Delete a File Remove a file from the Flash file system by selecting it from the list and executing the Delete Selected File action 3 1 4 Clear Con...

Page 15: ...L file doing so will result in an invalid file format that cannot be loaded again You must use the browser s save as or save page function The browser should default to wanting to save a file with a xml suffix If correctly saved on your PC you should be able to double click on the saved file and it will result in opening the file automatically in your browser It was saved correctly if the browser ...

Page 16: ...indow is the configured static address If Static is selected and a new IP address entered as the static address this new address will not take effect until the next system restart The numbers shown to the right of the IPv4 input windows are the actual numbers currently in use If static IP addresses have been entered but the gateway has not been restarted yet these numbers will not be the same The ...

Page 17: ...er time starts ends The date portion of the rule is formatted as follows m indicates the month 1 m 12 n indicates which week of the month 1 n 5 5 the last week in the month d indicates what day of the week 0 d 6 0 Sunday For example Start 4 1 0 02 00 00 end 10 5 0 02 00 00 means summer time starts at 2am on the first Sunday in April and ends at 2am on last Sunday in October That was the old US rul...

Page 18: ...ress when attempting to browse the web user interface if it has been moved away from port 80 The Modbus port to which this device responds as a Modbus TCP server is entered here The standard port is 502 To enter a non standard port number enter that here and click Set Ports to set the Modbus port The device needs to be restarted after changing the Modbus TCP port FTP is enabled by default to allow...

Page 19: ...nt Additional user logins may be created The privilege level Administrator lets that user see and change anything The privilege level Maintenance allows the user to log in and see and change values in the local objects via the Local Objects page but cannot access any other pages The Restricted level has no meaning in the BB3 6101 MX 61 other than block access to everything since it does not operat...

Page 20: ...n the RTU network Therefore select I act as the RTU master for mode Select the baud rate and parity setting that all of the RTU slaves on the network are set for Set a timeout value This is the amount of time that the gateway will wait for a response from an RTU slave before calling it a no response error 4 Accessing RTU Devices from TCP file C AAA_CSI Literature 2021 User Guides BB3 6101 MX 61 Us...

Page 21: ...evice even though the device is perfectly functional IMPORTANT The timeout you set in your Modbus TCP client must be longer than the timeout set on this page If the RTU slave queried times out it will be tabulated as a no response error here in the gateway but the gateway will return an exception 11 to the TCP client telling it that the RTU slave timed out If your TCP client timeout is shorter tha...

Page 22: ...TCP client with exception code 4 which is defined as Slave device failure If a good response is received from the RTU slave and its checksum test passes then the TCP header will be added to the response and it will be transmitted back to the requesting TCP client 4 Accessing RTU Devices from TCP file C AAA_CSI Literature 2021 User Guides BB3 6101 MX 61 Use 3 of 3 5 4 2021 9 56 AM ...

Page 23: ...twork Therefore select I act as one or more RTU slaves for mode Select the baud rate and parity setting that all of the RTU slaves on the network are set for Set a timeout value This is the amount of time that the gateway will wait for a response from a TCP server before calling it a no response error 5 Accessing TCP Devices from RTU file C AAA_CSI Literature 2021 User Guides BB3 6101 MX 61 Use 1 ...

Page 24: ...quest This known collision will take on the appearance of further communication problems including further no response errors and possibly CRC errors These will be avoided with timeout settings that do not conflict 5 2 Create TCP Device Map The gateway can present one or more TCP servers as one or more RTU slaves There can be a one to one mapping or a many to one mapping If the TCP device is itsel...

Page 25: ...n IPv6 address is illustrated below Each device must have a unique RTU address on the RTU network Therefore when mapping multiple TCP servers as RTU slaves the First RTU Address In should be the unique RTU address you want to associate with a specific TCP device The First RTU Address In is the address to which the gateway will respond as an RTU slave But the TCP servers may all expect to see unit ...

Page 26: ... table Duplicate IP addresses will not function properly In the example below the gateway will respond as RTU slaves 1 through 5 The unit numbers in the requests forwarded to the TCP server at the given IP address will be 20 through 25 When you have a long list of TCP devices use the Prev and Next buttons to scroll through the list This gateway will support up to 120 connections to different TCP d...

Page 27: ... discarded if there is a checksum error and there will be no response Next the gateway scans the TCP Device Map table to see if the RTU address in the request matches any RTU address in the table If no match is found the message is disregarded and assumed to be intended for some other device on the RTU network If the message passes the checksum test and the RTU address is found in the TCP Device M...

Page 28: ...d by Modbus protocol to mean Gateway target device failed to respond This is how a gateway reports a timeout or no response error back to the requesting device If a good response is received from the TCP server then the TCP header is removed the original RTU address is restored a checksum is added and the response is transmitted back to the RTU master 5 Accessing TCP Devices from RTU file C AAA_CS...

Page 29: ...f times a device fails to respond is tabulated The number of times a CRC error is detected on the RTU link is tabulated The number of times an exception message is sent is tabulated and the exception code found in the most recent exception message is logged Exceptions can be generated by this gateway or by the device to which a request was sent Regardless of the origin of the exception it is tabul...

Page 30: ...4 or 5 as applicable for additional notes about timeout settings 6 2 Reviewing TCP Device Status When accessing TCP devices from RTU an additional diagnostic is available on the TCP Device Map page If a TCP device has failed to connect or failed to respond its status in the Status column will be some number other than zero 0 no error detected Status codes will normally clear on their own but you c...

Page 31: ...ddress function code and data are displayed RTU checksum and TCP header are omitted from the display to aid in clarity The most recent message is always displayed at the top and elapsed time gives a relative indication of when the message was sent The Source Dest column indicates the from and to Content is the actual message sent Indicator Request from master to slave Response from slave The examp...

Page 32: ...Dest column This number is the device number as listed on the TCP Device Map The number indicated along with RTU is the RTU slave address as recognized on the RTU link 6 Error Counts and Packet Log file C AAA_CSI Literature 2021 User Guides BB3 6101 MX 61 Use 4 of 6 5 4 2021 9 56 AM ...

Page 33: ...egisters Longer messages will also be displayed in their entirety In this particular example the Modbus holding registers contained a lot of uneventful zeroes 6 Error Counts and Packet Log file C AAA_CSI Literature 2021 User Guides BB3 6101 MX 61 Use 5 of 6 5 4 2021 9 56 AM ...

Page 34: ...6 Error Counts and Packet Log file C AAA_CSI Literature 2021 User Guides BB3 6101 MX 61 Use 6 of 6 5 4 2021 9 56 AM ...

Page 35: ...A 1 Wiring Wiring for the Babel Buster BB3 6101 is illustrated below Wiring for the Babel Buster MX 61 is illustrated below A Hardware Details file C AAA_CSI Literature 2021 User Guides BB3 6101 MX 61 Use 1 of 10 5 4 2021 9 57 AM ...

Page 36: ...esent you may even need to insert optically isolated repeaters between EIA 485 devices Use standard CAT5 cables for Ethernet connections Use control wire as applicable for local electrical codes for connecting the 24V AC or DC power supply Note that in addition to connecting power supply common to a GND terminal you must also connect a GND terminal to earth ground in order to ensure proper ESD pro...

Page 37: ...ply LEDs will indicate Modbus RTU traffic while the Ethernet LEDs will be the only indication of TCP traffic Babel Buster BB3 6101 LEDs indicate as follows LEDs are bi color REQUEST Flashes yellow each time a request is sent when operating as Modbus Master or each time a request is received when operating as Modbus Slave REPLY Operating as Modbus Master flashes green each time a good response is r...

Page 38: ... normal functionality Babel Buster MX 61 Request Reply and Error LEDs reflect Modbus RTU traffic and the Ethernet activity LED will indicate network traffic in general Babel Buster MX 61 LEDs indicate as follows LEDs are each a single color Error red Operating as Modbus Master flashes red when an error code is received the request times out or there is a flaw in the response such as CRC error Oper...

Page 39: ...ination only when this device is placed at the end of the network Termination should only be enabled at two points on the network and these two points must be specifically the end points Enable line bias when needed Line bias should only be enabled at one point on the network and does not have to be the end point Line bias holds the line in a known neutral state when no devices are transmitting Wi...

Page 40: ...CAT5 cable if your PC supports auto MDX With Wireshark running power up the gateway Upon power up BB3 6101 MX 61 will ping its own IP address one or more times This is part of its duplicate address resolution mechanism If it finds another device with its own IP address it will set its own IP address to a default pseudo random address generally starting with 192 Wait until you are certain BB3 6101 ...

Page 41: ...at 192 168 1 42 A 6 Forced Hard Configuration Reset IMPORTANT Before considering the forced hard reset be sure you have considered soft configuration reset or discovering lost IP address if applicable The Init jumper inside the BB3 6101 MX 61 serves two purposes and what it does depends on whether you apply the jumper before or after the BB3 6101 MX 61 boots up Hard Configuration Reset Installing ...

Page 42: ...s to allow FTP firmware uploads if needed Note The hard reset of configuration also means all of your resource allocations are reset to original factory defaults If you want resource allocations that are different you will need to repeate the allocation setup as described in Section 3 4 Firmware Update Recovery Installing this jumper prior to power up causes the server to go into TFTP firmware upd...

Page 43: ...n included with the device If the MAC address is deemed to be valid the window will be labeled Valid MAC Address and you will not be allowed to change it If the MAC address is deemed to be invalid the window will be labeled Restore MAC Address and you should then enter the correct MAC address and click Restore A restart is then needed A 7 Firmware Update Notes The most up to date firmware is shipp...

Page 44: ...our gateway to use a minimum of resources to free up space to temporarily buffer the image bin file upload More detailed instructions for the FTP upload are included in the zip file you will download to obtain the firmware update Instructions for the TFTP upload are available in our knowledgebase at https info csimn com A Hardware Details file C AAA_CSI Literature 2021 User Guides BB3 6101 MX 61 U...

Page 45: ... of things including inputs outputs configuration data or any requirement for holding data Modbus Function Codes Modbus protocol defines several function codes for accessing Modbus registers There are four different data blocks defined by Modbus and the addresses or register numbers in each of those overlap Therefore a complete definition of where to find a piece of data requires both the address ...

Page 46: ...urred 6 Slave Device Busy The slave is engaged in processing a long duration command The master should try again later 10 hex 0A Gateway Path Unavailable Gateway could not establish communication with target device 11 hex 0B Gateway Target Device Failed to Respond Specialized use in conjunction with gateways indicates no response was received from the target device 17 hex 11 Gateway Target Device ...

Page 47: ...olding register at address 0000 most often referred to as holding register number 1 If registers are 16 bits how does one read Floating Point or 32 bit data Modbus protocol defines a holding register as 16 bits wide however there is a widely used defacto standard for reading and writing data wider than 16 bits The most common are IEEE 754 floating point and 32 bit integer The convention may also b...

Page 48: ...ry plus or minus one for register number All Control Solutions products refer to register numbers in configuration software or web pages However some manufacturers document their devices showing address not register numbers When you have addresses you must add one when entering that register into configuration software from Control Solutions Can I put 2 gateways on the same Modbus network You can ...

Page 49: ...fully communicating The exception code itself will provide a clue as to the problem C 2 Modbus TCP Trouble Shooting Since there is always a one to one correlation between TCP message and RTU message in this type of gateway the Error Counts page applies regardless of source and destination of the message You will find message and error counters listed on the Error Counts see section 6 There is also...

Page 50: ...b collecting dust somewhere you now have a new use for it It will let Wireshark see all traffic from the PC that goes between any other devices connected to that 10BaseT hub Beware of devices that call themselves hubs but support 100BaseT connections These are switches Since manufacturers of hubs decided nobody should have a use for them anymore they are generally out of production Finding a 10Bas...

Page 51: ...o modbus your display will be something similar to what is pictured below Click on any request or reply and you can expand the interpretation of the Modbus message in the middle section of the screen C Trouble Shooting file C AAA_CSI Literature 2021 User Guides BB3 6101 MX 61 Use 3 of 3 5 4 2021 9 58 AM ...

Page 52: ...nal certificates are found or could not be loaded correctly These will be generated one time and saved in the Flash file system for subsequent reuse When the self generated X 509 certificates are in use this will be indicated at the bottom of the Network configuration page If there is a need to delete the self generated certificates you can do so by logging in via FTP Change directory to FLASH0 th...

Page 53: ...erver private key in PEM format The content of each certificate file will look something like the screen shot below If you require external certificates for your secure web server the requirement was likely imposed by your IT department They should be able to provide the necessary certificates for you For globally accessed use the Root CA would come from somebody like GoDaddy or DigiCert formerly ...

Page 54: ...t run on a Linux system with OpenSSL installed will generate the three required SSL certificate files It will generate a number of intermediate files as well you don t need to upload them Replace references to Control Solutions in this script with your own company name bin bash echo hello This will create some self signed certs using one master CA these can be the webserver DNS name or an IP addre...

Page 55: ...ys openssl genrsa out server key BITS openssl genrsa out client key BITS ok and now the MAIN CA openssl req x509 HASH nodes days 10000 newkey rsa BITS keyout ca key out ca crt subj CN Main CA Certificate O Control Solutions Inc C US ST Minnesota L St Paul Create a CSR for both server and client Replace these values with one appropriate for your organization openssl req out server csr key server ke...

Page 56: ...2 out client full pem clcerts mv f server key svrkey pem mv f server crt svrcert pem mv f client key clntkey pem mv f client crt clntcert pem cp f ca crt cacert pem cleanup rm f client csr server csr DLS 20160420 echo echo WARNING Do not use this script to generate production echo keys and certificates This script is for echo demonstration purposes only echo D SSL Certificates for Secure Web HTTPS...

Reviews:

No comments