Security functions

VPN (Virtual Private Network)
(only for SCALANCE S612, S615, S623 and SCALANCE S627-2M);
for reliable authentication (identification) of the network stations, for encrypting data and checking data integrity.

• Authentication;
  All incoming data traffic is monitored and checked. As IP addresses can be falsified (IP spoofing), so checking the IP address of the client access is not sufficient. In addition, Client PCs may have changing IP addresses. For this reason the authentication is performed by means of tried and tested VPN mechanisms.
• Data encryption;
  Secure encryption is necessary in order to protect data communication from espionage and unauthorized manipulation. This means that the data traffic remains incomprehensible to any eavesdropper in the network. The SCALANCE Security Module establishes VPN tunnels to other Security Modules for this purpose.

The firewall
can be used as an alternative or to supplement VPN with flexible access control.
The firewall filters data packets and disables or enables communication links in accordance with the filter list and stateful inspection. Both incoming and outgoing communication can be filtered, either according to IP and MAC addresses as well as communication protocols (ports) or user-specific.

• Logging;
  access data are saved by the Security Module in a log file. Enables detection of how, when and by whom the network has been accessed as well as detecting access attempts, enabling appropriate preventative measures to be taken.

Certification as per the Achilles Level II Standard:
http://www.wurldtech.com/product_services/certifications/certified_products/

Configuration

Configuration is carried out using the Security Configuration Tool (SCT). This means that all SIMATIC NET security products can be configured and diagnosed from a central point. All the configuration data can be saved on the optional C-PLUG swap media (not included in scope of supply) so that the Security Module can be replaced quickly in the event of a fault and without the need for a programming device.

SCALANCE S615

The security configuration tool (SCT) supports the generation of certificates for IPSec-VPN tunnels.

Configuration using Web Based Management (WBM), Command Line Interface (CLI) or SNMP.

Configuration

Secure remote access without direct connection to the automation network with SCALANCE S623

Demilitarized zone (DMZ) for remote maintenance or access to data server with SCALANCE S623

Secure remote access over Internet with SCALANCE S and SCALANCE M

Secure, redundant connection between two MRP rings with SCALANCE S627-2M

Secure, redundant connection of an automation cell to a redundant ring with SCALANCE S627-2M

Secure, redundant connection of a redundant ring to a plant network with SCALANCE S627-2M