LOYTEC L-Gate, User Manual, Page: 102 / 113

L-INX/L-GATE User Manual 102 LOYTEC
Version 7.2 LOYTEC electronics GmbH
12 Security Hardening Guide
This guide contains security-relevant information for operating the product on IT networks.
The information refers to the firmware version and the instructions found in the previous
chapters of this User Manual.
12.1 Installation Instructions
Install the device over the Web interface:

Set up the basic device functions and protocol settings as described in Section 5.2. When
connecting over the Web UI use https:// in the URL.

Set a secure password for the admin and operator accounts.

Disable the HTTP, FTP, and Telnet servers in the IP port configuration as described in
the LOYTEC Device User Manual [1]. Note, that FTP and Telnet are disabled in factory
defaults as of firmware 7.0.0.

Create a new HTTPS server certificate as described in the LOYTEC Device User Manual
[1].
12.2 Firmware
The device is equipped with one piece of software. This is the firmware image and its related
firmware version. The firmware is distributed as a downloadable file. The device can be
upgraded by placing the firmware image onto the device using the procedure described in
Chapter 9.
12.3 Ports
This Section lists all ports, which may be used by the device. The ports are default settings
for their respective services. If not stated otherwise, the ports can be changed.
Required Ports:

80 tcp: This port is opened by the Web server and the OPC XML-DA server. It can be
disabled if OPC XML-DA is not required. The port can be changed.

1628 udp/tcp: This is the data exchange port for CEA-852 (LON over IP). It is required
for the primary function of the device to exchange control network data between routers
over the IP network. Each device needs this port open. The port can be changed.

1629 udp/tcp: This is the configuration server port of CEA-852. Exactly one device in
the system needs this port open. Other devices register with the configuration server to
form the IP-852 channel list. The port can be changed.

47808 udp: This is the data exchange port for BACnet/IP. It is required for the primary
function of the device to exchange control network data between routers over the IP
network. Each device needs this port open. The port can be changed.