Innominate mGuard Reference Manual

Innominate Security Technologies Configuration of the mGuard Security Appliances

I15007_en_02 Installing and starting up the mGuard hardware UM EN MGUARD DEVICES 02 — This user manual is valid for the following devices of the mGuard product range: – mGuard rs4000/rs2000 – rs4000 TX/TX – rs4000 TX/TX VPN – rs2000 TX/TX VPN – mGuard rs4000/rs2000 Switch – rs4000 4TX/TX – rs4000 4TX/TX VPN – rs2000 5TX/TX VPN – mGuard rs4000/rs2000 3G – rs4000 4TX/3G/TX VPN – rs2000 4TX/3G VPN – mGuard smart²/smart – mGuard pci² SD – mGuard pcie² SD – mGuard pci – mGuard blade – mGuard delta² – mGuard delta – mGuard centerport² – mGuard centerport – mGuard industrial rs – EAGLE mGuard User manual Designation: Revision: Order No.:

Please observe the following notes Target group of this user manual The use of products described in this manual is aimed exclusively at qualified electricians or persons instructed by them, who are familiar with applicable national standards and other regulations regarding electrical engineering and, in particular, the relevant safety concepts. Explanation of symbols used and signal words General terms and conditions of use for technical documentation Innominate reserves the right to alter, correct, and/or improve the technical documentation and the products described in the technical documentation at its own discretion and without giving prior notice, insofar as this is reasonable for the user. The same applies to any changes that serve the purpose of technical progress. The receipt of technical documentation (in particular user documentation) does not consti- tute any further duty on the part of Innominate to furnish information on modifications to products and/or technical documentation. You are responsible for verifying the suitability and intended use of the products in your specific application, in particular with regard to ob- serving the applicable standards and regulations. All information made available in the tech- nical data is supplied without any accompanying guarantee, whether expressly mentioned, implied or tacitly assumed. In general, the provisions of the current standard Terms and Conditions of Innominate apply exclusively, in particular as concerns any warranty liability. This user manual, including all illustrations contained herein, is copyright protected. Any changes to the contents or the publication of extracts of this document are prohibited. Innominate reserves the right to register its own intellectual property rights for the product identifications of Innominate products that are used here. Registration of such intellectual property rights by third parties is prohibited. Other product identifications may be afforded legal protection, even where they may not be indicated as such. This symbol indicates hazards that could lead to personal injury. Obey all safety measures that follow this symbol to avoid possible injury or death. There are three different categories of personal injury that are indicated by a sig- nal word. DANGER This indicates a hazardous situation which, if not avoided, will re- sult in death or serious injury. WARNING This indicates a hazardous situation which, if not avoided, could result in death or serious injury. CAUTION This indicates a hazardous situation which, if not avoided, could result in minor or moderate injury. This symbol together with the signal word NOTE and the accompanying text alert the reader to a situation which may cause damage or malfunction to the de- vice, hardware/software, or surrounding property. This symbol and the accompanying text provide the reader with additional infor- mation or refer to detailed sources of information.

“Innominate” and “mGuard” are registered trade names of Innominate Security Technolo- gies AG. mGuard technology is protected by patents 10138865 and 10305413, granted by the German Patent and Trademark Office. Further patents are pending. Published by Innominate Security Technologies AG Rudower Chaussee 13 12489 Berlin Germany Phone: +49 (0)30 92 10 28-0 [email protected] www.innominate.com © 24. July 2015 Innominate Security Technologies AG Notes on CE identification The declarations of conformity are held here in agreement with EU directives for the relevant authorities: Innominate Security Technologies AG Rudower Chaussee 13 12489 Berlin Germany Tel. +49 (0)30 92 10 28-0

FCC Note The FCC Statement applies to the following devices: Class A: mGuard rs4000, mGuard rs2000, mGuard rs4000 Switch, mGuard rs2000 Switch, mGuard centerport, mGuard industrial rs, mGuard smart², mGuard smart, mGuard pci, mGuard pci² SD, mGuard delta, mGuard delta², and EAGLE mGuard. Class B: mGuard rs4000 3G, mGuard rs2000 3G, mGuard centerport² FCC Statement This device complies with Part 15 of the FCC Rules. Operation is subject to the following two conditions: (1) this device may not cause harmful interference, and (2) this device must accept any interference received, including interference that may cause undesired opera- tion. Class A Class B This equipment has been tested and found to comply with the limits for a Class A digital device, persuant to part 15 of the FCC Rules. These limits are designed to provide reasonable protec- tion against harmful interfer- ence when the equipment is operated in a commercial environment. This equip- ment generates, uses, and can radiate radio frequency energy and, if not installed and used in accordance with the instruction manual, may cause harmful interference to radio communications. Operation of this equipment in a residential area is likely to cause harmful interfer- ence in which case the user will be required to correct the interference at his own ex- pense. This equipment has been tested and found to comply with the limits for a Class B digital device, pursuant to part 15 of the FCC Rules. These limits are designed to provide reasonable protection against harmful interfer- ence in a residential installation. This equipment gener- ates, uses, and can radiate radio frequency energy and, if not installed and used in accordance with the instruc- tions, may cause harmful interference to radio commu- nications. However, there is no guarantee that interfer- ence will not occur in a particular installation. If this equipment does cause harmful interference to radio or television reception, which can be determined by turn- ing the equipment off and on, the user is encouraged to try to correct the interference by one or more of the fol- lowing measures: – Reorient or relocate the receiving antenna. – Increase the separation between the equipment and receiver. – Connect the equipment into an outlet on a circuit different from that to which the receiver is connected. – Consult the dealer or an experienced radio/TV technician for help. Changes or modifications not expressly approved by the party responsible for compliance could void the user’s authority to operate the equipment. FCC RF radiation Exposure Statement: This equip- ment complies with FCC RF exposure limits set forth for an uncontrolled environment. The antenna(s) used for this transmitter must be installed and operated with a minimum separation distance of 20 cm from all persons and must not be co-located or operating in conjunction with any other antenna or transmitter expect in accor- dance with the FCC multi-transmitter policy.

7 Table of contents 1 mGuard rs4000/rs2000 ............................................................................................................11 1.1 Operating elements and LEDs.............................................................................12 1.2 Startup.................................................................................................................14 1.3 Installation of mGuard rs4000/rs2000..................................................................15 1.4 Preparing the configuration..................................................................................20 1.5 Configuration in Stealth mode..............................................................................21 1.6 Establishing a local configuration connection ......................................................24 1.7 Remote configuration ..........................................................................................26 1.8 Restart, recovery procedure, and flashing the firmware.......................................27 1.9 Technical data .....................................................................................................31 2 mGuard rs4000/rs2000 Switch ................................................................................................33 2.1 Operating elements and LEDs.............................................................................34 2.2 Startup.................................................................................................................36 2.3 Installing the mGuard rs4000/rs2000 Switch .......................................................37 2.4 Preparing the configuration..................................................................................42 2.5 Configuration in Router mode..............................................................................42 2.6 Establishing a local configuration connection ......................................................43 2.7 Remote configuration ..........................................................................................45 2.8 Restart, recovery procedure, and flashing the firmware.......................................46 2.9 Technical data .....................................................................................................50 3 mGuard rs4000/rs2000 3G ......................................................................................................51 3.1 Operating elements and LEDs.............................................................................52 3.2 Startup.................................................................................................................54 3.3 Installation of mGuard rs4000/rs2000 3G ............................................................55 3.4 Preparing the configuration..................................................................................64 3.5 Configuration in Router mode..............................................................................64 3.6 Establishing a local configuration connection ......................................................65 3.7 Remote configuration ..........................................................................................67 3.8 Restart, recovery procedure, and flashing the firmware.......................................68 3.9 Technical data .....................................................................................................72 4 mGuard delta² ..........................................................................................................................75 4.1 Operating elements and LEDs.............................................................................76 4.2 Startup.................................................................................................................77 4.3 Connecting the mGuard delta² ............................................................................78 4.4 Preparing the configuration..................................................................................79 4.5 Configuration in Stealth mode..............................................................................80 4.6 Establishing a local configuration connection ......................................................83 4.7 Remote configuration ..........................................................................................85 4.8 Restart, recovery procedure, and flashing the firmware.......................................86

I15007_en_02 4.9 Technical data .....................................................................................................90 5 mGuard pci² SD .......................................................................................................................91 5.1 Operating elements and LEDs.............................................................................92 5.2 Startup.................................................................................................................93 5.3 Installation of mGuard pci² SD ............................................................................94 5.4 Preparing the configuration..................................................................................95 5.5 Configuration in Stealth mode..............................................................................96 5.6 Establishing a local configuration connection ....................................................101 5.7 Remote configuration ........................................................................................103 5.8 Restart, recovery procedure, and flashing the firmware.....................................104 5.9 Technical data ...................................................................................................107 6 mGuard smart²/smart .............................................................................................................109 6.1 Operating elements and LEDs...........................................................................110 6.2 Startup...............................................................................................................111 6.3 Connecting the mGuard smart² ........................................................................112 6.4 Preparing the configuration................................................................................113 6.5 Configuration in Stealth mode............................................................................114 6.6 Establishing a local configuration connection ....................................................117 6.7 Remote configuration ........................................................................................119 6.8 Restart, recovery procedure, and flashing the firmware.....................................120 6.9 Technical data ...................................................................................................123 7 mGuard centerport² ...............................................................................................................125 7.1 Operating elements and LEDs...........................................................................126 7.2 Startup...............................................................................................................127 7.3 Installing and booting the mGuard centerport²...................................................128 7.4 Preparing the configuration................................................................................132 7.5 Establishing a local configuration connection ....................................................133 7.6 Remote configuration ........................................................................................135 7.7 Restart, recovery procedure, and flashing the firmware.....................................136 7.8 Performing a restart ...........................................................................................136 7.9 Technical data ...................................................................................................141 8 mGuard delta .........................................................................................................................143 8.1 Operating elements and LEDs...........................................................................144 8.2 Startup...............................................................................................................145 8.3 Connecting the mGuard delta............................................................................146 8.4 Preparing the configuration................................................................................147 8.5 Establishing a local configuration connection ....................................................149 8.6 Remote configuration ........................................................................................151

I15007_en_02 Innominate Security Technologies 9 8.7 Restart, recovery procedure, and flashing the firmware.....................................152 8.8 Technical data ...................................................................................................155 9 mGuard pci ............................................................................................................................157 9.1 Operating elements and LEDs...........................................................................158 9.2 Startup...............................................................................................................159 9.3 Installation of mGuard pci .................................................................................160 9.4 Preparing the configuration................................................................................169 9.5 Configuration in Stealth mode............................................................................170 9.6 Establishing a local configuration connection ....................................................172 9.7 Remote configuration ........................................................................................174 9.8 Restart, recovery procedure, and flashing the firmware.....................................175 9.9 Technical data ...................................................................................................179 10 mGuard blade ........................................................................................................................181 10.1 Operating elements and LEDs...........................................................................182 10.2 Startup...............................................................................................................183 10.3 Installation of mGuard blade..............................................................................184 10.4 Preparing the configuration................................................................................187 10.5 Establishing a local configuration connection ....................................................189 10.6 Remote configuration ........................................................................................191 10.7 Restart, recovery procedure, and flashing the firmware.....................................192 10.8 Technical data ...................................................................................................195 11 mGuard centerport .................................................................................................................197 11.1 Operating elements and LEDs...........................................................................198 11.2 Startup...............................................................................................................199 11.3 Installing and booting mGuard centerport..........................................................200 11.4 Preparing the configuration................................................................................204 11.5 Establishing a local configuration connection ....................................................206 11.6 Remote configuration ........................................................................................208 11.7 Restart, recovery procedure, and flashing the firmware.....................................209 11.8 Performing a restart ...........................................................................................209 11.9 Technical data ...................................................................................................214 12 mGuard industrial rs ...............................................................................................................215 12.1 Operating elements and LEDs...........................................................................216 12.2 Startup...............................................................................................................217 12.3 Installation of mGuard industrial rs ....................................................................218 12.4 Preparing the configuration................................................................................225 12.5 Configuration in Stealth mode............................................................................226 12.6 Establishing a local configuration connection ....................................................229

I15007_en_02 12.7 Remote configuration ........................................................................................231 12.8 Restart, recovery procedure, and flashing the firmware.....................................232 12.9 Technical data ...................................................................................................235 13 EAGLE mGuard .....................................................................................................................237 13.1 Operating elements and LEDs...........................................................................238 13.2 Startup...............................................................................................................239 13.3 Installation of EAGLE mGuard ........................................................................240 13.4 Preparing the configuration................................................................................243 13.5 Configuration in Stealth mode............................................................................244 13.6 Establishing a local configuration connection ....................................................247 13.7 Remote configuration ........................................................................................249 13.8 Restart, recovery procedure, and flashing the firmware.....................................250 13.9 Technical data ...................................................................................................253 14 Assigning IP addresses and setting up DHCP/TFTP servers .................................................255 14.1 Assigning the IP address using IPAssign.exe....................................................255 14.2 Installing the DHCP and TFTP server ................................................................258

11 1 mGuard rs4000/rs2000 Table 1-1 Available mGuard rs4000/rs2000 versions The mGuard rs4000 is a security router with intelligent firewall and optional IPsec VPN (10 to 250 tunnels). It has been designed for use in industry to accommodate strict distributed security and high availability requirements. The mGuard rs2000 is a version with basic firewall and integrated IPsec VPN (maximum of two tunnels). Its scope of functions is reduced to the essentials. It is suitable for secure remote maintenance applications in industry and enables the quick startup of robust field devices for industrial use, thereby facilitating error-free, independent operation. Both versions support a replaceable configuration memory in the form of an SD card. (The SD cards are not supplied as standard.) The fanless metal housing is mounted on a DIN rail. The following connectivity options are available Figure 1-1 mGuard rs4000/mGuard rs2000 Available versions Order No. mGuard rs4000 TX/TX HW-107010 mGuard rs4000 TX/TX VPN BD-701000 mGuard rs2000 TX/TX VPN HW-108010 mGuard rs4000: (LAN/WAN) mGuard rs2000: (LAN/WAN) TX/TX Ethernet/Ethernet TX/TX VPN Ethernet/Ethernet + VPN TX/TX VPN Ethernet/Ethernet + VPN

I15007_en_02 1.1 Operating elements and LEDs Figure 1-2 Operating elements and LEDs on the mGuard rs4000 LEDs, see Table 1-2 For plug-in screw terminal blocks, assignment, refer to Page 16 and Page 19 Configuration (SD card) Connections below: RS-232 interface Reset button Table 1-2 LEDs on the mGuard rs4000 and mGuard rs2000 LED State Meaning P1 Green On Power supply 1 is active P2 Green On Power supply 2 is active (mGuard rs2000: not used) STAT Green Flashing Heartbeat. The device is correctly connected and operating. ERR Red Flashing System error. Restart the device. – Press the Reset button (for 1.5 seconds). – Alternatively, briefly disconnect the device power supply and then connect it again. If the error is still present, start the recovery procedure (see Page 28) or contact your dealer. STAT+ ERR Flashing alter- nately: green and red Boot process. When the device has just been connected to the power supply. After a few seconds, this LED changes to the heartbeat state. SIG – (Not used) FAULT Red On The signal output takes low level due to an error (inverted logic) (see Page 17 or Page 18). The signal output is inactive during a restart. MOD Green On Connection via modem established

13 INFO Green On Up to firmware version 8.0: the configured VPN connection has been established As of firmware version 8.1, the configured VPN connections are established or the firewall rule records defined at output O1 are activated Flashing Up to firmware version 8.0: the configured VPN connection is being established or aborted As of firmware version 8.1: the configured VPN connections are being established or aborted or the defined firewall rule records are activated or deactivated. LAN Green On The LAN/WAN LEDs are located in the LAN/WAN sockets (10/100 and duplex LED) Ethernet status. Indicates the status of the LAN or WAN port. As soon as the device is connected to the relevant network, a continuous light indicates that there is a con- nection to the network partner in the LAN or WAN. When data packets are transmit- ted, the LED goes out briefly. WAN Green On Table 1-2 LEDs on the mGuard rs4000 and mGuard rs2000 [...] LED State Meaning

I15007_en_02 1.2 Startup 1.2.1 Safety notes To ensure correct operation and the safety of the environment and of personnel, the mGuard must be installed, operated, and maintained correctly. General notes regarding usage 1.2.2 Checking the scope of supply Before startup, check the scope of supply to ensure nothing is missing. The scope of supply includes: – The device – Package slip – Plug-in screw terminal blocks for the power supply connection and inputs/outputs (in- serted) NOTE: Risk of material damage due to incorrect wiring Only connect the mGuard network ports to LAN installations. Some telecommunications connections also use RJ45 sockets; these must not be connected to the RJ45 sockets of the mGuard. NOTE: Select suitable ambient conditions – Ambient temperature: -20°C ... +60°C – Maximum humidity, non-condensing 5% ... 95% To avoid overheating, do not expose the mGuard to direct sunlight or other heat sources. NOTE: Cleaning Clean the device housing with a soft cloth. Do not use aggressive solvents.

15 1.3 Installation of mGuard rs4000/rs2000 1.3.1 Mounting/removal Mounting The device is ready to operate when it is supplied. The recommended sequence for mount- ing and connection is as follows: • Mount the mGuard rs4000/rs2000 on a grounded 35 mm DIN rail according to DIN EN 60715. Figure 1-3 Mounting the mGuard rs4000/rs2000 on a DIN rail • Attach the top snap-on foot of the mGuard rs4000/rs2000 to the DIN rail and then press the mGuard rs4000/rs2000 down towards the DIN rail until it engages with a click. Removal • Remove or disconnect the connections. • To remove the mGuard rs4000/rs2000 from the DIN rail, insert a screwdriver horizon- tally in the locking slide under the housing, pull it down – without tilting the screwdriver – and then pull up the mGuard rs4000/rs2000.

I15007_en_02 1.3.2 Connecting to the network • Connect the mGuard to the network. To do this, you need a suitable UTP cable (CAT5) which is not included in the scope of supply. • Connect the internal network interface LAN 1 of the mGuard to the corresponding Ethernet network card of the configuration computer or a valid network connection of the internal network (LAN). 1.3.3 Service contacts A push button or an on/off switch (e.g., key switch) can be connected between service contacts CMD V+ and CMD. The contacts ACK (+) and FAULT (+) are non-floating, continuously short-circuit-proof and supply a maximum of 250 mA. NOTE: Only connect the mGuard network ports to LAN installations. Some telecommuni- cations connections also use RJ45 sockets; these must not be connected to the RJ45 sockets of the mGuard. NOTE: Do not connect the voltage and ground outputs (GND, CMD V+) to an external voltage source. Please note that only the “Service 1” contacts are used with firmware version up to and including 7.6x. The “Service 2” contacts shall be made available as of firmware version 8.1. The plug-in screw terminal blocks of the service contacts may be removed or inserted dur- ing operation of the mGuard. mGuard rs4000 mGuard rs2000 Service 1 + 2 CMD V+ CMD GND ACK Power P1+ GND P2+ GND Voltage out- put (+) Supply volt- age Switching input 11 ... 36 V DC Ground out- put (-) Supply volt- age Short-cir- cuit-proof switching output * +24 V 0 V +24 V 0 V See Section 1.3.4 Only for mGuard rs4000 See Section 1.3.4 Contact GND AUX GND FAULT Example Example Not used Not used Signal out- put (-) Signal out- put (+)† * Maximum of 250 mA at 11 ... 36 V DC † 11 V ... 36 V when operating correctly; disconnected in the event of a fault

17 The switching inputs and switching outputs can be connected with signals from external de- vices, e.g., with signals from PLCs. In this case, ensure the same potential as well as voltage and current specifications are defined. Depending on the firmware version used, the service contacts can be used for various switching or signaling tasks. Service contacts as of firmware version 8.1 Input/CMD I1, CMD I2 Via the web interface under “Management, Service I/O”, you can set whether a push button or an on/off switch has been connected to the inputs. One or more freely selectable VPN connections or firewall rule records can be switched via the corresponding switch. A mixture of VPN connections and firewall rule records is also possible. The web interface displays which VPN connections and which firewall rule records are connected to this input. The push button or on/off switch is used to establish and release predefined VPN connec- tions or the defined firewall rule records. Operating a connected push button • To switch on the selected VPN connections or firewall rule records, press and hold the push button for a few seconds and then release the push button. • To switch off the selected VPN connections or firewall rule records, press and hold the push button for a few seconds and then release the push button. Operating a connected on/off switch • To switch on the selected VPN connections or firewall rule records, set the switch to ON. • To switch off the selected VPN connections or firewall rule records, set the switch to OFF. Signal contact (signal out- put) ACK O1, O2 Via the web interface under “Management, Service I/O” you can set whether certain VPN connections or firewall rule records are monitored and displayed via the LED Info 1 (out- put/ACK O1) or LED Info 2 (output/ACK O2). If VPN connections are being monitored, an illuminated Info LED indicates that VPN con- nections are established. Alarm output ACK O3 The O3 alarm output monitors the function of the mGuard rs4000/rs2000 and therefore en- ables remote diagnostics. The Fault LED lights up red if the signal output takes low level due to an error (inverted logic). The O3 alarm output reports the following when “Management, Service I/O, Alarm output” has been activated. – Failure of the redundant supply voltage – Monitoring of the link status of the Ethernet connections – Monitoring of the temperature condition – Monitoring of the connection state of the internal modem

I15007_en_02 Service contacts up to firmware version 8.0 The push button or on/off switch is used to establish and release a predefined VPN connec- tion. The output indicates the status of the VPN connection (in the web interface under “IPsec VPN >> Global >> Options”). Operating a connected push button • To establish the VPN connection, hold down the button for a few seconds until the INFO LED flashes. Only then release the button. Flashing indicates that the mGuard has received the command to establish the VPN connection and is establishing the VPN connection. As soon as the VPN connection is established, the INFO LED remains lit continuously. • To release the VPN connection, hold down the button for a few seconds until the signal output flashes or goes out. Only then release the button. As soon as the INFO LED goes out, the VPN connection is released. Operating a connected on/off switch • To establish the VPN connection, set the switch to the ON position. • To release the VPN connection, set the switch to the OFF position. INFO LED If the INFO LED does not light up, this generally indicates that the defined VPN connection is not present. Either the VPN connection was not established or it has failed due to an error. If the INFO LED is illuminated, the VPN connection is present. If the INFO LED is flashing, the VPN connection is being established or released. Signal contact (signal out- put) The signal contact monitors the function of the mGuard rs4000/rs2000 and thus enables re- mote diagnostics. The FAULT LED lights up red if the signal output takes low level due to an error (inverted logic). The voltage at the signal contact corresponds to the supply voltage applied. The following is reported when monitoring the output voltage: – Failure of at least one of the two supply voltages. – Power supply of the mGuard rs4000/rs2000 below the limit value (supply voltage 1 and/or 2 lower than 11 V). – Link status monitoring of the Ethernet connections, if configured. By default upon deliv- ery, the connection is not monitored. Monitoring can be activated (on the web interface under “Management >> System Settings >> Signal Contact”). – Error during selftest. During a restart, the signal contact is switched off until the mGuard rs4000/rs2000 has started up completely. This also applies when the signal contact is manually set to “Closed” under “Manual settings” in the software configuration.

19 1.3.4 Connecting the supply voltage The supply voltage is connected via a plug-in screw terminal block, which is located on the top of the device. Figure 1-4 Connecting the supply voltage The mGuard rs4000 has a redundant supply voltage. If you only connect one supply volt- age, you will get an error message. • Remove the plug-in screw terminal blocks for the power supply and the service con- tacts. • Do not connect the service contacts to an external voltage source. • Wire the supply voltage lines with the corresponding screw terminal block (P1/P2) of the mGuard. Tighten the screws on the screw terminal blocks with 0.5 ... 0.8 Nm. • Insert the screw terminal blocks into the intended sockets on the top of the mGuard (see Figure 1-4). Status LED P1 lights up green when the supply voltage has been connected properly. On the mGuard rs4000, the status indicator P2 also lights up if there is a redundant supply volt- age connection. The mGuard boots the firmware. Status STAT LED flashes green. The mGuard is ready for operation as soon as the Ethernet socket LEDs light up. Additionally, status LEDs P1/P2 light up green and the status STAT LED flashes green at heartbeat. Redundant voltage supply (mGuard rs4000) A redundant supply voltage can be connected. Both inputs are isolated. The load is not dis- tributed. With a redundant supply, the power supply unit with the higher output voltage sup- plies the mGuard rs4000 alone. The supply voltage is electrically isolated from the housing. If the supply voltage is not redundant, the mGuard rs4000 indicates the failure of the supply voltage via the signal contact. This message can be prevented by feeding the supply volt- age via both inputs (P1/P2) or by installing an appropriate wire jumper between connections P1 and P2. WARNING: The mGuard rs4000/rs2000 is designed for operation with a DC voltage of 11 V DC ... 36 V DC/SELV, 1.5 A, maximum. Therefore, only SELV circuits with voltage limitations according to EN 60950-1 may be connected to the supply connections and the signal contact. +24 V 0 V +24 V 0 V P1 P2 +24 V 0 V P1 mGuard rs2000 mGuard rs4000

I15007_en_02 1.4 Preparing the configuration 1.4.1 Connection requirements – The mGuard rs4000/rs2000 must be connected to at least one active power supply unit. – For local configuration: The computer that is to be used for configuration must be connected to the LAN socket on the mGuard. – For remote configuration: The mGuard must be configured so that remote configura- tion is permitted. – The mGuard must be connected, i.e., the required connections must be working. 1.4.2 Local configuration on startup (EIS) As of firmware version 7.2, initial startup of mGuard products provided in Stealth mode is considerably easier. From this version onwards, the EIS (Easy Initial Setup) procedure en- ables startup to be performed via preset or user-defined management addresses without actually having to connect to an external network. The mGuard is configured using a web browser on the computer used for configuration. According to the default setting, the mGuard can be accessed via the following addresses: The mGuard is preset to the “multiple Clients” stealth configuration. You need to configure a management IP address and default gateway if you want to use VPN connections (see Page 24). Alternatively, you can select a different stealth configuration or use another net- work mode. NOTE: The web browser used must support SSL encryption (i.e., HTTPS). Table 1-3 Preset addresses Default setting Network mode Management IP #1 Management IP #2 mGuard rs4000 Stealth https://1.1.1.1/ https://192.168.1.1/ mGuard rs2000 Stealth https://1.1.1.1/ https://192.168.1.1/

21 1.5 Configuration in Stealth mode On initial startup, the mGuard can be accessed via two addresses: – https://192.168.1.1/ (see Page 22) – https://1.1.1.1/ (see Page 22) Alternatively, an IP address can be assigned via BootP (see “Assigning the IP address via BootP” on page 23). The mGuard can be accessed via https://192.168.1.1/ if the external network interface is not connected on startup. Computers can access the mGuard via https://1.1.1.1/ if they are directly or indirectly con- nected to the LAN port of the mGuard. For this purpose, the mGuard with LAN port and WAN port must be integrated in an operational network in which the default gateway can be accessed via the WAN port. – After access via IP address 192.168.1.1 and successful login, IP address 192.168.1.1 is set as a fixed management IP address. – After access via IP address 1.1.1.1 or after IP address assignment via BootP, the product can no longer be accessed via IP address 192.168.1.1.

I15007_en_02 1.5.1 IP address 192.168.1.1 To access the configuration interface, it may be necessary to adapt the network configura- tion of your computer. Under Windows 7, proceed as follows: • In the Control Panel, open the “Network and Sharing Center”. • Click on “LAN connection”. (The “LAN connection” item is only displayed if a connection exists from the LAN interface on the computer to a mGuard in operation or another part- ner). • Click on “Properties”. • Select the menu item “Internet protocol Version 4 (TCP/IPv4)”. • Click on “Properties”. • First select “Use the following IP address” under “Internet Protocol Version 4 Proper- ties”, then enter the following address, for example: 1.5.2 IP address https://1.1.1.1/ With a configured network interface In order for the mGuard to be addressed via address https://1.1.1.1/, it must be connected to a configured network interface. This is the case if it is connected in an existing network connection and if the default gateway can be accessed via the WAN port of the mGuard at the same time. In this case, the web browser establishes a connection to the mGuard configuration inter- face after the address https://1.1.1.1/ is entered (see “Establishing a local configuration con- nection” on page 24). Continue from this point. In Stealth mode, the mGuard can be accessed via the LAN interface via IP address 192.168.1.1 within network 192.168.1.0/24, if one of the following conditions applies. – The mGuard is in the delivery state. – The mGuard was reset to the default settings via the web interface and restarted. – The rescue procedure (flashing of the mGuard) or the recovery procedure has been performed. IP address: 192.168.1.2 Subnet mask: 255.255.255.0 Default gateway: 192.168.1.1 Depending on the configuration of the mGuard, it may then be necessary to adapt the net- work interface of the locally connected computer or network accordingly. After access via IP address 1.1.1.1, the product can no longer be accessed via IP address 192.168.1.1

23 1.5.3 Assigning the IP address via BootP For IP address assignment, the mGuard uses the BootP protocol. The IP address can also be assigned via BootP. On the Internet, numerous BootP servers are available. You can use any of these programs for address assignment. Section 14.1 explains IP address assignment using the free Windows software “IP Assignment Tool” (IPAssign.exe). Notes for BootP During initial startup, the mGuard transmits BootP requests without interruption until it re- ceives a valid IP address. After receiving a valid IP address, the mGuard no longer sends BootP requests. The product can then no longer be accessed via IP address 192.168.1.1. After receiving a BootP reply, the mGuard no longer sends BootP requests, not even after it has been restarted. For the mGuard to send BootP requests again, it must either be set to the default settings or one of the procedures (recovery or flash) must be performed. Requirements The mGuard is connected to a computer using a Microsoft Windows operating system. After assigning an IP address via BootP, the product can no longer be accessed via IP ad- dress 192.168.1.1

I15007_en_02 1.6 Establishing a local configuration connection Web-based administrator interface The mGuard is configured via a web browser that is executed on the configuration com- puter. The mGuard can be accessed via one of the following addresses: Proceed as follows: • Start a web browser. • Make sure that the browser, when it is started, does not automatically establish a con- nection as otherwise the connection establishment to the mGuard may be more diffi- cult. In Internet Explorer, make the following settings: • In the “Tools” menu, select “Internet Options” and click on the “Connections” tab: • Under “Dial-up and Virtual Private Network settings”, select “Never dial a connection”. • Enter the address of the mGuard completely into the address line of the web browser (refer to Table 1-4). You access the administrator website of the mGuard. If the administrator web page of the mGuard cannot be accessed If you have forgotten the configured address If the address of the mGuard in Router, PPPoE or PPTP mode has been set to a different value, and the current address is not known, the mGuard must be reset to the default set- tings specified above for the IP address using the Recovery procedure (see “Performing a recovery procedure” on page 28). If the administrator web page is not displayed If the web browser repeatedly reports that the page cannot be displayed, try the following: • Check whether the default gateway of the connected configuration computer is initial- ized (see “Local configuration on startup (EIS)” on page 20). • Disable any active firewalls. • Make sure that the browser does not use a proxy server. In Internet Explorer (Version 8), make the following settings: “Tools” menu, “Internet Options”, “Connections” tab. Click on “Properties” under “LAN settings”. Check that “Use a proxy server for your LAN” (under “Proxy server”) is not activated in the “Local Area Network (LAN) Settings” dialog box. • If other LAN connections are active on the computer, deactivate them until the configu- ration has been completed. Under the Windows menu “Start, Settings, Control Panel, Network Connections” or “Network and Dial-up Connections”, right-click on the corresponding icon and select “Disable” in the context menu. NOTE: The web browser used must support SSL encryption (i.e., HTTPS). Table 1-4 Preset addresses Default setting Network mode Management IP #1 Management IP #2 mGuard rs4000 Stealth https://1.1.1.1/ https://192.168.1.1/ mGuard rs2000 Stealth https://1.1.1.1/ https://192.168.1.1/

25 After successful connection establishment Once a connection has been established successfully, a security alert may be displayed. Explanation: As administrative tasks can only be performed using encrypted access, a self-signed certif- icate is supplied with the device. • Click “Yes” to acknowledge the security alert. The login window is displayed. Figure 1-5 Login • To log in, enter the preset user name and password (please note these settings are case-sensitive): The mGuard can then be configured via the web interface. For additional information, please refer to the software reference manual. User Name: admin Password: mGuard For security reasons, we recommend you change the default root and administrator pass- words during initial configuration.

I15007_en_02 1.7 Remote configuration Requirement The mGuard must be configured so that remote configuration is permitted. The option for remote configuration is disabled by default. Switch on the remote configuration option in the web interface under “Management >> Web Settings”. How to proceed To configure the mGuard via its web user interface from a remote computer, establish the connection to the mGuard from there. Proceed as follows: • Start the web browser on the remote computer. • Under address, enter the IP address where the mGuard can be accessed externally over the Internet or WAN, together with the port number (if required). Example If the mGuard can be accessed over the Internet, for example, via address https://123.45.67.89/ and port number 443 has been specified for remote access, the fol- lowing address must be entered in the web browser of the remote peer: https://123.45.67.89/ If a different port number is used, it should be entered after the IP address, e.g., https://123.45.67.89:442/ Configuration The mGuard can then be configured via the web interface. For additional information, please refer to the software reference manual.

27 1.8 Restart, recovery procedure, and flashing the firm- ware The Reset button is used to set the device to one of the following states: – Performing a restart – Performing a recovery procedure – Flashing the firmware/rescue procedure Figure 1-6 Reset button 1.8.1 Performing a restart Objective The device is restarted with the configured settings. Action • Press the Reset button for around 1.5 seconds until the ERR LED lights up. (Alternatively, disconnect the power supply and then connect it again.) Reset button

I15007_en_02 1.8.2 Performing a recovery procedure Objective The network configuration (but not the rest of the configuration) is to be reset to the delivery state, as it is no longer possible to access the mGuard. When performing the recovery procedure, the default settings are established: The mGuard is reset to Stealth mode with the default setting “multiple Clients”. – The CIFS integrity monitoring function is also disabled because this only works when the management IP is active. – In addition, MAU management is switched on for Ethernet connections. HTTPS access is enabled via the local Ethernet connection (LAN). – The settings configured for VPN connections and the firewall are retained, including passwords. Possible reasons for performing the recovery procedure: – The mGuard is in Router or PPPoE mode. – The configured device address of the mGuard differs from the default setting. – The current IP address of the device is not known. Action • Slowly press the Reset button six times. After approximately 2 seconds, the STAT LED lights up green. • Press the Reset button slowly again six times. If successful, the STAT LED lights up green. If unsuccessful, the ERR LED lights up red. If successful, the device restarts after two seconds and switches to Stealth mode. The de- vice can then be reached again under the corresponding addresses. Table 1-5 Preset addresses Default setting Network mode Management IP #1 Management IP #2 mGuard rs4000 Stealth https://1.1.1.1/ https://192.168.1.1/ mGuard rs2000 Stealth https://1.1.1.1/ https://192.168.1.1/ Up-to-date information on the recovery and flashing procedure can be found in the appli- cation note for your mGuard firmware version. You can find application notes under the following Internet address: www.innominate.com.

29 1.8.3 Flashing the firmware/rescue procedure Objective The entire firmware of the mGuard should be reloaded on the device. – All configured settings are deleted. The mGuard is set to the delivery state. – In Version 5.0.0 or later of the mGuard, the licenses installed on the mGuard are re- tained after flashing the firmware. Therefore, they do not have to be installed again. Possible reasons The administrator and root password have been lost. Requirements Requirements for flashing – The mGuard firmware has been obtained from your dealer's support team or the www.innominate.com website and has been saved on a compatible SD card. – This SD card has been inserted into the mGuard. – The relevant firmware files are available for download from the download page of www.innominate.com. The files must be located under the following path names or in the following folders on the SD card: Firmware/install-ubi.mpc83xx.p7s Firmware/ubifs.img.mpc83xx.p7s NOTE: During flashing, the firmware is always loaded from an SD card first. The firmware is only loaded from a TFTP server if no SD card is found. The following requirements apply when loading the firmware from an SD card: – All necessary firmware files must be located in a common directory on the first parti- tion of the SD card – This partition must use a VFAT file system (standard type for SD cards). To flash the firmware from a TFTP server, a TFTP server must be installed on the locally connected computer (see “Installing the DHCP and TFTP server” on page 258). NOTE: Installing a second DHCP server in a network could affect the configuration of the entire network.

I15007_en_02 Action To flash the firmware or to perform the rescue procedure, proceed as follows: • Hold down the Reset button until the STAT, MOD, and SIG LEDs light up green. Then, the mGuard is in the recovery state. • Release the Reset button within a second of entering the recovery state. If the Reset button is not released, the mGuard is restarted. The mGuard now starts the recovery system: It searches for a DHCP server via the LAN interface in order to obtain an IP address. The STAT LED flashes. The “install.p7s” file is loaded from the TFTP server or SD card. It contains the electron- ically signed control procedure for the installation process. Only files that are signed are executed. The control procedure deletes the current contents of the Flash memory and prepares for a new firmware installation. The STAT, MOD, and SIG LEDs form a running light. The “jffs2.img.p7s” firmware file is downloaded from the TFTP server or SD card and written to the Flash memory. This file contains the actual mGuard operating system and is signed electronically. Only files signed by Innominate are accepted. This process takes around 3 to 5 minutes. The STAT LED is lit continuously. The new firmware is extracted and configured. This procedure takes 1 to 3 minutes. As soon as the procedure is complete, the STAT, MOD, and SIG LEDs flash green simulta- neously. • Restart the mGuard. To do this, briefly press the Reset button. (Alternatively, disconnect the power supply and then connect it again.) The mGuard is in the delivery state. You can now configure it again (see “Establishing a local configuration connection” on page 24). NOTE: Do not interrupt the power supply to the mGuard during any stage of the flashing procedure. Otherwise, the device could be damaged and may have to be reactivated by the manufacturer.

31 1.9 Technical data Hardware properties mGuard rs4000 mGuard rs2000 Platform Freescale network processor with 330 MHz clocking Freescale network processor with 330 MHz clocking Network interfaces 1 LAN port | 1 WAN port Ethernet IEEE 802.3 10/100-BaseTX RJ45 | full duplex | auto MDIX 1 LAN port | 1 WAN port Ethernet IEEE 802.3 10/100-BaseTX RJ45 | full duplex | auto MDIX Other interfaces Serial RS-232 | D-SUB 9 connector 2 digital inputs and 2 digital outputs Serial RS-232 | D-SUB 9 connector 2 digital inputs and 2 digital outputs Memory 128 MB RAM | 128 MB Flash | SD card Replaceable configuration memory 128 MB RAM | 128 MB Flash | SD card Replaceable configuration memory Redundancy options Optional: VPN | router and firewall Not available Power supply Voltage range 11 ... 36 V DC, redundant Voltage range 11 ... 36 V DC Power consumption 2.13 W, typical 2.13 W, typical Humidity range 5% ... 95% (operation, storage), non-con- densing 5% ... 95% (operation, storage), non-con- densing Degree of protection IP20 IP20 Temperature range -20°C ... +60°C (operation) -20°C ... +60°C (storage) -20°C ... +60°C (operation) -20°C ... +60°C (storage) Dimensions (H x W x D) 130 x 45 x 114 mm (up to DIN rail support) 130 x 45 x 114 mm (up to DIN rail support) Weight 725 g (TX/TX) 722 g (TX/TX) Firmware and power values mGuard rs4000 mGuard rs2000 Firmware compatibility For mGuard v7.4.0 or later: Innominate recommends the use of the latest firmware ver- sion and patch releases in each case. For the scope of functions, please refer to the relevant firmware data sheet. Data throughput (router | firewall) Router mode, default firewall rules, bidirectional throughput: 99 Mbps, maximum Stealth mode, default firewall rules, bidirectional throughput: 50 Mbps, maximum. Virtual Private Network (VPN) IPsec (IETF standard) Up to 250 VPN tunnels IPsec (IETF standard) Up to 2 VPN tunnels Hardware-based encryption DES | 3DES | AES-128/192/256 DES | 3DES | AES-128/192/256 Encrypted VPN throughput (AES-256) Router mode, default firewall rules, bidirectional throughput: 35 Mbps, maximum Stealth mode, default firewall rules, bidirectional throughput: 25 Mbps, maximum Management support Web GUI (HTTPS) | command line interface (SSH) | SNMP v1/2/3 | central device man- agement software Diagnostics LEDs (Power 1 + 2, State, Error, Signal, Fault, Modem, Info) signal contacts | ser- vice contacts | log file | remote syslog LEDs (Power, State, Error, Signal, Fault, Modem, Info) signal contacts | service contacts | log file | remote syslog Other Conformance CE | FCC | UL 508 ANSI/ISA 12.12 Class I Div. 2 Special features Realtime clock | Trusted Platform Module (TPM) | temperature sensor | mGuard Remote Services Portal ready

33 2 mGuard rs4000/rs2000 Switch Table 2-1 Available mGuard rs4000/rs2000 Switch versions The mGuard rs4000 Switch is suitable for distributed protection of production cells or in- dividual machines against manipulation. It features a 4-port managed LAN switch, one WAN port and one DMZ port, and a serial in- terface. The serial interface can be switched to the WAN interface as redundancy path, for example. A dedicated DMZ port with its own firewall rules enables segmentation and differentiated safety concepts. You can integrate automation devices with serial interfaces into networks, as a COM server is integrated. For software-independent remote maintenance, the mGuard rs4000 Switch can be used as a VPN router for up to 250 parallel, IPsec-encrypted VPN tunnels. The mGuard rs2000 Switch is a version with basic firewall and can be used as a VPN cli- ent for up to two parallel, IPsec-encrypted VPN tunnels. It is suitable for secure remote maintenance applications and enables connection of globally distributed machines and controllers. Both versions support a replaceable configuration memory in the form of an SD card. To in- crease safety, VPN connections can be switched on or off via a switch contact or software interface. The fanless metal housing is mounted on a DIN rail. Figure 2-1 mGuard rs4000 Switch/mGuard rs2000 Switch Available versions Order No. mGuard rs4000 4TX/TX HW-107020 mGuard rs4000 4TX/TX VPN BD-702000 mGuard rs2000 5TX/TX VPN HW-108020

I15007_en_02 2.1 Operating elements and LEDs Figure 2-2 Operating elements and LEDs on the mGuard rs4000 Switch Plug-in screw terminal blocks, for assignment, refer to page 39 and page 41 Reset button LEDs, see Table 2-2 DMZ port WAN port LAN port (protected) LAN port (protected) LAN port (protected) Slot for optional SD card LAN port (protected) RS-232 interface (bottom) Table 2-2 LEDs on the mGuard rs4000 Switch and mGuard rs2000 Switch LED State Meaning P1 Green On Power supply 1 is active P2 Green On Power supply 2 is active (mGuard rs2000 Switch: not used) Stat Green Flashing Heartbeat. The device is correctly connected and operating. Err Red Flashing System error. Restart the device. – Press the reset button shortly (for 1.5 seconds). – Alternatively, briefly disconnect the device power supply and then connect it again. If the error is still present, start the recovery procedure (see page 47) or contact your dealer. Stat + Err Flashing alternately: green and red Boot process. When the device has been connected to the power supply. After a few seconds, this LED changes to the heartbeat state. Mod Green On Connection via modem established Fault Red On The signal output takes low level due to an error (inverted logic). The signal output is inactive during a restart.

35 Info2 Green On The configured VPN connections are established at output O1 or the firewall re- cords defined at output O1 are activated. Flashing The configured VPN connections are being established or aborted at output O1 or the firewall rule records defined at output O1 are activated or deactivated. Info1 Green On The configured VPN connections are established at output O2 or the firewall re- cords defined at output O2 are activated. Flashing The configured VPN connections are being established or aborted at output O2 or the firewall rule records defined at output O2 are activated or deactivated. WAN 1 Green On The LEDs are located in the sockets (10/100 and duplex LED) Ethernet status. The LEDs indicate the status of the relevant port. As soon as the device is connected to the relevant network, a continuous light indicates that there is a connection to the network partner in the LAN, WAN or DMZ. When data pack- ets are transmitted, the LED goes out briefly. DMZ11 Green On LAN 1–4/52 Green On 1 mGuard rs4000 Switch only 2 mGuard rs2000 Switch only Table 2-2 LEDs on the mGuard rs4000 Switch and mGuard rs2000 Switch [...] LED State Meaning

I15007_en_02 2.2 Startup 2.2.1 Safety notes To ensure correct operation and the safety of the environment and of personnel, the device must be installed, operated, and maintained correctly. General notes regarding usage 2.2.2 Checking the scope of supply Before startup, check the scope of supply to ensure nothing is missing. The scope of supply includes: – Device – Package slip – Plug-in screw terminal blocks for the power supply connection and inputs/outputs (in- serted) 2.2.3 mGuard-Firmware The device must be operated with mGuard-Firmware version 8.1.5 or higher. NOTE: Risk of material damage due to incorrect wiring Only connect the device network ports to LAN installations. Some telecommunications connections also use RJ45 sockets; these must not be connected to the RJ45 sockets of the device. For connecting a modem or serial terminal to the RS-232 interface, you will need a null modem cable not exceeding 10 m in length. NOTE: Risk of damage to equipment due to noise emissions This is a Class A item of equipment. This equipment can cause radio interference in resi- dential areas; in this case, the operator may be required to implement appropriate mea- sures. NOTE: Electrostatic discharge When handling the device, observe the necessary safety precautions against electrostat- ic discharge (ESD) in accordance with EN 61340-5-1 and IEC 61340-5-1. NOTE: Select suitable ambient conditions – Ambient temperature: -20°C ... +60°C – Maximum humidity, non-condensing: 5% ... 95% To avoid overheating, do not expose the device to direct sunlight or other heat sources. NOTE: Cleaning Clean the device housing with a soft cloth. Do not use aggressive solvents.

37 2.3 Installing the mGuard rs4000/rs2000 Switch 2.3.1 Mounting/removal Mounting The device is ready to operate when it is supplied. The recommended sequence for mount- ing and connection is as follows: • Mount the mGuard rs4000/rs2000 Switch on a grounded 35 mm DIN rail according to DIN EN 60715. Figure 2-3 Mounting the mGuard rs4000/rs2000 Switch on a DIN rail • Attach the top snap-on foot of the mGuard rs4000/rs2000 Switch to the DIN rail and then press the mGuard rs4000/rs2000 Switch down towards the DIN rail until it engag- es with a click. Removal • Remove or disconnect the connections. • To remove the mGuard rs4000/rs2000 Switch from the DIN rail, insert a screwdriver horizontally in the locking slide under the housing, pull it down – without tilting the screwdriver – and then pull up the mGuard rs4000/rs2000 Switch. NOTE: Device damage Only mount and remove devices when the power supply is disconnected.

I15007_en_02 2.3.2 Connecting to the network • Connect the device to the network. To do this, you need a suitable UTP cable (CAT5) which is not included in the scope of supply. • Connect the internal network interface LAN of the device to the corresponding Ethernet network card of the configuration computer or a valid network connection of the internal network (LAN). NOTE: Risk of material damage due to incorrect wiring Only connect the device network ports to LAN installations. Some telecommunications connections also use RJ45 sockets; these must not be connected to the RJ45 sockets of the device.

39 2.3.3 Connecting the service contacts The mGuard rs4000/rs2000 Switch has three digital inputs and outputs. These are config- ured in the web interface, e.g., as a control signal for starting and stopping VPN connec- tions. The digital inputs and outputs are connected as follows. A push button or an on/off switch (e.g., key switch) can be connected between service contacts CMD V+ and CMD. The contacts ACK (+) and FAULT (+) are non-floating, continuously short-circuit-proof and supply a maximum of 250 mA. The switching inputs and switching outputs can be connected with signals from external de- vices, e.g., with signals from PLCs. In this case, ensure the same potential as well as voltage and current specifications are defined. Depending on the firmware version used, the service contacts can be used for various switching or signaling tasks. NOTE: Do not connect the voltage and ground outputs to an external voltage source. The plug-in screw terminal blocks of the service contacts may be removed or inserted dur- ing operation of the device. mGuard rs4000 Switch mGuard rs2000 Switch Service 1 + 2 CMD V+ CMD GND ACK Power P1+ GND P2+ GND Voltage out- put (+) Supply volt- age Switching input 11 ... 36 V DC Ground out- put (-) Supply volt- age Short-cir- cuit-proof switching output 1 +24 V 0 V +24 V 0 V See Section 2.3.4 Only for mGuard rs4000 See Section 2.3.4 Contact GND AUX GND FAULT Example Example Not used Not used Signal out- put (-) Signal out- put (+)2 1 Maximum of 250 mA at 11 ... 36 V DC 2 11 V ... 36 V when operating correctly; disconnected in the event of a fault

I15007_en_02 Service contacts as of firmware version 8.1 Input/CMD I1, CMD I2 Via the web interface under “Management, Service I/O”, you can set whether a push button or an on/off switch has been connected to the inputs. One or more freely selectable VPN connections or firewall rule records can be switched via the corresponding switch. A mixture of VPN connections and firewall rule records is also possible. The web interface displays which VPN connections and which firewall rule records are connected to this input. The push button or on/off switch is used to establish and release predefined VPN connec- tions or the defined firewall rule records. Operating a connected push button • To switch on the selected VPN connections or firewall rule records, press and hold the push button for a few seconds and then release the push button. • To switch off the selected VPN connections or firewall rule records, press and hold the push button for a few seconds and then release the push button. Operating a connected on/off switch • To switch on the selected VPN connections or firewall rule records, set the switch to ON. • To switch off the selected VPN connections or firewall rule records, set the switch to OFF. Signal contact (signal out- put) ACK O1, O2 Via the web interface under “Management, Service I/O” you can set whether certain VPN connections or firewall rule records are monitored and displayed via the LED Info 1 (out- put/ACK O1) or LED Info 2 (output/ACK O2). If VPN connections are being monitored, an illuminated Info LED indicates that VPN con- nections are established. Alarm output ACK O3 The O3 alarm output monitors the function of the mGuard rs4000/rs2000 and therefore en- ables remote diagnostics. The Fault LED lights up red if the signal output takes low level due to an error (inverted logic). The O3 alarm output reports the following when “Management, Service I/O, Alarm output” has been activated. – Failure of the redundant supply voltage – Monitoring of the link status of the Ethernet connections – Monitoring of the temperature condition – Monitoring of the connection state of the internal modem

41 2.3.4 Connecting the supply voltage The supply voltage is connected via a plug-in screw terminal block, which is located on the top of the device. Figure 2-4 Connecting the supply voltage The mGuard rs4000 Switch has a redundant supply voltage. If you only connect one supply voltage, you will get an error message. • Remove the plug-in screw terminal blocks for the power supply and the service con- tacts. • Wire the supply voltage lines with the corresponding screw terminal block (P1/P2) of the mGuard. Tighten the screws on the screw terminal blocks with 0.5 ... 0.8 Nm. • Insert the plug-in screw terminal blocks into the intended sockets on the top of the de- vice. The P1 status LED lights up green when the supply voltage has been connected properly. On the mGuard rs4000 Switch, the P2 LED also lights up if there is a redundant supply volt- age connection. The device boots the firmware. The Stat LED flashes green. The device is ready for opera- tion as soon as the Ethernet socket LEDs light up. Additionally, the P1/P2 LEDs light up green and Stat LED flashes green at heartbeat. Redundant power supply (mGuard rs4000 Switch) A redundant supply voltage can be connected. Both inputs are isolated. The load is not dis- tributed. With a redundant supply, the power supply unit with the higher output voltage sup- plies the mGuard rs4000 Switch alone. The supply voltage is electrically isolated from the housing. If the supply voltage is not redundant, the mGuard rs4000 Switch indicates the failure of one supply voltage via the signal contact. This message can be prevented by feeding the supply voltage via both inputs or by installing an appropriate wire bridge between the connections. WARNING: The device is designed for operation with a DC voltage of 11 V DC ... 36 V DC/SELV. Therefore, only SELV circuits with voltage limitations according to IEC 60950/EN 60950/VDE 0805 may be connected to the supply connections and the signal contact. +24 V 0 V +24 V 0 V P1 P2 +24 V 0 V P1 mGuard rs2000 Switch mGuard rs4000 Switch

I15007_en_02 2.4 Preparing the configuration 2.4.1 Connection requirements – The mGuard rs4000/rs2000 Switch must be connected to at least one active power supply unit. – For local configuration: The computer that is to be used for configuration must be connected to the LAN socket on the device. – For remote configuration: The device must be configured so that remote configura- tion is permitted. – The device must be connected, i.e., the required connections must be working. 2.5 Configuration in Router mode On initial startup, the mGuard can be accessed via the following address: – https://192.168.1.1 2.5.1 IP address 192.168.1.1 To access the configuration interface, it may be necessary to adapt the network configura- tion of your computer. Under Windows 7, proceed as follows: • In the Control Panel, open the “Network and Sharing Center”. • Click on “LAN connection”. (The “LAN connection” item is only displayed if a connection exists from the LAN interface on the computer to a mGuard in operation or another part- ner). • Click on “Properties”. • Select the menu item “Internet protocol Version 4 (TCP/IPv4)”. • Click on “Properties”. • First select “Use the following IP address” under “Internet Protocol Version 4 Proper- ties”, then enter the following address, for example: – In Router mode, the mGuard can be accessed via the LAN interface via IP address 192.168.1.1 within network 192.168.1.0/24, if one of the following conditions applies. – The mGuard is in the delivery state. – The mGuard was reset to the default settings via the web interface and restarted. – The rescue procedure (flashing of the mGuard) or the recovery procedure has been performed. IP address: 192.168.1.2 Subnet mask: 255.255.255.0 Default gateway: 192.168.1.1 Depending on the configuration of the mGuard, it may then be necessary to adapt the net- work interface of the locally connected computer or network accordingly.

43 2.6 Establishing a local configuration connection Web-based administrator interface The device is configured via a web browser that is executed on the configuration computer. The device can be accessed via the following address: Proceed as follows: • Start a web browser. • Make sure that the browser, when it is started, does not automatically establish a con- nection as otherwise the connection establishment to the device may be more difficult. In Internet Explorer, make the following settings: • In the “Tools” menu, select “Internet Options” and click on the “Connections” tab: • Under “Dial-up and Virtual Private Network settings”, select “Never dial a connection”. • Enter the address of the device completely into the address line of the web browser (re- fer to Table 2-3). You access the administrator website of the device. If the administrator web page of the device cannot be accessed If you have forgotten the configured address If the address of the device in Router, PPPoE or PPTP mode has been set to a different value, and the current address is not known, the device must be reset to the default settings specified above for the IP address using the Recovery procedure (see “Performing a recov- ery procedure” on page 47). If the administrator web page is not displayed If the web browser repeatedly reports that the page cannot be displayed, try the following: • Disable any active firewalls. • Make sure that the browser does not use a proxy server. In Internet Explorer (Version 8), make the following settings: “Tools” menu, “Internet Options”, “Connections” tab. Click on “Properties” under “LAN settings”. Check that “Use a proxy server for your LAN” (under “Proxy server”) is not activated in the “Local Area Network (LAN) Settings” dialog box. • If other LAN connections are active on the computer, deactivate them until the configu- ration has been completed. Under the Windows menu “Start, Settings, Control Panel, Network Connections” or “Network and Dial-up Connections”, right-click on the corresponding icon and select “Disable” in the context menu. NOTE: The web browser used must support SSL encryption (i.e., HTTPS). Table 2-3 Preset address Default setting Network mode Management IP #1 mGuard rs2000 Switch Router https://192.168.1.1/ mGuard rs4000 Switch Router https://192.168.1.1/

I15007_en_02 After successful connection establishment Once a connection has been established successfully, a security alert may be displayed. Explanation As administrative tasks can only be performed using encrypted access, a self-signed certif- icate is supplied with the device. • Click “Yes” to acknowledge the security alert. The login window is displayed. Figure 2-5 Login • To log in, enter the preset user name and password (please note these settings are case-sensitive): The device can then be configured via the web interface. For additional information, please refer to software reference manual. User Name: admin Password: mGuard For security reasons, we recommend you change the default root and administrator pass- words during initial configuration.

45 2.7 Remote configuration Requirement The device must be configured so that remote configuration is permitted. By default upon delivery, the option for remote configuration is disabled. Switch on the remote configuration option in the web interface under “Management >> Web Settings”. How to proceed To configure the device via its web user interface from a remote computer, establish the connection to the device from there. Proceed as follows: • Start the web browser on the remote computer. • Under address, enter the IP address where the device can be accessed externally over the Internet or WAN, together with the port number (if required). Example If the device can be accessed over the Internet, for example, via address https://123.45.67.89/ and port number 443 has been specified for remote access, the fol- lowing address must be entered in the web browser of the remote peer: https://123.45.67.89/ If a different port number is used, it should be entered after the IP address, e.g., https://123.45.67.89:442/ Configuration The device can then be configured via the web interface. For additional information, please refer to software reference manual.

I15007_en_02 2.8 Restart, recovery procedure, and flashing the firm- ware The reset button is used to set the device to one of the following states: – Performing a restart – Performing a recovery procedure – Flashing the firmware/rescue procedure Figure 2-6 Reset button 2.8.1 Performing a restart Objective The device is restarted with the configured settings. Action • Press the reset button for around 1.5 seconds until the Err LED lights up. (Alternatively, disconnect the power supply and then connect it again.) Reset button

47 2.8.2 Performing a recovery procedure Objective The network configuration (but not the rest of the configuration) is to be reset to the delivery state, as it is no longer possible to access the device. Use the recovery procedure in case you have forgotten the IP address under which the de- vice can be accessed. The following network setting is restored: The mGuard is reset to router mode with the fixed IP address. – The CIFS integrity monitoring function is also disabled because this only works when the management IP is active. – In addition, MAU configuration is activated for the Ethernet connections. HTTPS ac- cess is enabled via the local Ethernet connection (LAN). – The settings configured for VPN connections and the firewall are retained, including passwords. Possible reasons for performing the recovery procedure: – The device is in Router or PPPoE mode. – The device address has been configured and is not known. – The current IP address of the device is not known. Action • Slowly press the reset button six times. After approximately two seconds, the Stat LED lights up green. • When the Stat LED has gone out, slowly press the reset button again six times. If successful, the Stat LED lights up green. If unsuccessful, the Err LED lights up red. If successful, the device restarts after two seconds and switches to Router mode. The de- vice can then be reached again under the corresponding address. Table 2-4 Restored network setting Network mode Management IP #1 Management IP #2 Router https://192.168.1.1/ Up-to-date information on the recovery and flashing procedure can be found in the appli- cation note for your firmware version. You can find application notes under the following Internet address: www.innomi- nate.com.

I15007_en_02 2.8.3 Flashing the firmware/rescue procedure Objective The entire firmware of the device should be reloaded on the device. – All configured settings are deleted. The device is set to the delivery state. Possible reasons The administrator and root password have been lost. Requirements Requirements for flashing – The mGuard firmware has been obtained from your dealer's support team or the www.innominate.com website and has been saved on a compatible SD card. – This SD card has been inserted into the device. – The relevant firmware files are available for download from the download page of www.innominate.com. The files must be located under the following path names in the following folders on the SD card: Firmware/install-ubi.mpc83xx.p7s Firmware/ubifs.img.mpc83xx.p7s NOTE: During flashing, the firmware is always loaded from an SD card first. The firmware is only loaded from a TFTP server if no SD card is found. The following requirements apply when loading the firmware from an SD card: – All necessary firmware files must be located in a common directory on the first parti- tion of the SD card – This partition must use a VFAT file system (standard type for SD cards) To flash the firmware from a TFTP server, a TFTP server must be installed on the locally connected computer (see “Installing the DHCP and TFTP server” on page 258). NOTE: Installing a second DHCP server in a network could affect the configuration of the entire network.

49 Action To flash the firmware or to perform the rescue procedure, proceed as follows: • Hold down the reset button until the Stat, Mod, and Sig LEDs light up green. The device then is in rescue status. • Release the reset button within one second of entering rescue status. If the reset button is not released, the mGuard is restarted. The mGuard now starts the rescue system: It first searches for an inserted SD card and for the relevant firmware there. If the mGuard does not find an SD card, it searches for a DHCP server via the LAN interface in order to obtain an IP address. The Stat LED flashes. The “install.p7s” file is loaded from the TFTP server or SD card. It contains the electron- ically signed control procedure for the installation process. Only files that are signed are executed. The control procedure deletes the current contents of the Flash memory and prepares for a new firmware installation. The Stat, Mod, and Sig LEDs form a running light. The “jffs2.img.p7s” firmware file is downloaded from the TFTP server or SD card and written to the Flash memory. This file contains the actual operating system and is signed electronically. Only files signed by the manufacturer are accepted. This process takes around 3 to 5 minutes. The Stat LED is lit continuously. The new firmware is extracted and configured. This procedure takes 1 to 3 minutes. As soon as the procedure is complete, the Stat, Mod, and Sig LEDs flash green simultane- ously. • Restart the device. To do so, press the reset button. (Alternatively, disconnect the power supply and then connect it again.) The device is in the delivery state. You can now configure it again (see “Establishing a local configuration connection” on page 43). NOTE: Do not interrupt the power supply to the device during any stage of the flashing procedure. Otherwise, the device could be damaged and may have to be reactivated by the manufacturer.

I15007_en_02 2.9 Technical data Hardware properties mGuard rs4000 Switch mGuard rs2000 Switch Platform Freescale network processor Freescale network processor Network interfaces 4 LAN ports (managed) | 1 DMZ port | 1 WAN port Ethernet IEEE 802.3 10/100 Base TX RJ45 | full duplex | auto MDIX 5 LAN ports (unmanaged) Ethernet IEEE 802.3 10/100-BaseTX RJ45 | full duplex | auto MDIX Other interfaces Serial RS-232 | D-SUB 9 connector 3 digital inputs and 3 digital outputs Serial RS-232 | D-SUB 9 connector 3 digital inputs and 3 digital outputs Memory 128-Mbyte RAM | 128-Mbyte Flash SD card Replaceable configuration memory 128-Mbyte RAM | 128-Mbyte Flash SD card Replaceable configuration memory Redundancy options Optional: VPN | router and firewall – Power supply Voltage range 11 ... 36 V DC, redundant Voltage range 11 ... 36 V DC Current consumption Typical < 200 mA (24 V DC) | Maximum < 800 mA (10 V DC) Typical < 200 mA (24 V DC) | Maximum < 800 mA (10 V DC) Humidity range 5% ... 95% (operation, storage), non-con- densing 5% ... 95% (operation, storage), non-con- densing Degree of protection IP20 IP20 Temperature range -20°C ... +60°C (operation) -20°C ... +70°C (storage) -20°C ... +60°C (operation) -20°C ... +70°C (storage) Dimensions (H x W x D) 130 mm x 45 mm x 114 mm (up to DIN rail support) 130 mm x 45 mm x 114 mm (up to DIN rail support) Weight 835 g 835 g Firmware and power values mGuard rs4000 Switch mGuard rs2000 Switch Firmware compatibility Firmware 8.1.5: Innominate recommends the use of the latest firmware version and patch releases in each case. For the scope of functions, please refer to the relevant firmware data sheet. Data throughput (router | firewall) Router mode, default firewall rules, bidirectional throughput: 99 Mbps, maximum Stealth mode, default firewall rules, bidirectional throughput: 50 Mbps, maximum When using the DMZ as independent network zone, the maximum possible data throughput is distributed to the three zones. Virtual Private Network (VPN) IPsec (IETF standard) Up to 250 VPN tunnels IPsec (IETF standard) Up to 2 VPN tunnels Hardware-based encryption DES | 3DES | AES-128/192/256 DES | 3DES | AES-128/192/256 Encrypted VPN throughput (AES-256) Router mode, default firewall rules, bidirectional throughput: 35 Mbps, maximum Stealth mode, default firewall rules, bidirectional throughput: 25 Mbps, maximum When using the DMZ as independent network zone, the maximum possible data throughput is distributed to the three zones. Management support Web GUI (HTTPS) | command line interface (SSH) | SNMP v1/2/3 | central device man- agement software Diagnostics 13 LEDs (Power 1 + 2, State, Error, Signal, Fault, Modem, Info, Signal Status, SIM Sta- tus) | service I/O | log file | remote Syslog Other mGuard rs4000 Switch mGuard rs2000 Switch Special features Realtime clock | Trusted Platform Module (TPM) | temperature sensor | mGuard Se- cure Cloud ready

51 3 mGuard rs4000/rs2000 3G Table 3-1 Available mGuard rs4000/rs2000 3G versions The mGuard rs4000 3G is suitable for distributed protection of production cells or individ- ual machines against manipulation. It features a 4-port managed LAN switch and an industrial 3G mobile communication modem for GPRS, UMTS, and CDMA networks with a download speed of up to 14.4 Mbps. The mobile communication interface can be switched to WAN interface as redundancy path. A dedicated DMZ port with its own firewall rules enables segmentation and differenti- ated safety concepts. The GPS/GLONASS receiver enables time synchronization and loca- tion services. You can integrate automation devices with serial interfaces into networks, as a COM server is integrated. For software-independent remote maintenance, the mGuard rs4000 3G can be used as a VPN router for up to 250 parallel, IPsec-encrypted VPN tunnels. The mGuard rs2000 3G is a version with basic firewall and can be used as a VPN client for up to two parallel, IPsec-encrypted VPN tunnels. It is suitable for secure remote mainte- nance applications at locations without wired networks and enables global connection of distributed machines and controllers. Both versions support a replaceable configuration memory in the form of an SD card. To in- crease safety, VPN connections can be switched on or off via switch contact, SMS or soft- ware interface. The fanless metal housing is mounted on a DIN rail. Figure 3-1 mGuard rs4000 3G/mGuard rs2000 3G Available versions Order No. mGuard rs4000 4TX/3G/TX VPN BD-703000 mGuard rs2000 4TX/3G VPN HW-108030

I15007_en_02 3.1 Operating elements and LEDs Figure 3-2 Operating elements and LEDs on the mGuard rs4000 3G 5 4 7 9 8 6 10 11 12 1 2 3 13 14 15 For plug-in screw terminal blocks, assignment, refer to Page 57 and Page 62 Reset button LEDs, see Table 3-2 WAN port DMZ port LAN port (protected) LAN port (protected) LAN port (protected) Slot for optional SD card LAN port (protected) LEDs, see Table 3-2 SMA RS-232 interface Slot for SIM card 1 Slot for SIM card 2 RSMA Antenna sockets – SMA (mobile communi- cation) – RSMA (GPS) Table 3-2 LEDs on the mGuard rs4000 3G and mGuard rs2000 3G LED State Meaning P1 Green On Power supply 1 is active P2 Green On Power supply 2 is active (mGuard rs2000 3G: not used) Stat Green Flashing Heartbeat. The device is correctly connected and operating. Err Red Flashing System error. Restart the device. – Press the Reset button (for 1.5 seconds). – Alternatively, briefly disconnect the device power supply and then connect it again. If the error is still present, start the recovery procedure (see Page 69) or contact your dealer. Stat + Err Flashing alternately: green and red Boot process. When the device has just been connected to the power supply. After a few seconds, this LED changes to the heartbeat state. Mod Green On Connection via modem established Fault Red On The signal output takes low level due to an error (inverted logic). The signal output is inactive during a restart.

53 Info2 Green On Up to firmware version 8.0 As of firmware version 8.1 The configured VPN connection has been established at output O1. The configured VPN connections are established at output O1 or the firewall rule records defined at output O1 are activated. Flashing The configured VPN connection is being established or aborted at output O1. The configured VPN connections are being established or aborted at output O1 or the firewall rule records defined at output O1 are activated or deactivated. Info1 Green On Up to firmware version 8.0 As of firmware version 8.1 The configured VPN connection has been established at output O2. The configured VPN connections are established at output O2 or the firewall rule records defined at output O2 are activated. Flashing The configured VPN connection is being established or aborted at output O2. The configured VPN connections are being established or aborted at output O2 or the firewall rule records defined at output O2 are activated or deactivated. WAN 1* Green On The LEDs are located in the sockets (10/100 and duplex LED) Ethernet status. The LEDs indicate the status of the relevant port. As soon as the device is connected to the relevant network, a continuous light indicates that there is a connection to the network partner in the LAN, WAN or DMZ. When data pack- ets are transmitted, the LED goes out briefly. DMZ* Green On LAN 1–4 Green On Bar graph LED 3 Top Off Yellow Yellow Yellow LED 2 Middle Off Off Green Green LED 1 Bottom Off Off Off Green Signal strength -113 ... 111 dBm -109 ... 89 dBm -87 ... 67 dBm -65 ... 51 dBm Network reception Very poor to none Sufficient Good Very good SIM 1 Green On Flashing SIM card 1 active No PIN or incorrect one entered SIM 2 Green On Flashing SIM card 2 active No PIN or incorrect one entered * only mGuard rs4000 3G Table 3-2 LEDs on the mGuard rs4000 3G and mGuard rs2000 3G [...] LED State Meaning

I15007_en_02 3.2 Startup 3.2.1 Safety notes To ensure correct operation and the safety of the environment and of personnel, the mGuard must be installed, operated, and maintained correctly. General notes regarding usage 3.2.2 Checking the scope of supply Before startup, check the scope of supply to ensure nothing is missing. The scope of supply includes: – The device – Package slip – Plug-in screw terminal blocks for the power supply connection and inputs/outputs (in- serted) 3.2.3 mGuard-Firmware – The device must be operated with mGuard-Firmware version 8.0 or higher. NOTE: Risk of material damage due to incorrect wiring Only connect the mGuard network ports to LAN installations. Some telecommunications connections also use RJ45 sockets; these must not be connected to the RJ45 sockets of the mGuard. For connecting a modem or serial terminal to the RS-232 interface, you will need a null modem cable not exceeding 10 m in length. NOTE: Risk of material damage due to emissions This is a Class A item of equipment. This equipment can cause radio interference in resi- dential areas; in this case, the operator may be required to implement appropriate mea- sures. NOTE: Electrostatic discharge When handling the device, observe the necessary safety precautions against electrostat- ic discharge (ESD) according to EN 61340-5-1 and IEC 61340-5-1. NOTE: Select suitable ambient conditions – Ambient temperature: -40°C ... +60°C – Maximum humidity, non-condensing: 5% ... 95% To avoid overheating, do not expose the mGuard to direct sunlight or other heat sources. NOTE: Cleaning Clean the device housing with a soft cloth. Do not use aggressive solvents.

55 3.3 Installation of mGuard rs4000/rs2000 3G 3.3.1 Mounting/removal Mounting The device is ready to operate when it is supplied. The recommended sequence for mount- ing and connection is as follows: • Mount the mGuard rs4000/rs2000 3G on a grounded 35 mm DIN rail according to DIN EN 60715. Figure 3-3 Mounting the mGuard rs4000/rs2000 3G on a DIN rail • Attach the top snap-on foot of the mGuard rs4000/rs2000 3G to the DIN rail and then press the mGuard rs4000/rs2000 3G down towards the DIN rail until it engages with a click. Removal • Remove or disconnect the connections. • To remove the mGuard rs4000/rs2000 3G from the DIN rail, insert a screwdriver hori- zontally in the locking slide under the housing, pull it down – without tilting the screw- driver – and then pull up the mGuard rs4000/rs2000 3G. NOTE: Device damage Only mount and remove devices when the power supply is disconnected.

I15007_en_02 3.3.2 Connecting to the network • Connect the mGuard to the network. To do this, you need a suitable UTP cable (CAT5) which is not included in the scope of supply. Use UTP cables with an impedance of 100 Ω. • Connect the internal network interface LAN of the mGuard to the corresponding Ether- net network card of the configuration computer or a valid network connection of the in- ternal network (LAN). NOTE: Risk of material damage due to incorrect wiring Only connect the mGuard network ports to LAN installations. Some telecommunications connections also use RJ45 sockets; these must not be connected to the RJ45 sockets of the mGuard.

57 3.3.3 Connecting service contacts The mGuard rs4000/rs2000 3G has three digital inputs and outputs. These are configured in the web interface, e.g., the starting and stopping of VPN, sending alarms via SMS etc.. The digital inputs and outputs are connected as follows. Figure 3-4 Service contacts A push button or an on/off switch (e.g., key switch) can be connected between service contacts US and I. The service contacts O1–O3 are non-floating, continuously short-circuit-proof and supply a maximum of 250 mA. The switching inputs and switching outputs can be connected with signals from external de- vices, e.g., with PLC signals. In this case, ensure the same potential as well as voltage and current specifications are defined. Depending on the firmware version used, the service contacts can be used for various switching or signaling tasks. NOTE: Do not connect the voltage and ground outputs to an external source. The plug-in screw terminal blocks of the service contacts may be removed or inserted dur- ing operation of the mGuard. Control switch CMD Signal output (digital) ACK X1 ... X3 US I1, I2, I3 GND O1, O2, O3 Voltage output (+) Supply voltage Switching input 11 ... 36 V DC Ground output (-) Supply voltage Short-circuit-proof switch output, maximum 250 mA at 11 ... 36 V DC Example Example US I2 GND O2 X2 US I3 GND O3 X3 US I1 GND O1 X1

I15007_en_02 Service contacts as of firmware version 8.1 Input/CMD I1, CMD I2 Via the web interface under “Management, Service I/O”, you can set whether a push button or an on/off switch has been connected to the inputs. One or more freely selectable VPN connections or firewall rule records can be switched via the corresponding switch. A mixture of VPN connections and firewall rule records is also possible. The web interface displays which VPN connections and which firewall rule records are connected to this input. The push button or on/off switch is used to establish and release predefined VPN connec- tions or the defined firewall rule records. Operating a connected push button • To switch on the selected VPN connections or firewall rule records, press and hold the push button for a few seconds and then release the push button. • To switch off the selected VPN connections or firewall rule records, press and hold the push button for a few seconds and then release the push button. Operating a connected on/off switch • To switch on the selected VPN connections or firewall rule records, set the switch to ON. • To switch off the selected VPN connections or firewall rule records, set the switch to OFF. Signal contact (signal out- put) ACK O1, O2 Via the web interface under “Management, Service I/O” you can set whether certain VPN connections or firewall rule records are monitored and displayed via the LED Info 1 (out- put/ACK O1) or LED Info 2 (output/ACK O2). If VPN connections are being monitored, an illuminated Info LED indicates that VPN con- nections are established. Alarm output ACK O3 The O3 alarm output monitors the function of the mGuard rs4000/rs2000 and therefore en- ables remote diagnostics. The Fault LED lights up red if the signal output takes low level due to an error (inverted logic). The O3 alarm output reports the following when “Management, Service I/O, Alarm output” has been activated. – Failure of the redundant supply voltage – Monitoring of the link status of the Ethernet connections – Monitoring of the temperature condition – Monitoring of the connection state of the internal modem Service contacts up to firmware version 8.0 The push button or on/off switch is used to establish and release a predefined VPN connec- tion. The output indicates the status of the VPN connection (in the web interface under “IPsec VPN >> Global >> Options”). Operating a connected push button • To establish the VPN connection, hold down the button for a few seconds until the INFO LED flashes. Only then release the button. Flashing indicates that the mGuard has received the command to establish the VPN connection and is establishing the VPN connection. As soon as the VPN connection is established, the INFO LED remains lit continuously. • To release the VPN connection, hold down the button for a few seconds until the signal output flashes or goes out. Only then release the button.

59 As soon as the INFO LED goes out, the VPN connection is released. Operating a connected on/off switch • To establish the VPN connection, set the switch to the ON position. • To release the VPN connection, set the switch to the OFF position. INFO LED If the INFO LED does not light up, this generally indicates that the defined VPN connection is not present. Either the VPN connection was not established or it has failed due to an error. If the INFO LED is illuminated, the VPN connection is present. If the INFO LED is flashing, the VPN connection is being established or released. Signal contact (signal out- put) The signal contact monitors the function of the mGuard rs4000/rs2000 and thus enables re- mote diagnostics. The FAULT LED lights up red if the signal output takes low level due to an error (inverted logic). The voltage at the signal contact corresponds to the supply voltage applied. The following is reported when monitoring the output voltage: – Failure of at least one of the two supply voltages. – Power supply of the mGuard rs4000/rs2000 below the limit value (supply voltage 1 and/or 2 lower than 11 V). – Link status monitoring of the Ethernet connections, if configured. By default upon deliv- ery, the connection is not monitored. Monitoring can be activated (on the web interface under “Management >> System Settings >> Signal Contact”). – Error during selftest. During a restart, the signal contact is switched off until the mGuard rs4000/rs2000 has started up completely. This also applies when the signal contact is manually set to “Closed” under “Manual settings” in the software configuration.

I15007_en_02 3.3.4 Antennas To establish a mobile communication connection, a matching antenna must be connected to the devices. We recommend combined mobile phone GPS antenna with omnidirectional characteristic, antenna cable with SMA round plug (GSM/UMTS) and R-SMA round plug (TC ANT MOBILE/GPS, 2903590 from Phoenix Contact). In the case of the mGuard rs2000 3G, the WAN is only available via the mobile network, as a WAN interface is not available. The mobile network function is preset. The mGuard rs2000 3G can only be operated in Router mode. Connecting antennas Figure 3-5 Antenna connection • Connect a suitable antenna to the antenna connection. Antenna connection – SMA for mobile communication (ANT) – RSMA (GPS) • If the bar graph indicates good or very good reception, affix the antenna (see “Bar graph” on page 53). NOTE: Removing operator permissions Operation of the wireless system is only permitted with accessories supplied by Innominate. The use of other accessory components may invalidate the operating li- cense. You can find the approved accessories for this wireless system listed with the product at: www.innominate.com. GPS ANT

61 3.3.5 SIM card To establish a mobile communication connection, the mGuard also requires at least one valid mini SIM card in ID-000 format, via which it assigns and authenticates itself to a mo- bile network. The mGuard rs4000/rs2000 3G can be equipped with two SIM cards. The SIM card in the SIM 1 slot is the primary SIM card which is normally used to establish the connection. If this connection fails, the device can optionally turn to the second SIM card in slot SIM 2. You can set whether, and under which conditions, the connection to the primary SIM card is re- stored. The state of the SIM cards is indicated via two LEDs on the front. The LEDs SIM1 and SIM2 light up green when the SIM card is active. If a PIN has not been entered, the LED flashes green. Quality of the mobile network connection The signal strength of the mobile network connection is indicated by three LEDs on the front of the mGuard rs4000/rs2000 3G. The LEDs function as a bar graph (refer to “Bar graph” on page 53). For stable data transmission, we recommend at least good network reception. If the network reception is only adequate, only SMS messages can be sent and received. Inserting the SIM card You will receive a SIM card from the wireless provider on which all data and services for your connection are stored. If you use CDMA networks in the USA (e.g., from Verizon Wireless), you will not receive a SIM card. Change the mGuard rs4000/rs2000 3G to a CDMA provider via the web interface. Figure 3-6 Insert the SIM card To insert the SIM card, proceed as follows: • Press the release button. • Remove the SIM card holder. • Insert the SIM card so that the SIM chip remains visible. • Insert the SIM card holder together with the SIM card into the device until this ends flush with the housing. A B D C

I15007_en_02 3.3.6 Connecting the supply voltage The supply voltage is connected via a plug-in screw terminal block, which is located on the top of the device. Figure 3-7 Connecting the supply voltage (mGuard rs4000 3G) The mGuard rs4000 3G has a redundant supply voltage. If you only connect one supply voltage, you will get an error message. • Remove the plug-in screw terminal blocks for the power supply and the service con- tacts. • Wire the supply voltage lines of the X4 mGuard screw terminal block. Tighten the screws on the screw terminal blocks with 0.5 ... 0.8 Nm. • Insert the plug-in screw terminal blocks into the intended sockets on the top of the mGuard. Status LED P1 lights up green when the supply voltage has been connected properly. On the mGuard rs4000 3G, the status indicator P2 also lights up if there is a redundant supply voltage connection. The mGuard boots the firmware. The Stat LED flashes green. The mGuard is ready for op- eration as soon as the Ethernet socket LEDs light up. Additionally, the P1/P2 LEDs light up green and Stat LED flashes green at heartbeat. Redundant voltage supply (mGuard rs4000 3G) A redundant supply voltage can be connected. Both inputs are isolated. The load is not dis- tributed. With a redundant supply, the power supply unit with the higher output voltage sup- plies the mGuard rs4000 3G alone. The supply voltage is electrically isolated from the hous- ing. WARNING: The device is designed for operation with a DC voltage of 11 V DC ... 36 V DC/SELV, 800 mA maximum. Therefore, only SELV circuits with voltage limitations according to IEC 60950/EN 60950/VDE 0805 may be connected to the supply connections and the signal contact. Table 3-3 Supply voltage mGuard rs4000/rs2000 3G mGuard rs4000 3G mGuard rs2000 3G 24V 0V 24V 0V X4

63 If the supply voltage is not redundant, the mGuard rs4000 3G indicates the failure of the supply voltage via the signal contact. This message can be prevented by feeding the supply voltage via both inputs or by installing an appropriate wire jumper between the connections.

I15007_en_02 3.4 Preparing the configuration 3.4.1 Connection requirements – The mGuard rs4000/rs2000 3G must be connected to at least one active power sup- ply unit. – For local configuration: The computer that is to be used for configuration must be connected to the LAN socket on the mGuard. – For remote configuration: The mGuard must be configured so that remote configura- tion is permitted. – The mGuard must be connected, i.e., the required connections must be working. 3.5 Configuration in Router mode On initial startup, the mGuard can be accessed via the following address: – https://192.168.1.1 3.5.1 IP address 192.168.1.1 To access the configuration interface, it may be necessary to adapt the network configura- tion of your computer. Under Windows 7, proceed as follows: • In the Control Panel, open the “Network and Sharing Center”. • Click on “LAN connection”. (The “LAN connection” item is only displayed if a connection exists from the LAN interface on the computer to a mGuard in operation or another part- ner). • Click on “Properties”. • Select the menu item “Internet protocol Version 4 (TCP/IPv4)”. • Click on “Properties”. • First select “Use the following IP address” under “Internet Protocol Version 4 Proper- ties”, then enter the following address, for example: In Router mode, the mGuard can be accessed via the LAN interface via IP address 192.168.1.1 within network 192.168.1.0/24, if one of the following conditions applies. – The mGuard is in the delivery state. – The mGuard was reset to the default settings via the web interface and restarted. – The rescue procedure (flashing of the mGuard) or the recovery procedure has been performed. IP address: 192.168.1.2 Subnet mask: 255.255.255.0 Default gateway: 192.168.1.1 Depending on the configuration of the mGuard, it may then be necessary to adapt the net- work interface of the locally connected computer or network accordingly.

65 3.6 Establishing a local configuration connection Web-based administrator interface The mGuard is configured via a web browser that is executed on the configuration com- puter. The mGuard can be accessed via the following address: Proceed as follows: • Start a web browser. • Make sure that the browser, when it is started, does not automatically establish a con- nection as otherwise the connection establishment to the mGuard may be more diffi- cult. In Internet Explorer, make the following settings: • In the “Tools” menu, select “Internet Options” and click on the “Connections” tab: • Under “Dial-up and Virtual Private Network settings”, select “Never dial a connection”. • Enter the address of the mGuard completely into the address line of the web browser (refer to Table 3-4). You access the administrator website of the mGuard. If the administrator web page of the mGuard cannot be accessed If you have forgotten the configured address If the address of the mGuard in Router, PPPoE or PPTP mode has been set to a different value, and the current address is not known, the mGuard must be reset to the default set- tings specified above for the IP address using the Recovery procedure (see “Performing a recovery procedure” on page 69). If the administrator web page is not displayed If the web browser repeatedly reports that the page cannot be displayed, try the following: • Disable any active firewalls. • Make sure that the browser does not use a proxy server. In Internet Explorer (Version 8), make the following settings: “Tools” menu, “Internet Options”, “Connections” tab. Click on “Properties” under “LAN settings”. Check that “Use a proxy server for your LAN” (under “Proxy server”) is not activated in the “Local Area Network (LAN) Settings” dialog box. • If other LAN connections are active on the computer, deactivate them until the configu- ration has been completed. Under the Windows menu “Start, Settings, Control Panel, Network Connections” or “Network and Dial-up Connections”, right-click on the corresponding icon and select “Disable” in the context menu. After successful connection establishment Once a connection has been established successfully, a security alert may be displayed. NOTE: The web browser used must support SSL encryption (i.e., HTTPS). Table 3-4 Preset address Default setting Network mode Management IP #1 mGuard rs4000 3G Router https://192.168.1.1/ mGuard rs2000 3G Router https://192.168.1.1/

I15007_en_02 Explanation: As administrative tasks can only be performed using encrypted access, a self-signed certif- icate is supplied with the device. • Click “Yes” to acknowledge the security alert. The login window is displayed. Figure 3-8 Login • To log in, enter the preset user name and password (please note these settings are case-sensitive): The mGuard can then be configured via the web interface. For additional information, please refer to the software reference manual. User Name: admin Password: mGuard For security reasons, we recommend you change the default root and administrator pass- words during initial configuration.

67 3.7 Remote configuration Requirement The mGuard must be configured so that remote configuration is permitted. The option for remote configuration is disabled by default. Switch on the remote configuration option in the web interface under “Management >> Web Settings”. How to proceed To configure the mGuard via its web user interface from a remote computer, establish the connection to the mGuard from there. Proceed as follows: • Start the web browser on the remote computer. • Under address, enter the IP address where the mGuard can be accessed externally over the Internet or WAN, together with the port number (if required). Example If the mGuard can be accessed over the Internet, for example, via address https://123.45.67.89/ and port number 443 has been specified for remote access, the fol- lowing address must be entered in the web browser of the remote peer: https://123.45.67.89/ If a different port number is used, it should be entered after the IP address, e.g., https://123.45.67.89:442/ Configuration The mGuard can then be configured via the web interface. For additional information, please refer to the software reference manual.

I15007_en_02 3.8 Restart, recovery procedure, and flashing the firm- ware The Reset button is used to set the device to one of the following states: – Performing a restart – Performing a recovery procedure – Flashing the firmware/rescue procedure Figure 3-9 Reset button 3.8.1 Performing a restart Objective The device is restarted with the configured settings. Action • Press the Reset button for around 1.5 seconds until the Err LED lights up. (Alternatively, disconnect the power supply and then connect it again.) Reset button

69 3.8.2 Performing a recovery procedure Objective The network configuration (but not the rest of the configuration) is to be reset to the delivery state, as it is no longer possible to access the mGuard. When performing the recovery procedure, the default settings are established: The mGuard is reset to router mode with the fixed IP address. – The CIFS integrity monitoring function is also disabled because this only works when the management IP is active. – In addition, MAU management is switched on for Ethernet connections. HTTPS access is enabled via the local Ethernet connection (LAN). – The settings configured for VPN connections and the firewall are retained, including passwords. Possible reasons for performing the recovery procedure: – The mGuard is in Router or PPPoE mode. – The configured device address of the mGuard differs from the default setting. – The current IP address of the device is not known. Action • Slowly press the Reset button six times. After approximately two seconds, the Stat LED lights up green. • When the Stat LED has gone out, slowly press the Reset button again six times. If successful, the Stat LED lights up green. If unsuccessful, the Err LED lights up red. If successful, the device restarts after two seconds and switches to Router mode. The de- vice can then be reached again under the corresponding address. Table 3-5 Preset address Default setting Network mode Management IP #1 mGuard rs4000 3G Router https://192.168.1.1/ mGuard rs2000 3G Router https://192.168.1.1/ Up-to-date information on the recovery and flashing procedure can be found in the appli- cation note for your mGuard firmware version. You can find application notes under the following Internet address: www.innominate.com.

I15007_en_02 3.8.3 Flashing the firmware/rescue procedure Objective The entire firmware of the mGuard should be reloaded on the device. – All configured settings are deleted. The mGuard is set to the delivery state. Possible reasons The administrator and root password have been lost. Requirements Requirements for flashing – The mGuard firmware has been obtained from your dealer's support team or the www.innominate.com website and has been saved on a compatible SD card. – This SD card has been inserted into the mGuard. – The relevant firmware files are available for download from the download page of www.innominate.com. The files must be located under the following path names or in the following folders on the SD card: Firmware/install-ubi.mpc83xx.p7s Firmware/ubifs.img.mpc83xx.p7s NOTE: During flashing, the firmware is always loaded from an SD card first. The firmware is only loaded from a TFTP server if no SD card is found. The following requirements apply when loading the firmware from an SD card: – All necessary firmware files must be located in a common directory on the first parti- tion of the SD card – This partition must use a VFAT file system (standard type for SD cards). To flash the firmware from a TFTP server, a TFTP server must be installed on the locally connected computer (see “Installing the DHCP and TFTP server” on page 258). NOTE: Installing a second DHCP server in a network could affect the configuration of the entire network.

71 Action To flash the firmware or to perform the rescue procedure, proceed as follows: • Hold down the Reset button until the Stat, Mod, and Sig LEDs light up green. Then, the mGuard is in the recovery state. • Release the Reset button within a second of entering the recovery state. If the Reset button is not released, the mGuard is restarted. The mGuard now starts the rescue system: It searches for a DHCP server via the LAN interface in order to obtain an IP address. (Exception: if an SD card is inserted into the device with corresponding firmware, the rescue system is started from there). The Stat LED flashes. The “install.p7s” file is loaded from the TFTP server or SD card. It contains the electron- ically signed control procedure for the installation process. Only files that are signed are executed. The control procedure deletes the current contents of the Flash memory and prepares for a new firmware installation. The Stat, Mod, and Sig LEDs form a running light. The “jffs2.img.p7s” firmware file is downloaded from the TFTP server or SD card and written to the Flash memory. This file contains the actual mGuard operating system and is signed electronically. Only files signed by Innominate are accepted. This process takes around 3 to 5 minutes. The Stat LED is lit continuously. The new firmware is extracted and configured. This procedure takes 1 to 3 minutes. As soon as the procedure is complete, the Stat, Mod, and Sig LEDs flash green simultane- ously. • Restart the mGuard. To do so, press the Reset button. (Alternatively, disconnect the power supply and then connect it again.) The mGuard is in the delivery state. You can now configure it again (see “Establishing a local configuration connection” on page 65): NOTE: Do not interrupt the power supply to the mGuard during any stage of the flashing procedure. Otherwise, the device could be damaged and may have to be reactivated by the manufacturer.

I15007_en_02 3.9 Technical data Hardware properties mGuard rs4000 3G mGuard rs2000 3G Platform Freescale network processor Freescale network processor Network interfaces 4 LAN Ports (managed) | 1 DMZ port | 1 WAN port Ethernet IEEE 802.3 10/100-BaseTX RJ45 | full duplex | auto MDIX 4 LAN ports (unmanaged) Ethernet IEEE 802.3 10/100-BaseTX RJ45 | full duplex | auto MDIX Wireless interface WAN | GSM | GPRS | EDGE | UMTS | CDMA2000 WAN | GSM | GPRS | EDGE | UMTS | CDMA2000 SIM interfaces (1 + 2) 1.8 V | 3 V, redundant 1.8 V | 3 V, redundant Data rate ≤ 14.4 Mbps (HSDPA) ≤ 14.4 Mbps (HSDPA) Other interfaces Serial RS-232 | D-SUB 9 connector 3 digital inputs and 3 digital outputs Serial RS-232 | D-SUB 9 connector 3 digital inputs and 3 digital outputs Memory 128 MB RAM | 128 MB Flash | SD card Replaceable configuration memory 128 MB RAM | 128 MB Flash | SD card Replaceable configuration memory Redundancy options Optional: VPN | router and firewall – Power supply Voltage range 11 ... 36 V DC, redundant Voltage range 11 ... 36 V DC, redundant Power consumption typical < 200 mA (24 V DC) | maximum < 800 mA (10 V DC) typical < 200 mA (24 V DC) | maximum < 800 mA (10 V DC) Humidity range 5% ... 95% (operation, storage), non-con- densing 5% ... 95% (operation, storage), non-con- densing Degree of protection IP20 IP20 Temperature range -40°C ... +60°C (operation) -40°C ... +70°C (storage) -40°C ... +60°C (operation) -40°C ... +70°C (storage) Dimensions (H x W x D) 130 x 45 x 114 mm (up to DIN rail support) 130 x 45 x 114 mm (up to DIN rail support) Weight 850 g 835 g Firmware and power values mGuard rs4000 3G mGuard rs2000 3G Firmware compatibility For mGuard v8.0 or later: Innominate recommends the use of the latest firmware ver- sion and patch releases in each case. For the scope of functions, please refer to the relevant firmware data sheet. Data throughput (router | firewall) Router mode, default firewall rules, bidirectional throughput: 99 Mbps, maximum Stealth mode, default firewall rules, bidirectional throughput: 50 Mbps, maximum When using the DMZ as independent network zone, the maximum possible data throughput is distributed to the three zones. Virtual Private Network (VPN) IPsec (IETF standard) Up to 250 VPN tunnels IPsec (IETF standard) Up to 2 VPN tunnels Hardware-based encryption DES | 3DES | AES-128/192/256 DES | 3DES | AES-128/192/256 Encrypted VPN throughput (AES-256) Router mode, default firewall rules, bidirectional throughput: 35 Mbps, maximum Stealth mode, default firewall rules, bidirectional throughput: 25 Mbps, maximum When using the DMZ as independent network zone, the maximum possible data throughput is distributed to the three zones. Data throughput (mobile) Depending on the mobile connection ≤ 14,4 Mbit/s (HSDPA) upload ≤ 5,7 Mbit/s (HSDPA) download Management support Web GUI (HTTPS) | command line interface (SSH) | SNMP v1/2/3 | central device man- agement software Diagnostics 13 LEDs (Power 1 + 2, State, Error, Signal, Fault, Modem, Info, Signal Status, SIM Sta- tus) | Service I/O| Log File | Remote Syslog

73 Other mGuard rs4000 3G mGuard rs2000 3G Conformance CE | FCC | UL 508 | electrical isolation (VCC//PE) | ANSI / ISA 12.12 Class I Div. 2 Special features GPS / GLONASS receiver | realtime clock | Trusted Platform Module (TPM) | tempera- ture sensor | mGuard Secure Cloud ready

75 4 mGuard delta² Table 4-1 Available mGuard delta² versions The mGuard delta² is ideal for use in desktop applications, in distribution compartments, and other environments close to production processes with low requirements for industrial hardening. Individual devices or network segments can be safely networked and comprehensively pro- tected. The mGuard delta² can be used as a firewall between office and production net- works as well as a security router for small and medium-sized workgroups. Figure 4-1 mGuard delta² Available versions Order No. mGuard delta² TX/TX HW-103060 mGuard delta² TX/TX VPN BD-211010

I15007_en_02 4.1 Operating elements and LEDs SD card slot (configuration memory) RJ45 socket (LAN 1) for connecting to the in- ternal network RJ45 socket (WAN 1) for connecting to the ex- ternal network Reset button LEDs LAN 2/WAN 2 LEDs LAN 1/WAN 1 LEDs Figure 4-2 Operating elements and LEDs on the Table 4-2 LEDs on the mGuard delta² LEDs State Meaning WAN 1 LAN 1 Green On Full duplex Off Half duplex WAN 2 LAN 2 Yellow On 10 Mbps Flash- ing 10 Mbps, data transmission active Green On 100 Mbps Flash- ing 100 Mbps, data transmission active PWR Green On Supply voltage OK STAT Green Flash- ing The mGuard is ready to operate. ERR Red On System error FAULT Red On mGuard in the booting or flashing state INFO Not used

77 4.2 Startup 4.2.1 Safety notes To ensure correct operation and the safety of the environment and of personnel, the mGuard must be installed, operated, and maintained correctly. General notes regarding usage 4.2.2 Checking the scope of supply Before startup, check the scope of supply to ensure nothing is missing. The scope of supply includes: – mGuard delta² – Package slip – 12 V DC power supply including different country adapters NOTE: Risk of material damage due to incorrect wiring Only connect the mGuard network ports to LAN installations. Some telecommunications connections also use RJ45 sockets; these must not be connected to the RJ45 sockets of the mGuard. NOTE: Select suitable ambient conditions – Ambient temperature: 0°C ... +40°C – Maximum humidity, non-condensing: 5% ... 95% To avoid overheating, do not expose the mGuard to direct sunlight or other heat sources. NOTE: Cleaning Clean the device housing with a soft cloth. Do not use aggressive solvents.

I15007_en_02 4.3 Connecting the mGuard delta² 4.3.1 Connecting to the network • Connect the mGuard to the network. To do this, you need a suitable UTP cable (CAT5) which is not included in the scope of supply. • Connect the internal network interface LAN 1 of the mGuard to the corresponding Ethernet network card of the configuration computer or a valid network connection of the internal network (LAN). 4.3.2 Connecting the supply voltage • Connect the wide-range power supply unit of the mGuard to a suitable power supply. Connect the low-voltage plug of the power supply unit on the back of the mGuard. Figure 4-3 Low-voltage plug of the power supply unit The status LED PWR lights up green when the supply voltage has been connected properly. The mGuard boots the firmware. Status LED STAT flashes green. The mGuard is ready for operation as soon as the LAN/WAN LEDs of the Ethernet socket light up. Additionally, the status LED PWR lights up green and the status LED STAT flashes green at heartbeat. NOTE: Notes on mounting and installation Only connect the RJ45 Ethernet ports of the mGuard to matching network installations. Some telecommunications connections also use RJ45 sockets. You may not connect these to the RJ45 ports of the mGuard. Safe isolation of live circuits is only guaranteed if connected devices fulfill requirements specified by VDE 0106-101 (safe isolation). The supply lines must be isolated or laid sep- arately to live circuits.

79 4.4 Preparing the configuration 4.4.1 Connection requirements mGuard delta² – The mGuard delta² must be connected to its power supply. – For local configuration: The computer that is to be used for configuration must be connected to the LAN socket on the mGuard. – For remote configuration: The mGuard must be configured so that remote configura- tion is permitted. – The mGuard must be connected, i.e., the required connections must be working. 4.4.2 Local configuration on startup (EIS) As of firmware version 7.2, initial startup of mGuard products provided in Stealth mode is considerably easier. From this version onwards, the EIS (Easy Initial Setup) procedure en- ables startup to be performed via preset or user-defined management addresses without actually having to connect to an external network. The mGuard is configured using a web browser on the computer used for configuration. According to the default setting, the mGuard can be accessed via the following addresses: The mGuard is preset to the “multiple Clients” stealth configuration. You need to configure a management IP address and default gateway if you want to use VPN connections (in the web interface under “Network >> Interfaces >> General”). Alternatively, you can select a dif- ferent stealth configuration or use another network mode. NOTE: The web browser used must support SSL encryption (i.e., HTTPS). Table 4-3 Preset addresses Default setting Network mode Management IP #1 Management IP #2 mGuard delta² Stealth https://1.1.1.1/ https://192.168.1.1/

I15007_en_02 4.5 Configuration in Stealth mode On initial startup, the mGuard can be accessed via two addresses: – https://192.168.1.1/ (see Page 81) – https://1.1.1.1/ (see Page 81) Alternatively, an IP address can be assigned via BootP (see “Assigning the IP address via BootP” on page 82). The mGuard can be accessed via https://192.168.1.1/ if the external network interface is not connected on startup. Computers can access the mGuard via https://1.1.1.1/ if they are directly or indirectly con- nected to the LAN port of the mGuard. For this purpose, the mGuard with LAN port and WAN port must be integrated in an operational network in which the default gateway can be accessed via the WAN port. – After access via IP address 192.168.1.1 and successful login, IP address 192.168.1.1 is set as a fixed management IP address. – After access via IP address 1.1.1.1 or after IP address assignment via BootP, the FL MGUARD can no longer be accessed via IP address 192.168.1.1.

81 4.5.1 IP address 192.168.1.1 To access the configuration interface, it may be necessary to adapt the network configura- tion of your computer. Under Windows 7, proceed as follows: • In the Control Panel, open the “Network and Sharing Center”. • Click on “LAN connection”. (The “LAN connection” item is only displayed if a connection exists from the LAN interface on the computer to a mGuard in operation or another part- ner). • Click on “Properties”. • Select the menu item “Internet protocol Version 4 (TCP/IPv4)”. • Click on “Properties”. • First select “Use the following IP address” under “Internet Protocol Version 4 Proper- ties”, then enter the following address, for example: 4.5.2 IP address https://1.1.1.1/ With a configured network interface In order for the mGuard to be addressed via address https://1.1.1.1/, it must be connected to a configured network interface. This is the case if it is connected in an existing network connection and if the default gateway can be accessed via the WAN port of the mGuard at the same time. In this case, the web browser establishes a connection to the mGuard configuration inter- face after the address https://1.1.1.1/ is entered (see “Establishing a local configuration con- nection” on page 83). Continue from this point. In Stealth mode, the mGuard can be accessed via the LAN interface via IP address 192.168.1.1 within network 192.168.1.0/24, if one of the following conditions applies. – The mGuard is in the delivery state. – The mGuard was reset to the default settings via the web interface and restarted. – The rescue procedure (flashing of the mGuard) or the recovery procedure has been performed. IP address: 192.168.1.2 Subnet mask: 255.255.255.0 Default gateway: 192.168.1.1 Depending on the configuration of the mGuard, it may then be necessary to adapt the net- work interface of the locally connected computer or network accordingly. After access via IP address 1.1.1.1, the FL MGUARD can no longer be accessed via IP address 192.168.1.1

I15007_en_02 4.5.3 Assigning the IP address via BootP For IP address assignment, the mGuard uses the BootP protocol. The IP address can also be assigned via BootP. On the Internet, numerous BootP servers are available. You can use any of these programs for address assignment. Section 14.1 explains IP address assignment using the free Windows software “IP Assignment Tool” (IPAssign.exe). Notes for BootP During initial startup, the mGuard transmits BootP requests without interruption until it re- ceives a valid IP address. After receiving a valid IP address, the mGuard no longer sends BootP requests. The FL MGUARD can then no longer be accessed via IP address 192.168.1.1. After receiving a BootP reply, the mGuard no longer sends BootP requests, not even after it has been restarted. For the mGuard to send BootP requests again, it must either be set to the default settings or one of the procedures (recovery or flash) must be performed. Requirements The mGuard is connected to a computer using a Microsoft Windows operating system. After assigning an IP address via BootP, the FL MGUARD can no longer be accessed via IP address 192.168.1.1

83 4.6 Establishing a local configuration connection Web-based administrator interface The mGuard is configured via a web browser that is executed on the configuration com- puter. The mGuard can be accessed via one of the following addresses: Proceed as follows: • Start a web browser. • Make sure that the browser, when it is started, does not automatically establish a con- nection as otherwise the connection establishment to the mGuard may be more diffi- cult. In Internet Explorer, make the following settings: • In the “Tools” menu, select “Internet Options” and click on the “Connections” tab: • Under “Dial-up and Virtual Private Network settings”, select “Never dial a connection”. • Enter the address of the mGuard completely into the address line of the web browser (refer to Table 4-4). You access the administrator website of the mGuard. If the administrator web page of the mGuard cannot be accessed If you have forgotten the configured address If the address of the mGuard in Router, PPPoE or PPTP mode has been set to a different value, and the current address is not known, the mGuard must be reset to the default set- tings specified above for the IP address using the Recovery procedure (see “Performing a recovery procedure” on page 87). If the administrator web page is not displayed If the web browser repeatedly reports that the page cannot be displayed, try the following: • Check whether the default gateway of the connected configuration computer is initial- ized (see “Local configuration on startup (EIS)” on page 79). • Disable any active firewalls. • Make sure that the browser does not use a proxy server. In Internet Explorer (Version 8), make the following settings: “Tools” menu, “Internet Options”, “Connections” tab. Click on “Properties” under “LAN settings”. Check that “Use a proxy server for your LAN” (under “Proxy server”) is not activated in the “Local Area Network (LAN) Settings” dialog box. • If other LAN connections are active on the computer, deactivate them until the configu- ration has been completed. Under the Windows menu “Start, Settings, Control Panel, Network Connections” or “Network and Dial-up Connections”, right-click on the corresponding icon and select “Disable” in the context menu. NOTE: The web browser used must support SSL encryption (i.e., HTTPS). Table 4-4 Preset addresses Default setting Network mode Management IP #1 Management IP #2 mGuard delta² Stealth https://1.1.1.1/ https://192.168.1.1/

I15007_en_02 After successful connection establishment Once a connection has been established successfully, a security alert may be displayed. Explanation: As administrative tasks can only be performed using encrypted access, a self-signed certif- icate is supplied with the device. • Click “Yes” to acknowledge the security alert. The login window is displayed. Figure 4-4 Login • To log in, enter the preset user name and password (please note these settings are case-sensitive): The mGuard can then be configured via the web interface. For additional information, please refer to the software reference manual. User Name: admin Password: mGuard For security reasons, we recommend you change the default root and administrator pass- words during initial configuration.

85 4.7 Remote configuration Requirement The mGuard must be configured so that remote configuration is permitted. The option for remote configuration is disabled by default. Switch on the remote configuration option in the web interface under “Management >> Web Settings”. How to proceed To configure the mGuard via its web user interface from a remote computer, establish the connection to the mGuard from there. Proceed as follows: • Start the web browser on the remote computer. • Under address, enter the IP address where the mGuard can be accessed externally over the Internet or WAN, together with the port number (if required). Example If the mGuard can be accessed over the Internet, for example, via address https://123.45.67.89/ and port number 443 has been specified for remote access, the fol- lowing address must be entered in the web browser of the remote peer: https://123.45.67.89/ If a different port number is used, it should be entered after the IP address, e.g., https://123.45.67.89:442/ Configuration The mGuard can then be configured via the web interface. For additional information, please refer to the software reference manual.

I15007_en_02 4.8 Restart, recovery procedure, and flashing the firm- ware The Reset button is used to set the device to one of the following states: – Performing a restart – Performing a recovery procedure – Flashing the firmware/rescue procedure Figure 4-5 Reset button 4.8.1 Performing a restart Objective The device is restarted with the configured settings. Action • Press the Reset button for around 1.5 seconds until the ERR LED lights up. (Alternatively, disconnect the power supply and then connect it again.) Reset button

87 4.8.2 Performing a recovery procedure Objective The network configuration (but not the rest of the configuration) is to be reset to the delivery state, as it is no longer possible to access the mGuard. When performing the recovery procedure, the default settings are established: The mGuard is reset to Stealth mode with the default setting “multiple Clients”. – The CIFS integrity monitoring function is also disabled because this only works when the management IP is active. – In addition, MAU management is switched on for Ethernet connections. HTTPS access is enabled via the local Ethernet connection (LAN). – The settings configured for VPN connections and the firewall are retained, including passwords. Possible reasons for performing the recovery procedure: – The mGuard is in Router or PPPoE mode. – The configured device address of the mGuard differs from the default setting. – The current IP address of the device is not known. Action • Slowly press the Reset button six times. After approximately 2 seconds, the STAT LED lights up green. • Slowly press the Reset button again six times. If successful, the STAT LED lights up green. If unsuccessful, the ERR LED lights up red. If successful, the device restarts after two seconds and switches to Stealth mode. The de- vice can then be reached again under the corresponding addresses. Table 4-5 Preset addresses Default setting Network mode Management IP #1 Management IP #2 mGuard delta² Stealth https://1.1.1.1/ https://192.168.1.1/ Up-to-date information on the recovery and flashing procedure can be found in the appli- cation note for your mGuard firmware version. You can find application notes under the following Internet address: www.innominate.com.

I15007_en_02 4.8.3 Flashing the firmware/rescue procedure Objective The entire firmware of the mGuard should be reloaded on the device. – All configured settings are deleted. The mGuard is set to the delivery state. – In Version 5.0.0 or later of the mGuard, the licenses installed on the mGuard are re- tained after flashing the firmware. Therefore, they do not have to be installed again. Possible reasons The administrator and root password have been lost. Requirements Requirements for flashing – The mGuard firmware has been obtained from your dealer's support team or the www.innominate.com website and has been saved on a compatible SD card. – This SD card has been inserted into the mGuard. – The relevant firmware files are available for download from the download page of www.innominate.com. The files must be located under the following path names or in the following folders on the SD card: Firmware/install-ubi.mpc83xx.p7s Firmware/ubifs.img.mpc83xx.p7s NOTE: During flashing, the firmware is always loaded from an SD card first. The firmware is only loaded from a TFTP server if no SD card is found. The following requirements apply when loading the firmware from an SD card: – All necessary firmware files must be located in a common directory on the first parti- tion of the SD card. – This partition must use a VFAT file system (standard type for SD cards). To flash the firmware from a TFTP server, a TFTP server must be installed on the locally connected computer (see “Installing the DHCP and TFTP server” on page 258). NOTE: Installing a second DHCP server in a network could affect the configuration of the entire network.

89 Action To flash the firmware or to perform the rescue procedure, proceed as follows: • Hold down the Reset button until the STAT, MOD, and SIG LEDs light up green. Then, the mGuard is in the recovery state. • Release the Reset button within a second of entering the recovery state. If the Reset button is not released, the mGuard is restarted. The mGuard now starts the recovery system: It searches for a DHCP server via the LAN interface in order to obtain an IP address. The STAT LED flashes. The “install.p7s” file is loaded from the TFTP server or SD card. It contains the electron- ically signed control procedure for the installation process. Only files that are signed are executed. The control procedure deletes the current contents of the Flash memory and prepares for a new firmware installation. The STAT, MOD, and SIG LEDs form a running light. The “jffs2.img.p7s” firmware file is downloaded from the TFTP server or SD card and written to the Flash memory. This file contains the actual mGuard operating system and is signed electronically. Only files signed by Innominate are accepted. This process takes around 3 to 5 minutes. The STAT LED is lit continuously. The new firmware is extracted and configured. This procedure takes 1 to 3 minutes. As soon as the procedure is complete, the STAT, MOD, and SIG LEDs flash green simulta- neously. • Restart the mGuard. To do this, briefly press the Reset button. (Alternatively, disconnect the power supply and then connect it again.) The mGuard is in the delivery state. You can now configure it again (see “Establishing a local configuration connection” on page 83): NOTE: Do not interrupt the power supply to the mGuard during any stage of the flashing procedure. Otherwise, the device could be damaged and may have to be reactivated by the manufacturer.

I15007_en_02 4.9 Technical data Hardware properties Platform Freescale network processor with 330 MHz clocking Network interfaces 1 LAN port | 1 WAN port Ethernet IEEE 802.3 10/100 Base TX | RJ45 | full duplex | auto MDIX Other interfaces Serial RS-232, D-SUB 9 connector Memory 128 MB RAM | 128 MB Flash SD card, replaceable configuration memory Redundancy options Optional: VPN | router Power supply External power supply unit 12 V/0.85 A DC | 100 – 240 V/0.4 A AC Power consumption 2.13 W, typical Humidity range 5% ... 95% during operation, non-condensing Degree of protection IP20 Temperature range 0°C ... +40°C (operation) 0°C ... +60°C (storage) Dimensions (H x W x D) 45 x 130 x 114 mm Weight 629 g Firmware and power values Firmware compatibility For mGuard v7.4.0 or later: Innominate recommends the use of the latest firmware version and patch releases in each case. For the scope of functions, please refer to the relevant firmware data sheet. Data throughput (router | firewall) Router mode, default firewall rules, bidirectional throughput: max. 99 Mbps Stealth mode, default firewall rules, bidirectional throughput: max. 50 Mbps Virtual Private Network (VPN) IPsec (IETF standard), VPN models up to 10 tunnels, Optionally up to 250 VPN tunnels Hardware-based encryption DES | 3DES | AES-128/192/256 Encrypted VPN throughput (AES-256) Router mode, default firewall rules, bidirectional throughput: max. 35 Mbps Stealth mode, default firewall rules, bidirectional throughput: max. 25 Mbps Management support Web GUI (HTTPS) | command line interface (SSH) | SNMP v1/2/3 | central device management software Diagnostics LEDs (Power, State, Error, Signal, Fault, Info) | log file | remote syslog Other Conformance CE | FCC Special features Realtime clock | Trusted Platform Module (TPM) | temperature sensor | mGuard Remote Services Portal ready

91 5 mGuard pci² SD Table 5-1 Available mGuard pci² SD versions The mGuard pci² SD has the design of a PCI-compatible plug-in board. It is available in two versions: – mGuard pci² SD for devices or machines with PCI bus – mGuard pcie² SD for devices or machines with PCI Express bus To aid understanding, mGuard pci² SD is used for the two device versions in this user man- ual. The mGuard pci² SD is suitable for distributed protection of industrial and panel PCs, indi- vidual machines or industrial robots. It has a configuration memory in the form of a replace- able SD card, which can be easily accessed on the front. Figure 5-1 mGuard pci² SD Available versions Order No. mGuard pci² SD HW-102061 mGuard pcie² SD HW-102071 mGuard pci² SD VPN BD-111040 mGuard pcie² SD VPN BD-111060

I15007_en_02 5.1 Operating elements and LEDs WAN 1 LED SD card slot (configuration memory) Reset button RJ45 socket (LAN 1) for connecting to the internal network RJ45 socket (WAN 1) for connecting to the external network/Internet LAN 1 LED Battery (can be replaced) Extension connection (LEDs, Reset button, SD card) STAT LED LAN 2 LED WAN 1 LED Figure 5-2 Operating elements and LEDs on the mGuard pci² SD Table 5-2 LEDs on the mGuard pci² SD LEDs State Meaning WAN 1 LAN 1 Green On Full duplex Off Half duplex WAN 2 LAN 2 Yellow On 10 Mbps Flash- ing 10 Mbps, data transmission active Green On 100 Mbps Flash- ing 100 Mbps, data transmission active LAN 1 LAN 2 WAN 1 Various LED light codes Recovery procedure/flashing See “Restart, recovery procedure, and flashing the firmware” on page 104. STAT Red/green Flash- ing Boot process. When the device has just been connected to the power supply. After a few seconds, this LED changes to the heartbeat state. Green Flash- ing Heartbeat. The mGuard is connected correctly and ready to operate. Red Flash- ing System error. Restart the device. • Press the Reset button (for 1.5 seconds). • Alternatively, briefly disconnect the device power supply and then connect it again. If the error is still present, start the recovery procedure (see “Performing a recovery proce- dure” on page 105) or contact your dealer.

93 5.2 Startup 5.2.1 Safety notes To ensure correct operation and the safety of the environment and of personnel, the mGuard must be installed, operated, and maintained correctly. General notes regarding usage 5.2.2 Checking the scope of supply Before startup, check the scope of supply to ensure nothing is missing. The scope of supply includes: – mGuard pci² SD – Package slip NOTE: Risk of material damage due to incorrect wiring Only connect the mGuard network ports to LAN installations. Some telecommunications connections also use RJ45 sockets; these must not be connected to the RJ45 sockets of the mGuard. NOTE: Connection notes – A free PCI slot (3.3 V or 5 V) must be available on your PC when using the mGuard pci² SD. – Do not bend connecting cables. Only use the network plug for connection to a net- work. NOTE: Select suitable ambient conditions – Ambient temperature: 0°C ... +60°C (mGuard pci² SD with battery) 0°C ... +70°C (mGuard pci² SD without battery) – Maximum humidity, non-condensing: 5% ... 95% To avoid overheating, do not expose the mGuard to direct sunlight or other heat sources. NOTE: Cleaning Clean the device housing with a soft cloth. Do not use aggressive solvents.

I15007_en_02 5.3 Installation of mGuard pci² SD 5.3.1 Installing the hardware mGuard pci² SD: structure Figure 5-3 mGuard pci² SD structure • Install the mGuard pci² SD in a free PCI or PCI Express slot. Observe the notes in the documentation for your system. WARNING: This is a Class A item of equipment. This equipment can cause radio interfer- ence in residential areas; in this case, the operator may be required to implement appro- priate measures. WARNING: Safe isolation of live circuits is only guaranteed if connected devices fulfill re- quirements specified by VDE 0106-101 (safe isolation). The supply lines must be isolated or laid separately to live circuits. NOTE: Electrostatic discharge Before installation, touch the metal frame of the PC in which the mGuard pci² SD is to be installed, in order to remove electrostatic discharge. The device contains components that can be damaged or destroyed by electrostatic dis- charge. When handling the device, observe the necessary safety precautions against electrostatic discharge (ESD) according to EN 61340-5-1 and IEC 61340-5-1. SD card slot (configuration memory) Reset button RJ45 socket (LAN 1) for connecting to the in- ternal network Use a UTP cable (CAT5). The cable is not supplied as standard. RJ45 socket (WAN 1) for connecting to the external network/Internet. Use a UTP cable (CAT5). The cable is not supplied as standard. Battery (can be replaced) Extension connection (LEDs, Reset button, SD card)

95 5.4 Preparing the configuration 5.4.1 Connection requirements – For local configuration: The computer used for configuration must meet the following requirements: – The computer must be connected to the mGuard LAN connection or to the mGuard via the local network. – For remote configuration: The mGuard must be configured so that remote configura- tion is permitted. – The mGuard must be connected, i.e., the required connections must be working. 5.4.2 Local configuration on startup (EIS) As of firmware version 7.2, initial startup of mGuard products provided in Stealth mode is considerably easier. From this version onwards, the EIS (Easy Initial Setup) procedure en- ables startup to be performed via preset or user-defined management addresses without actually having to connect to an external network. The mGuard is configured using a web browser on the computer used for configuration. According to the default setting, the mGuard can be accessed via the following addresses: The mGuard is preset to the “multiple Clients” stealth configuration. You need to configure a management IP address and default gateway if you want to use VPN connections (see Page 101). Alternatively, you can select a different stealth configuration or use another net- work mode. NOTE: The web browser used must support SSL encryption (i.e., HTTPS). Table 5-3 Preset addresses Default setting Network mode Management IP #1 Management IP #2 mGuard pci² SD Stealth https://1.1.1.1/ https://192.168.1.1/

I15007_en_02 5.5 Configuration in Stealth mode The mGuard pci² SD can be started up in three different ways: – Start up the device in Stealth mode (standard) – Start up the device via temporary management IP address – Start up device via BootP 5.5.1 Start up the device in Stealth mode (standard) Insert the mGuard pci² SD between an existing network connection. To connect to the LAN and WAN interfaces, a suitable UTP cable (CAT5) is required. The cables are not supplied as standard. • Connect the internal network interface (LAN 1) of the mGuard pci² SD to the corre- sponding Ethernet network card of the configuration computer or a valid network con- nection of the internal network. • Connect the external network interface (WAN 1) of the mGuard pci² SD to the external network, e.g., Internet. The STAT status LED lights up green when the supply voltage has been connected prop- erly. The mGuard boots the firmware. The STAT status LED flashes green during this time. The mGuard is ready for operation as soon as the lower Ethernet socket LEDs light up. In addition, the STAT status LED flashes green at heartbeat. The mGuard is configured via a web browser that is executed on the locally connected com- puter. The mGuard is preset and can be accessed via address https://1.1.1.1/ If the lower LEDs in the Ethernet sockets do not light up, this indicates a missing connec- tion to the internal or external network. If no LED lights up, the supply voltage is missing. NOTE: The web browser used must support SSL encryption (i.e., HTTPS).

97 Configuring the mGuard pci² SD • Enter the following address into the browser: https://1.1.1.1/ The connection to the mGuard pci² SD is established. (If not, see Section 5.5.2). A security message indicating a possible invalid/not trusted certificate is displayed. This message results from the use of an mGuard certificate from Innominate that is not yet known to the browser but necessary for encryption of the communication. • Acknowledge this message with “Accept this certificate always/temporarily” (Mozilla Firefox), “Continue loading this website” (Internet Explorer), “Continue anyway” (Google Chrome). • Click “Yes” to acknowledge the security alert. The login window is displayed. Figure 5-4 Login • To log in, enter the preset user name and password (please note these settings are case-sensitive): To configure the device, make the desired or necessary settings on the individual pages of the mGuard web interface. User Name: admin Password: mGuard For security reasons, we recommend you change the default root and administrator pass- words during initial configuration (in the web interface under “Authentication >> Adminis- trative Users”).

I15007_en_02 5.5.2 Starting up the mGuard pci² SD via a temporary manage- ment IP address If the mGuard pci² SD is connected without a functioning external network in initial startup mode, the device cannot be accessed via address https://1.1.1.1/. In this case, the mGuard pci² SD is accessible automatically via management IP address 192.168.1.1/24. This applies to the internal (LAN 1) and the external (WAN 1) network inter- faces. An address conflict with the external network interface is not possible as long as WAN 1 is not connected to a functioning network. This management IP address is normally non-persistent. Starting up the mGuard pci² SD without external network • Connect the internal network interface (LAN 1) of the mGuard pci² SD to the corre- sponding Ethernet network card of the configuration computer or a valid network con- nection of the internal network. • Disconnect the external network interface (WAN 1) of the mGuard pci² SD from the ex- ternal network (WAN). • Switch on the system. The STAT LED lights up green when the supply voltage has been connected properly. The mGuard boots the firmware. The STAT LED flashes green. Adapting the configuration computer In order to access the mGuard pci² for configuration, the configuration computer must be adapted to the management IP address of the mGuard pci² SD. Example of Microsoft Windows XP: • Set the following in the “Internet Protocol (TCP/IP) Properties” of the relevant network interface of the configuration computer: • Enter the address assigned into the browser: https://192.168.1.1/ • Configure the mGuard as described in “Configuring the mGuard pci² SD” on page 97. However, if the external network interface (WAN 1) is connected after booting the mGuard pci² SD, the management IP address remains valid. In this case, an address conflict with an existing address in the external network is possible. IP address: 192.168.1.10 Subnet mask: 255.255.255.0 Default gateway: 192.168.1.2

99 5.5.3 Starting up mGuard pci² SD via BootP In initial startup mode, the mGuard pci² additionally starts a BootP client on the internal net- work interface (LAN 1). The BootP client is compatible with the “IPAssign” BootP servers from Phoenix Contact as well as “DHCPD” under Linux. This software can either be downloaded free of charge at phoenixcontact.net/products or at www.innominate.com under "Downloads > Software". If an non-configured mGuard pci² SD accesses a BootP server after booting, the BootP pro- tocol assigns an IP address, a subnet mask, and optionally a default gateway of the internal network interface to the mGuard pci² SD. These parameters are saved in the device which can then be immediately accessed under these parameters. • Enter the address assigned via BootP in the browser: e.g., https://192.168.1.1/ Configure the mGuard as described in “Configuring the mGuard pci² SD” on page 97. IP address assignment using IPAssign is described in detail in “Assigning the IP address using IPAssign.exe” on page 255.

I15007_en_02 5.5.4 Assigning the IP address via BootP For IP address assignment, the mGuard uses the BootP protocol. The IP address can also be assigned via BootP. On the Internet, numerous BootP servers are available. You can use any of these programs for address assignment. Section 14.1 explains IP address assignment using the free Windows software “IP Assignment Tool” (IPAssign.exe). Notes for BootP During initial startup, the mGuard transmits BootP requests without interruption until it re- ceives a valid IP address. After receiving a valid IP address, the mGuard no longer sends BootP requests. The product can then no longer be accessed via IP address 192.168.1.1. After receiving a BootP reply, the mGuard no longer sends BootP requests, not even after it has been restarted. For the mGuard to send BootP requests again, it must either be set to the default settings or one of the procedures (recovery or flash) must be performed. Requirements The mGuard is connected to a computer using a Microsoft Windows operating system. After assigning an IP address via BootP, the product can no longer be accessed via IP ad- dress 192.168.1.1