Read this document and the documents listed in the additional resources section about installation, configuration, and
operation of this equipment before you install, configure, operate, or maintain this product. Users are required to
familiarize themselves with installation and wiring instructions in addition to requirements of all applicable codes, laws,
and standards.
Activities including installation, adjustments, putting into service, use, assembly, disassembly, and maintenance are required
to be carried out by suitably trained personnel in accordance with applicable code of practice.
If this equipment is used in a manner not specified by the manufacturer, the protection provided by the equipment may be
impaired.
In no event will Rockwell Automation, Inc. be responsible or liable for indirect or consequential damages resulting from the
use or application of this equipment.
The examples and diagrams in this manual are included solely for illustrative purposes. Because of the many variables and
requirements associated with any particular installation, Rockwell Automation, Inc. cannot assume responsibility or
liability for actual use based on the examples and diagrams.
No patent liability is assumed by Rockwell Automation, Inc. with respect to use of information, circuits, equipment, or
software described in this manual.
Reproduction of the contents of this manual, in whole or in part, without written permission of Rockwell Automation,
Inc., is prohibited.
Throughout this manual, when necessary, we use notes to make you aware of safety considerations.
WARNING: Identifies information about practices or circumstances that can cause an explosion in a hazardous environment,
which may lead to personal injury or death, property damage, or economic loss.
ATTENTION: Identifies information about practices or circumstances that can lead to personal injury or death, property
damage, or economic loss. Attentions help you identify a hazard, avoid a hazard, and recognize the consequence.
Identifies information that is critical for successful application and understanding of the product.
Labels may also be on or inside the equipment to provide specific precautions.
SHOCK HAZARD: Labels may be on or inside the equipment, for example, a drive or motor, to alert people that dangerous
voltage may be present.
BURN HAZARD: Labels may be on or inside the equipment, for example, a drive or motor, to alert people that surfaces may
reach dangerous temperatures.
ARC FLASH HAZARD: Labels may be on or inside the equipment, for example, a motor control center, to alert people to
potential Arc Flash. Arc Flash will cause severe injury or death. Wear proper Personal Protective Equipment (PPE). Follow ALL
Regulatory requirements for safe work practices and for Personal Protective Equipment (PPE).
Allen-Bradley, Rockwell Software, Rockwell Automation,, ControlFLASH, ControlLogix, FactoryTalk View, FLEX, Logix5000, POINT I/O, PowerFlex, RSLinx, RS View, and Studio 5000 are trademarks of Rockwell
Automation, Inc.
Trademarks not belonging to Rockwell Automation are property of their respective companies.
Summary of Changes
This manual contains new and updated information. Changes throughout this
revision are marked by change bars, as shown to the right of this paragraph.
New and Updated
Information
This table contains the changes made to this revision.
Top icPag e
Clearer information on configuring an L2TP connection for a secure tunnel
between the 1756-EN2TSC module and a Windows client
Chapter 3
Rockwell Automation Publication ENET-UM003B-EN-P - September 20133
Summary of Changes
Notes:
4Rockwell Automation Publication ENET-UM003B-EN-P - September 2013
6Rockwell Automation Publication ENET-UM003B-EN-P - September 2013
Preface
The 1756-EN2TSC is a security-enhanced version of the 1756-EN2T
EtherNet/IP communication module. This module is designed for applications
that need to limit network access to a control system from within the plant
network. This module is not intended to connect any devices in the local 1756
backplane to devices outside of the plant firewall.
Additional Resources
These documents contain additional information concerning related products
from Rockwell Automation.
ResourceDescription
1756 ControlLogix Communication Modules Specifications Technical Data, publication
1756-TD003
EtherNet/IP Network Configuration User Manual, publication ENET-UM001
Industrial Automation Wiring and Grounding Guidelines, publication 1770-4.1
Product Certifications website, http://www.ab.comDeclarations of conformity, certificates, and other certification details
Specifications for ControlLogix communication modules
Guidelines for configuring EtherNet/IP network parameters
Guidelines for installing EtherNet/IP modules
Guidelines for Ethernet networks
Guidelines for installing a Rockwell Automation industrial system
You can view or download publications at
http:/www.rockwellautomation.com/literature/
. To order paper copies of
technical documentation, contact your local Allen-Bradley distributor or
Rockwell Automation sales representative.
Rockwell Automation Publication ENET-UM003B-EN-P - September 20137
Preface
Notes:
8Rockwell Automation Publication ENET-UM003B-EN-P - September 2013
Chapter 1
Enterprise Zone
Levels 4 and 5
Demilitarized Zone (DMZ)
Demilitarized Zone (DMZ)
Manufacturing Zone
Site Manufacturing
Operations and Control
Level 3
Level 0…2
Secure Tunnel Between 1756-EN2TSC
Module and Windows 7 Client.
Peer-to-Peer Secure Tunnel
Between 1756-EN2TSC Modules
ControlLogix Chassis with
1756-EN2TSC Module
Secure Tunnel Between 1756-EN2TSC
Module and VPN Appliance
Secure Communication Architecture
Top icPag e
Network Access Security12
Performance14
Many control systems currently use 1756-EN2T and 1756-ENBT modules to
connect ControlLogix® systems to plant-level systems. A 1756-EN2TSC module
offers the same connectivity, as well as additional security options to protect
access to resources on the local backplane from the plant network Use the
1756-EN2TSC module to establish secure tunnels with peer modules,
Windows 7 clients, and VPN appliances.
Rockwell Automation Publication ENET-UM003B-EN-P - September 20139
Chapter 1Secure Communication Architecture
The 1756-EN2TSC module provides a level of protection against unauthorized
network access, either malicious or accidental, to a ControlLogix controller via
an EtherNet/IP connection. The 1756-EN2TSC module uses the IPsec protocol
suite to provide a secure communication tunnel.
The 1756-EN2TSC module is intended for use behind an existing
firewall/DMZ that protects the plant network from outside access. This module
is not intended to be connected directly to the public Internet or to provide a
mechanism by which remote access is provided to a network. The module does
not provide the ability to expose a private network address range via IPsec; only
the module’s IP address is available.
Considerations
Out-of-the-box, the module functions just like a 1756-EN2T module, except
that the module does not support the following :
• Integrated motion on EtherNet/IP networks
• ControlLogix redundancy systems
• SIL 2 applications
• Email capabilities
• EtherNet/IP socket interface
Once security is enabled, modules like POINT I/O™ adapters, FLEX™ I/O
adapters, and PowerFlex® drives are not able to establish a secure connection
because they do not support secure tunnels.
When security is enabled, the module connects with:
• Upper level systems and user workstations with Windows 7 operating
systems
• Cisco ASA security appliances
• Other 1756-EN2TSC modules
The module supports the current versions of common web browsers, such as
Internet Explorer (8 and 9). For security reasons, Secure Sockets Layer (SSL) 2.0
is disabled in the module. Browsers must enable support for cryptographic
protocols SSL 3.0 or Transport Layer Security (TLS) 1.0.
The 1756-EN2TSC module lets only those devices with proper credentials
access the module. This module is intended for use behind an existing
firewall/DMZ that protects the plant network from outside access.
To minimize complexity, the module supports the following authentication and
encryption methods.
• IPsec technology with as many as 8 VPN tunnels (only one of which can
be a Cisco ASA connection)
• Pre-shared key authentication
• AES encryption (128, 192, and 256 bit)'
10Rockwell Automation Publication ENET-UM003B-EN-P - September 2013
Secure Communication ArchitectureChapter 1
Local Chassis Security
You can use the 1756-EN2TSC module with the following features to prevent
unauthorized access to a controller in the local chassis.
• The trusted slot feature (in the controller properties) designates slots in
the local chassis as trusted. When the trusted slot feature is enabled, the
controller denies communication through paths that are not trusted. This
requires authentication to the module for anyone to access the controller
with programming software.
• The serial number lock feature (in the 1756-EN2TSC module properties)
in conjunction with the trusted slot features restricts communication
through a module in the trusted slot with the specific serial number.
Rockwell Automation Publication ENET-UM003B-EN-P - September 201311
Chapter 1Secure Communication Architecture
IMPORTANT
IMPORTANT
EtherNet/IP™
RUNSDOKFORCE
Logix5575
EtherNet/IP™
DeviceNet Access via 1756-DNB
EtherNet/IP Access via 1756-EN2T
Secure Plant Network Access via
1756-EN2TSC
ControlLog ix
Chassis
The trusted slot and serial number lock features are for applications that have
concern with physical access to and tampering with the controller.
Use caution with these features and make sure you have the controller project backed up in a
secure location. If the module becomes disabled for any reason, you have to download to the
controller to recover.
Network Access Security
The 1756-EN2TSC module uses the Internet Protocol Security (IPsec)
technology to provide secure communication over the Ethernet network. IPsec is
widely-deployed, and is often used to create Virtual Private Networks (VPN).
IPsec provides the following security features:
• Authentication of the communication end points (both client and server)
• Data authenticity and integrity (via message integrity checks)
• Data confidentiality (via encryption algorithms)
Use of the IPsec protocol suite lets you use the Microsoft Windows VPN client
to connect securely to the module. IPsec also lets the module create secure
tunnels with other 1756-EN2TSC modules and with off-the-shelf, VPN
appliances.
The module does not provide access to a private network.
While the module supports secure communication, the module is not intended
to be connected directly to the public Internet and provide a VPN function, or be
the mechanism by which remote access is provided to a network. The module
does not provide the ability to expose a private network address range via
IPsec—only the module’s IP address is available.
12Rockwell Automation Publication ENET-UM003B-EN-P - September 2013
The module does the following:
• Secures access to the controller and I/O modules in the local chassis
• Secures bridge access to other networks accessible within the local chassis
As part of establishing the secure tunnel, both endpoints must authenticate with
each other and exchange information to ensure secure data transfer. When
security is enabled, the module is able to connect only with the following:
• Upper level systems and user workstations with Windows 7 operating
systems
• Cisco ASA security appliances
• Other 1756-EN2TSC modules
IPsec Association
Once the IPsec association is established, data between the two endpoints is fully
encrypted (except for produced/consumed tags) or optionally sent unencrypted,
but with a cryptographic message integrity code.
CapabilityDescription
Authentication MethodPre-shared key (PSK). Configure a secret key on each of the endpoints.
Header FormatEncapsulating Security Payload (ESP)
ModeTunnel mode, default
Transport mode if the module cannot negotiate tunnel mode (such as a Microsoft Windows 7 client)
Internet Key Exchange• IKE version 1
• IKE version 2
Lifetime(s)IKE and IPsec lifetimes user-configurable
PFS GroupNone
DH Key GroupGroup 2 = modp1024, default
Groups 5,14,15,16,17, and 18 supported
IKE Encryption Algorithm• AES(128 bit)
• AES(192 bit)
• AES(256 bit)
IKE Authentication AlgorithmSHA-1
IPsec Encryption Algorithm• AES(128 bit)
• AES(192 bit)
• AES(256 bit)
• None
IPsec Authentication AlgorithmSHA-1
Secure Communication ArchitectureChapter 1
As long as the IPsec traffic is received, the connection is considered alive. Your
VPN connection can recover without having to re-authenticate if you lose your
connection for a very short period of time (few seconds). However, if the time
since the last received packet is greater than the timeout interval, the connection
times out. This interval is common to all IPsec connections and is not
configurable. The default keepalive-timeout is 30 seconds.
Rockwell Automation Publication ENET-UM003B-EN-P - September 201313
Chapter 1Secure Communication Architecture
Performance
The basic communication capability of the module is the same as the
1756-EN2T module.
• The module supports the same number of TCP and CIP connections as
the 1756-EN2T module (256 CIP connections and 128 TCP/IP
connections).
• The module supports configuration of IPsec associations with as many as
8 IP addresses (devices); only 1 of which can be a Cisco ASA connection.
• The module supports CIP Sync communication.
Traffic Filtering
When IPsec is enabled, the module blocks traffic that is not received via a VPN
client, another peer with an IPsec connection, or an appliance with an IPsec
connection, with these exceptions:
• BOOTP/DHCP traffic (to let the module obtain an IP address)
• HTTPS traffic (needed to configure the module)
• CIP Sync packets (you have the option to disable CIP Sync)
• Logix produced/consumed tags (the establishment of the
produced/consumed connection occurs over via IPsec)
• 1756 I/O connections in a remote chassis
If the 1756-EN2TSC module is the trusted slot for a ControlLogix chassis, the
following traffic to the controller must go through the 1756-EN2TSC module.
• RSLinx® Classic traffic (such as Studio 5000™ and ControlFLASH
communication)
• RSLinx Enterprise traffic (such as FactoryTalk View® SE and
FactoryTalk View ME communication)
14Rockwell Automation Publication ENET-UM003B-EN-P - September 2013
Get Started
IMPORTANT
Top icPag e
Initial Powerup16
Configuration Overview18
Assign Network Settings19
Configuration Overview18
Create User Accounts21
Generate HTTPS Certificate23
Backup / Restore25
Chapter 2
This chapter describes the initial configuration settings required for the module.
After setting up the module, see the next chapters for security configuration
examples.
For information on installing the module, see EtherNet/IP Network Modules
Installation Instructions, publication ENET-IN002
.
Add the module to a controller project the same as you add a 1756-EN2T
module. All security-related configuration is via the module web pages.
When you finish using the web pages, close the web browser. This prevents any
user on a shared computer from accessing the web pages.
Rockwell Automation Publication ENET-UM003B-EN-P - August 201315
Chapter 2Get Started
Specify the IP address of the web
server module in the Address
window of your web browser.
This is the module’s Home page.
IMPORTANT
Configure all security parameters via the web server. In the Address field of your
web browser, enter the IP address that displays on the front of the module.
'The 1756-EN2TSC module has an embedded HTTPS server that it uses to
provide secure web communication. An HTTPS server uses a certificate so that
the client can verify server authenticity. For web sites connected to the Internet,
certificates are normally signed by a trusted certificate authority. Web browsers
are then able to verify the authenticity of the web server by virtue of its certificate.
Initial Powerup
The module comes with a self-signed certificate because the module is not
directly connections to the Internet. Self-signed certificates are not signed by a
known, trusted authority, so they must explicitly be accepted by the user when
connecting via the web browser.
On initial powerup, the module generates a new certificate for the embedded
HTTPS server. This can take up to several minutes. During this process, the
message ‘SSL certificate generation in progress’ is shown on the module display.
Wait until the module is fully booted and ‘OK’ is shown on the display before
accessing the module by using a web browser.
1. In the Address field of your web browser, enter the IP address that displays
on the front of the module.
When you enter the IP address, you must enter the prefix https:// in the
address. If you enter an http:// prefix, the module redirects to the
https:// prefix.
16Rockwell Automation Publication ENET-UM003B-EN-P - August 2013
Get StartedChapter 2
IMPORTANT
2. After the web browser connects to the server, a warning message is shown
about the certificate not being signed by a trusted authority.
Accept this message and continue to the web page.
In general, do not accept the certificate not being signed by a trusted authority.
But in the case of initial powerup, the module has a self-signed certificate, so
continue to the website even though the message says this option is not
recommended.
The self-signed certificate warning continues to display unless you add the
certificate to the list of exceptions for the web browser.
3. After accepting the self-signed certificate, enter the user name and
password.
Rockwell Automation Publication ENET-UM003B-EN-P - August 201317
Chapter 2Get Started
Default Credentials
Default credentials are case sensitive and are as follows:
• User name : Administrator
• Password: admin
You are prompted to change the password on the Administrator account. Enter
the new password and click Change.
The browser prompts you to authenticate again. Use the Administrator user
name and new password.
Configuration Overview
The left pane of the web browser is a navigation tree to configure and maintain
the module.
18Rockwell Automation Publication ENET-UM003B-EN-P - August 2013
Get StartedChapter 2
IMPORTANT
See the next chapters in this manual for different security configurations.
Assign Network Settings
By default, the module is BOOTP enabled.
Do not simply configure the initial address assigned to the module as a
static IP address. Contact your network administrator for an appropriate
static IP address.
Choose one of the following methods to assign an IP address.
• Rotary switches on the module (before you install the module)
• Rockwell BOOTP/DHCP utility (available with RSLinx and
Studio 5000 software)
• RSLinx software
• Studio 5000 software
For information on assigning network parameters, see EtherNet/IP Network
Configuration User Manual, publication ENET-UM001
.
Change Network Settings via the Module Web Page
Choose Administrative Settings > Device Configuration > Network
Configuration. An authenticated user can modify network parameters.
Rockwell Automation Publication ENET-UM003B-EN-P - August 201319