iSG4F
User’s Manual
iS5 Communications Inc.
177
Application Aware Firewall
The integrated SCADA protocol firewall provides a network-based distributed security.
The firewall implemented is "application-aware", meaning that it inspects the contents of the
data packets of selected SCADA protocols according to the rules set by the user.
Using the firewall, the router becomes distributed Intrusion Prevention System (IPS) realizing
detailed service-aware inspection.
• Supported protocols: Modbus TCP, IEC 104, DNP3
The service-aware firewall checks each packet in details including:
Protocol validity – Check that the packet structure and all its control fields comply
with the standard and that the session flow follows the expected logic (i.e. session
initiated by master, response matches request, session setup sequence, etc.).
Application logic – Per each pair of source and destination devices verify that only
the allowed communication is performed by checking the function code and the
command parameters according to the operator defined values.
27.1
Firewall Service Flow
In order for a protocol flow to be inspected by the firewall the following is achieved by the iS5
iNMS tool.
A designated service VLAN is created and the ports are tagged.
ACLs are placed on the relevant access port and network ports to redirect the traffic
flow to service VLAN and to the application firewall. The ACLs will allow traffic
between service members only. ACLs will permit traffic only of the TCP/UDP type
correlating to the service protocol determined by the user. Other ports are blocked
by default.
The ACLs also validate the packet direction and block messages in violation of proper
session.
A file holding a list of allowed messages is created upon user configuration and is
downloaded to the router. The file holds specific addressing properties of the target
device under the relevant SCADA protocol (for example Common Address of ASDU in
IEC104) and so the packet inspection is done not only at the IP header but as well in
the payload itself.
Service packets will be inspected towards this file.
A packet originated and designated to a service member will be directed to the
application processor for in depth inspection of the payload before allowed to pass
to the network.