Helmholz REX 100 Quick Start Manual

2 Inhalt 1. Introduction 3 2. Preparing the REX 100 unit 3 3. Access to the myREX24-V2 portal 6 4. Initial router configuration via the myREX24 V2 portal 8 5. Router configuration transfer options 11 6. Connection to the machine network 14 7. Tips and tricks 15 8. Remote maintenance of Ethernet CPUs 18 9. Description of LEDs and buttons 19 10. Restoring the REX 100 router to its default settings 21 11. Load configuration/firmware update from USB stick 21 12. Technical data 22

3 1. Introduction The REX 100 is an industrial router suitable for worldwide remote access to IPv4- enabled devices (PLCs, HMIs, IP cameras, etc.). This Quick Start Guide explains the basic settings in the myREX24 portal and shows how to transfer the configuration made there to the REX 100 unit. 2. Preparing the REX 100 unit 2.1 Safety instructions Assembly, installation and commissioning of the router may only be carried out by qualified personnel. The respective national safety and accident-prevention regula- tions must be complied with. The router was constructed using state-of-the-art tech- nology and the recognized safety-related rules (see declaration of conformity). The router was designed solely for operation in the switch cabinet and at safety extra-low voltage (SELV) in accordance with IEC 60950/EN 60950/VDE 0805 and may only be connected to devices which fulfill the conditions of EN 60950. The router is only intended for use inside buildings, i.e. it is not intended for outdoor use. Electrostatic discharge! Comply with the required precautionary measures when handling components at risk from static electricity (EN 61340-5-1 and IEC 61340-5-1). 2.2 Installation position/Minimum clearances The router was designed to be mounted on DIN rails (as per DIN EN 50 022) and in- tended for installation in switch cabinets. Installation and mounting must take place in accordance with VDE 0100/IEC 364. The router may only be installed in a vertical installation position. Important advance information: Please use the most current version (V3.7R1.0 or higher) of the “shDIALUP” dial-up software for commissioning. You can download it from www.helmholz.de. For a successful and secure connection with the myREX24 V2 portal, the firmware statuses of all REX 100 routers should be checked regularly and, when necessary, be updated to the most current status through the system settings of your myREX24 account. Minimum distances from neighboring modules: 40 mm 20 mm 40 mm 20 mm

4 2.3 Terminals and interfaces Rigid copper wires with a max. diameter of 1.5 mm² can be clamped onto the provided connector plug. Network cables corresponding to at least category 5/5e (CAT-5) should be connected to the RJ-45 sockets. Internal switch functions are active even if the REX 100 router is not connected to the Internet. The PWR LED lights up when the 24-volt supply voltage is applied. The boot process starts following the internal system check, which is indicated by the blinking RDY LED. The REX 100 is ready for operation as soon as the PWR LED and RDY LED light up continuously. (duration: approx. 90 sec.) Connection FE is for the functional ground. Connect this properly to the reference potential. 2.4 Digital inputs IN1 and IN2 The alarm inputs can be activated with potential-free switches, buttons or relay contacts. IN1 can, for example, be used for the VPN establishing of connection with the myREX24 portal. An alarm can be triggered with the IN2. The use of both inputs for the alarm is also possible. The confi guration of the alarms takes place via alarm management in the myREX24 V2 portal.

5 P4 LAN P1 WAN P2 LAN P3 LAN Ext. V DC 18 ... 30 V + FE IN1 IN2 – FCN RST PWR RDY CON USR SN: R00012345 USB P4 LAN P1 LAN P2 LAN P3 LAN Ext. V DC 18 ... 30 V + FE IN1 IN2 – FCN RST PWR RDY CON USR SN: R00012345 ANT USB 0 1 2 3 4 5 6 7 0 1 2 3 4 5 6 7 0 1 2 3 4 5 6 7 0 1 2 3 4 5 6 7 0 1 2 3 4 5 6 7 WLAN Accesspoint Ethernet Ethernet Ethernet 2.5 REX 100 WAN Connect the WAN interface of the REX 100 (P1 WAN) with a patch cable with the higher level (company) network/router. LAN ports P2 to P5 are available for connection to the machine network and for commissioning via PC. 2.6 REX 100 Wi-Fi Connect a Wi-Fi-compatible antenna (2.4 GHz) and ensure that a radio connection to a Wi-Fi network is possible. Antennas are available separately as accessories.

6 3. Access to the myREX24-V2 portal The REX 100 can be fully configured in the shDIALUP dial-up software through the myREX24 V2 portal. This software, as well as other documents with supple- mentary example applications, can be downloaded from the download area of www.helmholz.de at any time and installed under a Windows operating system. You can also administer your projects and the configuration of your REX routers through an HTTPS-secured direct call from your browser. Use the following URL for this purpose: https://v2.myREX24.net. Use the myREX24 V2 portal access data available to you for logging in. The various ways to transfer a configuration you have created to the REX 100 are described below. Establishing a secure VPN to a REX router can then only occur using the shDIALUP remote client software. You can find further information in the manual for the myREX24 V2 portal. 3.1 Logging in to the myREX24 V2 portal server Install the shDIALUP software with administrative rights under a Windows operating system. After opening the program, select the “V2.myREX24.net” server in the top menu bar and then log in to the myREX24 V2 portal with your access data. You should only register at www.myREX24.net if you don’t yet have a myREX24 V2 portal account or have not received user access from a myREX24 account administra- tor. Fill out the required fields there. After your data is checked by our service team (Mon. to Fri., 8 a.m. to 5 p.m. CET), you will receive two separate e-mails with the access data. One e-mail contains the user name, and the second the password. Notes: - Alternatively, the login page can also be accessed at https://v2.myrex24.net. Any current browser can be used for this. - Your login name can be comprised of your user name and company name separated by the @ symbol, for example. Example: admin@helmholz - Following the initial login, you will be prompted to register a new, individual password for your account. - As the account administrator, you can create and administer additional users after logging in to the myREX24 V2 portal if necessary.

7 Simple view Expanded view 3.2 Navigation in the portal Once a user has logged in for the first time, he or she is guided through a tutorial. Navigation, basic settings and switching from the simple view to the extended view are shown. 3.3 Simple and extended views You can choose between the two views in the menu interface of the myREX24 V2 portal. The “simple view” is active the first time you log in. You can switch to the “extended view” at any time without changes being lost or losing their validity. The simple view is mainly used throughout the rest of this Quick Start Guide. The extended view is also presented in some places for purposes of illustration.

8 4. Initial router configuration via the myREX24 V2 portal The following information describes the basic configuration steps required in order to set up a REX router for a VPN connection. A description of the extended functions can be found in the online help or in the manuals/white papers. You can go to the online help in the myREX24 V2 portal using the question mark symbol in the lower left-hand area of the screen ? . When you log in for the first time, the myREX24 portal guides you through a brief tutorial. Please change the password for your myREX24 account following the tutorial. 4.1 Creating a new project A project is the highest level for carrying out the following tasks: - Device administration - Remote maintenance - Monitoring and alarms - Data logging - Visualizations Initially, at least one new project must be created in which a router is assigned. Navigate to the Administration section using the following symbol (the tutorial also brings you to this point). A unique project name is now issued in this menu. Additional account users, if created, can be assigned to this project on the “Access” tab.

9 4.2 Creating a new device A router can be added to the tree structure using the plus symbol + or with a right-click of the mouse. If a project does not yet have a router, the same function is made available in the main view by way of the green button “Create new device”. Clicking the respective button starts the configuration assistant, which guides the user through the settings. 4.3 Configure REX 100 (connection data) Three simple steps are sufficient for minimal configuration of the router. - Selection of the device type - Network settings - Transfer of the configuration to the REX router 4.3.1 Step 1 “Device” – Selection of the type and name In the first step, the correct device type (matching the device order number) must be selected. A unique, freely selectable name should be assigned to this router. Only numbers and letters may be used (0 to 9, A to Z, a to z and no spaces or special characters).

10 4.3.2 Step 2 “Internet” – Network settings In Step 2, the network configuration for the LAN and mobile WAN side of the device is defined. - LAN All REX 100 routers come with the IP address 192.168.0.100/24 as a default. If necessary, modify the IP address and subnet mask according to the specifications from the machine network to be maintained remotely. - WAN The required information for the DHCP or static IP settings is provided by the respective network administrator. DHCP is preset at the factory. - Wi-Fi Enter the Wi-Fi-specific access data (only 700-875-WIF01). The corre- sponding data provides you with the responsible network administrator. Note: If you use DHCP, make sure that the DHCP server does not assign an IP address the WAN interface that is already active on the LAN side. IP addresses from two different subnets must be assigned to each router’s LAN and WAN interfaces. 4.3.3 Step 3 “Configuration” – Coupling/pairing the router with the portal The basic parameters of the minimum configuration of the REX 100 are now stored in the portal account and must now be transferred to the device (see Chapter 5). Note: We recommend the “Download configuration to PC” variant for the initial configuration.

11 5. Router configuration transfer options Newly created or subsequently modified device configurations can be transferred to the REX 100 in a variety of ways. - 1. Download configuration to PC (via USB flash drive) The configuration file is saved on the PC and can subsequently be transferred to the REX 100 using a USB stick (subsequent procedure described in chapter 5.1). - 2. Synchronize (recommended for subsequent modifications) If the router has already been configured and a connection with the portal is established, each subsequent change to the configuration can be carried out via the existing VPN remote connection (further procedure described in Section 5.2). - 3. Transfer configuration to the device (with LAN connection, only possible via shDIALUP) For this configuration option, the REX 100 must be accessible directly in the LAN from the PC. The PC must also be logged in on the Internet via the shDIALUP dial-up client using your myREX24 account at the same time. The transfer via USB stick (point 1) is explained in this Quick Start Guide, and how retroactive changes can be transferred via the function “Synchronization” (Point 2).

12 5.1 Transferring the confi guration using a USB fl ash drive Ensure that the power supply is connected to the REX 100. Download the confi gura- tion fi le provided through the myREX24 portal to the FAT-formatted USB fl ash drive connected to your PC using the download symbol. Note: The myrex24.mbn(x) confi guration fi le must be stored in the root directory of your USB fl ash drive and may not be renamed. Now carry out the steps described on page 21 in chapter 11 “Load confi guration/ fi rmware update from the USB stick”.

13 Synchronization in the simplified view Synchronization in the extended view 5.2 Synchronization As soon as the REX 100 has logged into your account in the portal, you can transfer subsequent changes at any time with “Synchronize”. Where there is an existing myREX24-V2 portal connection, the REX 100 checks cyclically whether there is a new configuration available for its serial number and then loads it automatically. As soon as you have modified and saved one or more parameters, the following symbol appears next to the Online LED: “Device configuration is not up to date”. Click this sym- bol (or the “Synchronize” button), to start the process.

14 The synchronization function is confirmed through the following dialog. In this menu, you can select optional user-defined settings, such as the sending of information/confirmation mails. The REX router now accepts the new settings and restarts automatically. As soon as the boot process has concluded, the REX router logs into the portal again. 6. Connection to the machine network Note: The following steps presume that the REX 100 has already been configured and that you have successfully logged into your account with shDIALUP. A secure VPN connection to the end device cannot be implemented via the browser view (https://v2.myREX24.net). Logged-in REX 100 routers are identified with a green circle in the dashboard. The secure VPN connection between the PC and REX router is not established until the connection button is clicked. Effective immediately, you can view the setup of your REX router and the functional overview of the myREX24 V2 portal very easily online. https://youtu.be/8a1Xnu9lJ4g Video tutorial (3:22 min.)

15 The active connection status to the REX 100 is represented by an animated orange connection button. The number of active connections made using this account is shown with details in the menu bar. Once the VPN connection to the REX 100 has been established, all the IPv4 packets valid for the applicable LAN network on the system side will be forwarded. The parameters (port, VPN IP, LAN IP etc.) used for this connection are also shown with details in the status bar at the bottom. To end a remote access connection, click the orange animated connection button and then confirm disconnection of the remote connection. 7. Tips and tricks 7.1 A connection cannot be established 7.1.1 Checking the device status The device status website of the REX 100 shows the connection status and the active configuration data of the router. To this purpose, the REX 100 must be accessible in the LAN, meaning that the TCP/IP address of a PC must be in the same IP subnet. To this purpose, enter the LAN IP address of the REX 100 into the address bar of a browser. Authenticate yourself with the standard - user: helmholz and the - password: router To view more information on each step of the connection, click on the Info icon in the status fields. Note: If the website of the REX 100 is not accessible, please check the corresponding setting in the myREX24 portal. Make sure that there are no address space conflicts with any other network interfaces (do not assign the same IP address more than once) in order to be able to communicate with the REX 100.

16 7.1.2 VPN port The REX 100 establishes an outbound TCP connection with the address VPN-V2. myrex24.net (5.39.123.21). To be able to establish a secure connection to the myREX24 V2 server with shDIALUP or the REX 100, at least one of the following TCP ports (80, 1194, or 443) must be enabled for the VPN tunnel in the customer firewall. This communication takes place via port 1194 by default, which is also preset. Please clarify all details of the settings in advance with the responsible IT department on site. If necessary, the port in the REX 100 can be changed in the VPN settings. 7.1.3 Diagnostics page In the event of irregularities or interruptions when establishing the connection, the diagnostics page can provide troubleshooting assistance. In the event of an error, Helmholz technical support requires the respective result from the individual and autonomous test functions. 7.1.4 Is a MAC address filter activated in the firewall? It may be necessary to approve the MAC address of the REX 100 in the higher level DSL modem or the firewall. Should it not be possible to establish a connection, please ask the responsible network administrator whether such a MAC address filter has been activated.

17 7.1.5 Is the connection established over a proxy? If a connection is not established on the customer network, the required proxy settings may not have been stored or may be faulty. These settings may be adjusted on the configuration page of the REX 100 in the Internet settings. 7.2 Device configuration: Services – NTP server For the internal system time of the REX 100, this carries out a comparison using a time server on the Internet at regular intervals. Where necessary, you can individually set the preset NTP server entry and the interval. Note: Various functions in the myREX24 portal require a current time setting in the REX 100. 7.3 Device configuration: Services – Mail settings If you would like to use the REX 100 function for the automatic sending of e-mails, port 25 (SMTP) may not be blocked in the firewall of the customer network. You can also use alternative e-mail servers to send e-mails.

18 8. Remote maintenance of Ethernet CPUs Notes: - The LAN ports are suitable for 100 Mbps and full duplex operation and support auto- crossover and auto-negotiation. No special PROFINET functions are supported. - When connecting additional Ethernet participants (PLC/panel) on the REX 100, it must be ensured that the IP addresses of the devices lie within the address range of the LAN interface of the REX 100. Device settings: Services – Firewall – SNAT With a REX 100, the SNAT function is activated as a default. With this setting, par- ticipants for which no gateway*/router has been entered are accessed via the VPN tunnel. For the CPUs and panels of some manufacturers, it can be the case that you need to explicitly enter the gateway* and deactivate the SNAT function in order that a remote connection with the end device is possible. *Gateway: This refers to the configured LAN IP address of the REX 100. To access a PLC or panel via the VPN tunnel, the OpenVPN adapter must be selected in the corresponding engineering tool as the interface. The virtual network connec- tion responsible for this is the TAP Windows2 Adapter V9. The setting to be selected in the PG/PC interface module from the SIMATIC STEP 7¹ software is emphasized in the detail to the right.

19 9. Description of LEDs and buttons 9.1 Function and status LEDs in normal operation PWR Indicator light for the power supply RDY Readiness indicator (this LED must show a solid light after a max. of 110 sec.) CON Off: There is no active Internet or VPN connection Solid light: Internet connection active or possible, but VPN connection inactive Flashing (1.5 Hz): VPN connection is active Rapid flashing (3 Hz): The router is attempting to establish a VPN connection USR Solid light: When loading default settings, firmware files, or device configurations Flashing (1.5 Hz): A portal configuration was recognized on the USB stick (see FCN button) Rapid flashing (3 Hz): A firmware file was recognized on the USB stick (see FCN button) FCN 1. Function key for manually establishing the connection with the portal server 2. If the USR LED starts flashing, this means that you have ten seconds to press this button in order to load data from an inserted USB stick. RST Reset button for restarting the router 9.2 Buttons P4 LAN P1 LAN P2 LAN P3 LAN +F E IN1I N2 – FCN RST PWR RDY CON USR SN: R00012345 ANT USB LED LED color LED status Description WAN & LAN Orange LED on Network connection present Green LED flashing Network data traffic active Note: Use the provided tool to activate the buttons (SIM card ejector).

20 The device is not connected with the portal. The device has logged in at the portal and is thus online. Depending upon the device type, the device is connected with - a machine connected with the device (PLC) - the website of a connected machine - the integrated web server of the device (router) The device configuration is not up to date. This means: - the configuration of a newly created device has not yet been transferred to the device - or the changed configuration of an existing device has not yet been transferred to the device/no synchronization has been carried out. This symbol can be displayed in connection with any of the symbols named above. 9.2 myREX24 V2 portal LEDs Information points for detailed information about the status of the interface