Remote Access Firewall Issue

Good Morning.

Our local IT group has been trying to get some of my PLCs online with the plant network so I can remotely access. They are stringent on cyber security, etc, so they have to deal with some firewall issues. Right now they have got us to the point were I can access the machines from an external VPN connection, but not a local plant connection.

This is a L30ER v20.014.

He has asked me this:

"it is concluded that something is one the PLC that is blocking replies, there should be something on that machine maybe like IP filtering, IP route filtering or something else, can you make sure that none of this configured ?"

Any thoughts here? Could the PLC be blocking network access?

When IT refers to "that machine," is IT referring to the PLC?

And are they actually asking if the PLC has IP filtering?

Ask them to show you a log, from the same LAN the PLC is on, of the packet they conclude has been blocked or filtered. It should have the MAC address of the PLC in it; if it only has the IP address of the PLC, then it is not from the same LAN that the PLC is on.

drbitboy said:

When IT refers to "that machine," is IT referring to the PLC?

Click to expand...

Yes.

drbitboy said:

And are they actually asking if the PLC has IP filtering?

Click to expand...

hah. yes.

drbitboy said:

Ask them to show you a log, from the LAN the PLC is on, of the packet they think is being blocked or filtered. It should have the MAC address of the PLC in it.

Click to expand...

Okay, thank you.

Look into E_W_O_N.
If you can drop an Ethernet line to it, you can access all your connected devices.

Or Secomea, or INSYS icom.

Ports

We had a similar situation, in our case some ports were blocked (cant remember anymore which exactly).
You can see the different ports used by Rockwell in this list:
TCP and UDP Port Configuration - Quick Reference Guide

https://literature.rockwellautomation.com/idc/groups/literature/documents/qr/comm-qr001_-en-e.pdf

As others alluded to, direct firewall connection is not recommended. Either use a VPN or a Jump Server in addition to firewall. You can even go as far as adding a physical kill switch to prevent outside connection.

No, PLC doesn't "block" ICMP pings and I'm not even sure that's possible on AB network card.