Network and Firewall Issues

Transcription

1 Network and Firewall Issues Questions regarding network performance and security arise when installing the Niagara Framework in a facility that utilizes a firewall. The Niagara software suite functions fine in this environment provided a few simple conditions are met. You are advised, however, to consult the system owner s Network or Information Systems Group during the planning phase of the installation to avoid unnecessary delays and rework resulting from a lack of adequate communication. Consult the Information Systems Group early to avoid problems. FIREWALLS Firewalls are used to keep private networks secure. A firewall can be implemented in a single router that filters out unwanted packets, or it may use a combination of technologies (hardware and software) in routers and hosts. Firewalls are often implemented to provide users access to and from a secure network via the Internet as well as to separate a company s public Web server from its internal network. Firewalls may also be used to keep separate internal networks secure. For instance, an IS Manager may wish to keep a research or accounting subnet secure from internal snooping. Firewall protection is often implemented using a combination of the following techniques. Packet Filter Also known as a screening router, this technique blocks traffic based on IP address and/or port number. Proxy Server A proxy server is an application that breaks the connection between the sender and the receiver of a message. An HTTP proxy is used for Web access and an SMTP proxy is used for . Network Address Translation (NAT) Proxies generally employ network address translation, which presents one organizationwide IP address to the Internet it funnels all user requests to the Internet and fans responses back to the appropriate user. Stateful Inspection This technique tracks a transaction in order to verify that the destination of an inbound packet matches the source of a previous outbound request. Copyright 2000 Tridium, Inc. 1 January, 2000

2 SYSTEM ARCHITECTURE The following illustration is typical for a Niagara Framework system architecture when a firewall is employed. Figure 1. Typical network architecture employing a firewall (simplified). Internet Remote Browser Router Switch Firewall Remote Browser Remote Browser The remote browsers shown in this drawing are located outside of the firewall and do not use it for security. If there are concerns about locating the Niagara Web Supervisor on the secure side of the firewall, it too may be located outside the firewall. It is very important though to establish suitable user accounts and passwords to protect access to control system data (through the Web Supervisor or JACE controller). Only users with appropriate passwords can access control system data contained in the Web Supervisor and/or JACE controller. Ethernet Internal Browser Niagara Web Supervisor JACE JACE Strong passwords use a very large number as its cryptographic key. Today, 128 bits is considered strong encryption. SSL is the leading security protocol on the Internet. When an SSL session is started, the browser sends it public key to the server so that the server can securely send a secret key to the browser. SECURITY As mentioned above, the Niagara Web Supervisor may be located outside a company s firewall if there are concerns about locating it on a secure network. When this situation exists, it is very important to establish suitable user accounts and passwords to protect access to control system data. Release 2.0 of the Web Supervisor software supports both strong passwords and, optionally, SSL (Secure Sockets Layer) encryption. These two methods provide increasing levels of security for data that is potentially offered over the Internet. CONNECTION SPEED The speed of the Internet connection and the number of users that are simultaneously connected to the common pipeline directly affect the performance of each remote client (web browser) accessing building data. A T1 connection, operating at 1.5 Mbit, provides very good performance in terms of update speed for large numbers of simultaneous connections hundreds of simultaneous connections on the same pipeline would have to be made to significantly degrade T1 performance. Very acceptable performance can be obtained with slower speed connections if the number of simultaneous users is limited. Copyright 2000 Tridium, Inc. 2 January, 2000

3 I N S T A L L A T I O N Predicting the optimum connection speed/number of users though is an inexact science and no performance guarantees can be made. BANDWIDTH UTILIZATION Niagara bandwidth utilization is dependent on the type, amount, and frequency of data being passed on the Ethernet LAN. During system configuration, bandwidth utilization varies depending on the number and type of objects being copied, cut, and pasted on the workspace. During normal runtime, the following can be used to roughly estimate the impact on bandwidth. To load an applet the first time an HTML page is viewed, the following packet sizes can be used to estimate bandwidth. Chart: 45-KB GxPage: 38-KB Calendar: 46-KB Schedule: 58-KB These figures exclude the actual size of the HTML page and any images it may need, but after the graphic is loaded, only the real-time values that change are passed over the network. This drastically reduces network traffic once the HTML page is loaded. GxPages maintain an open TCP connection to receive real-time updates, which amount to approximately six bytes per change. How often updates occur depends on how fast that data is changing. How quickly the page updates depends on the number of updating values being displayed on the graphic. Once the chart applet is loaded, it remains active. It is not reloaded when the user views that data in a different format or even when the user views an altogether different trend log only the new data is passed across the network. PORT NUMBER In a TCP/IP-based network such as the Internet, certain ports are assigned to various applications running on a computer. Port number is used to link incoming data to the appropriate service. The port numbers that must be enabled at the firewall to allow the user to access building data from outside the facility over the Internet include: TCP port 80: Provides HTTP access to the station from a standard Web browser. UDP port 80: Provides UDP monitoring of the station. TCP port 3011: Supports remote access by the Station Administration Tool to start, stop, and administer station databases. If time synchronization with Web accessed atomic clocks is to be utilized, then server port 37 must also be enabled. Copyright 2000 Tridium, Inc. 3 January, 2000

4 Who registers with the ISP? The ISP account holder is most often the building owner, but it may be the Systems Integrator if the ISP account was made part of the Niagara system installation. ISP REQUIREMENTS A key ingredient to accessing the control systems from the Internet are static and public IP addresses for the building s points of connection including the Web Supervisor PC (if present) and each JACE controller (with Web UI Services). In other words, if the owner wishes to access building data from outside the facility over the Internet, it is necessary to register the name of the Web Supervisor with the ISP and map that name to a public IP address using DNS and obtain static, public IP addresses for each JACE controller that is to be accessed on the Ethernet LAN. The ISP account holder must make the request to register a name and/or IP address and agree to support the cost of the account. DOMAIN NAME REGISTRATION Domain names must be unique within a parent domain (i.e.,.com,.org,.edu, and so on). InterNIC is the overall guiding organization that distributes and licenses these names through their primary liaison company Network Solutions. Domain names can be researched, applied for, and assigned at The cost for registering a name is $35 per year, but you are required to sign up for a minimum of two years. For the latest information on how to apply for a domain name, visit Network Solutions web site at FOR MORE INFORMATION This document is intended to overview the issues associated with installing and using the Niagara software suite in a secure environment, that which employs the use of firewall technology. Requests for additional information and questions can be directed to: Gil Rockwell, Product Manager Tridium, Inc Westerre Parkway, Suite 350 Richmond, Virginia gil@tridium.com Copyright 2000 Tridium, Inc. 4 January, 2000

5 Please help us make our documentation as good as possible. Use this form to advise us of errors, descriptions that are not clear, or other helpful information. Send this form to: Tridium, Inc Westerre Parkway, Suite 350 Richmond, Virginia Or e:mail us at: DOCUMENTATION COMMENT FORM I have found the following errors and/or unclear descriptions in this document. Document Name: Page # and suggested improvement: Page # and suggested improvement: Please let us know who you are: Name & Company: Copyright 2000 Tridium, Inc. 5 January, 2000