Siemens SIMATIC NET SCALANCE SC-600 - Security Recommendations for Industrial Networks; General Security and Authentication Practices

Table of contents
SCALANCE SC-600 Web Based Management (WBM)
Configuration Manual, 10/2021, C79000-G8976-C475-03
13
4.7.3 AAA .................................................................................................................................................... 293
4.7.3.1 General ............................................................................................................................................. 293
4.7.3.2 RADIUS client ................................................................................................................................. 294
4.7.3.3 802.1X Authenticator ..................................................................................................................... 297
4.7.4 Certificates ...................................................................................................................................... 303
4.7.4.1 Overview........................................................................................................................................... 303
4.7.4.2 Certificates ...................................................................................................................................... 304
4.7.5 Firewall ............................................................................................................................................. 306
4.7.5.1 General ............................................................................................................................................. 306
4.7.5.2 Predefined ....................................................................................................................................... 307
4.7.5.3 Dynamic Rules ................................................................................................................................ 309
4.7.5.4 IP services ....................................................................................................................................... 313
4.7.5.5 ICMP services ................................................................................................................................. 314
4.7.5.6 IP protocols ..................................................................................................................................... 315
4.7.5.7 IP rules ............................................................................................................................................. 316
4.7.5.8 Pre-defined MAC rules ................................................................................................................. 319
4.7.5.9 MAC services .................................................................................................................................. 320
4.7.5.10 MAC rules ........................................................................................................................................ 321
4.7.5.11 Firewall State Sync ........................................................................................................................ 323
4.7.6 IPsec VPN (SC64x-2C).................................................................................................................. 324
4.7.6.1 General ............................................................................................................................................. 324
4.7.6.2 Remote End ..................................................................................................................................... 325
4.7.6.3 Connections .................................................................................................................................... 327
4.7.6.4 Authentication................................................................................................................................. 330
4.7.6.5 Phase 1 ............................................................................................................................................. 332
4.7.6.6 Phase 2 ............................................................................................................................................. 334
4.7.7 OpenVPN ......................................................................................................................................... 337
4.7.7.1 General ............................................................................................................................................. 337
4.7.7.2 Connections .................................................................................................................................... 338
4.7.7.3 Client ................................................................................................................................................. 340
4.7.7.4 Authentication................................................................................................................................. 341
4.7.7.5 Server................................................................................................................................................ 342
4.7.8 Brute Force Prevention ................................................................................................................. 343
5 Upkeep and maintenance ..................................................................................................................... 347
5.1 Device configuration with PRESET-PLUG ................................................................................ 347
5.2 Firmware update using WBM not possible ............................................................................... 349
5.3 Restoring the factory settings ..................................................................................................... 352
6 Exchange of configuration data with STEP7 ..................................................................................... 353
6.1 Exchange of configuration data with STEP 7 Basic/Professional using a file .................. 353
6.2 Message: SINEMA configuration not yet accepted ................................................................ 354
A Appendix A .............................................................................................................................................. 357
A.1 Structure of the Syslog messages .............................................................................................. 357
A.2 Tags in Syslog messages ............................................................................................................. 358
A.3 Syslog messages ............................................................................................................................ 359
Index ........................................................................................................................................................ 369