Application and functions
1.6 Security functions (CP 1542SP-1 IRC, CP 1543SP-1)
CP 154xSP-1
Operating Instructions, 12/2019, C79000-G8976-C426-05
21
Secure underlying networks can be operated via additional Ethernet/PROFINET interfaces of
the CPU.
As a result of using the CP, as a security module, the following security functions are
accessible to the ET 200SP station on the interface to the Ethernet network:
●
Firewall
The firewall protects the device with:
–
IP firewall with stateful packet inspection (layer 3 and 4)
–
Firewall also for "non-IP" Ethernet frames according to IEEE 802.3 (layer 2)
–
Limitation of the transmission speed to restrict flooding and DoS attacks ("Define IP
packet filter rules")
●
Certificates
Certificates are used for the secure authentication of the communications partners.
●
VPN
The following alternatives can be used:
–
Secured communication via IPsec tunnels
VPN communication allows the establishment of secure IPsec tunnels for
communication with one or more security modules. The CP can be grouped together
with other modules to form VPN groups during configuration. IPsec tunnels are
created between all security modules of a VPN group.
–
Remote maintenance via SINEMA Remote Connect
It is not necessary and not possible to create a VPN group for communication via a
SINEMA RC server. The SINEMA RC Server manages the communication between
the devices and the security mechanisms (OpenVPN).
For information on the configuration, see section SINEMA Remote Connect (Page 67).
●
Logging
Sending of events can be enabled for monitoring. The events can be read out using
STEP 7 or sent to a Syslog server.
●
Encrypted e-mails
For secure transfer of information with encrypted e-mails, you can use the following as an
alternative:
–
SSL/TLS
–
STARTTLS
For information on the configuration, see section E-mail configuration (Page 64).
●
NTP (secure)
For secure transfer during time-of-day synchronization
●
SNMPv3
For secure transmission of network analysis information safe from eavesdropping
For information on configuring the security functions, refer to the section Security (CP
