manualshive.com logo in svg

Eaton eNMC2, User Manual, Page: 163 / 231

Share
Download
Eaton eNMC2 User Manual Download Page 163

Cybersecurity considerations for electrical distribution systems

Securing the Network Management Module  –  163

IPS

Intrusion Prevention Systems

IT

Information Technology

NVD

National Vulnerability Database

OSI

Open System Interconnection

PLC

Programmable Logic Controller

SCADA

Supervisory Control and Data Acquisition

SNMP

Simple Network Management Protocol

SSH

Secure Shell

SIEM

Security Information and Event Management

USB

Universal Serial Bus

5.1.11  References

[1] Recommended Practice: Improving Industrial Control Systems Cybersecurity with Defense-In-Depth Strategies, October 2009

https://ics-cert.us-cert.gov/sites/default/files/FactSheets/NCCIC%20ICS_FactSheet_Defense_in_Depth_Strategies_S508C.pdf

[2] NIST.SP.800-82 Guide to Industrial Control Systems (ICS) Security, June 2011

http://csrc.nist.gov/publications/nistpubs/800-82/SP800-82-final.pdf

[3] NIST.SP.800-94 Guide to Intrusion Detection and Prevention Systems (IDPS), Feb 2007

http://csrc.nist.gov/publications/nistpubs/800-94/SP800-94.pdf

[4] Common Cybersecurity Vulnerabilities in Industrial Control Systems, May 2011

http://ics-cert.uscert.gov/sites/default/files/recommended_practices/DHS_Common_Cybersecurity_Vulnerabilities_ICS_2010.pdf

[5] The Tao of Network Security Monitoring, 2005 Richard Bejtlich

Summary of Contents for eNMC2

Page 1: ...PDU Network Module eNMC2 User s Guide English 10 09 2023...

Page 2: ......

Page 3: ...Corporation in the United States and or other countries UNIX is a registered trademark of The Open Group Linux is the registered trademark of Linus Torvalds in the U S and other countries VMware is a...

Page 4: ...20 3 1 2 Troubleshooting 20 3 2 Home 21 3 2 1 Menu structure 22 3 2 2 Energy flow diagram examples 24 3 2 3 Access rights per profiles 31 3 3 Meters 31 3 3 1 Main utility input 32 3 3 2 Second utility...

Page 5: ...128 4 SERVICING THE NETWORK MANAGEMENT MODULE 129 4 1 Configuring Commissioning Testing LDAP 129 4 1 1 Commissioning 129 4 1 2 Testing LDAP authentication 130 4 1 3 Limitations 130 4 2 Pairing agent t...

Page 6: ...cal distribution systems 156 5 1 1 Purpose 156 5 1 2 Introduction 156 5 1 3 Connectivity why do we need to address cybersecurity for industrial control systems ICS 156 5 1 4 Cybersecurity threat vecto...

Page 7: ...207 7 7 1 Commands available 208 7 7 2 Contextual help 208 7 7 3 get release info 209 7 7 4 history 209 7 7 5 logout 210 7 7 6 maintenance 210 7 7 7 netconf 210 7 7 8 ping and ping6 212 7 7 9 reboot 2...

Page 8: ...7 8 6 2 Possible cause 227 8 6 3 Setup 227 8 6 4 Action 1 227 8 6 5 Action 2 228 8 7 LDAP configuration commissioning is not working 228 8 8 Password change in My profile is not working 228 8 8 1 Symp...

Page 9: ...he two screws securing the option slot cover plate and store the plate for possible future use Install the Network Module along the alignment channels in the option slot Secure the Network Module usin...

Page 10: ...d in the Password field The default password is admin STEP 6 The password must be changed at first login STEP 7 Click Login The Network Module web interface appears 2 3 2 Finding and setting the IP ad...

Page 11: ...to Contextual help Settings Network Protocol IPV4 Select Manual Static IP Input the following information Address Subnet Mask Default Gateway Save the changes 2 3 3 Accessing the web interface throug...

Page 12: ...EP 1 In case Windows OS fails to find driver automatically go to the Windows control panel Network and sharing center Local area connection STEP 2 Right click on the RNDIS local area connection and se...

Page 13: ...Accessing the Network Module Installing the Network Management Module 13 STEP 4 Then enter the configuration as below and validate IP 169 254 0 150 and mask 255 255 0 0 click OK then click on Close...

Page 14: ...ork Management Module Accessing the Network Module Modifying the Proxy exception list section in the full documentation STEP 4 Launch a supported browser the browser window appears STEP 5 In the Addre...

Page 15: ...P 3 Check the CDC Serial in the list if it is with a yellow exclamation mark implying that driver has not been installed follow the steps 4 5 6 7 otherwise configuration is OK STEP 4 Right click on it...

Page 16: ...LI can be accessed through SSH Serial terminal emulation For more details refer to Information CLI section 2 3 5 Modifying the Proxy exception list To connect to the Network Module via a USB cable and...

Page 17: ...Accessing the Network Module Installing the Network Management Module 17 Select the Connections tab Press LAN Settings Press ADVANCED Add the address 169 254...

Page 18: ...any other browser 2 4 Configuring the Network Module settings Use the web interface to configure the Network Module The main web interface menus are described below 2 4 1 Menu structure Home Overview...

Page 19: ...onfiguration Information Settings Network Module settings Maintenance Firmware Services Resources System logs Legal Legal information Availability of source code Notice for proprietary elements Profil...

Page 20: ...the Network Module for the first time you must enter the factory set default username and password Username admin Password admin 3 1 1 2 2 Change default password Changing the default password is mand...

Page 21: ...is not up to date after a FW upgrade Symptom After an upgrade The Web interface is not up to date New features of the new FW are not displayed Possible causes The browser is displaying the Web interf...

Page 22: ...t be found 3 2 1 Menu structure Home Overview and status of the Device Active alarms Outlet status Meters Power quality meters and logs Controls Device and outlets control Protection Agents list Agent...

Page 23: ...Notice for proprietary elements Profile Displays user profile password change account information and logout Help Opens full documentation in a separate browser page Alarms Open alarm page and display...

Page 24: ...Home Contextual help of the web interface 24 3 2 2 Energy flow diagram examples 3 2 2 1 Line interactive UPS 3 2 2 1 1 Normal mode 3 2 2 1 2 Buck Boost mode...

Page 25: ...Home Contextual help of the web interface 25 3 2 2 1 3 Battery mode 3 2 2 1 4 Off mode...

Page 26: ...Home Contextual help of the web interface 26 3 2 2 2 Online UPS with single input source 3 2 2 2 1 Online mode 3 2 2 2 2 Bypass mode...

Page 27: ...Home Contextual help of the web interface 27 3 2 2 2 3 Battery mode 3 2 2 2 4 Off mode...

Page 28: ...Home Contextual help of the web interface 28 3 2 2 2 5 HE mode ESS mode 3 2 2 3 Online UPS with dual inputs sources and Maintenance bypass 3 2 2 3 1 Online mode...

Page 29: ...Home Contextual help of the web interface 29 3 2 2 3 2 Bypass mode 3 2 2 3 3 Battery mode...

Page 30: ...Home Contextual help of the web interface 30 3 2 2 3 4 HE mode ESS mode 3 2 2 3 5 Maintenance bypass mode...

Page 31: ...2 2 4 1 Normal mode 3 2 2 4 2 Prefered source missing 3 2 3 Access rights per profiles Administrator Operator Viewer Home 3 2 3 1 For other access rights 3 3 Meters For other access rights see the Inf...

Page 32: ...the product main utility measures Current A Voltage V 3 3 2 Second utility input if available If presents displays the product second utility measures Current A Voltage V Green Value inside threshold...

Page 33: ...utput Voltage V Power W Current A 3 3 4 Battery status Battery status section is an overview of the battery information 3 3 4 1 Overview Environment Type Nominal capacity Nominal voltage Capacity rema...

Page 34: ...of the battery and allow to launch a battery test The status reflects the last completed battery test result as well as its critical status color and completion time Pass Warning Fail Unknown 3 3 5 1...

Page 35: ...tput Frequency Hz Output Current A Output Apparent Power VA Output Active Power W Output Power Factor Output Percent Load Battery Voltage V Battery Capacity Battery Remaining Time s 3 3 7 Default sett...

Page 36: ...3 4 1 1 Status Reflects the current mode of the UPS The following is a list of potential table values that are displayed based on the UPS topology On Protected Not protected Off Not powered Not prote...

Page 37: ...mote reboot and the sequential start of servers to restrict inrush currents 3 4 2 1 Status It reflects the current outlet status On Protected Not protected Off Not powered 3 4 2 2 Commands A set of co...

Page 38: ...be triggered before the corresponding outlets are turned off as configured in shutdown settings 3 4 3 1 Scheduled shutdown table The table displays the scheduled shutdowns and includes the following d...

Page 39: ...d due to the UPS configuration see the action below 2 The UPS does not support remote commands Action Refer to the UPS user manual and its instruction on how to configure the UPS settings and allow re...

Page 40: ...fter automatic acceptance make sure that all listed agents belong to your infrastructure If not access may be revoked using the Delete button For maximum security Eaton recommend following one of the...

Page 41: ...estamp leads to Full acquisition has failed error message on Software Symptoms IPP IPM shows the error message The full data acquisition has failed even if the credentials are correct Possible cause T...

Page 42: ...work Module The log in screen appears Enter the user name in the User Name field Enter the password in the Password field Click Login The Network Module web interface appears STEP 2 Navigate to Settin...

Page 43: ...e to accepts new agents is running on the Network Module Remove the Network module certificate file s 0 that is are located in the folder Eaton IntelligentPowerProtector configs tls Client server is n...

Page 44: ...es by power sources Primary Group 1 Group 2 The local agent setting is used for setting for example a minimum shutdown duration or a power down delay for a load segment that has no registered shutdown...

Page 45: ...irectly change the setting in the table and then Save 3 5 2 2 2 Set OS shutdown duration Select and directly change the setting in the table and then Save 3 5 2 3 Examples Examples below show the impa...

Page 46: ...Protection Contextual help of the web interface 46 3 5 2 3 2 Example 2 Shutdown time 180s Immediate shutdown time 180s...

Page 47: ...correct order For example applications first database servers next and storage last It is also possible to turn off some outlets to reduce power consumption and get longer battery runtime for the most...

Page 48: ...iate OFF To initiate the shutdown sequence when on battery for 10 seconds c Custom Several conditions can be set to define shutdown criteria To initiate the shutdown sequence when on battery for 10 se...

Page 49: ...All the following examples are using below agent s settings Shutdown time 210s Example 1 Maximize availability When primary shuts OFF both group1 and group 2 shut OFF immediately So if Primary is set...

Page 50: ...Protection Contextual help of the web interface 50 Example 2 Immediate OFF Example 4 Custom...

Page 51: ...Protection Contextual help of the web interface 51 Settings 1 Settings 2...

Page 52: ...example this allows sequential startup of the IT system so that network and storage devices are connected to Primary and start up immediately After a delay database servers in Group1 are powered up an...

Page 53: ...ands are not allowed due to the UPS configuration see the action below 2 The UPS does not support remote commands Action Refer to the UPS user manual and its instruction on how to configure the UPS se...

Page 54: ...sors log file If available possible measures are listed below Temperature of sensor_1 in K 1 decimal digit Humidity of sensor_1 in 1 decimal digit Temperature of sensor_2 in K 1 decimal digit Humidity...

Page 55: ...button to adjust the temperature and humidity offsets of the selected sensors 3 Extend the temperature or humidity section 4 Set the offsets in the cell temperatures and humidity will be updated acco...

Page 56: ...ture and humidity Active Yes No Dry contacts Active Yes No Name Polarity Normally open Normally closed The dry contact is close and this is normal because it is configured as normally close The dry co...

Page 57: ...y the Network module Action 1 1 Launch again the discovery if it is still not ok go to Action 1 2 Action 1 2 1 Check the EMPs connection and cables Refer to the sections Servicing the EMP Installing t...

Page 58: ...and termination Manual addressing 2 Disconnect and reconnect the USB to RS485 cable The address change is only taken into account after an EMP power up 3 Launch the discovery if it is still not ok go...

Page 59: ...6 2 1 1 Actions a Set Enabled Select and directly change the setting in the table and then Save When disabled no alarm will be sent b Set alarm threshold Enable the alarm first and then change the set...

Page 60: ...abled no alarm will be sent b Set alarm threshold Enable the alarm first and then change the setting in the table and then Save When a warning threshold is reached an alarm will be sent with a warning...

Page 61: ...y open 3 6 2 4 Default settings and possible parameters Environment Alarm configuration Default setting Possible parameters Temperature Enabled No Low critical 0 C 32 F Low warning 10 C 50 F High warn...

Page 62: ...o the Network Module Physical name Vendor Part number Firmware version UUID Serial number Location 3 6 3 1 Access rights per profiles Administrator Operator Viewer Environment Information 3 6 3 1 1 Fo...

Page 63: ...ext field that is used to provide the system name information Card system information is updated to show the system name 3 7 1 1 4 Time date settings The current date and time appears in the footer at...

Page 64: ...ails Configuration name Email address Notification updates Displays Events notification Periodic report icons when active Status Active Inactive In delegation 3 7 1 2 2 Actions a Add Press the New but...

Page 65: ...wing settings Custom name Email address Status Active Inactive Hide the IP address from the email body Disabled Enabled This setting will be forced to Enabled if Enabled in the SMTP settings Schedule...

Page 66: ...Settings Contextual help of the web interface 66 3 7 1 3 SMTP settings SMTP is an internet standard for electronic email transmission The following SMTP settings are configurable...

Page 67: ...ope Paris Location 31 characters maximum Contact 255 characters maximum System name 255 characters maximum Time date settings Manual Time zone selection on map Date Dynamic NTP Email notification sett...

Page 68: ...from the email body enable disabled Secure SMTP connection enable disable Verify certificate authority disable enable 3 7 1 4 1 For other settings 3 7 1 5 Access rights per profiles Administrator Oper...

Page 69: ...nt display date and time in YYYYMMDDhhmmss format s set mode Mode values set date and time format YYYYMMDDhhmmss manual date and time set preferred and alternate NTP servers ntpmanual preferred server...

Page 70: ...s a Add Press the New button to create up to ten new users b Remove Select a user and press the Delete button to remove it c Edit Press the pen logo to edit user information You will get access to the...

Page 71: ...sword to be changed on next login d Global settings Press Save after modifications Password settings To set the password strength rules apply the following restrictions Minimum length Minimum upper ca...

Page 72: ...Minimum digit enable 0 32 disable Special character enable 0 32 disable Password expiration Number of days until password expires disabled Main administrator password never expires disabled Number of...

Page 73: ...characters maximum Phone 64 characters maximum Organization 128 characters maximum 3 7 2 2 1 For other settings 3 7 2 3 Access rights per profiles Administrator Operator Viewer Local users 3 7 2 3 1 F...

Page 74: ...he main administrator your password can be reset manually by following steps described in the Servicing the Network Management Module Recovering main administrator password 3 7 2 5 1 For other issues...

Page 75: ...the web interface 75 Certificate Status Status could take following values Unreachable Active 3 7 3 1 1 Actions a Configure 1 Enable LDAP to be able to configure settings 2 Press Configure to access...

Page 76: ...arch bind Search user DN Password User base DN User name attribute Group base DN Group name attribute 2 Click Save b Profile mapping 1 Press Profile mapping to map remote groups to local profiles 2 Cl...

Page 77: ...ure Date format Time format 2 Click Save 3 7 3 2 RADIUS The table shows all the supported severs and includes the following details Name descriptive name for the RADIUS server Address hostname or IP a...

Page 78: ...he UDP port for the RADIUS server 1812 by default Time out s length of time the client waits for a response from the RADIUS server Retry count the number of time a connection is retried Secondary serv...

Page 79: ...he attribute needed for this mapping Profile the local profile you want users to be mapped Note The default mapping is used for eaton specific value Attribute 28 Vendor 534 Value 1 and Profile adminis...

Page 80: ...e format MM DD YYYY Time format hh mm ss 24h Configure Active No yes Security SSL None Start TLS SSL Verify server certificate disabled enabled Primary server Name 128 characters maximum Hostname 128...

Page 81: ...ondary server Name 128 characters maximum Address 128 characters maximum Secret 128 characters maximum UDP port 1 to 65535 Time out 3 to 60 Users preferences Language English French German Italian Jap...

Page 82: ...e primary server optional s secondary Force the test to use secondary server optional v verbose Print the exchanges with LDAP server optional ldap test checkmappedgroups primary secondary v Check LDAP...

Page 83: ...for password initialization If you are the main administrator your password can be reset manually by following steps described in the Servicing the Network Management Module Recovering main administr...

Page 84: ...interface 84 3 7 4 Network Protocol 3 7 4 1 Network 3 7 4 1 1 IPv4 Press the Edit button to configure the network settings select either the Manual or DHCP settings option Any modifications are appli...

Page 85: ...he gateway address allows connections to devices or hosts attached to different network segments b DHCP Select dynamic DHCP to configure network parameters by a BootP or DHCP server If a response is n...

Page 86: ...Settings Contextual help of the web interface 86 a Current configuration Address Gateway b Address settings Enabled Mode Manual DHCP Address Prefix Gateway...

Page 87: ...urces connected to the Internet or a private network Press the Edit button to configure the network settings select either the Static or Dynamic settings a Manual Enter the Network Module Hostname Ent...

Page 88: ...net A LAN is a computer network that interconnects computers within a limited area The available values for LAN configuration are listed below Auto negotiation 10Mbps Half duplex 10Mbps Full duplex 10...

Page 89: ...https is 443 For additional security the ports can be changed on this page Press Save after modifications 3 7 4 2 2 Syslog a Settings This screen allows an administrator to configure up to two syslog...

Page 90: ...needed Press Save after modifications 3 7 4 3 Default settings and possible parameters Network Protocol Default setting Possible parameters IPV4 Mode DHCP Mode DHCP Manual Address Netmask Gateway IPV6...

Page 91: ...ode byte order mask BOM disable enable Server 2 Name 128 characters maximum Status Disabled Enabled Hostname 128 characters maximum Port x xxx Protocol UDP TCP Message transfer method in TCP Octet cou...

Page 92: ...dard IETF UPS MIB RFC 1628 Sensor MIB Press the Supported MIBs button to download the MIBs 3 7 5 1 1 Settings This screen allows an administrator to configure SNMP settings for computers that use the...

Page 93: ...either Read Only or Read Write account to access settings 2 Enter the SNMP Community Read Only string The Network Module and the clients must share the same community name to communicate 3 Select Acti...

Page 94: ...ate the account 4 Select access level Read only The user does not use authentication and privacy to access SNMP variables Read Write The user must use authentication but not privacy to access SNMP var...

Page 95: ...security mechanism select the Privacy algorithms AES fill in password and privacy keys The password can be between 8 and 24 characters and use a combination of alphanumeric and the following special c...

Page 96: ...3 Press the SAVE button b Remove Select a trap receiver and press the Delete button to remove it c Edit Press the pen icon to edit trap receiver information and access to its settings d Test trap Pres...

Page 97: ...ers maximum Enabled Inactive Active Access Read only Community 2 128 characters maximum Enabled Inactive Active Access Read Write SNMP V3 disable enable User 1 32 characters maximum Enabled Inactive A...

Page 98: ...The SNMPv3 was configured prior to 1 7 0 In that case SNMPv3 configuration is not well managed by the Save and by the Restore settings Action Reconfigure your SNMPv3 users and passwords on versions 1...

Page 99: ...ecured and trusted network For maximum security we recommend following one of the two methods on the certificate settings page Import agent s certificates manually Generate trusted certificate for bot...

Page 100: ...nd then press the Revoke button A confirmation window appears press Continue to proceed this operation cannot be recovered b Export Exports the selected certificate on your OS browser window c Configu...

Page 101: ...he following Certificate summary Actions Generate a new self signed certificate Generate CSR Import certificate only available when CSR is generated Details e Generate a new self signed certificate To...

Page 102: ...signed by the CA it can be imported into the Network Module When the import is complete the new local certificate information is displayed in the table 3 7 6 3 Certificate authorities CA Manages CAs 3...

Page 103: ...rtificate Used for Issued by Issued to Valid from Expiration In case a certificate expires the connection with the client will be lost If this happens the user will have to recreate the connection and...

Page 104: ...4 characters maximum 3 7 6 5 1 For other settings 3 7 6 6 Access rights per profiles Administrator Operator Viewer Certificate 3 7 6 6 1 For other access rights 3 7 6 7 CLI commands certificates Descr...

Page 105: ...PASSWORD batch certificates local export SERVICE_NAME import over SSH type FILE plink USER CARD_ADDRESS pw PASSWORD batch certificates local import SERVICE_NAME csr over SSH plink USER CARD_ADDRESS p...

Page 106: ...dule with IPP IPM and check that the status of the Protected applications MQTT is now valid Communication will then recover if not go to Action 2 STEP 2 Action 2 Pair agent to the Network Module with...

Page 107: ...T certificate is not valid at Network module date Action Set the right date time and timezone If possible use a NTP server refer to Contextual help Settings General System details Time date settings s...

Page 108: ...ad 3 Click Choose file and select the firmware package by navigating to the folder where you saved the downloaded firmware 4 Click Upload The upload can take up to 5 minutes The firmware that was inac...

Page 109: ...1 t Get current release time v Get current release version number 3 8 1 4 1 For other CLI commands 3 8 1 5 Troubleshooting The Network Module fails to boot after upgrading the firmware Possible Cause...

Page 110: ...laying the Web interface through the cache that contains previous FW data Action Empty the cache of your browser using F5 or CTRL F5 3 8 1 5 1 For other issues 3 8 2 Services 3 8 2 1 Service options 3...

Page 111: ...A confirmation message displays click Reboot to confirm the reboot time will take approximately less than 2min Depending on your network configuration the Network Module may restart with a different I...

Page 112: ...Click on Save Depending on your network configuration the Network Module may restart with a different IP address Refresh the browser after the Network module reboot time to get access to the login pa...

Page 113: ...elect the JSON file 5 Click on Restore to confirm 3 8 2 1 6 Maintenance The maintenance report is for the service representative use to diagnose problems with the network module It is not intended for...

Page 114: ...enance report file which may be handed to the technical support Help maintenance cr Create maintenance report file h help Display help page reboot Description Tool to Reboot the card Help Usage reboot...

Page 115: ...tore over SSH cat FILE sshpass p PASSWORD ssh USER CARD_ADDRESS restore_configuration p PASSPHRASE From a Windows host Save over SSH plink USER CARD_ADDRESS pw PASSWORD batch save_configuration p PASS...

Page 116: ...d 3 8 2 3 1 For other CLI commands 3 8 3 Resources Card resources is an overview of the Network Module processor memory and storage information The COPY TO CLIPBOARD button will copy the information t...

Page 117: ...17 3 8 3 2 Memory Total size in MB Available size in MB Application size in MB Temporary files size in MB 3 8 3 3 Storage Total size in MB Available size in MB Used size in MB 3 8 3 4 Access rights pe...

Page 118: ...d MB tmpfs temporary files usage MB Flash user data total MB free MB used MB Help systeminfo_statistics Display systeminfo statistics h help Display the help page 3 8 3 5 1 For other CLI commands 3 8...

Page 119: ...Y TO CLIPBOARD button will copy the information to the clipboard 3 8 5 1 Identification System name if filled it replaces the Device model name in the top bar Product Physical name Vendor UUID Part nu...

Page 120: ...er licensed under various open source license or under a proprietary license 3 9 1 Component All the open source components included in the Network Module are listed with their licenses 3 9 2 Availabi...

Page 121: ...rights per profiles Administrator Operator Viewer Legal information 3 9 4 1 For other access rights 3 10 Alarms 3 10 1 Alarm sorting Alarms can be sorted by selecting All Active only For other access...

Page 122: ...s above the number of alarms per page the buttons First Previous and Next appears to allow navigation in the Alarm list 3 10 5 Export Press the Export button to download the file 3 10 6 Clear Press th...

Page 123: ...e icon on the top right side of the page to access the user profile window 3 11 2 User profile This page displays the current username with its realm local remote and allows to Change passwords Edit a...

Page 124: ...web interface 124 3 11 2 1 Change password Click on Change password to change the password In some cases it is not possible to change the password if it has already been changed within a day period R...

Page 125: ...Edit account to edit user profile and update the following information Account details Full name Email Phone Organization Preferences Language Date format Time format Temperature 3 11 2 3 Edit account...

Page 126: ...ench German Italian Japanese Russian Simplified Chinese Spanish Traditional Chinese Date format MM DD YYYY YYY MM DD DD MM YYY DD MM YYY DD MM YYY DD MM YYYY Time format hh mm ss 24h hh mm ss 12h Temp...

Page 127: ...My profile is not working Symptoms The password change shows Invalid credentials when I try to change my password in My profile menu Possible cause The password has already been changed once within a...

Page 128: ...ons below when they are related to the web page Servicing the Network Management Module How to install and use the Network module Securing the Network Management Module How to secure the Network modul...

Page 129: ...ned by a CA import the corresponding CA in the Certificate authorities CA list for LDAP service Configure credentials to bind with the LDAP server or select anonymous if no credentials are required Co...

Page 130: ...verify an LDAP user can authenticate using his username and password and will display its local profile In case of error use the verbose option of the command to investigate the reason 4 1 3 Limitatio...

Page 131: ...agents and press the Start button and the press Continue During the selected timeframe new agent connections to the Network Module are automatically trusted and accepted STEP 2 Action on the agent IPP...

Page 132: ...nd then click on CONTINUE 4 Select the client pem file previously saved click Open Communication with the agent is restored 4 3 Powering down up applications examples 4 3 1 Powering down IT system in...

Page 133: ...ent shutdown sequencing page 4 Set the OS shutdown duration to the time needed for your server to shutdown gracefully This will make sure IPP shutdowns your servers before the load segment is powered...

Page 134: ...y is maximized and its shutdown will end 30s before the end of backup time 3 Set Group 1 and Group 2 to Custom Applications must shutdown first so Group 1 has been set to start shutdown when on batter...

Page 135: ...cal equipment Powering down critical equipment 3min before the end of backup time 4 3 2 2 Step 1 Installation setup 4 3 2 2 1 Objective Use load segmentation provided by the UPS to independently contr...

Page 136: ...ion Agent shutdown sequencing page 4 Set the OS shutdown duration to the time needed for your server to shutdown gracefully This will make sure IPP shutdowns your servers before the load segment is po...

Page 137: ...xamples Servicing the Network Management Module 137 Critical equipment is the last one to power down their availability will be maximized and their shutdown will end 180s before the end of backup time...

Page 138: ...ally the IT equipment on utility recovery 4 3 3 1 Target Restart the storage first right after utility recovery database servers next 2min after utility recovery and applications last 3min after utili...

Page 139: ...t 3 Enable the Automatically restart the UPS when battery capacity exceeds and set it to 0 The storage will restart first right after utility recovery without waiting the battery capacity to exceed a...

Page 140: ...l script executable chmod 700 install_updatePackage sh 4 6 2 2 Procedure To upgrade the Network module using Open a shell terminal on your computer Linux or cygwin meaning real or emulated Linux opera...

Page 141: ...sh upgrade inProgress 78 Uncompress and flash upgrade inProgress 92 Uncompress and flash upgrade inProgress 100 Uncompress and flash upgrade inProgress 100 Uncompress and flash upgrade Executing post...

Page 142: ...work Management Module 142 6 Replace the Network Module and secure the screw reconnect the Network cable if it was unplugged during the operation 7 Connect the Network Module and set the date and time...

Page 143: ...ule 4 9 1 2 If the Network Module time is lost The Network Module and the UPS time is synchronized with the oldest time between the last know Network Module time and the UPS time 4 9 2 Manual time syn...

Page 144: ...r your current password the new password twice 4 Press Submit to save the changes 4 12 Recovering main administrator password To recover the main administrator password ask another administrator to in...

Page 145: ...ed to change the password accordingly to the current password strength rules 4 13 Switching to static IP Manual Changing IP address of the Network Module Administrators can switch to static IP in the...

Page 146: ...Contextual help Settings General Email notification settings 2 Press the button New to create a new configuration 3 Select Active Yes Configuration name Load unprotected notification Email address mya...

Page 147: ...xtual help Settings General Email notification settings 2 Press the button New to create a new configuration 3 Select Active Yes Configuration name ALL Critical and User account Warning notification E...

Page 148: ...Network Management Module 148 4 Press Save the table will show the new configuration 4 16 Saving Restoring Duplicating Network module configuration settings 4 16 1 Modifying the JSON configuration set...

Page 149: ...a Data block Data block cannot be modified this is the mandatory structure of the JSON file b Value block If some values inside the Value block need to be kept Value block structure cannot be modified...

Page 150: ...users is not yet available only the predefined account main administrator can be modified 4 16 1 3 3 Modifying SNMP settings Original file Modified file SNMP disabled SNMP enabled on port 161 SNMPv1...

Page 151: ...ork Management Module 151 Original file Modified file 4 16 1 3 4 Making a partial update restoration a Example Updating Restoring only LDAP settings If you restore below JSON content only LDAP setting...

Page 152: ...searchBaseDN DC xxx DC xxx DC xxx requestParameters userBaseDN OU xxxx DC xxxx userNameAttribute xxxx uidAttribute objectSid x x x xx xxxxxxxxxx xxxxxxxxxx xxxxxxxxxx groupBaseDN OU xxxx DC xxxx grou...

Page 153: ...Data Values example Card Data Values example Date timeZone Europe Paris Africa Johannesburg America New_York Asia Shanghai Refer to the Web interface for the full list Data Values example email period...

Page 154: ...ol fr Fran ais it Italiano ja ru zh_Hans zh_Hant preferences dateFormat Y m d YYYY MM DD d m Y DD MM YYYY d m Y DD MM YYYY d m Y DD MM YYYY m d Y MM DD YYYY d m Y DD MM YYYY preferences timeFormat 1 2...

Page 155: ...servers protocol 1 UDP 2 TCP servers tcpframing 1 TRADITIONAL 2 OCTET_COUNTING Data Values example Web server 4 16 2 Saving Restoring Duplicating settings through the CLI Navigate to Information CLI s...

Page 156: ...easing concern regarding cybersecurity across industries where companies are steadily integrating field devices into enterprise wide information systems This occurs in discrete manufacturing and proce...

Page 157: ...grams and provides access to that device Worm a device program that spreads without user interaction and affects the stability and performance of the ICS network Spyware a device program that changes...

Page 158: ...l protection methods that hide and protect individual devices and computers in a control network These firewalls communicate at the application layer and can provide better inspection capabilities Bec...

Page 159: ...ntrol both physical and logical should be defined and implemented The key consideration when designing access control is defining the required interactions both within a given zone and between zones T...

Page 160: ...ndards 5 1 7 1 Understanding an ICS network Creating an inventory of all the devices applications and services that are hosted in a network can establish an initial baseline for what to monitor Once t...

Page 161: ...ce Extensive testing needs to be conducted before deployment to minimize this impact 5 1 7 5 Continuous assessment and security training It is critical that ICS network administrators and regular user...

Page 162: ...ignificant concern compensating controls should be investigated 5 1 8 Conclusion To protect important assets all organizations must take cybersecurity threats seriously and meet them proactively with...

Page 163: ...bersecurity with Defense In Depth Strategies October 2009 https ics cert us cert gov sites default files FactSheets NCCIC 20ICS_FactSheet_Defense_in_Depth_Strategies_S508C pdf 2 NIST SP 800 82 Guide t...

Page 164: ...rs that can be referenced at www eaton com cybersecurity 5 2 2 Secure configuration guidelines 5 2 2 1 Asset identification and Inventory Keeping track of all the devices in the system is a prerequisi...

Page 165: ...such as locks card readers and or guards etc Network module supports the following physical access ports controller mode switches and USB ports RJ45 USB A USB Micro B Access to them need to be restri...

Page 166: ...r instructions on how to edit a user account Server and client certificate configuration Navigate to Contextual help Settings Certificate Follow embedded help for instructions on how to configure it 5...

Page 167: ...Maintenance Services to get information on how to upgrade the Network Module Eaton also has a robust vulnerability response process In the event of any security vulnerability getting discovered in it...

Page 168: ...ettings 5 4 Decommissioning the Network Management module With the increased frequency of reported data breaches it s becoming more and more necessary for companies to implement effective and reliable...

Page 169: ...it on your installation Bottom mounting capabilities magnets keyholes tie wraps nylon fastener Side mounting magnets tie wraps 6 1 1 1 Rack mounting with keyhole example To mount the EMP on the rack u...

Page 170: ...nd tighten it 6 1 1 4 Wall mounting with nylon fastener example To mount the EMP within the enclosure environment attach one nylon fastener to the EMP and the other nylon fastener to an enclosure rail...

Page 171: ...Commissioning the EMP Refer to the section Contextual help Environment Commissioning Status 6 2 3 Enabling temperature compensated battery charging in the UPS To enable the temperature compensated ba...

Page 172: ...e is connected to the network but no activity detected Flashing yellow UPS Network Module is connected to the network and sending or receiving data AUX connector For Network Module accessories only Re...

Page 173: ...1A AUX output power 5V 5 200mA Date Time backup CR1220 battery coin cell The RTC is able to keep the date and the time when Network Module is OFF Functions Languages English French German Italian Jap...

Page 174: ...No email 5 configurations maximum Custom name 128 characters maximum Email address 128 characters maximum Hide IP address from the email body enable disabled Status Active Inactive Alarm notifications...

Page 175: ...0 32 disable Minimum lower case enable 0 32 disable Minimum digit enable 0 32 disable Special character enable 0 32 disable Password expiration Number of days until password expires disabled Main adm...

Page 176: ...ertificate disabled enabled Primary server Name 128 characters maximum Hostname 128 characters maximum Port x xxx Secondary server Name 128 characters maximum Hostname 128 characters maximum Port x xx...

Page 177: ...ret 128 characters maximum UDP port 1 to 65535 Time out 3 to 60 Users preferences Language English French German Italian Japanese Russian Simplified Chinese Spanish Traditional Chinese Temperature uni...

Page 178: ...r mask BOM disabled Inactive Active Server 1 Name 128 characters maximum Status Disabled Enabled Hostname 128 characters maximum Port x xxx Protocol UDP TCP Message transfer method Non transparent fra...

Page 179: ...y 2 128 characters maximum Enabled Inactive Active Access Read Write SNMP V3 disable enable User 1 32 characters maximum Enabled Inactive Active Access Read only Read Write Authentication Auth SHA 1 N...

Page 180: ...fault settings and possible parameters Meters Default setting Possible parameters Meters Logs Log measures every 60s Log measures every 3600s maximum 7 3 3 Sensors alarm configuration Default settings...

Page 181: ...glish Date format MM DD YYYY Time format hh mm ss 24h Temperature C Celsius Account details Full name 128 characters maximum Email 128 characters maximum Phone 64 characters maximum Organization 128 c...

Page 182: ...Viewer Meters Battery health Launch test Abort Logs configuration 7 4 3 Controls Administrator Operator Viewer Control 7 4 4 Protection Administrator Operator Viewer Protection Scheduled shutdowns Ad...

Page 183: ...perator Viewer Environment Alarm configuration Administrator Operator Viewer Environment Information 7 4 6 Settings Administrator Operator Viewer General Administrator Operator Viewer Local users Admi...

Page 184: ...Operator Viewer System information Administrator Operator Viewer Firmware Administrator Operator Viewer Services Administrator Operator Viewer Resources Administrator Operator Viewer System logs 7 4 8...

Page 185: ...extual help Administrator Operator Viewer Contextual help Full documentation 7 4 12 CLI commands Administrator Operator Viewer get release info Administrator Operator Viewer history Administrator Oper...

Page 186: ...ewer reboot Administrator Operator Viewer save_configuration restore_configuration Administrator Operator Viewer sanitize Administrator Operator Viewer ssh keygen Administrator Operator Viewer time re...

Page 187: ...rror Card reboot due to database error logSystem csv 0700200 Error Failed to start execution of script script description Client not registered script uuid logSystem csv 0700400 Error Execution of scr...

Page 188: ...logSystem csv 0C00500 Warning Unable to send email Certificate Authority not recognized logSystem csv 0C00600 Warning Unable to send email Secure connection required logSystem csv 0C00800 Warning Unab...

Page 189: ...unt name changed user account id logAccount csv 0800600 Notice User account password changed logAccount csv 0800800 Notice User account password reset user account id logAccount csv 0800A00 Notice Use...

Page 190: ...zz logUpdate csv 0B00300 Info Time with NTP synchronized logSystem csv 0B00600 Info Time settings changed logSystem csv 0B01100 Info Time reset to last known date date logSystem csv 0C00F00 Info Test...

Page 191: ...e required 607 Critical Battery test failed Battery test OK Check battery 60D Critical No battery Battery present Check battery 61B Critical Battery BMS fault Battery BMS OK Check battery 629 Critical...

Page 192: ...re on battery 007 Warning Fan fault Fan OK Service required 00B Warning Parallel UPS redundancy lost Parallel UPS redundancy OK Reduce output load 00E Warning Parallel UPS communication lost Parallel...

Page 193: ...ning DC bus too low DC bus voltage OK Service required 303 Warning DC bus too low DC bus voltage OK Service required 304 Warning DC bus unbalanced DC bus OK Service required 501 Warning Charger temper...

Page 194: ...attery temperature OK Check battery 63D Warning Battery warning Battery OK Check battery 700 Warning Inverter limitation No current limitation Reduce output load 701 Warning Inverter fuse fault Invert...

Page 195: ...ve message Non active message Advice 005 Info Communication lost with UPS Communication recovered with UPS Service required 009 Info On high efficiency On ESS mode High efficiency disabled ESS disable...

Page 196: ...fault UPS power supply OK 2075 Critical Rectifier overload Rectifier OK 2077 Critical Input AC module failure Input AC module OK 2102 Critical Inverter limitation No current limitation 2111 Critical I...

Page 197: ...essage Non active message Advice 2000 Warning Inverter voltage too high Inverter voltage OK 2001 Warning Inverter voltage too low Inverter voltage OK 2003 Warning Bypass AC over voltage End of bypass...

Page 198: ...powered 2176 Warning Compatibility failure Compatibility OK 2189 Warning Load not powered 2194 Warning Input bad wiring Input wiring OK 2206 Warning UPS Shutdown requested End of UPS shutdown request...

Page 199: ...List of event codes Information 199 2227 Info On high efficiency High efficiency disabled 2A0F Info Group is OFF Group is ON...

Page 200: ...Unsynchronized sources Synchronized sources F01 Warning Frequency out of range Frequency in range F02 Warning Out of range In range F04 Warning Voltage in derated range Voltage in normal range F06 War...

Page 201: ...n range F1A Warning On alternate source 7 5 4 3 Good Code Severity Active message Non active message Advice F05 Good Source 1 used to power the load Source 1 not used to power the load F0A Good Source...

Page 202: ...tion lost Communication recovered 1202 Warning Temperature is low Temperature is back to normal 1203 Warning Temperature is high Temperature is back to normal 1212 Warning Humidity is low Humidity is...

Page 203: ...ssage Non active message Advice 1016 Info Protection sequential shutdown scheduled Protection sequential shutdown canceled 1017 Info Protection sequential shutdown in progress Protection sequential sh...

Page 204: ...or reference only Trap oid 1 3 6 1 2 1 33 2 0 x Description 1 3 6 1 2 1 33 2 0 1 Sent whenever the UPS transfers on battery then sent every minutes until the UPS Comes back to AC Input 1 3 6 1 2 1 33...

Page 205: ...ed 1 3 6 1 2 1 33 1 6 3 23 Shutdown imminent Shutdown canceled 7 6 1 2 Xups Mib traps This information is for reference only Trap oid 1 3 6 1 4 1 534 1 11 4 1 0 x Trap message at oid 1 3 6 1 4 1 534 1...

Page 206: ...critical threshold 1 3 6 1 4 1 534 1 11 4 1 0 43 Sensor humidity is below above critical threshold 1 3 6 1 4 1 534 1 11 4 1 0 48 Maintenance bypass 7 6 2 ATS Mib This information is for reference only...

Page 207: ...is for reference only Trap oid 1 3 6 1 4 1 534 6 8 1 x x x Trap description 1 3 6 1 4 1 534 6 8 1 1 0 1 Sent whenever the sensor count changes after a discovery or removing from the UI 1 3 6 1 4 1 534...

Page 208: ...completions enter Auto completes syntax checks then executes a command If there is a syntax error then offending part of the command line will be highlighted and explained space Auto completes or if t...

Page 209: ...Specifics 7 7 3 4 Access rights per profiles Administrator Operator Viewer get release info 7 7 4 history 7 7 4 1 Description Displays recent commands executed on the card 7 7 4 2 Help history cr Disp...

Page 210: ...ogout 7 7 6 maintenance 7 7 6 1 Description Creates a maintenance report file which may be handed to the technical support 7 7 6 2 Help maintenance cr Create maintenance report file h help Display hel...

Page 211: ...play IPv4 Mode Address Netmask and Gateway 6 ipv6 display IPv6 Mode Addresses and Gateway Set commands are used to modify the settings s set lan link speed Link speed values auto Auto negotiation 10hf...

Page 212: ...negotiation to Link netconf s auto Set custom hostname netconf f hostname ups 00 00 00 00 00 00 Set Adress Netmask and Gateway netconf i manual 192 168 0 1 255 255 255 0 192 168 0 2 Disable IPv6 netco...

Page 213: ...owed by a struct timeval and then an arbitrary number of pad bytes used to fill out the packet c Specify the number of echo requests to be sent IPv6 address IPv6 address 7 7 8 3 Specifics 7 7 8 4 Acce...

Page 214: ...D ssh USER CARD_ADDRESS restore_configuration p PASSPHRASE 7 7 10 3 2 From a Windows host Save over SSH plink USER CARD_ADDRESS pw PASSWORD batch save_configuration p PASSPHRASE FILE Restore over SSH...

Page 215: ...s per profiles Administrator Operator Viewer sanitize 7 7 12 ssh keygen 7 7 12 1 Description Command used for generating the ssh keys 7 7 12 2 Help ssh keygen h help Display help cr Renew SSH keys 7 7...

Page 216: ...ver alternate server automatically set date and time ntpauto Examples of usage Set date 2017 11 08 and time 22 00 time set manual 201711082200 Set preferred and alternate NTP servers time set ntpmanua...

Page 217: ...14 3 Specifics 7 7 14 4 Access rights per profiles Administrator Operator Viewer traceroute traceroute6 7 7 15 whoami 7 7 15 1 Description whoami displays current user information Username Profile Re...

Page 218: ...f the recipient 7 7 16 3 Specifics 7 7 16 4 Access rights per profiles Administrator Operator Viewer email test 7 7 17 systeminfo_statistics 7 7 17 1 Description Displays the following system informat...

Page 219: ...hpass p PASSWORD ssh USER CARD_ADDRESS certificates local revoke SERVICE_NAME export over SSH sshpass p PASSWORD ssh USER CARD_ADDRESS certificates local export SERVICE_NAME import over SSH cat FILE s...

Page 220: ...e terms of the underlying open source licenses when the situation requires 7 8 2 Notice for Open Source Elements This product includes software released under BSD or Apache v2 licenses and developed b...

Page 221: ...licenses and legal disclaimers see the Legal Information pages available from the HTML user interface of the present product 7 8 3 Notice for our proprietary i e non Open source elements Copyright 20...

Page 222: ...xt Transfer Protocol HTTP within a connection encrypted by Transport Layer Security TLS IPP Intelligent Power Protector is a web based application that enables administrators to manage an Devices from...

Page 223: ...lecting and organizing information about managed devices on IP networks and for modifying that information to change device behavior SSH Secure Shell is a cryptographic network protocol for operating...

Page 224: ...Acronyms and abbreviations Information 224...

Page 225: ...nfigure the UPS settings and allow remote commands Example UPS menu Settings ON OFF settings Remote command Enable 8 2 Card wrong timestamp leads to Full acquisition has failed error message on Softwa...

Page 226: ...ce and Servicing the EMP Installing the EMP Daisy chaining 3 EMPs 2 Disconnect and reconnect the USB to RS485 cable 3 Launch the discovery if it is still not ok go to Action 1 3 8 4 1 4 Action 1 3 1 R...

Page 227: ...k Module Certificates of IPP IPM and the Network Module are not matching so that authentication and encryption of connections between the Network Module and the shutdown agents is not working 8 6 3 Se...

Page 228: ...nections to the Network Module are automatically trusted and accepted STEP 4 Action on the agent IPP IPM while the time to accepts new agents is running on the Network Module Remove the Network module...

Page 229: ...ist has been cleared and is now empty 8 10 2 Action The alarm list has been saved on a csv file and can be retrieved using Rest API calls 8 10 2 1 Authenticate curl location request POST https domain...

Page 230: ...Module Finding and setting the IP address section 8 12 Web user interface is not up to date after a FW upgrade 8 12 1 Symptom After an upgrade The Web interface is not up to date New features of the n...

Page 231: ......

Reviews:

No comments