VCL-2243 RTU Firewall IEC -104, MODBUS TCP/IP

VCL Products > Cyber Security Suite > RTU Firewall IEC -104, MODBUS

UNMS Supported

3D View Mechanical Drawing (PDF)

VCL-2243: RTU Firewall IEC -104, MODBUS TCP/IP

Get Data Sheet

VCL-2243 is a high-security, high-reliability, ruggedized, failsafe, transparent RTU firewall that is designed to be installed between the RTU and the SCADA server without having to reconfigure any element of the network. The VCL-2243 firewall supports IEC 60870-5-104 (IEC 104) and MODBUS TCP/IP protocol options with extremely advanced features that may be installed to secure and protect RTUs (Remote Terminal Units) in critical infrastructure such as substations, smart grid distribution systems, oil and gas infrastructure, and railway signaling networks from being compromised, attacked, or accessed by hostile elements.

Protocol Supported:

IEC 60870-5-104:
10/100BaseT ETH Port MODBUS TCP/IP:
10/100BaseT ETH Port

Versions and Technology Deployment:

High-Security, High-Reliability, Ruggedized RTU Firewall.
Failsafe—Never itself becomes a point of failure, even in a power-down condition.
Transparent Firewall—No modification required in the existing network.
Does not add any measurable latency. The latency added under full load conditions is less than 1ms.
Installed in substations to protect RTUs from network-side intrusion and hostile access.
MAC-based lock. Allows users to lock to specified MAC addresses of known network devices in the utility network, such as SCADA servers, network management devices, computers, etc. The RTU shall only accept or transmit data to known network devices in the MAC whitelist.
IP address-based lock. Allows lock to user-specified IP address. The RTU shall only accept or transmit data to known network devices in the IP address whitelist.
Port-based lock. Allows transmission only on user-selected ports. Blocks communication and access on all other ports.
Deep Packet Inspection. Allows only SCADA (-104/MODBUS TCP/IP) packets to pass through. Blocks all other packets.
Comprehensive logging of all -104/MODBUS TCP/IP packets. Fingerprints and logs all unauthorized traffic and access attempts.
Timekeeping: Fetches time from NTP Server to maintain millisecond accuracy.

Applications:

Utilities: Electric generation, transmission, and distribution.
May be installed to firewall RTU terminals and server(s) located in Load Dispatch Centres/SCADA management centres and rail traffic control.
Smart Grid Distribution Systems.
Oil & gas production, pipelines.
Railway Signalling Infrastructure: Rail Traffic Control Room(s).
All distributed data networks consisting of a central server and multiple edge locations.

Firewall—Features and Capabilities:

Protocols supported:

IEC 60870-5-104 (IEC 104)
MODBUS TCP/IP

Lock to user-specified MAC addresses.
Lock to user-specified IP address.
Allows transmission of only 104 MODBUS TCP/IP packets.
Port-based lock. Allows transmission only on user-selected ports. Blocks access on all other ports.
Deep Packet Inspection. Allows only SCADA (-104 / MODBUS TCP/IP) packets to pass through. Blocks all other packets.
Per-frame/packet authentication
Firewall

Port (Soft) based
MAC-based
IP address-based
IP domain-based

Whitelist and blacklist options

Whitelist exception allowed and blocks all other traffic by default (system default mode)
Blacklist exception blocked and allows all other traffic.

Seamless scalability
Infrastructure neutral: maybe used with SDH, IP/MPLS, or MPLS-TP networks
Transparent to network and applications
Easy installation and management

Monitoring and Access Control:

Password Strength Monitor
Device Management and Alarm Monitoring
Command Line Interface—Telnet, SSH
SNMPv2 Alarm Monitoring
Alarm condition detection and reporting (traps and SNMP alarm table)
Syslog

Firewall and Security:

Secure Boot
Firewall Security:

Inclusion Policy—Access Control based upon White-List IP addresses, MAC addresses, and IP domain
Exclusion Policy—Access Control Based on Blacklist

Resistance to Denial of Service (DoS) Attack
Encrypted Firmware Updates
Non-volatile access log with the capability to "fingerprint" all successful log-in attempts and keep a log of the IP and MAC addresses of all successful logins.
SNMP trap generation, along with LED and external alarm indication
Password protection with password strength monitor
RADIUS Password Authentication
SSH (Secure Access Control) with encrypted password protection

Interfaces—Terminal:

Total Number of Ethernet Interfaces: 2

One 10/100 RJ45 equipment interface for the local (trusted) RTU side
One 10/100 RJ45 network interface to the WAN (untrusted) network side

Auto MDI/X (straight or crossover Ethernet cable correction)
Management interfaces:

Ethernet, RS-232, RS-485, USB

CE Compliances:

Immunity as per EN 60255-26
Low voltage directive as per EN 60255-27

Other Regulatory Compliances:

RoHS
Meets CE requirements
Complies with FCC Part 68 and EMC FCC Part 15

Application Diagram:

Mechanical Drawing (PDF)

UNMS (Unified Network Management System)

Secure (supports TLS/SSL for encrypting connections between devices)
Permission-based security
Uses Software Defined Perimeter (SDP); the username/password login is replaced with Single-Packet Authorization (SPA) and the receiving device cannot be seen by hackers. This introduces an additional layer of security and is beneficial with or without SSL/TLS.
Guaranteed message delivery (no data loss or duplication of data)