Distech ECYPSE - Securing an ECLYPSE Controller

To Next Page

To Previous Page

Securing an ECLYPSE Controller

ECLYPSE User Guide 103

CHAPTER 10

SECURING AN ECLYPSE CONTROLLER

This chapter describes how to harden an ECLYPSE controller from unauthorized access and use.

In This Chapter

Topic

Page

Introduction

104

Passwords

105

Account Management and Permissions

106

Additional Settings

107

External Factors

108

Main Page

Table of Contents3
ECLYPSE User Guide7
Chapter 19
Introduction9
Introduction10
About the ECY Series Controller10
About the IP Protocol Suite10
About Bacnet10
About this User Guide11
Purpose of the User Guide11
ECLYPSE Introduction11
Network Security11
Intended Audience11
Conventions Used in this Document11
Related Documentation12
Acronyms and Abbreviations Used in this Document13
Chapter 215
Internet Protocol Suite Fundamentals15
About the Internet Network16
Internet Protocol Suite Overview17
Chapter 318
Ipv4 Communication Fundamentals18
DHCP Versus Manual Network Settings19
Dynamic Host Configuration Protocol (DHCP)19
Why Should ECLYPSE IP Controllers Use a Fixed IP Address or Hostname Management19
Networking Basics20
IP Addressing20
About the Subnetwork Mask20
CIDR Addressing20
Private Ipv4 Address Ranges21
Reserved Host Addresses21
Default Gateway21
Domain Name System (DNS)22
About Routers, Switches, and Hubs23
Connecting a Router23
Network Address Translation / Firewall24
IP Network Segmentation24
Chapter 426
ECLYPSE Controller IP Network Protocols and Port Numbers26
About Port Numbers27
ECLYPSE IP Network Port Numbers and Protocols28
ECLYPSE Services that Require Internet Connectivity30
Chapter 531
Connecting IP Devices to an IP Network31
Connecting the IP Network32
Wired Network Cable Requirements32
About the Integrated Ethernet Switch34
Fail-Safe Ethernet (ECY-VAV Model Only)34
Spanning Tree Protocol35
Connecting the Network Cable to the ECLYPSE Controller36
Wireless Network Connection37
About the 2.4 Ghz ISM Band37
Distance between ECLYPSE Wi-Fi Adapter and Sources of Interference38
About Wi-Fi Network Channel Numbers38
Radio Signal Range38
Radio Signal Transmission Obstructions39
Where to Locate Wireless Adapters39
Transmission Obstructions and Interference39
ECLYPSE Wi-Fi Adapter Mounting Tips40
Planning a Wireless Network42
ECLYPSE Wi-Fi Adapter Connection Modes44
Wi-Fi Client Connection Mode45
Wi-Fi Access Point45
Wi-Fi Hotspot46
Mesh Network47
Wireless Network Commissioning Architectures49
Client to Access Point Configuration49
Client to Hotspot Configuration50
Mesh Configuration51
Chapter 652
First Time Connection to an ECLYPSE Controller52
Connecting to the Controller53
Controller Identification53
Ethernet Network Connection54
Network Connections for ECY-VAV and ECY-S1000 Model Controllers54
Network Connections for ECY-VAV-Poe Model Controllers55
Wi-Fi Network Connection57
Configuring the Controller58
Using the Xpressnetwork Utility58
Using the Controller's Factory-Default Hostname in the Web Browser58
Using the Controller's IP Address in the Web Browser59
Connecting to the Controller's Configuration Web Interface60
Next Steps60
Chapter 761
Supported RADIUS Server Architectures61
Overview62
Authentication Fallback62
RADIUS Server Architectures63
Local Credential Authentication63
ECLYPSE-Based Centralized Credential Authentication64
EC-Net AX -Based Centralized Credential Authentication65
Configuring the EC-Net Station's Restservice66
Chapter 867
ECLYPSE Web Interface67
Overview68
Login Credentials69
Web Configuration Interface70
Main Screen70
Menu Button70
Network Settings72
IP Configuration72
Wireless Configuration73
Hotspot Configuration75
Advanced75
Bacnet Settings77
General77
Routing78
Network Port IP79
BBMD Settings80
Foreign Device Settings81
Network Port MS/TP82
Firmware Update84
User Management85
Authentication85
Local RADIUS Server86
Local User Management86
Adding a User87
Remote RADIUS Server88
Device Information90
System Settings91
Saving a Certificate92
Viewer Information95
Chapter 996
Configuring the ECLYPSE Wi-Fi Adapter Wireless Networks96
Setting up a Wi-Fi Client Wireless Network97
Setting up a Wi-Fi Access Point Wireless Network98
Setting up a Wi-Fi Hotspot Wireless Network99
Setting up a Wi-Fi Mesh Wireless Network101
Mesh Network Diagnostics101
Chapter 10103
Securing an ECLYPSE Controller103
Introduction104
Passwords105
Change the Default Platform Credentials105
Use Strong Passwords105
Do Not Allow a Browser to Remember a User's Login Credentials105
Account Management and Permissions106
Use a Different Account for each User106
Use Unique Service Type Accounts for each Project106
Disable Known Accounts When Possible106
Assign the Minimum Required Permissions106
Use Minimum Possible Number of Admin Users106
Additional Settings107
Update the ECLYPSE Controller's Firmware to the Latest Release107
External Factors108
Install ECLYPSE Controllers in a Secure Location108
Make Sure that ECLYPSE Controllers Are Behind a VPN108
Chapter 11109
Bacnet MS/TP Communication Data Bus Fundamentals109
Bacnet MS/TP Data Transmission Essentials110
Maximum Number of Bacnet MS/TP Devices on a Data Bus Segment and Baud Rate112
Data Bus Segment MAC Address Range for Bacnet MS/TP Devices112
Maximum Number of Bacnet MS/TP Devices on a Data Bus112
Device Loading113
Data Bus Physical Specifications and Cable Requirements115
Data Bus Topology and EOL Terminations116
When to Use EOL Terminations116
When to Use EOL Terminations with Bacnet MS/TP Thermostats116
About Setting Built-In EOL Terminations117
Only a Daisy-Chained Data Bus Topology Is Acceptable117
Data Bus Shield Grounding Requirements119
ECB 24V-Powered Controller Data Bus Shield Grounding Requirements119
ECB-PTU Line-Powered Data Bus Controller Shield Grounding Requirements120
Data Bus Shield Grounding Requirements When Mixing both ECB 24V-Powered Controllers and ECB-PTU Line-Powered Controllers121
Using Repeaters to Extend the Data Bus122
Device Addressing125
Power Supply Requirements for 24VAC-Powered Controllers130
Chapter 12134
Subnetwork Installation Guidelines134
About the Subnetwork Data Bus135
Subnetwork Connection Method135
Subnetwork Module Compatibility and Supported Quantity Charts136
Subnetwork Module Connection136
Subnetwork Data Bus Length137
Cat 5E Cable Subnetwork Data Bus139
Cat 5E Cable Subnetwork Data Bus Cable Requirements139
Cat 5E Cable Subnetwork Bus Topology and End-Of-Line Terminations141
Setting the Subnet ID Addressing for Room Devices143
Setting the Allure EC-Smart-Vue Sensor's Subnet ID Address144
Setting the Allure EC-Smart-Vue Sensor's Subnet ID144
Setting the Allure EC-Smart-Air and EC-Smart-Comfort Communicating Sensor Series' Subnet ID Address145
Setting the EC-Multi-Sensor Series' Subnet ID Address146
Setting the Ecx-Light and Ecx-Blind Series' Subnet ID Address147
Commissioning a Connected VAV Controller with an Allure EC-Smart-Vue Sensor149
Commissioning a Connected VAV Controller with an Allure149
Chapter 13150
Modbus TCP Configuration150
Modbus TCP Device Connection151
Device Addressing152
Chapter 14154
Modbus RTU Communication Data Bus Fundamentals154
Modbus RTU Data Transmission Essentials155
Maximum Number of Modbus RTU Devices on a Data Bus Segment and Baud Rate156
Data Bus Segment Addressing Range for Modbus RTU Devices156
Maximum Number of Modbus RTU Devices on a Data Bus156
Data Bus Physical Specifications and Cable Requirements158
Data Bus Topology and EOL Terminations159
When to Use EOL Terminations159
About Setting Built-In EOL Terminations159
Only a Daisy-Chained Data Bus Topology Is Acceptable160
Data Bus Shield Grounding Requirements161
Modbus RTU Data Bus Shield Grounding Requirements161
Device Addressing162
Chapter 15163
Resetting or Rebooting the Controller163
Resetting or Rebooting the Controller164
Chapter 16166
ECY Controller Troubleshooting166
Chapter 17170
Allure EC-Smart-Vue Communicating Sensor Troubleshooting170
Appendix A173
Appendix A174

Distech ECYPSE - Securing an ECLYPSE Controller

Table of Contents