Instruction/ maintenance manual of the product EDR-G902 Moxa
Go to page of 79
EDR- G9 03 /G902 Use r’s Manual Second Edition, Januar y 2011 www.moxa.com/product © 201 1 Moxa Inc . All rights reserved. Reprod uction witho ut perm ission is prohibite d.
EDR- G9 03 /G902 Use r’s Manual The softw are described in this manual is furnished under a license agreement and may be used only in accordance with the terms of that agree ment. Copyri ght Notice Copyrig ht ©201 1 Mo xa I nc . All r ights r eserved.
Table of Content s 1. Int rodu ct ion ...................................................................................................................................... 1-1 Ov erv iew ...............................................................
A. MIB Groups ....................................................................................................................................... A-1.
1 1. Introduction Welcome to the Moxa EtherDevice Router (EDR - G903 /G902), the Gig abit F irewall/VPN secure routers desig ned for connec ting Ethernet - enab led devic es in industrial fie ld applicatio ns.
EDR - G903/G902 Introduc tion 1-2 Overvi ew As the world ’ s network and information techno logy becomes more mature , the trend is to use Etherne t as the major communic ations interf ace in many industrial co mmunications and automation applicati ons.
2 2. Getting Started This chapte r explains how to access the E therDevic e R outer for the first time . There are three ways to access the switch: (1 ) serial console , (2) Telnet console, or (3) web brow ser.
EDR - G903/G902 Getting Started 2-2 RS - 232 Console Configurati on (115200, None, 8, 1, VT100) NOTE Connec tion C autio n! We strong ly suggest that you do NOT use more than one connectio n method at the same time.
EDR - G903/G902 Getting Started 2-3 4. Click the Ter minal tab, and select V T100 for Terminal Type. Click OK to continue. 5. Typ e 1 to select an si/VT1 00 terminal ty pe, and then press Ent er.
EDR - G903/G902 Getting Started 2-4 telnet telnet (IP address) Example : telnet 1 92.168 .127 .10 Open a telnet conne ction telnet (IP address) (port number) Example : telnet 192.168 .127 .10 23 Open a telnet conne ction with por t number ssh ssh (IP ad dress) Example : ssh 19 2.
EDR - G903/G902 Getting Started 2-5 Perfor m the following step s to access the console utility v ia Telnet. 1. Click Star t ( Run, and then telnet to the E therDev ice R outer ’s IP address from the Windows Run window. (You may also iss ue the telnet command from the MS - DOS pro mpt.
EDR - G903/G902 Getting Started 2-6 NOTE By defa ult, the E therDevice R outer ’ s password is not set (i.e., is blank). Y ou may need to wait a few moments for the web page to be downlo aded to your compute r. Use the menu tr ee on the left side of the wind ow to open the function pages to acce ss each of the router ’s functions.
3 3. Features and Functio ns In this cha pter, we explain how to access the E therD evice R o uter ’s c onfigur ation op tions, pe rform mo nitoring, and use adminis tration functions . There are three ways to access thes e functions: (1) RS - 232 consol e, (2) Telnet co nsole, and (3) web browser.
EDR - G903/G902 Featur es and F unctio ns 3-2 The Overv iew page is divid ed into three major par ts: Interf ace Status, Basic f unction status , and Recent 10 Event logs , and gives u ser s a quick overview of the E therDevic e R outer ’ s current s etting s.
EDR - G903/G902 Featur es and F unctio ns 3-3 Click More … at the top of the “ Recent 10 Event Log ” table to open the Eve ntLogT abl e page . Configu ring Basic Settin gs The Basic Settings gro up includes the most commonly used settings require d by administrators to maintain and contro l the E therDevic e R outer .
EDR - G903/G902 Featur es and F unctio ns 3-4 Maintai ner Contac t Info Sett ing Descrip tion Facto ry Defa ult Max. 30 Charac ters Enter the conta ct informatio n of the person responsible for mainta.
EDR - G903/G902 Featur es and F unctio ns 3-5 The follow ing table shows additional c onfig uration example s: Allowable Hosts In put For mat Ay hos t Disabl e 192.1 68.1.120 192.1 68.1.120 / 255. 255. 255.255 192.1 68.1.1 t o 192.16 8.1.25 4 192.1 68.
EDR - G903/G902 Featur es and F unctio ns 3-6 • ATTE NTION ! • By d efault , the Pa ssw ord f ield is blank . If a Password is already set, the n you will be requir ed to type the Passwor d when logging into the RS - 232 conso le, Telnet console , or web browser interf ace.
EDR - G903/G902 Featur es and F unctio ns 3-7 NOTE The E therDe vice R outer has a real time clock so the user does not need to update the Current Time and Current D ate to set the initia l time fo r the E therDevic e R outer after each re b oot .
EDR - G903/G902 Featur es and F unctio ns 3-8 Time S erver I P/Name Sett ing Descrip tion Facto ry Defa ult 1s t Tim e Serv er IP/Name IP or Domain addre ss (e.
EDR - G903/G902 Featur es and F unctio ns 3-9 If the user en able s the SettingCheck functio n with the Accessible IP l ist and the confirmer Timer is set to 15 seconds, then whe n the user cl ick s t.
EDR - G903/G902 Featur es and F unctio ns 3- 10 System File Update — b y Remote TFTP The E therDe vice R outer s upports saving your config uration file to a remote TF TP server or local host to allow other E the rDevic e R outer r o ute r s to use the same config uration at a later time, or sav ing the Log file for future reference.
EDR - G903/G902 Featur es and F unctio ns 3- 11 Log File C lick Ex por t t o export the Log file of th e E therDevic e R oute r to the local hos t. NOTE Some operating syste ms will open the configur ation file and log file directly in the web page. In such cases, right clic k the Expo rt b utton and then s ave as a file.
EDR - G903/G902 Featur es and F unctio ns 3- 12 Networ k Setting s Mode C onfiguration Network M ode E therDevic e R outer pr ovid es Rou ter Mode and Bridge Mo de op eration for differ ent applications : Route r Mode In this mode , E therD evice R outer operates as a gateway between differe nt networks.
EDR - G903/G902 Featur es and F unctio ns 3- 13 WAN1 Configuration Connect ion Note that there are t here are thre e diffe rent connec tion types fo r the WAN1 interface: D ynamic I P, Static I P , and PPPoE. A detaile d explanation o f the configuratio n settings for each type is give n below.
EDR - G903/G902 Featur es and F unctio ns 3- 14 E xample : S uppose a remote user (IP: 1 0.10.10.10 ) wants to connect to the internal se rver (pr ivate IP: 30.30. 30.10) vi a the PPTP protocol. The IP addre ss for the PPTP server is 20.20.20.1. T he necessar y c onfig uration settings are sho w n in the fo llowing fig ure.
EDR - G903/G902 Featur es and F unctio ns 3- 15 Gat eway Sett ing Descrip tion Facto ry Defa ult IP Add res s The Gatewa y IP address None Detaile d Ex pla nation o f PPPoE Type PPPoE Dialup User Na me Sett ing Descrip tion Facto ry Defa ult Max.
EDR - G903/G902 Featur es and F unctio ns 3- 16 Connec tion T ype Sett ing Descrip tion Facto ry Defa ult Static IP, Dynamic IP, PPPoE Conf igure the connectio n type Dynamic I P Detaile d Ex pla nation o f Dyna mic IP Type PPTP Dialup Point - to - Point Tunnel ing Pr otocol is used for Vir tual Private Networ ks (VPN).
EDR - G903/G902 Featur es and F unctio ns 3- 17 DNS (Dom an Name Ser ver; option al set ting for Dynamic IP and PPPoE t y pes) Server 1/ 2/3 Sett ing Descrip tion Facto ry Defa ult IP Add res s The DNS I P Addr ess None NOTE The prior ity of a manual ly c onfigured DNS will higher than the DNS from the PPPo E or DHCP s erver.
EDR - G903/G902 Featur es and F unctio ns 3- 18 Subn et Ma sk Sett ing Descrip tion Facto ry Defa ult IP Add res s The sub net mask None Gat eway Sett ing Descrip tion Facto ry Defa ult IP Add res s The Gatewa y IP address None Detaile d Ex pla nation o f PPPoE Type PPPoE Dialup User Na me Sett ing Descrip tion Facto ry Defa ult Max.
EDR - G903/G902 Featur es and F unctio ns 3- 19 Using DMZ M ode A DMZ ( d emilitarize d z one) is an isolated netw ork for de vices — such as d ata, FTP, w eb , and m ail server s connec ted to a LAN n etwo r k — that need to frequently co nnect with externa l network s .
EDR - G903/G902 Featur es and F unctio ns 3- 20 LAN IP Co nfig urat ion IP Addre ss Sett ing Descrip tion Facto ry Defa ult IP Add res s The LAN interf ace IP address 192.1 68.127.2 54 Subn et Ma sk Sett ing Descrip tion Facto ry Defa ult IP Add res s The sub net mask 255.
EDR - G903/G902 Featur es and F unctio ns 3- 21 Static DHCP List Use the Static DHC P list to ensure that device s connected to the E therDev ice R outer alw ays use the same IP address. The static DHCP list matches I P add re ss es to MAC a ddress es .
EDR - G903/G902 Featur es and F unctio ns 3- 22 DHCP Leas ed List Use the DHCP Leased List to view the current DHCP clients. Dynamic DNS Dynamic DNS ( Do main Name S erv er ) al l o ws you to use a domain name (e .g. , moxa .edr - g903) t o conne ct to the E therDev ice R outer .
EDR - G903/G902 Featur es and F unctio ns 3- 23 Network Redundancy Moxa EtherDev ice Router provide s 2 types of network redundanc y functions : WAN backup (EDR - G903 o nly) and V RRP . The E the rDevic e R outer has two WAN interfaces : WAN 1 is the pr imary WAN interface and WA N2 is the backup interf ace .
EDR - G903/G902 Featur es and F unctio ns 3- 24 Link Ch eck Sett ing Descrip tion Facto ry Defa ult Enable or Disab le Activate Backup function by checking the link status of WAN1 Disabl ed Ping Che c.
EDR - G903/G902 Featur es and F unctio ns 3- 25 Virtual Router R edundancy P rotocol (VRRP ) VRRP Setting s The Virtual Router Redund ancy Protocol (VRR P) feature can solv e the problem with static configur ation . VR RP enables a group of routers to form a single virtual route r w ith a virtual IP addr ess .
EDR - G903/G902 Featur es and F unctio ns 3- 26 Static Ro uting a nd Dynam ic Routin g The E therDe vice R outer s upports two routing methods : static routing and dynamic routing. Dy namic routing makes use of RIP V1/V1c /V2. You can either choose o ne routing method, or combine the two method s to establis h you r routing tab le.
EDR - G903/G902 Featur es and F unctio ns 3- 27 Clickable B uttons Add For add ing an entry to the Static Ro uting Table . Delet e For re mov ing selected entries f rom the Static Ro uting Table. Modify For mo dif y ing the content of a selec ted entry in the Static Routing Ta ble .
EDR - G903/G902 Featur es and F unctio ns 3- 28 Routing T able The Routing Table page show s all r outing entr ies. All Routi n g Entr y List Sett ing Descrip tion Fac tory Defau lt All S how all rout.
EDR - G903/G902 Featur es and F unctio ns 3- 29 Enable/D isable NAT Policy Sett ing Descrip tion Facto ry Defa ult Enable or Disab le Enable or disa ble the selected NA T policy Enabled NAT Mo de Sett.
EDR - G903/G902 Featur es and F unctio ns 3- 30 Enable/D isable NAT policy Sett ing Descrip tion Facto ry Defa ult Enable or Disab le Enable or disa ble the selected NA T policy Enabled NAT Mo de Sett.
EDR - G903/G902 Featur es and F unctio ns 3- 31 1- to - 1 NAT If the internal d evice and external device need to communicate w ith each other, choose 1- to - 1 NAT , which offe rs bi - directio n al communicatio n (N- to - 1 and Port forw arding are b oth single - direction al communica tion NAT func tions ).
EDR - G903/G902 Featur es and F unctio ns 3- 32 Enable/D isable NAT policy Sett ing Descrip tion Facto ry Defa ult Enable or Disab le Enable or disa ble the selected NA T policy None NAT Mo de Sett in.
EDR - G903/G902 Featur es and F unctio ns 3- 33 Fire wall Settin gs Firewall Policy Concept A f irewall dev ice is common ly used to pr ovi de secu r e traffic control o ver an Ethernet n etwo rk , as illustr ated in the f ollowing f igure .
EDR - G903/G902 Featur es and F unctio ns 3- 34 Firewall P olic y Config uration The E therD evice R oute r ’s F irewall polic y prov id es secur e traffic c ontrol , allo wing u ser s to control network traffic based on the fo llowing par ameters .
EDR - G903/G902 Featur es and F unctio ns 3- 35 Destin at ion IP Sett ing Descrip tion Facto ry Defa ult All (I P Addres s) This Firewall Polic y will check all Destination IP addresses in the packet .
EDR - G903/G902 Featur es and F unctio ns 3- 36 Ether Type Sett ing Descrip tion Fac tory Defa ult 0x060 0 to 0x FFFF When Protoc ol is set to “ Manual ” you can set up Ether T ype manually None T.
EDR - G903/G902 Featur es and F unctio ns 3- 37 Quick Automa tion Profile Ethernet Fieldbus prot ocol s are p opular in i ndustrial auto mation applica tion s.
EDR - G903/G902 Featur es and F unctio ns 3- 38 Modbus TC P/IP (UDP) 502 PROFInet RT U nicast (TCP) 34962 PROFInet RT U nicast (UDP) 34962 PROFInet R T Multicast (TCP) 34963 PROFInet RT Multic ast (UD.
EDR - G903/G902 Featur es and F unctio ns 3- 39 Mask : Po licy [ X ] is m asked by P olicy [Y ] The Source/De stination I P r ang e or Source/Destinati on port number of policy [X] is smaller or e qual to policy [Y ] but the actio n target (Accep t/Drop) is d ifferent .
EDR - G903/G902 Featur es and F unctio ns 3- 40 Suppos e the user ne xt ad d s a new policy with the f ollowing c onfig uration : In d ex In put Outp ut Protocol Source IP Destin at ion IP T ar get 3 WAN2 LAN All 20.20. 20.25 192.1 68.127.2 0 to 192 .
EDR - G903/G902 Featur es and F unctio ns 3- 41 SYN/R ST Scan Sett ing Descrip tion Facto ry Defa ult Enable or Disab le Enable or disa ble the SYN/RST Scan No ne ICMP - D eath Sett ing Descrip tion F.
EDR - G903/G902 Featur es and F unctio ns 3- 42 IPSec C onfiguration IP Sec configuratio n includes 5 parts: • Global Setting: Enable / Disable all I PSec Tunnels and N AT - Traver sal functio n •.
EDR - G903/G902 Featur es and F unctio ns 3- 43 Tunnel Setting Enable or Di sable VPN T unnel Sett ing Descrip tion Fac tory Defa ult Enable or Disab le Enable or Disa ble this VPN Tunnel Disable Name o f VP N Tunne l Sett ing Descrip tion Fac tory Defa ult Max.
EDR - G903/G902 Featur es and F unctio ns 3- 44 Local Ne twork / Ne tmask / ID Setting Descrip tion Fac tory Defa ult IP Add res s IP address of loc al VPN network IP addres s of LAN interf ace S ubnet Mask Subnet Mask of lo cal VPN network Netmask of LAN interf ace ID ID for indentify ing the VPN tunnel conne ction.
EDR - G903/G902 Featur es and F unctio ns 3- 45 In X .50 9 Mod e , the use r needs to up load the Local and Remote certif ications first , and then sele ct the certif ications fro m the drop - down li st . S ee the X.509 C ertifica tion sectio n in this chapter for details.
EDR - G903/G902 Featur es and F unctio ns 3- 46 Data Exchange (IPSec phase II) Perfect Fo rward Secrecy Sett ing Descrip tion Fac tory Defa ult Enable or Disab le Us es different secur ity key for dif.
EDR - G903/G902 Featur es and F unctio ns 3- 47 IPSec Status The user can check the VPN tunnel status in the I PSec Conn ection L ist . This list sho ws the Name of the IPSec tunnel, IP address of Local and Remote Subnet/Gatew ay , and the establis h ed status of the Key exchang e phase and Data exchange phase.
EDR - G903/G902 Featur es and F unctio ns 3- 48 Certificat e Generat ion The user must fill in the fo llowing inform ation to generate the Root c ertificatio n: • Countr y name (2 Letter code) • C.
EDR - G903/G902 Featur es and F unctio ns 3- 49 Local Cert ificat e Uploa d Upload the .p12 loc al certific ate on this pa ge. The Password must be the sam e as the .p12 cer tificate file. If the password is not correct, the certific ate import proce ss will fail.
EDR - G903/G902 Featur es and F unctio ns 3- 50 L2TP Configurat ion L2TP S erver Mod e Sett ing Descrip tion Fac tory Defaul t Enable / Disabl e Enable or Disab le the L2TP functio n on the WAN1 or WAN 2 interf ace Disabl e Local IP Sett ing Descrip tion Fac tory Defau lt IP Add res s The IP ad dress of the Lo c al S ubn et 0.
EDR - G903/G902 Featur es and F unctio ns 3- 51 Examples for T ypical VPN App lications Site to Sit e IPSec VPN t unnel with P er - shar ed Key The follo wing example show s how to create a secure LAN to LAN VPN tunnel between the C entral site and Remote si te via an Intr anet network .
EDR - G903/G902 Featur es and F unctio ns 3- 52 L2TP for Remo te User Ma intenance The follow ing example show s how a Roaming user use s L2TP over IPSec to connec t to theremote site networ k. VPN Plan: • A ll communicatio n from the Roaming us er ( n o f ixed IP) to the Remote site Network (100 .
EDR - G903/G902 Featur es and F unctio ns 3- 53 How Traffic Prioritization W orks The E therDe vice R outer provides fo ur diff erent prior ities levels ( 0- 3 , h igh to l ow) for incoming and outgoing traff ic.
EDR - G903/G902 Featur es and F unctio ns 3- 54 Max . Ban dwid th Sett ing Descrip tion Facto ry Defa ult 1 to 1,0 00,000 KBytes/s The maximum b andwidth f or total inco ming or outgo ing traffic 100 .
EDR - G903/G902 Featur es and F unctio ns 3- 55 Priority Sett ing Descrip tion Facto ry Defa ult Prior ity 0/1/2/3 Sel ect the prior ity for this policy Prior ity 0 Source IP Sett ing Descrip tion Fac.
EDR - G903/G902 Featur es and F unctio ns 3- 56 The E therDe vice R outer will manag e the bandwi dth for outgoing packet s . Base d o n the fou r o utgo ing po licies below , when the source IP of th.
EDR - G903/G902 Featur es and F unctio ns 3- 57 SNMP Re ad Settings SN MP Versi ons Sett ing Descrip tion Facto ry Defa ult Disabl e V1, V2c , V3, or V1, V 2c, or V3 only Select the SN MP protocol version use d to manage the secu re router .
EDR - G903/G902 Featur es and F unctio ns 3- 58 Access Co ntrol Sett ing Descrip tion Facto ry Defa ult Read only (Pub lic MIB only) A ccess contro l type after match ing the community string Re ad only No Access Target IP Address Sett ing Descrip tion Facto ry Defa ult IP Add res s Enter the IP addre ss of the Trap Server used by your network.
EDR - G903/G902 Featur es and F unctio ns 3- 59 1. Co nfig ure Em ail Ev ent Ty pes Select the desir ed Event types fro m the Web B ro wse r Event t ype pa ge (a descrip tion of each event type is given later in the Email Alarm Events se tting subsecti on).
EDR - G903/G902 Featur es and F unctio ns 3- 60 E- mail Setup Main S erver I P/Name Sett ing Descrip tion Facto ry Defa ult IP add re ss The I P Address of your email server. None Port Sett ing Descrip tion Facto ry Defa ult Port number The por t number of your email server.
EDR - G903/G902 Featur es and F unctio ns 3- 61 Configur ing R elay Warning The Auto Relay Warning functio n uses relay output to alert the user when certain user - configured events take place. Ther e are two basic steps requir ed to set up the Relay Warni ng f unction: 1.
EDR - G903/G902 Featur es and F unctio ns 3- 62 Using Diagnosis The E therDe vice R outer provides P ing tools a nd LLD P for adminis trator s to diagnose network sys tems. Ping The Ping functio n uses the ping comma nd to gi ve users a simple but powerful tool for troubles hooting network proble ms.
EDR - G903/G902 Featur es and F unctio ns 3- 63 Neighbor Por t D escrip t ion: A tex tual descrip tion of the neighbor device ’ s inter face. Neighbor Sy s tem: Hostname of the neighbor dev ice. Using Monitor You can monito r statistics in real time from the E therDevice R outer ’ s web conso le.
EDR - G903/G902 Featur es and F unctio ns 3- 64 Using Syst em Log The E th erDevice R outer provi des Event L og and Sys l og functions to record impor tant events . Using Ev ent Log Field Desc riptio n Bootup This field shows how many times the ED R- G509 has been rebooted or cold started.
EDR - G903/G902 Featur es and F unctio ns 3- 65 DI trans ition (On - > O ff) Cold star t Factory def ault Warm start System restart Warm start Firm ware U pgrade War m start Conf iguration Upgrade Warm start NOTE The m aximum numb er of e vent e ntr ies is 1000.
EDR - G903/G902 Featur es and F unctio ns 3- 66 2. A w arning mess age will appe ar to warn the user that the security c ertificate was issued by a company they have no t chosen to t rust. 3. Select Yes to enter the E therDev ice R outer ’ s web br owser i nterface and acc ess the web browse r interf ace secured via HTTPS/SS L.
A A. MIB Groups The E therD evice R outer come s with built - in SNMP (Simple Network Management Protoco l) agent software that suppor ts cold start trap, line up/d own trap, and RFC 1213 MIB - II. The standard MIB groups that the E therDevic e R outer series suppo rt are: MIB I I.
An important point after buying a device Moxa EDR-G902 (or even before the purchase) is to read its user manual. We should do this for several simple reasons:
If you have not bought Moxa EDR-G902 yet, this is a good time to familiarize yourself with the basic data on the product. First of all view first pages of the manual, you can find above. You should find there the most important technical data Moxa EDR-G902 - thus you can check whether the hardware meets your expectations. When delving into next pages of the user manual, Moxa EDR-G902 you will learn all the available features of the product, as well as information on its operation. The information that you get Moxa EDR-G902 will certainly help you make a decision on the purchase.
If you already are a holder of Moxa EDR-G902, but have not read the manual yet, you should do it for the reasons described above. You will learn then if you properly used the available features, and whether you have not made any mistakes, which can shorten the lifetime Moxa EDR-G902.
However, one of the most important roles played by the user manual is to help in solving problems with Moxa EDR-G902. Almost always you will find there Troubleshooting, which are the most frequently occurring failures and malfunctions of the device Moxa EDR-G902 along with tips on how to solve them. Even if you fail to solve the problem, the manual will show you a further procedure – contact to the customer service center or the nearest service center
