The device mus t be installed only by qualified personnel according to the following installation and operating instructions.
·
The manufac turer does not acc ept responsibilit y in cas e of improper use of the devic e
and particularly any us e of equipment that m ay cause personal injury or material damage.
·
The device c ontains no user-maintenable parts. A ll maint enance has to be performed
by factory trained servic e personnel.
·
This devi c e contains potentially hazardous volt ages and should not be opened or disassembled.
·
The device c an be connected only to 230V AC (50 Hz or 60 Hz) power supply s oc kets.
·
The power cords, plugs and sock et s have to be in good condition. Always connect the
device t o properly grounded power sock et s .
·
The device is intended for indoor use only. Do NOT install t hem in an area where excessive moisture or heat is present.
·
Because of safety and approval issues it i s not allowed to modify the device without
our permiss ion.
·
The device is NOT a toy . It has to be used or st ored out or range of children.
·
Care about packaging material. Plasti c s has t o be st ored out of range of children.
Please recycle the packaging materials.
·
In case of further questions, about inst allat ion, operation or usage of the device, which
are not c lear after reading the manual, please do not hesitate to ask our support team.
·
Please, never leave connected equipment unattended, that can cause damage.
·
Connect only elect rical devic es t hat do not have limited on-time. I.e. i n c as e of failure,
all connected appliances have to cope with a continuous on-time without causing
damage.
1.2Content of Delivery
The package includes:
·
Expe rt Power Control 8221-1/8226-1
·
2 x Power Supply cable (IEC C19, max. 16 A)
·
CD-ROM with Manual and Softwaretools
1.3Description
The Expe rt Power Control 8221-1/8226-1 can switch 12 different load outputs (IEC
C13, max. 10A), which each 6 outputs are fed from a mains connection (IEC C20, max.
16A) . The device has t he following features:
Energy Metering of the two mains connections and measurement of volt age, c urrent,
active power, reactive power, apparent power, frequency, phase angle, power fact or.
·
Continuously and resettable energy m eters on the mains c onnecti ons.
·
Energy Metering and meters for each port of the 12 load outputs and measurement of
voltage, c urrent, act i ve power, reactive power, apparent power, frequency , phase
angle, power factor per output (8226-1 only).
·
Connecting of two optional ext ernal sensors to determine the temperature and humidity , or a input switc h.
·
Two four-digit 7-segment LED displays (for display of current or temperature / humidity
of the ext ernal sensors).
·
Separated over-voltage protection of the two mains connections (Overvolt age Protection).
·
Startup delay, individually parametrizable for all load outputs.
·
Indivi dually adjust able watchdog function that s wit c hes power ports in dependency of
the acces sibility of a device (network ping).
·
Dual TCP/IP S t ac k with IPv4 and IPv6 support.
·
Control and monitoring of the device vi a Ethernet with an integrated web server and
SNMP (v1, v2c and v3).
·
Console Commands with telnet s upport and serial interface.
·
Generation of messages (E-Mail, Syslog and SNMP traps) and relay switching depending on the energy measurement limits, resp. ex t ernal sensors.
·
Secure E-Mails.
1.4Installation
1. 6 plain text dis plays (on/off) for the state of the outputs (Bank A or B)
2. Current power consumption of the Bank
3. LED indicator whether the Bank is c onnected to m ains supply
4. LED indicator for Over Voltage Protect ion (green - surge protecti on is ac t i ve, red - inactive)
Connect the two power cords (IEC C19, max. 16A) to t he mains s upply. The cable
connectors are secured as regards their ty pe against unintentional loosening. They
must be inserted up to the st op, otherwise there is no secure connection. The plug
must not wobble in the socket , or there is no tight c onnection.
·
Plug the network cable into the Ethernet sock et (RJ45).
·
If required, s et up a serial connection to t he RS232 port.
·
Insert t he optional external sensors into t he sens or connectors.
·
Connect the consumers with the load outputs (IEC C13, max. 10A).
1.5Dual-Circuit Characteristics
The Expert Power Control 8221-1/8226-1 has two different input circ uit s (Banks A and
B). Therefore the mains supply A ( IEC C20, max . 16 A ) feeds the current t o t he load
outputs A1 t o A 6 (IEC C13, max. 10 A), resp. mains supply B feeds the current t o t he
load outputs B 1 t o B 6 (IEC C13, max . 10 A ) . The elect ronics of the device works when
one of t he t wo input circuit s is supplied .
Two ports of different Banks but with t he same number can be combined to a "twin port".
Then one port always participates i n t he swit c hing status of the other port. In the sc reenshot t he ports A1 and B1 are combined, symboliz ed by the chain link ic on. The "Connect t win port" option can be found in the chapter "Configuration - Power Ports" .
Currentless Bank
If a bank is not receiving enough power smaller 70 V), a red "L" appears in the front
panel display , while a operating power supply s hows a green " L". Upon entry of the current loss all relays are switc hed off by t he elect ronics , but t he "On" and "Off" LEDs still
show the state of the relays when the supply was active. This is s ymbolized by t he
flashing of the LEDs.
1.6Overvoltage Protection
The device c ontains an overvoltage protect i on at each of the banks. The protection is
based on input s ide varistors with thermal fuse between phase (L) and neutral (N) to protect the internal elect ronics and power ports with failure detection (permanently triggered
thermal fuse). The state of the protecti on is indic ated on the front panel by a green or red
flash. A green fl as h means t hat t he protection is ac tive, a red flash symboliz es that the
overvoltage protection fails. In addition, the status of the overvoltage protection can be
seen on the Webpage (HTTP) and acquired with SNMP. Eac h surge protection module
is designed that it can derive a pract ical unlimited number of voltage pulses in normal installat ion environments. In an environment with many energy rich surge pulses it can
result in permanent loss of function due to aging of the overvoltage protection element.
Recovering of t he overvolt age protection function can only be performed by the manufacturer of the device. In the normal cas e, t he device will continue to work even after the
failure of the protective funct i on.
A s ignaling via E -Mail, S yslog or SNMP trap occ urs only once during operation, exactly at t he moment in which the protection fails. In addition, at the st art up of the device
a message is generated, when the overvoltage protection is not ac t ive.
Temp: -20 to +80°C, ±0,5°C (maximum) and ±0,3°C (typical)
Humidi t y: 0-100%, ±3% (maximum) and ±2% (typical)
The sensors are automatically detec t ed after connect . This is indic ated by t he green
LED on the sensor port that is lit permanently. Th e sen sor v al u es are displayed at the
The current s tatus of the output is indic ated by t he c olor of the LED. Red indicates that
the output is off, green shows that the output is on. On t he devic e are the buttons "select" and "ok" . If you press " select" , the LED will blink for the first output, i e the output is
select ed. P ress "select" again to select the next output. Hold down the button "ok" for
two seconds, t hen the st at us of the select ed output is t oggled.
Display Informat i on
If no port is selected manually, repeatedly pressing the "ok" button will show the IP-address and the values of the external sensors on the display.
Status-LED
The Status LE D shows t he different states of the device:
·
red: The device is not connected to the Ethernet.
·
orange: The device is connected to t he Et hernet and waits for data from the DHCP
server.
·
green: The devic e is connected to t he Et hernet and the TCP/ IP s ettings are allocated.
·
periodic blink ing: The devi ce is in B ootloader mode.
2.2Control Pane l
Access the web interface: http:// " IP-address " and log-in.
The web page provides an overview of the switching st at e, energy measurement values of
the banks "A " and "B", as well as the external sensors, provided that they are connected. When a single port is clicked at the Expe rt Po wer Control 8221-1/8226-1, a panel
with buttons to control a single port appear:
The Port icon is green when the relay is c los ed, or red in the open st ate. If a bank has
no voltage, the state is represented by a gray P ort icon. An additional small clock i c on
indicates that a timer is active. Timer can be activated by delay, reset or batch mode.
Two outputs configured as twin ports are connected by a chain icon.
An acti vated Wat chdog is represented by an eye icon. A n " X" means, that the address
that s hould be observed, could not be resolved. Two circular arrows show a booting
status.
In add ition to the panel, the Expert Power Control 8226-1 shows the measured values
of the selected port:
The ports c an be switched manually wit h the "On" and "Off" buttons. If the port is t urned
on, it c an be turned off by pressing the "Reset " butt on, unti l after a delay it turns it self on
again. T he delay time is determined by the parameter Reset Duration, which is desc ribed in the chapter "Configuration - Power Ports". The "Close" button diss olves
the panel again.
23
Batchmode
Each indivi dual port can be set for a selectable period of tim e t o t he st at e " switch on" or
"swit ch off" . A fter the select ed ti me t hey are automatically switched to t he sec ond
preselected stat e.
Optionally the devic e c an be switched via a Perl sc ript or ext ernal tools like wget. More
info rmation is available on our support wiki at www.gude.info/wiki.
2.3Maintenance
The actual devic e generation with IPv6 and SSL allows all maintenance functions in the
web interface to be carried out on the Maintenance Page.
Maintenance in the web interface
The following functions are available from the maintenance web page:
18
·
Firmware Update
·
Change the SSL certificate
·
Load and save the c onfiguration
·
Restart the devic e
·
Factory Reset
·
Jump into the Bootloader
·
Delete the DNS cac he
Upload Firmware, Certificate or Configuration
On the Maintenance Page, s elec t t he required file with " B rowse .." in the sec t i ons
"Firmware Update", "S SL Certificate Upload" or "Config Import File Upload" and press
"Upload". The file is now transferred to the update area of the devic e and the contents
are checked. Only now, pressing the "A pply " button will permanently update the data, or
abort with " Cancel".
Only one upload funct ion c an be initiated with a reboot, eg. you cannot transmit firm-
ware and configuration at t he s ame ti me.
If after a firmware update, the web page is not displayed c orrectly any more, this may
be related to the interacti on of Javascript with an outdated browser cache. If a Ctrl-F5
does not help, it is recomm ended that you manually delete the cache in the browser options. A l t ernatively , you c an tes t start t he browser in "privat e mode".
18
Acti ons i n Bootloader mode
If t he web interfac e of the device is no longer acces sible, the device can be put into
Bootloader mode (see chapter Bootloader activat ion). The following functions can be
executed using the GBL_Conf.exe application:
Jump into the bootloader (can be switc hed on and off)
·
Restart the devic e
For devices with relays , entering or exiting the bootloader mode does not c hange
the st ate of the relays as long as t he operating voltage is maintained.
The GBL_Conf.exe program is available free of charge on our website www.gude.info and
can also be found on the enclos ed CD-ROM.
To check the network settings with GBL_Conf.exe, start the program and choose "AllDevices" in the "Search" menu. From the list s elec t the appropriate device. The lower
part of the left half of the window now shows the current network s ettings of the device. If
the IP address i s dis play ed with the default s et t ings (192.168.0.2), either no DHCP
server is present on the network, or there could be no free IP address ass i gned to it.
·
Activate the Bootloader Mode (see Chapter Bootloader Mode) and choose in menu
"Search" t he it em " B ootloader-Mode Devices only"
·
Enter the desired settings in the edit window and save them with "Save Config".
·
Deactivat e the boot loader mode for the changes to take effect. Select again "All
Devices" in the "Search" menu of GBL_Conf .exe.
The new network configuration is now displayed.
Factory Reset
The device can be reset to the factory default via t he web interface from the Maintenance
1820
Page or fr om the Bootloader mode (see chapter Bootloader activat ion). A ll TCP/IP
sett ings are reset in this operation.
If a unit is s et to factory defaults, an uploaded certificat e or updated firmware will be
preserved.
This section provides access to important functi ons such as Fi rmware Update or Restart
Device. It is advis able to s et an HTTP password for this reason.
Firmware Update: S tart a firmware update.
SSL Certificate Upload: S aves y our own SS L c ertificate. S ee c hapter "SSL" for the
generation of a certificate in t he right format.
Config Import File Upload: Loads a new confi guration from a text file. To apply t he new
configuration, a "Restart Device" must be executed after the "Upload".
Config Fil e Export: Saves the c urrent configuration in a text file.
Saving the configuration should only be c arried out in an SS L c onnection, since it
contains sensitive password information (even if it is encrypted or hashed).
Restart Device: Rest arts the device without changing the status of the relays.
Some functions s uch as a firmware update or changing of the IP-address and HTTP
sett ings require a restart of the device. A j ump to t he boot loader or a restart of the
device lead by no means to a change of the relay st at es .
Restore Fab Settings and Restart Device: Performs a restart and resets t he devic e t o
factory default.
Enter Bootloader Mode: Jumps into bootloader mode, where additional settings can be
made with GBL_Conf.exe.
Flush DNS Cache: All entries in t he DNS cache are discarded and address resolutions
are requested again.
2.3.2
Configu ratio n Management
The device configuration can be saved and restored in the maintenance area.
The "Confi g File E xport" function can be used to save t he current configuration as a text
file. The syntax us ed in the configuration file corresponds to t he comm ands of the Telnet
console. If the configuration of a devi c e is to be restored from a text file, load the file with
"Upload" and restart the device with "Restart Device".
Saving the configuration should only be c arried out in an SS L c onnection, since it
contains sensitive password information (even if it is encrypted or hashed). For the same
reasons, it i s advi s able to c arefully handle the generated configuration files when archiving.
18
Editing the configurati on fi le
It is poss i ble to c us tomize a s aved configuration file with a text edit or for your own
needs. For example, one sc enario would be to use a script language to automate t he
creation of many c us t omi z ed versions of a configuration, then equip a large number of
devices wit h an individualized configuration. A lso Upload and rest art with CGI commands
can be done in sc ripting languages. Wit h use of the comment s i gn "#" y ou c an quick ly
hide single commands or add personal notes .
If you modify a c onfiguration file manually, it is not always c l ear which limits are allowed
for parameters. A fter uploading and restarting, commands with invalid parameters are ignored. Therefore, the generated configuration includes comments describing the boundaries of the parameters. Where "range:" refers to a numeric value, and "len:" t o a t ex t
parameter. E. g:
email a u th set 0 #rang e: 0..2
email u s er set "" #len : 0..10 0
The command "syst em fabsetti ngs" from the beginning of a generated configuration file
brings the device into t he factory state, and then executes the individual commands that
modify the configuration state. It may be desirable to make the changes relative t o t he
current configuration, and not out of the fact ory state. Then the "s yst em fabsettings"
should be removed.
The configuration files can in principle also be transferred in a Telnet session, but then
the sett i ngs are changed during operation, and not c ompletely when restarting, as it
would have been the case with an upload. It can happen that events are triggered at the
same tim e as t he devic e is configured. One should therefore:
a) dis able the function
b) c ompletely parametrize
c) reactivate the funct i on
An example:
email e n abled s et 0
email s e nder se t "" #len: 0.. 100
email r e cipien t s e t "" #len: 0.. 100
email s e rver se t "" #len: 0.. 100
email p o rt set 25
email s e curity set 0 #range: 0..2
email a u th set 0 #rang e: 0..2
email u s er set "" #len : 0..10 0
email p a sswd ha sh set "" #len : 0..10 0
email e n abled s et 1 #range: 0 ..1
2.3.3
Bootload er A c t ivation
The configuration of the device from the application "GBL_Conf. ex e" is only poss i ble, if
the device is in Bootloader Mode.
Acti vat i on of t he Bootloader Mode
1) via push button:
·
Hold both buttons for 3 seconds
2) or
·
Remove the power supply
·
Hold down the "Select" button. If the push button is recessed, use a pin or paper clip
·
Connect the operating voltage
3) by Software: (only if "Enable FW t o B L" was previously acti vated in the
"GBL_Conf.exe" applicati on)
·
Start t he "GB L_Conf.exe" program
·
Do a network search with the "Search" menu acti on
·
Activ a te in menu "Program Device" the item "Enter Bootloader"
4) via web interface:
Press "Enter Bootloader Mode" on the maintenance web page.
Whether the device is in Bootloader mode, is indicated by t he flashing of the st atus
LED, or it is shown in "GB L_Conf.exe" applicati on after a renewed device s earch (ap-
pendix " B OOT-LDR" after the devic e name). In Bootloader mode the program
"GBL_Conf.exe" c an disable the pass word and the IP ACL, perform a firmware update,
and rest ore the fact ory s et t i ngs.
For devices wit h relays, entering or exiti ng the bootloader mode does not change the
stat e of the relays as long as t he operating voltage is maintained.
Abandonment of the Bootl oader Mode
1) via push button:
·
Hold both buttons for 3 seconds (only if the device has 2 buttons)
2) or
·
Remove and connect t he power supply without operating a butt on
3) by Software:
·
Start t he "GB L_Conf.exe" applicat ion
·
Do a network sear ch with the "Search" m enu action
·
In menu "Program Devic e" activa te the item "E nter Firmware"
Factory Reset
If t he device is in bootloader mode, it can always be put back t o it s factory default. A ll
TCP/IP set t i ngs are reset in this operation.
If a unit is s et to factory defaults, an uploaded certificat e or updated firmware will be
preserved.
1) via push button:
·
Activat e t he Bootloader Mode of the devi ce
·
Hold down the button (or the "Select" button for devices with 2 buttons) for 6 seconds.
If t he push button is reces s ed, us e a pin or paper clip
·
The stat us LED will blink in a fast rhyt hm, please wait until the LED blinks s lowly
(about 5 sec onds)
2) by Software:
·
Activat e t he Bootloader Mode of the devi ce
·
"St art t he GBL_Conf.exe" program
·
In menu " P rogram Device" ac t ivate the item "Reset to Fab Set t ings"
·
The stat us LED will blink in a fast rhyt hm, please wait until the LED blinks s lowly
(about 5 sec onds)
After switching on the device is scanning on the Ethernet for a DHCP server and requests an unused IP address. Check t he IP address that has been assigned and adjust
if necessary, that the same IP address is us ed at each restart. To turn off DHCP use t he
software GBL_Conf.exe or use the configuration via the web interfac e.
To check the network settings with GBL_Conf.exe, start the program and choose "AllDevices" in the "Search" menu. From the list s elec t the appropriate device. The lower
part of the left half of the window now shows the current network s ettings of the device. If
the IP address i s dis play ed with the default s et t ings (192.168.0.2), either no DHCP
server is present on the network, or there could be no free IP address ass i gned to it.
3.1Power Ports
Choose Power Port to configure: This field is us ed to s elec t t he power ports to be configured.
Label: Y ou c an ass i gn a name up to 15 characters for each of the power ports. Using
the name, an identificati on of the the device connected to t he port can be facil it at ed.
Connect twinport: This option combines t wo relays of the same number of Bank A and
Bank B. E. g. A2 and B2. By t his c onnecti on a port always adopts the status of the connected port, so t hat both ports always have t he s ame s witching state.
It is important, that if necessary t he condition of the power ports c an be restored after a
power failure. Therefo re each port can be configured with Initialization st at us t o a s peci fic
start-up state. This s tart-up sequence can be carried out delayed by the parameter Initializ ati on Delay. There is in any case a minimum one-second delay between switc hing
of ports.
Initialization st at us (colds t art): This is t he port st at e (on, off, remember last state) the
port should be set when the device is turned on. The sett i ng "remember last state" s aves
the last manually set state of the power port in the EEP ROM.
Initialization st at us (bank repower): Had a bank not enough voltage, and is now adequately supplied again, the option "apply initialization st at us " l eads t o a repetition of
the st art-up sequence for this bank. Is " remain in current state" selected, t he port st at e
that is shown on display and web page is implemented.
Initialization delay: Here can be confi gured how long the port should wait to swit ch to its
defined state after the device is t urned on. The delay may las t up to 8191 seconds. This
corresponds t o a period of approx. t wo hours and 20 minutes. A value of zero means
that the initi aliz at ion is off.
3.1.1
Repower delay: When this feature is enabled (value greater than 0), the power port will
switc h itself on again a specified time after it has been disabled. Unlike the "Reset" button this function applies to all s witch actions, including SNMP, or an optional serial interface.
Reset Duration: When the "Reset" butt on is t riggered, the device turns the power port
off, waits for the tim e entered here (in seconds) and turns t he power port on.
Ignore Powerloss on Bank x: The power ports of bank x are not automatically s wit c hed
off when a voltage failure is detect ed, they keep their actual state.
This can lead to an increased total current c onsumpti on when the voltage is comi ng
back, since the act i vated connected devic es are simult aneously turned on again.
Activat ion of this option makes sense, if the input volt age of the device deviates strongly
from the si nusoidal shape. The internal signal evaluation might then erroneously ass ume
a voltage drop, because the zero-cross i ng characterist i c t ypical for sinusoidal voltage
curves is absent. One possible s ource of such non-sinusoidal voltage supply may be a
simple UPS t hat produces rectangular output voltages.
Watchdog
The watchdog feature enables t o m onitor various remote devic es. Therefore either ICMP
pings or TCP pings are sent t o t he devic e t o be monitored. If t hese pings are not
answered within a certain time (both the time and the number of attempt s can be set),
the port is reset. This allows e.g. t o automatically rest art not responding server or NAS
systems. The mode IP mas t er-slave port allows you to switc h a port depending on the
availability of a remote device.
When a watchdog is acti vated it presents various information in the Control Panel. The
information is c olor-coded.
·
Green text : The watchdog is act ive and regularly receives ping replies.
·
Orange text : The watc hdog is c urrently enabled, and waits for the first P i ng response.
Red text: The watc hdog is act i ve and receives no ping replies anym ore from the configured IP address.
After the watc hdog has been enabled, the display remains orange until the watchdog receives a ping response for the first time. Only t hen the watchdog is act i vated. Even after
triggering a watchdog and a subsequent power port reset, t he display will remain orange
until the devic e is rebooted and responds again to ping requests. This will prevent a premature watchdog reset of the port, e.g. when a s erver needs a long time for a file check.
You can monitor devices on your own network, as well as devi c es on an external network, e.g. t he operating status of a router.
Enable watc hdog: Enables the watchdog funct ion for this Power Port.
Watchdog type: Here you can choose between the monitoring by ICMP pings or TCP
pings.
·
ICMP P i ngs: The class ic ping (ICMP echo request ). It c an be used to check the accessibility of network devic es (for example, a server).
·
TCP Pings: With TCP pings, you can c heck if a TCP port on the target device would
accept a TCP connect. Therefore a non-blocked TCP port should be selected. A good
choice would be port 80 for http or port 25 for SMTP.
TCP port: Enter the TCP port to be monitored. When using ICMP pings this is not
needed.
Hostname: The name or IP address of the monitored network device.
Ping interval: S elec t the frequency (in s ec onds) at which the ping packet is sent to each
network devi ce to check its operating status.
Ping retries: After this number of consec uti ve unanswered ping request s the devic e is
Watchdog mode: When Reset port when host down is enabled, the Power P ort is turned
off and switched back on after the time set in Reset Duration. In mode Switch off once
when host down the Power Port remains disabled.
At the default s et t i ng (Infinite wait for booting host after reset) the watchdog monitors t he
connected device. When there is no longer a reply after a set ti me, the watchdog performs t he s pecified action, us ually a reset of the Power Port. Now the watchdog waits
until the monitored device reports again on the network. This may take several minutes
depending on the boot duration of the device. Only when the device is ac c es sible from
network again, the watchdog is re-armed. If the option Repeat reset on booting host after
x ping timeout is enabled, t his m ec hanism is bypass ed. Now the watchdog is re-act ivated after N Ping intervals (input field ping timeouts).
When enabling the IP mas t er-slave mode, t he port is switched depending on the availability of a remote devic e. Depending on the configuration, the port is s wit c hed on when the
terminal is reachable, or vice versa.
Th e option Repeat reset on booting host after x ping timeout has the following pitfall:
If a s erver, t hat i s connected to t he monitored Port is in need for a long boot process
(e.g. it is doing a file sy stem c hec k ), t he s erver would probably exceed the tripping tim e
of the watchdog. The server would be switched off and on again, and the file syst em
check i s rest arted. This would be repeated endlessly.
Hostname: Here you c an enter a name with up to 63 characters. This name will be used
for registration on the DHCP s erver.
Special c haracters and umlauts can cause problems in the network.
IPv4 Address: The IP address of the device.
IPv4 Netmask : The network mask used in the network.
IPv4 Gateway address : The IP address of the gateway.
IPv4 DNS address: The IP address of the DNS s erver.
Use IPv4 DHCP: S elect "y es " if the TCP/IP settings s hould be obtained directly from the
DHCP s erver: When the function is selected, each t i me t he devic e powers up it is
check ed if a DHCP server is available on the network. If not, t he last used TCP/IP set t ing
will be used further.
Use IPv6 Protocol: A ctivates IPv6 usage.
Use IPv6 Router Advertisement: The Router Advertisement communicates with t he router
to make global IPv6 address es available.
Use DHCP v6: Request s from an exis t i ng DHCPv6 server address es of the configured
DNS server.
Use manual IPv6 address setti ngs: Act ivates t he entry of manual IP v6 addresses.
IPv6 st at us : Dis play s t he IPv6 addresses over which t he device can be accessed, and
additionally DNS and router addresses.
For IP changes a firmware reset is required. This can be done in the Maintenance
web page. A restart of the device leads by no means to a c hange of the relay st ates .
The input fields for the manual set t ing of IPv6 address es allow you to configure the prefix
of four additional IPv6 device addresses, and to s et t wo DNS addresses , and a gateway.
3.2.2
IP ACL
Reply ICMP ping request s : If you enable this feature, t he devic e responds to ICMP pings
from the network.
Enable IP filter: Enable or disable the IP filter here. The IP filter represents an acc es s
control for incoming IP packets.
Please note that when IP access c ontrol is enabled HTTP and SNMP only work if
the appropriate servers and clients are registered in the IP acc es s control lis t .
If you choose a wrong IP ACL sett ing and locked yourself out, please acti vate the
Bootloader Mode and use GBL_Conf.exe t o deacti vate the IP ACL. Alternatively, y ou
can reset the devic e t o factory default.
HTTP Server option: Select s whether acc es s is possible only with HTTP, HTTPS, or
both.
Server port HTTP: Here can be set the port number of the internal HTTP. Pos s i ble values ??
are from 1 to 65534 (default: 80). If you do not use the default port, you must append the
port number to the address wit h a c olon to address the devic e from a web browser. Suc h
as: " ht t p: / / 192.168.0.2:800"
Server port HTTPS; The port number to c onnect the web server vi a t he SS L (TLS) protocol.
Enable Ajax autorefresh: If this is act ivated, t he information of the status page is automatic ally updated via htt p request (AJAX).
For some HTTP configuration changes a firmware reset i s required. This can be
done in the Maintenance web page. A restart of the device leads by no means to a
change of the relay states .
Enable password protection: P as s word access protection can be acti vated. If the admin
password is ass igned, you c an only log in by entering this password to c hange settings.
Users can log in by entering the user pass word in order to query t he status information
and initiate switc hing operations.
Use radius server passwords: Username and password are validated by a Radius Sever.
Use locally s tored pass words: Username and password are st ored locally. In this case,
an admin pass word and a user password must be assigned. The password can have a
maximum of 31 characters. The name "admin" and "user" are provided for the user name
in the password entry m as k of the browser. In factory set t i ngs, t he pass word for the admin is set t o "admin" or "user" for the user password.
If the password mask is redisplayed, only four "bullets" are shown as a symbolic
placeholder, s inc e for security reasons t he device never stores the pass word itself, but
only the SHA2-256 hash. If you want t o c hange a password, t he c omplete pass word
must always be re-entered.
If you have forgotten your password, please activate the bootloader mode and then
turn off the password prompt in GBL_Conf.exe.
3.3Protocols
3.3.1
Console
Enable Telnet: E nables Telnet console .
Telnet TCP port: Telnet s es sions are accepted on this port.
Raw mode: The VT100 editing and the IA C protocol are disabled.
Activat e echo: The echo setting if not changed by IAC.
Active negotiation: The IA C negotiation is init i ated by the server.
Require user login: Username and pass word are required.
Delay after 3 failed logins: A fter 3 wrong entries of username or password, the next login
attempt is delayed.
Use radius server passwords: Username and password are validated by a Radius Sever.
Use locally s tored pass words: Username and password are st ored locally.
Enable serial console: Enables the s erial console.
Raw mode: The VT100 editing is dis abled.
Activat e echo: The echo setting.
3.3.2
Enable binary KV M protocol: A dditi onally ac tivat es t he KV M protocol.
Enable UTF8 support: Enables c haracter encoding in UTF8.
Require user login: Us ername and password are required.
Delay after 3 failed logins: A fter 3 wrong entries of username or password, the next login
attempt is delayed.
Use radius server passwords: Username and password are validated by a Radius Sever.
Use locally s tored pass words: Username and password are st ored locally.
Syslog
Enable Sys log: E nables t he usage of Syslog Messages.
Syslog Server: If you have enabled Syslog Mes s ages, enter the IP address of the server
to which the sy slog information should be transmi t t ed.
SNMP-get: Enables t he acc eptance of SNMP-GET commands.
SNMP-set: A ll ows t he reception of SNMP-SET comm ands.
SNMP UDP Port: S et s the UDP port where SNMP mess ages are received.
Enable SNMP v2: A ctivates SNMP v2.
Because of security issues, it is advis able to use only S NMP v3, and to disable
SNMP v2. Acces s es t o S NMP v2 are always ins ec ure.
Community public: The community pass word for SNMP GET requests .
Community private: The community pass word for SNMP SE T requests.
Enable SNMP v3: A ctivates SNMP v3.
SNMP v3 Username: The SNMP v3 User Name.
SNMP v3 Authorization Algorithm: The selected Authentic at ion Algorithm.
SNMP v3 Privac y Algorithm: S NMP v3 Enc rypt ion Algorithm. .
If the password mask is redisplayed, only four "bullets" are shown as a symbolic
placeholder, s inc e for security reasons t he device never stores the pass word itself, but
only the key formed using the Authorization Algorithm. If you want to c hange a pass word, the c omplete pass word must always be re-entered.
The calc ulation of the password hashes varies with the select ed algorithms. If the
Authenticat ion or Privac y algorithms are changed, the passwords must be re-entered in
the configuration dialog. "SHA-384" and "S HA512" are calculated purely in software. If
"SHA-512" is set on the configuration page, t he ti me for the key generation may take
once up to approx. 45 sec onds.
Send SNMP traps: Here you can specify whether, and in what format t he devic e s hould
send SNMP traps.
SNMP t rap receiver: You can insert here up to eight SNMP trap receiver.
MIB table: The download link to t he tex t file with the MIB table for the device.
More information about SNMP s ettings are available from our support or can be found on
the Internet at www.gude.info/wiki.
3.3.4
Radius
Enable Radius Client: E nables validation over Radius.
Use CHAP: Use CHAP password encoding.
Use Mess age Authenticat ion: A dds the "Mess age Authentic at ion" at t ribute to t he
Authenticat ion Request.
Primary Server: Name or IP address of the Primary Radius server.
Shared sec ret: Radius Shared Secret.
Timeout: How long (in seconds) will be waited for a response from an Authentication
Request.
Retries: How oft en an authentication request i s repeated aft er a timeout.
Use Back up Server: A ctivates a Radius Bac kup server.
Back up Server: Name or IP address of the Radius B ac k up s erver.
Shared sec ret: Radius Shared Secret.
Timeout: How long (in seconds) will be waited for a response from an Authentication
Request.
Retries: How oft en an authentication request i s repeated aft er a timeout.
3.3.5
Test Username: Username input field for Radius t es t .
Test P as sword: P assword input field for Radius tes t .
The "Test Radius Server" function allows you to c heck whether a combination of User-
name and Password is ac c epted by t he c onfigured Radius S ervers.
Modbus TCP
Enable Modbus TCP: Enables Modbus TCP support.
Modus TCP port: The TCP/IP port number for Modbus TCP.
Mess age channels: Enables t he generation of messages on different channels.
Choose s ensor port: Selects a t y pe of sensor to configure it. The first digit "1" indicates
the number of the sensor port (only important for devic es with more than one sensor
port). This is followed by the sensor name (e.g. 7002 for the hybrid sensor), a letter for
the sub-type sensor and the changeable sensor name. The sensor subtypes are defined
as: " T" = t emperature, "H" = humidity, " I" = sensor input.
Sensor Name: Changeable name for this s ensor. Temperature and humidity can have different names, even if they are from the same s ensor.
Enable sensor events: E nables t he generation of sensor messages.
Maximum/ M inimum value: Here you can choose whether, and at what Max i mum/ M in-
imum temperature or humidity m easurements lim it s the alerts are send via SNMP t raps,
sy slog or E-Mail.
Hysteresis: This describes t he margin of when an event is generated aft er the measured
value has crossed the chosen limit.
Mess age channels: Enables t he generation of messages on different channels.
Min/Max meas urement period: Selec t s the tim e range for the sensor min/max values on
the overview web page.
Enable beeper for AC alarms: Act ivates t he beeper for all AC limi t m es sages.
Enable beeper for sensor alarms: Activates the beep er fo r all sensor limit mes sages.
Hysteresis Example:
A Hys t eresis value prevents that t oo much m es s ages are generated, when a sensor
value is j it tering around a sensor limit . The following example shows the behavior for a
temperature sensor and a hysteresis value of "1". An upper limit of "50 °C" is set .
Example:
49.9 °C - is below the upper limit
50.0 °C - a mess age is generated for reaching the upper limit
50.1 °C - is above the upper limit
...
49.1 °C - is below the upper limit, but in t he hys teresis range
49.0 °C - is below the upper limit, but in t he hys teresis range
48.9 °C - a mess age is generated for underrunning the upper limit inclus i ve hys t eresis
range
...
3.4.1
Port S wi t c hing
Depending on the measured Current and the measured sensor values, s witching actions
can be triggered. During operation, t he act ions configured for crossing the limit s are executed. For example, when a value moves from the range "above max value" ins i de the
range "below max value", t he act i on defined for "below max value" is performed. In the
case of device s t art, configuration or plug-in of t he s ensor, t he act ions corresponding to
the range in which the current t emperature is located are switched.
Example with " Max im um value" of 65 °C, "Mi nimum value" of 25 °C and hysteresis of 3 °
C. The dotted line shows the hysteresis.
Actions during confi guration, devic e s t art or plugging in the sensor (for given example):
Action matrix during operation when limit values are exceeded (for given example):
Only t he swit c hing operations for which actions have been defi ned, are triggered. If
no "On" or "Off" act ion is defined for a port, the port can never reach t his state by ex ceeding sensor values. Unless it is t he initi al s tate.
Enable E-Mail: Activates the E-Mail dispatch of messages.
Sender address: T he E-Mail addr ess of the sende r.
Recipient address: The E-Mail address of the recipient. A dditi onal E-Mail addresses,
separated by comma, c an be specified. The input limit is 100 characters.
SMTP Server: The SMTP IP-address of the E-Mail server. Ei t her as FQDN, e.g:
"mail. gmx .net", or as IP-address, e.g: " 213.165.64.20". If required, att ac h a designated
port, e.g: "mail.gmx.net:25".
SMTP server port: The port address of the E-Mail server. In the normal case this s hould
be the same as the default, that is determined by the setting SMTP Connection Sec urity.
SMTP Connection Sec urity: Transmission via SSL or no encryption.
SMTP Authentification (password): Aut hentic at ion method of the E-Mail Server.
Username: User name that is regist ered with the SMTP E-Mail server.
Set new password: Enter the password for the login to the E-Mail s erver.
Repeat password: Enter the password again to c onfirm it.
If the password mask is redisplayed, only four "bullets" are shown as a symbolic
placeholder, s inc e for security reasons t he pass word is never shown itself. If you want to
change a pass word, the complete pass word must always be re-entered.
E-Mail Logs: Logging of E -Mail sys tem mess ages.
the PC with IP Address "192.168.0.123" can access the device
192.168.0.1/24
all devices of subnet "192.168.0.1/24" can access the device
1234:4ef0:eec1:0::/64
all devices of subnet "1234:4ef0:eec1:0::/64" can access the
device
4Specifications
4.1IP ACL
IP Access Control List
The IP Acc es s Control List (ACL IP) is a filter for incoming IP packet s . If the filter is active, only t he hosts and subnets whose IP addresses are registered in the list, can contact via HTTP or SNMP, and make changes. For incoming connecti ons from unauthorized PCs, t he devic e is not completely transparent. Due to tec hnical rest raints , a TCP/IP
connection will be accepted at first, but then rejected directly.
Examples:
If you choose a wrong IP ACL sett ing and locked yourself out, please acti vate the
Bootloader Mode and use GBL_Conf.exe t o deacti vate the IP ACL. Alternatively, y ou
can reset the devic e t o factory default.
4.2IPv6
IPv6 Addresses
IPv6 address es are 128 bit l ong and thus four times as long as IPv4 addresses . The fi rst
64 bit form a so-called prefix, t he las t 64 bit desi gnate a unique interface identifier. The
prefix is composed of a routing prefix and a subnet ID. An IPv6 network interface can be
reached under several IP addresses. Us ually t his is t he cas e under a global address and
the link loc al address.
Address Notation
IPv6 address es are noted in 8 hexadecimal blocks at 16 bit, while IPv4 normally is noted
in decimal. The seperator is a colon, not a period.
E.g.: 1234:4ef0: 0:0: 0019:32ff:fe00:0124
Leading zeros may be omit t ed within a block. The previous example c an be rewritten as:
1234:4ef0:0:0:19:32ff:fe00:124
One may omit one or more suc c es sive blocks , if they consist of zeros. This may be
done only once within an IPv6 address !
1234:4ef0::19:32ff:fe00:124
One may use the usual decimal notation of IPv4 for the last 4 bytes:
1234:4ef0::19:32ff:254.0.1.36
4.3Radius
The passwords for HTTP, t elnet, and serial console (depending on the model) can be
stored locally and / or authenticated via RADIUS. The RADIUS configuration supports a
primary server and a backup s erver. If the primary s erver does respond, the RADIUS request is sent to the back up server. If the local password and RADIUS are enabled at the
same tim e, t he s y stem is first c heck i ng locally, and then in the event of a failure the
RADIUS servers are contact ed.
RADIUS attributes
The following RADIUS attributes are evaluated by the client:
Session-Timeout: This attribute speci fies (in sec onds) how long an accepted RADIUS
request is valid. A fter this t i me has elapsed, t he RADIUS s erver must be prompted
again. If this att ribute is not returned, the default timeout entry from the configuration is
used instead.
Filter-Id: If the value "admin" is s et for this att ribute, then an admin rights are assigned
for the login, otherwise only user access.
Service-Type: This is an alternative to Fi lt er-Id. A servic e t y pe of "6" or "7" means admin rights for the HTTP l ogin, otherwise only limited user access .
HTTP Login
The HTTP login takes plac e via Basic Authentic at ion. This means t hat it is the responsibility of the web server, how long the login credentials are temporarily s tored there. The
RADIUS parameter "Ses sion-Tim eout" t herefore does not determine when the user has
to login again, but at what intervals the RADIUS s ervers are asked again.
4.4Automated Access
The device c an be acces sed automatically via four different interfaces, which offer different possibilities t o access t he c onfiguration data and status information. Only http and
the console (telnet and serial) provide full access t o t he devic e.
List of different acc es s options (if supported by t he model):
read / write all c onfiguration data
read / write all s t at us i nformation
SNMP
read / write s t at us of Power Ports (relays)
read / write names of Power Ports (relays)
read / write s t at us of Port st art configuration
read / write s t at us B uz zer
read measurement values of external sensors
read measurement values of all energy s ensors
resetting the energy meters
read the status of Overvoltage Protect ion
Modbus TCP
read / write s t at us of Power Ports (relays)
read status of Inputs
read measurement values of external sensors
read measurement values of all energy s ensors
The device c an be controlled via HTTP interfac e with CGI commands and returns the internal configuration and stat us i n JSON format. The structure of the CGI commands and
the JSON data is explained in more detail in our Wiki article:
http://wiki.gude.info/EPC_HTTP_Interface
52
43
69
4.5SNMP
SNMP c an be used for st atus i nformation via UDP (port 161). Supported SNMP c ommands are:
·
GET
·
GETNEXT
·
GETBULK
·
SET
To query via SNMP you need a Network M anagement Sys t em, such as HP OpenView,
OpenNMS, Nagios etc . , or the sim ple c ommand line tools of NET-SNMP software. The
device s upports S NMP protocols v1, v2c and v3. If traps are enabled in the configuration,
the device mes sages are sent as notifications (traps). S NMP Informs are not supported.
SNMP Requests are answered with the same versi on with which they were sent. The
version of the sent traps can be set i n t he configuration.
MIB Tables
The values that c an be request ed or changed by t he devic e, t he s o-called "Managed Objects", are described in Management Information Bas es (MIBs). These substructures are
subordinate to s o-called "OID" (Object Identifiers). An OID digit signifies the location of a
value inside a MIB st ruct ure. Al t ernatively, each OID can be referred to with it s symbol
name (subtree name). The device's MIB table can be displayed as a tex t file by c li c king
on the link "MIB t able" on the SNMP configuration page in the browser.
SNMP v1 and v2c authenticates t he network requests by s o-called c ommuniti es. The
SNMP request has to s end along the so-called community public for queries (read ac-
Page 44
Specifications
cess) and the community privat e for status changes (write acc es s) . The SNMP
communities are read and write pass words. In SNMP v1 and v2 the communities are
transmitt ed unencrypted on the network and can be easily intercepted with IP sniffers
within this collision domain. To enforce limited access we recommend the use of DMZ or
IP-ACL.
SNMP v3
Because t he devic e has no multi us er management, only one user (default name "standard") is detected in SNMP v3. From t he User-based Sec urity M odel (USM) MIB variables, there is a s upport of "us mStats . . ." c ounter. The "us mUs er .. . " variables will be
added with the enhancement of additional users i n later firmware versions. The system
has only one context . The sys t em ac cepts t he c ontex t "normal" or an empty context.
Authentication
The algorithms "HMAC-MD5-96" and "HMAC-SHA-96" are available for authentic ati on. In
addition, the "HMAC-SHA-2" variants (RFC7630) "SHA-256", "SHA-384" and "SHA-512"
are implemented.
"SHA-384" and "SHA512" are calculated purely in s oftware. If "SHA-384" or "SHA-
512" is s et on the configuration page, the time for the key generation may tak e once up
to approx. 45 s ec onds.
Encryption
The methods "DES" , "3DES" , " A E S -128", " A ES-192" and "AES-256" are supported in
combination with "HMAC-MD5-96" and "HMAC-SHA-96." For the "HMAC-SHA-2" protocols, there is c urrently neither RFC nor draft that will allow for cooperation with an encryption.
W hile in the s ettings "A E S-192" and "AES256" the key calculation is based on
"draft-blumenthalphoto-aes-usm-04", the methods "A E S 192-3DESKey " and "AE S 2563DESKey" ut il ize a key generation, which is also us ed in the "3DES" c onfiguration
("draft -reeder-snmpv3-usm-3desede-00"). If one is not an SNMP expert, it is recommended to try in each cas e t he set t ings with and without "...- 3DESKey " .
Passwords
The passwords for authentication and encrypt ion are stored only as computed hashes
for security reasons. Thus it is , i f at all, very difficult to infer the initial pass word.
However, the hash c alc ulation c hanges with the set algorithms. If the authentic at ion or
privacy algorithms are changed, the passwords must be re-entered in the configuration
dialog.
Security
The following aspects should be consi dered:
·
If encry ption or authentication is us ed, t hen SNMP v1 and v2c s hould be turned off.
Otherw ise the device could be accessed with it.
·
If only authentic ation is us ed, t hen the new "HMAC-SHA-2" met hods are superior to
the MD5 or SHA-1 hashing algorithms . Since only S HA-256 is acc elerated in hardware, and SHA-384 and SHA-512 are calculated purely in software, one should normally select S HA-256. From a cryptographic point of view, the security of SHA-256 is
For SHA-1, there are a little les s attack scenarios than MD5. If in doubt, SHA-1 is
preferable.
·
Encrypt ion "DES " is consi dered very unsafe, use only in an emergency for reasons of
compatibility!
·
For cryptologists it's a debatable point whether "HMAC-MD5-96" and "HMAC-SHA-96"
can must er enough entropy for key l engths of "AE S -192" or "AES -256".
·
From the foregoing considerations, we would recommended at present " HMAC-SHA96" with "AE S -128" as authenticat ion and encryption method.
NET-SNMP
NET-SNMP provides a very widespread collect ion of SNMP command-line tools (snmpget, s nmpset , s nmpwalk etc.) NET-SNMP is among others available for Linux and Windows. After installing NET-SNMP y ou s hould create the device-speci fic MIB of the device
in NET-SMP share directory, e.g. after
c:\usr\share\snmp\mibs
4.5.1
or
/usr/share/snmp/mibs
So later you can use the 'subtree names' instead of OIDs:
Name: snmp w a lk -v2c - m ALL -c public 192.16 8 .1.232 gudead s
OID: s nmpwal k - v 2c -mAL L -c public 19 2.168. 1 .232 1. 3.6.1. 4.1.28 5 07
NET-SNMP Exampl es
Query Power Port 1 swit c hing state:
snmpget -v2c -mA LL -c public 192.168.1.232 epc822XPortState.1
Switc h on Power Port 1:
snmpset -v2c -mALL -c private 192.168.1.232 epc822XP ortSt at e.1 i nteger 1
Device MIB 8221
Below is a table of all devi c e-speci fic OID 's which can be access ed via SNMP. In the
numerical representation of the OID the prefix " 1. 3. 6.1. 4.1. 28507 " (Gude Enterprise
OID) was omitted at each entry in t he table to preserve space. The example for a complete OID would be "1.3.6.1. 4.1. 28507.56.1.1.1.1". A distinc t ion is made in SNMP OID 's
in between tables and sc alars. OID scalar have the extensi on ". 0" and only spec ify a
value. In SNMP tables t he "x" is replaced by an index (1 or greater) to address a value
from the table.
A unique value, greater than zero, for each receiver slot.
epc8221TrapAddr
.56.1.1.1.2.1.2.x
OCTETS
RW
DNS name or IP address specifying o ne Trap receiver slot. A port can
optionally be specified: 'name:port' An empty string disables this slot.
epc8221portNumber
.56.1.3.1.1.0
Integer32
RO
The number of Relay Ports
epc8221PortIndex
.56.1.3.1.2.1.1.x
Integer32
RO
A unique value, greater than zero, for each Relay Port.
epc8221PortName
.56.1.3.1.2.1.2.x
OCTETS
RW
A textual string containing n ame of a Relay Port.
epc8221PortState
.56.1.3.1.2.1.3.x
INTEGER
RW
current state of a Relay Port
epc8221PortSw itchCount
.56.1.3.1.2.1.4.x
Integer32
RO
The total number of sw itch actions ocurred on a Relay Port. Does not
count sw itch commands w hich will not switch the ral ay state, so just
real relay sw itches are displayed here.
epc8221PortStartupMode
.56.1.3.1.2.1.5.x
INTEGER
RW
set Mode of startup sequence (off, on , remember last state)
epc8221PortStartupDelay
.56.1.3.1.2.1.6.x
Integer32
RW
Delay in sec for startup action
epc8221PortRepowerTime
.56.1.3.1.2.1.7.x
Integer32
RW
Delay in sec for repow er port after sw itching off
epc8221Buzzer
.56.1.3.10.0
Integer32
RW
turn Buzzer on and off
epc8221ActivePow erChan
.56.1.5.1.1.0
Unsigned32
RO
Number of suppported Pow er Chann els.
epc8221Pow erIndex
.56.1.5.1.2.1.1.x
Integer32
RO
Index of Pow er Channe l entries
epc8221ChanStatus
.56.1.5.1.2.1.2.x
Integer32
RO
0 = data not active, 1 = data val id
epc8221AbsEnergyActive
.56.1.5.1.2.1.3.x
Gauge32
RO
Absolute Active Energy counter.
epc8221Pow erActive
.56.1.5.1.2.1.4.x
Integer32
RO
Active Pow er
epc8221Current
.56.1.5.1.2.1.5.x
Gauge32
RO
Actual Curent on Power Channel.
epc8221Voltage
.56.1.5.1.2.1.6.x
Gauge32
RO
Actual Voltage on Pow er Channel
epc8221Frequency
.56.1.5.1.2.1.7.x
Gauge32
RO
Frequency of Pow er Channel
epc8221Pow erFactor
.56.1.5.1.2.1.8.x
Integer32
RO
Pow er Factor of Channel between -1.0 and 1.00
epc8221Pangle
.56.1.5.1.2.1.9.x
Integer32
RO
Phase Angle between Voltage and L Line Current between -180.0 and
180.0
epc8221Pow erApparent
.56.1.5.1.2.1.10.x
Integer32
RO
L Line Mean Apparent Pow er
epc8221Pow erReactive
.56.1.5.1.2.1.11.x
Integer32
RO
L Line Mean Reactive Pow er
epc8221AbsEnergyReactive
.56.1.5.1.2.1.12.x
Gauge32
RO
Absolute Reactive E nergy counter.
epc8221AbsEnergyActiveResettable
.56.1.5.1.2.1.13.x
Gauge32
RW
Resettable Absolute Active Energy counter. Writi ng '0' resets all resettable counter.
shows the status of the built-in Overvoltage Protection
epc8221SensorIndex
.56.1.6.1.1.1.x
Integer32
RO
None
epc8221TempSensor
.56.1.6.1.1.2.x
Integer32
RO
actual temperature
epc8221HygroSensor
.56.1.6.1.1.3.x
Integer32
RO
actual humidity
epc8221InputSensor
.56.1.6.1.1.4.x
INTEGER
RO
logical state of input sensor
Name
OID
Type
Acc.
Description
epc8226TrapCtrl
.58.1.1.1.1.0
Integer32
RW
0 = off 1 = Ver. 1 2 = Ver. 2c 3 = Ver. 3
epc8226TrapIPIndex
.58.1.1.1.2.1.1.x
Integer32
RO
A unique value, greater than zero, for each receiver slot.
epc8226TrapAddr
.58.1.1.1.2.1.2.x
OCTETS
RW
DNS name or IP address specifying o ne Trap receiver slot. A port can
optionally be specified: 'name:port' An empty string disables this slot.
epc8226portNumber
.58.1.3.1.1.0
Integer32
RO
The number of Relay Ports
epc8226PortIndex
.58.1.3.1.2.1.1.x
Integer32
RO
A unique value, greater than zero, for each Relay Port.
epc8226PortName
.58.1.3.1.2.1.2.x
OCTETS
RW
A textual string containing n ame of a Relay Port.
epc8226PortState
.58.1.3.1.2.1.3.x
INTEGER
RW
current state of a Relay Port
epc8226PortSw itchCount
.58.1.3.1.2.1.4.x
Integer32
RO
The total number of sw itch actions ocurred on a Relay Port. Does not
count sw itch commands w hich will not switch the ral ay state, so just
real relay sw itches are displayed here.
4.5.2
Device MIB 8226
Below is a table of all devi c e-speci fic OID 's which can be access ed via SNMP. In the
numerical representation of the OID the prefix " 1. 3. 6.1. 4.1. 28507 " (Gude Enterprise
OID) was omitted at each entry in t he table to preserve space. The example for a complete OID would be "1.3.6.1. 4.1. 28507.58.1.1.1.1". A distinc t ion is made in SNMP OID 's
in between tables and sc alars. OID scalar have the extensi on ". 0" and only spec ify a
value. In SNMP tables t he "x" is replaced by an index (1 or greater) to address a value
from the table.
The device is c ompatible with t he st andards TLSv1.0 to TLSv1.2. Due to lack of security,
SSLv3.0 as well as RC4 and DES encrypt ions are deactivat ed.
The SSL stack is supplied with a specially newly generated certificate. There is no function to
generate the local certificate anew at the touch of a button, since the required random numbers in an embedded dev ice are usually not independent enough. However, you can create
new certificates and import them to the device. The server accepts RSA (1024/2048/4096) and
ECC (Elliptic Curve Cry ptography) certificates.
Usually O penSSL is used to create an SSL certificate. For Windows for ex ample, there is the
light version of Shinning Light Productions. There you open a command prompt, change to
the directory " C:\ O penSSL-Win32\bin" and set these environment variables:
set openssl _ conf=C : \OpenS S L-Win3 2 \bin\o p enssl. c fg
set RANDFIL E =C:\Op e nSSL-W i n32\bi n \.rnd
Here are some examples for the generation with OpenSSL:
Creation of a self-signed RSA 2048-bit certificat e
opens sl genr sa -out s e rver.k e y 2048
opens sl req -new -x 509 -da ys 365 -key se rver.k e y -out server . crt
RSA 2048-bit c ertificat e with Si gn Request :
opens sl genr sa -out s e rver.k e y 2048
opens sl req -new -k ey serv er.key -out se rver.c s r
opens sl req -x509 - days 36 5 -key server . key -in s e rver.c s r -out server .crt
The server key s s hould be generated with " openssl genrsa". If in the generated key
file it reads only " ----- BEGIN PRIVATE KEY -----" and not "----- BEGIN RSA PRIVATE
KEY -----", the key is not recognized.
ECC Certificate with Sign Request:
opens sl ecpa ram -ge nkey -n ame pri me256v 1 - o ut serv er.key
opens sl req -new -k ey serv er.key -out se rver.c s r
opens sl req -x509 - days 36 5 -key server . key -in s e rver.c s r -out server .crt
If you have created your key and certificate, both files are concatenated to one fil e:
Linux:
cat server. c rt serv er.key > serve r.pem
Windows:
copy server . crt + server. k ey serv er.pem
The created server.pem can only be uploaded in the maintenance s ec t ion of the device.
If several certificates (Intermediate CRT's) should also be uploaded to the device,
one should make sure, that firstly t he server certificate and secondly the Intermediates
are assembled , e.g:
cat server. c rt IM1. crt IM2 .crt se rver.k e y > server.pe m
An uploaded certificate will be preserved, when a device is put back to fact ory de-
21
faults.
Performance Considerati ons
If RSA 4096 certificates are used, the first access t o t he web server can take 8-10
seconds, because t he math unit of the embedded CPU is highly demanded. A fter that,
the parameters are in the SSL ses sion cache, so all other requests are just as fast as
with other certificate lengths. For a quick response even on the first acc es s , we recommend RSA 2048-bit certificates t hat offer adequate security, t oo.
4.7Console
For the configuration and control of the device, there is a s et of commands with parameters that c an be entered through a console. The console is available via Telnet, or for
devices wit h RS232 port t hrough using a serial terminal. The communication can also be
performed automated (e.g. via scripting languages). The console features are configured
through the web interface.
Command Set
There are several command levels . The following commands are usable from each level:
The "help" command returns all the commands of the current level. If "help" is called
from the top level, e. g. t he line "http [s ubtopics]" appears. This m eans t hat there is another level for "htt p". W it h t he c ommand "htt p help" all commands below "http" are
shown. Alternatively, with entering "http" y ou c an selec t the http level, and "help" s hows
all the commands on the selec t ed level. The command "back " again selects the top
level. It is possi ble to us e " help" at any position: "http passwd help" provides all commands that have t he prefix " ht t p passwd".
30
You will find a complete list of all possible device commands in the c hapter "Cmd Overview".
If parameters are expected for the command, the parameter may be pass ed as numeric
or constant. If e.g. you get the following line as help:
http server set {ht tp_bot h =0|htt p s_only = 1|http _ only=2 }
the following instructi on pairs are equivalent:
http server set htt ps_onl y
http server set 1
or
http server set htt ps_bot h
http server set 0
Numerical parameters can be entered with different bases. Here is an example of the
decimal value 11:
Return Values
If a c ommand is unknown or a parameter is inc orrect, the output "ERR." is given at the
beginning of the line, followed by a desc ription of the fault. S uc cessful inst ruct ions
without special return value will be acknowledged by "OK. " . All ot her return values are
output within a single line. There are of two exc eptions:
1. Some configuration changes, t hat affect TCP / IP and UDP, need a restart to be ap-
plied. These parameters are output on two lines. In the first l ine the current value is
shown, on the second row the value after a restart. In the "Cmd Overview" t able this
is marked with "Note 2".
2. Other configurations (such as the assigned IPv6 address es ) have s everal values that
can change dynamically. This is m arked with "Note 3" in t he "Cmd Overvi ew" t able.
Numerical Returns
For parameters that s upport const ants , t hese c ons t ants are output as return values. To
better deal with s cripting languages, it m ay be easier to work only with numerical returns. The command "vt100 n u meric s et ON" enables that only numerical values
appear.
If you use a tool to send an entire fil e of commands via Telnet, it i s helpful, if you can
place comments i n t here. Beginning with t he comm ent c haracter "#", the remaining contents of a line is ignored.
Page 54
Specifications
Keys
Function
Left, Right
moves cursor left or right
Pos1, E nd
moves cursor to the beginning or end of line
Del
deletes character under the cursor
Backspace
deletes character left of cursor
Up, Down
shows input lines his t ory
Tab, Ctrl-Tab
completes t he word at cursor
Ctrl-C
clears the line
Command
Description
Note
logout
go to login prompt w hen enabled
1
quit
quits telnet session - nothing in serial console
1
back
back one cmd level
1
help
show all cmds from this level
1
help a ll
show all cmds
1
console
enters cmd group "console"
console version
shows unique console version number
console telnet enabled set {OFF=0|ON =1}
enabl es telnet on/off
console telnet enabled show
shows if telne t enabled
console telnet port set {ip_p ort}
sets telnet port
console telnet port show
shows telnet port
Telnet
If t he c onfiguration "Raw Mode" is t urned off, it is tried to negotiate t he Telnet c onfiguration between cli ent and server using IAC commands. If this fails, t he editing functions are
not active, and the "Activate echo" option determines whether the characters s ent t o t he
Telnet server will be returned. Normally the client begins with t he IAC negotiation. If this
is not t he c as e with t he cli ent, the device configuration "A c tive negotiation" s hould be
turned on.
Raw Mode
If you want t o use t he cons ole only automated, it may be advantageous to set t he configuration "Raw mode" to " yes" and "Activate echo" t o " no" t o. Then there is no interfering interaction with the editor functions and the is no need to filter the sent characters to
process t he return values.
If in the console " Raw mode" is act ivated but not in the used Telnet c lient, the IAC
commands s ent at t he beginning can appear as int erfering characters in the command
line (partially invisi ble).
4.7.1
Editing
The following edit functions are available when the terminal supports VT100, and Raw
Mode is deactivated. Ent ered characters are inserted at t he c ursor position.
When a shrink of the terminal window leads t o t he result, that the input line extends
over multiple lines on the terminal, t he editing does not work reliably.
Dependent on the devi c e m odel Residual Current may not be supported.
4.7.3
Serial Con sole
If t he device has a serial port, the entire Telnet command set is also available at the
serial console. Connect y our PC to the devic e via an RS232 serial c able (9-pin RS232).
To use the editing funct ions, the serial terminal must support V T100 emulation, and
"echo" mus t not be activated. In the device c onfiguration on the other hand, "Ac t i vate
echo" should be set to " yes" and "Raw mode" t o " no". S t art your terminal program and
select the COM port to which t he RS232 cable is connected. Us e t he following sett ings
for the serial port:
KVM Protocol
For compatibility reasons, the KVM protocol c an be activated on the serial port. These
binary control sequences can be used for devices with power ports, to turn the relays on
and off individually.
The measured values of the ext ernal sensors are coded as fixed-point arithmetic with 1
decimal place, t hey mus t be divided by 10 to obtain the real measured value. A value of
0x8000 means, t hat no sensor is ins erted into the port. The formula for the address is
(the port numbers st art at zero):
0x100 + Port * 8 + Offset
For example, the humidity of the second port has the address : 0x 100 + 1 * 8 + 1 =
0x109
Energy Se n sors:
We dis t i nguish the line sensors (which correspond to the input c irc uit s) and the port
sensors, which measure the energy t hat is pass ed over the switched port. The measured values of the energy s ens ors are returned as signed 32-bit int egers. The high-order
16-bits are starting on the even address , followed by t he low-order 16-bits on the odd address. To calculate the address, t here are the following formulas (the values for line, port
and phase st art at zero):
Line: 0x0400 + Line * 0x120 + P hase * 0x 60 + Offset * 2
Port: 0x 3a00 + Port * 0x120 + P hase * 0x 60 + Offset * 2
For devices with only one phase, the phase is s et t o zero in the formula.
Examples:
"Power Acti ve" for 1st line sensor and 3rd phase: 0x400 + 0 * 0x120 + 2 * 0x60 + 1 * 2 =
0x4C2
"Volt age" for 2nd line sensor and single phase devic e: 0x 400 + 1 * 0x120 + 2 * 2 =
0x524
"Power Angle" for 4th port sensor and si ngle phase device: 0x 3a00 + 3 * 0x120 + 6 * 2 =
0x3d6c
Depending on adjustable events, various mes s ages can be sent from the devic e. The following message types are supported:
·
Sending of E -Mails
·
SNMP Traps
·
Syslog mess ages
E-Mail messages
E-Mail messages are triggered by the following events:
·
Switc hing of the Power Ports
·
Loss / return of voltage at power bank
·
Exceeding of the max / m in values of attached sensors
·
State change of digital sensor input ports
·
Exceeding of max / m in values of the measured power consumption
·
Condition change of overvolt age protection
SNMP Traps
SNMP Traps are system mes sages that are sent via the SNMP protocol to different recipients . S NMP traps are triggered by t he following events :
·
Switc hing of the Power Ports
·
Exceeding of the max / m in values of attached sensors
·
State change of digital sensor input ports
·
Exceeding of max / m in values of the measured power consumption
·
Condition change of overvolt age protection
Syslog messages
Syslog mess ages are simple tex t mes sages that are sent via UDP to a syslog server.
Under Linux, normally a sy slog daemon is already running (eg. syslog-ng), for Microsoft
Windows syst ems some freeware programs are available on the market. The syslog
mess ages are sent for the following events:
·
Turning on the device
·
Enable/disable of syslog in the c onfiguration
·
Switc hing of the Power Ports
·
Loss / return of voltage at power bank
·
Exceeding of the max / m in values of attached sensors
·
State change of digital sensor input ports
·
Exceeding of max / m in values of the measured power consumption
You will find the latest product software on our website at www.gude.info available for
download. If you have further questi ons about inst allat ion or operation of the unit, please
contact our support team. Furthermore, we present in our support wik i at
www.gude.info/wiki F A Qs and configuration examples.
5.1Data Security
To provide the device with a high level of data sec urity, we recommend the following
measures:
·
Check that t he HTTP password is switched on.
·
Set up your own HTTP password.
·
Allow acces s to HTTP via SSL only.
·
Authenticat ion and encryption is ac t ivated in SNMPv3.
·
SNMP v2 acces s is dis abled.
·
enable STARTTLS or SSL in the e-mail configuration.
·
Archive configuration files securely.
·
In the IP A CL, enter only the devic es that require acces s to HTTP or SNMP.
·
Because Telnet is unencrypted, only use it in a s ec ure environment.
·
Since Modbus TCP is not encrypted, only ac t ivate it in a secure environment.
·
Activat e " Mes sage Authentication" in RADIUS.
When accessed from t he Int ernet
·
Use a randomized password with at least 32 characters.
·
If possible, place the device behind a firewall.
5.2Contact
Gude Analog- und Digitalsyst eme GmbH
Eintrachtstraß e 113
50668 Cologne
Germany
Ex pert Power Control 8220-1 / 8225-1 / 8221-1 / 8226-1
Beschreibung
Description
IP gesteuerte, schaltbare Stromverteilung mit Leistungs- und Energiemessung / I P remote controlled power distribution unit with
power measurement and energy metering
2014/35/EU
Niederspannungsrichtlinie / Low Voltage Directive (LVD)
2014/30/EU
Elektromagnetische Verträglichkeit (EM V)
Electromagnetic Compatibility (EMC)
2011/65/EU
z ur Beschränkung der V erwendung bestimmter gefährlicher Stoffe
in Elektro- und Elektronikgeräten (RoHS) / on the restriction of the
use of certain hazardous substances in electrical and electronic
equipment (RoHS)
EN 609501:2006/A2:2013
Einrichtungen der Informationstechnik - Sicherheit
Information technology equipment - Safety
EN
55022:2010/AC:2011
Einrichtungen der Informationstechnik - Funkstöreigenschaften /
Information technology equipment - Radio disturbance characteristics
EN 55024:2010
Einrichtungen der Informationstechnik - Störfestigkeitseigenschaften / Information technology equipment - Immunity characteristics
EN 61000-3-2:2014
Elektromagnetische Verträglichkeit (EM V) Grenzwerte für Oberschwingungsströme / Electromagnetic Compatibility (EMC) Limits
for harmonic current emissions
EN 61000-3-3:2013
Elektromagnetische Verträglichkeit (EM V) Begrenzung von Spannungsänderungen, Spannungsschwankungen und Flicker / Electromagnetic Compatibility (EMC) Limitation of voltage changes,
v oltage fluctuations and flicker
EN 50581:2012
Technische Dokumentation zur Beurteilung von Elektro- und
Elektronikgeräten hinsichtlich der Beschränkung gefährlicher
Stoffe / Technical documentation for the assessment of electrical
and electronic products with respect to the restriction of hazardous
substances
Kö ln , 20.4.2016
Dr. Mi chael Gude, Geschäftsführer / G eneral manager, CEO
5.3Declaration of Conformity
erklärt hiermit, dass die folgenden Produ kte / h ereby declares that the follo wing produ cts
mit den Bestimmung en d er nachstehenden EU-Richtlini en ü b ereinstimmen / are in accordance with th e fol lowing European directives
und dass die n achstehenden harmonisierten Europäischen Normen zur An wendung
gelangt sin d. / and comply with the fol l o wing harmonised European standards.
1. W hat can I do if the device i s no longe r accessib l e?
·
If t he St at us LE D is red, the device has no connection to the swit c h. Unplug and plug
the Ethernet cable. If the Status LED is still red, try ot her switc hes. If one uses no
switc h, but connects e. g. a laptop directly to the device, m ake sure you are using a
cross over Ethernet cable.
·
If t he s t atus LED is orange for a longer tim e after unplugging and plugging the Ethernet
cable, then DHCP is configured, but no DHCP server was found in the network. A fter a
timeout, the last IP address is configured manually.
·
If t here is a phys ical link (s t at us LED is green) to t he devic e, but you can not acces s
the web server, bring the device i nto bootloader mode and search for it with
GBL_Conf.exe. Then check the TCP-IP parameters and change them if necessary.
·
If t he device is not found by GB L_Conf.exe in bootloader mode, you c an reset the s ettings to factory defaults as t he last option.
21
2. W hy does it sometim es take so long to configure new SNMPv3 passwords on
the we b site?
The authentication methods "S HA-384" and "SHA-512" are calc ulated purely in software,
and can not us e t he cry pto hardware. On the configuration page, e.g. " S HA-512", needs
up to 45 seconds to c alc ulate t he k ey .
3. Can you ente r m u l tiple e-mail recipi ents?
·
Yes. In the E-Mail configuration in the Recipient Address field, it is poss ible to enter
multiple e-mail address es separated by c ommas . The input limi t i s 100 characters.