remote access

so my it department has granted me access to are network form out side the plant. at this point i can see my drives but cant see or ping any of my plc's. so i an wording what i am missing or do i have to have a vpn router inside?

thanks any help will be great

wancues said:

so my it department has granted me access to are network form out side the plant. at this point i can see my drives but cant see or ping any of my plc's. so i an wording what i am missing or do i have to have a vpn router inside?

thanks any help will be great

Click to expand...

This is highly dependent on what your network design.

If you can ping your PLC's from your desk, but not from off-site ..
- you may be getting access through a computer that is not routed to your PLCs. That would require some help from your IT department

Adding a VPN router would only help if your off-site access could see the VPN router.

i think the problem is that there server is not letting me see that part of the network.all of the plc's are on a different scheme ( computers 10.35.128.x / plc's 10.35.158.x ) i use the same laptop outside as inside.

wancues said:

i think the problem is that there server is not letting me see that part of the network.all of the plc's are on a different scheme ( computers 10.35.128.x / plc's 10.35.158.x ) i use the same laptop outside as inside.

Click to expand...

I guess I was talking about the server that allows you access to the network, not the computer you are typing at.

For example, I get access to our network through a gateway that happens to be in our head office. That opens up a virtual machine or VM on a server at head office, which has it's separate subnets. Say 10.4.123.2 is the VM and 10.4.12x.xxx are the head office subnets. The IT guys then have allow traffic from that VM on that server to route to the site subnets, say 10.8.012.xxx then to our Bomgar gateway, in our DMZ, at say 10.8.015.xxx. The Bomgar then gives me access to ANOTHER VM, running in a server on our Control domain, at say 10.12.123.x ....

If I put a VPN router in my MCC room, at 10.12.123.xxx I still would have needed to get IT to route the packets from head office to site and through the DMZ and to the VPN router.

Or ... that's how I understand it ... which may or may not have any relation to reality.

we use a system which allows us to log into our system.
its a fire wall, router, …

see if you can ping anything on the corporate side.
if so and you can't ping anything on the plant, they have a firewall block / router block in place. that's another issue to deal with.

I'm in the IT department with 2 others and we do all the plc programming …..

hope this helps,
james

wancues said:

i think the problem is that there server is not letting me see that part of the network.all of the plc's are on a different scheme ( computers 10.35.128.x / plc's 10.35.158.x ) i use the same laptop outside as inside.

Click to expand...

What is the subnet 255.255.255.0 wont let those IP address communicate, 255.255.128.0 will let them communicate.

If you have a flat network, you can have multiple IP address on the single NIC. So, have 10.35.128.67 and 10.35.158.67 (I choose 67 at random).

This will provide you with a secure VPN connection.
https://www.spectrumcontrols.com/products/webport-solutions/remote-access-ethernet/

thanks for the input guys. i have sent this info to IT and they are are looking at the best way to fix this. I will report on the end result

again thank you all

john