LogTunnel
Deployment Guide
This guide describes the deployment process when using the SiteManager
LogTunnel functions for pushing and/or pulling log data from devices to acentral server.

Version: 1.3, August 2017
Applicable to GateManager and SiteManager version 7.3 or newer

Table of Contents
Version history

3

1.

Introduction

3

1.1.

Advantages of LogTunnel over other solutions

3

1.2.

Ordering (Enabling) LogTunnel

42.

SiteManager connection methods

4

3.

Configuring LogTunnel PULL mode

5

3.1.

LogTunnel Client Pull mode enabling
3.1.1.
LogTunnel enabling for an existing Ethernet agent
3.1.2.
LogTunnel enabled by dedicated LogTunnel agent.

6
6
6

3.2.

Configuring the LogTunnel Master (Pull) Agent

7

3.3.

Linking LogTunnel Device addresses to LogTunnel Clients
3.3.1.
Method 1: Auto assigning LogTunnel Device addresses
3.3.2.
Method 2: Assign specific LogTunnel Device Address
3.3.3.
Method 3: Linking from LogTunnel Client view
3.3.4.
Method 4: List selection from LogTunnel Client view

9
9
10
12
13

4.

Configuring LogTunnel PUSH mode

15

4.1.

LogTunnel Client Push mode enabling

16

4.2.

Configuring the LogTunnel Master (Push) Agent

18

4.3.

Linking LogTunnel Clients to LogTunnel Master4.3.1.
Drag-and-drop Clients onto LogTunnel Master

20
20

5.

Push and Pull for the same devices

22

5.1.

Configuration on SiteManagers

22

5.2.

Configuration on GateManager

23

APPENDIX A. Tech Hints and Known Limitations

25

Larger LogTunnel Device address ranges (Pull mode)

25

Address range entry formats

25

Port range formats

25

Limitations of Listening port and connections
Hardware SiteManager
SiteManager Embedded

25
25
25

Devices requiring the “real” log server address as destination

26

FTP data connections

26

Notices27

LogTunnel Deployment Guide

Page 2 of 27

Version history• 1.0 First release• 1.1. Added section about ordering/enabling section 1.2• 1.2. Port range corrected in Appendix A• 1.3. References to “EasyLogging” changed to “LogTunnel”

1.

Introduction
With distributed industrial equipment, there is often a requirement for persistentconnections to the remote devices from a central log server or SCADA system.
LogTunnel enables you to establish such persistent connections to the same orother SiteManager controlled devices using simple drag-and-drop operations in
the GateManager portal. This function works concurrently and independent of
the standard LinkManager “on-demand” access.
LogTunnel is built upon the existing Static Server and Device Relay mechanisms using the same secure data transport mechanism and suiting the same
purposes. LogTunnel is, however, considerably easier to configure, and can beused on both Cloud based and own/private GateManagers.
On the SCADA or log server side, you must install a SiteManager as a LogTunnel Master, while on the device side, you simply use your existing SiteManagers
to setup LogTunnel Clients for each device.
The remote log components, the LogTunnel Clients, can be either SiteManager hardware or software (SiteManager Embedded with an Extended license).
The solution requires a central LogTunnel Pull Master to be a hardware
SiteManager, while a LogTunnel Push Master, can be either a hardware orsoftware based SiteManager Embedded with an Extended license.
NOTE: LogTunnel will require both the GateManager and the SiteManagers to
be using release 7.2 or later. For Cloud based GateManagers, there may be
special terms for your use of this feature based on potential server load whenusing LogTunnel for constant transmissions of large amounts of data, such asvideo streams. Consult your GateManager hosting provider for details.

1.1. Advantages of LogTunnel over other solutions
 Setup is done by simple drag-and-drop in the central GateManager portal. No routing, firewall or tunnel configuration is required.

 Logging and Programming access (by LinkManager) is supported concurrently and independently of each other.

 No need for public addresses exposed on the Internet. Both Master andClient devices can be installed behind corporate firewalls.

 No dependency of static IP addresses. Both Master and Client devices
can have dynamically assigned IP addresses.

 No problem with conflicting IP subnets at remote sites, which is a com-mon problem with VPN based solutions (even the central site can havesame subnet as the remote sites) All data usage is logged centrally on the GateManager (Enabled with the
LogTunnel/Usage Statistics activation license).

 An operator on the SiteManager can locally control disabling of LinkMan-

ager on-demand access, while retaining the static LogTunnel connections
for uninterrupted surveillance.

LogTunnel Deployment Guide

Page 3 of 27

 Easy setup of logging direction (Pull and/or Push) and port/IP restrictions,for maintaining a high level of security.

 LogTunnel allows full data tunneling for optimum freedom, where mostnon-VPN logging solutions rely on predefined values to be collected andsubmitted (web post)

 On hardware SiteManagers, LogTunnel can access devices on both the
SiteManager Uplink and DEV side. Typically, VPN solutions would only
allow access to the DEV side (aka the LAN interface).

 SiteManager Embedded allows both logging on the device on which

SiteManager Embedded is installed, and on devices in the same network(Note that LogTunnel requires a SM-E Extended license)

1.2. Ordering (Enabling) LogTunnel
LogTunnel is enabled by ordering the LogTunnel/Usage Statistics upgradefrom your point of purchase. Refer to the Enabling and working with Usage
Statistics Guide for details on ordering the upgrade. The same guide gives
details on the benefits of Usage Statistics in general.
Note that even without the license, you can still configure your entire LogTunnel setup per the following, but no traffic will be forwarded until upgradeis active.

2.

SiteManager connection methods
A Hardware SiteManager can be installed in two ways:
1. Separation, where the log server accesses the DEV side of the SiteManager and the SiteManager’s Uplink side is connected to the Internet (either via a corporate network, or directly via the SiteManager’s Uplink2
broadband connection)
LogTunnel Master2. Uplink only, where the Log Server just accesses the Uplink side of the
SiteManager, and the SiteManager uses the corporate network to accessthe Internet. In this case the SiteManager DEV port is not used.

This would be the same setup for a SiteManager Embedded working in
LogTunnel PUSH mode.

LogTunnel Deployment Guide

Page 4 of 27

3.

Configuring LogTunnel PULL mode
The PULL scenario is based on a central log server or SCADA system, actively
collecting data from remote devices.
The principle is that the LogTunnel Master agent creates alias Device addresses on either the DEV or Uplink port that represents the remote devices, and thelog server just connects to these addresses locally.

Example: The agents and values in the following will establish this scenariothat you can return to for better understand the principles:
EasyLog Client1
EasyLog MasterA

172.16.16.23
172.16.16.24
172.16.16.25
172.16.16.26
Log Server
172.16.16.191

WebCAM
192.168.0.96
PC remote172.16.16.101

EasyLog Client2

172.26.2.50

172.26.2.231

PLC1

PLC2

A pair of IP addresses with the same colour depict the LogTunnel Device address (the alias) and the corresponding (real) Device address at the remote site.
For instance: The log server connects to 172.16.16.23 (aka the LogTunnel Device Address) and the connection is forwarded to address 172.16.16.101 (akathe Device Target address)

LogTunnel Deployment Guide

Page 5 of 27

3.1. LogTunnel Client Pull mode enabling
LogTunnel Clients for PULL mode can be enabled on both SiteManager hardware and software models (SiteManager Embedded with Extended license).
There are two methods for enabling LogTunnel Client mode in the SiteManager:
3.1.1. LogTunnel enabling for an existing Ethernet agent
This type of agent could be used for LinkManager access also:

3.1.2. LogTunnel enabled by dedicated LogTunnel agent.
This type of agent is used solely for logging, and cannot be accessed by Linkmanager clients.
Note that the agent will stay “not connected” (N/C) until it is eventually linked toa LogTunnel Master on the GateManager, after which it will go IDLE.

In the examples in the following, we will be working with two SiteManagers
named “EasyLog Client1 and Client2” respectively, with the following agents
configured:
SiteManager: “EasyLog Client1”

SiteManager: “EasyLog Client2”

LogTunnel Deployment Guide

Page 6 of 27

3.2. Configuring the LogTunnel Master (Pull) Agent
1. Enter the SiteManager Agents menu and create a Generic > LogTunnel
Master (Pull) agent; give it a meaning full Device Name (in this case called“PullMaster”) and select the Parameter details icon:

2. Complete the configuration:

 Enter the IP address of the log server. This must be a static IP address.
DNS names cannot be used.
Only the specified Log Server Address will be allowed access to the remotedevices, and is a security precaution for preventing unauthorized access.

 Configure the range of “alias” addresses that should represent the remote devices.

Make sure that no other equipment is using any of the IP addresses in therange, as it may result in unpredictable network behaviour.
In case you do not have enough free addresses in the local network of theserver, you may have to ask your IT department to create a VLAN or via arouter place the SiteManager in a different subnet, and ensure that the log
server has a route to that network.

 You will need to configure the specific ports or port range for TCP ports
and/or UDP ports for the LogTunnel Master to listen on. You can combine
single ports with ranges like this: 23,80,5000-5010. The mandatory indicator* just means that values must be filled in at least one of the fields UDP or
TCP.

LogTunnel Deployment Guide

Page 7 of 27

 You can specify whether the address range should be created on theUplink or the DEV port. (See section 2. SiteManager connection methods). Note that device address range you define must match a valid subnet
on the selected port.

 Idle timeout value in seconds. If left blank the default values will be 120
seconds for TCP connections and 30 seconds for UDP connections. Notethat if entering a value, this value will apply for both UDP and TCP.
3. When clicking Save, Back and Refresh a couple of times you will notice thata warning informs you to attach it on the GateManager. This is a Security
precaution to avoid accidental activation of undesired LogTunnel Device
addresses.

4. Login to the GateManager Portal and locate the LogTunnel Master agent(here named “PullMaster”):

LogTunnel Deployment Guide

Page 8 of 27

3.3. Linking LogTunnel Device addresses to LogTunnel Clients
You have different methods for linking the LogTunnel Master (Pull) Device
Addresses to the LogTunnel Client agents. Try them out and use your preferred method.
3.3.1. Method 1: Auto assigning LogTunnel Device addresses
1. Drag and drop the LogTunnel Client agent to the LogTunnel Master inthe tree view. It will automatically assign the first free address in the
LogTunnel Device Address range:

LogTunnel Deployment Guide

Page 9 of 27

3.3.2. Method 2: Assign specific LogTunnel Device Address
2. Stand on the LogTunnel Master and expand the list of available Logsymbol:
Tunnel Device addresses, by clicking theHint: If you have linked a client to a wrong LogTunnel Device Address,
icon and start over, or you can
you can either delete the link with thesimply drag-and-drop the client to another free address.

LogTunnel Deployment Guide

Page 10 of 27

Drag and drop the LogTunnel Client agent onto the field next to the IP address you want to assign as LogTunnel Device address for this agent:

3. Finally click Save, and you will see the complete list of linked agents:

Hint: Notice that the icons for linked agents change colour from

LogTunnel Deployment Guide

to.

Page 11 of 27

3.3.3. Method 3: Linking from LogTunnel Client view
4. While standing on the LogTunnel Client, drag and drop the pin onto the
LogTunnel Master (Pull) agent, or simply drag and drop the client agent onto the LogTunnel Master in the tree:

5. The LogTunnel Master agent configuration view will automatically expand
and indicate the linked client:

LogTunnel Deployment Guide

Page 12 of 27

3.3.4. Method 4: List selection from LogTunnel Client view
6. As above, while standing on the LogTunnel Client agent, select the available LogTunnel Master:

7. A list of unassigned LogTunnel Device IP addresses will appear to selectfrom:

LogTunnel Deployment Guide

Page 13 of 27

8. With all clients linked, the final view on the LogTunnel Master agent will look
like this. You can always edit the IP assigning by editing the fields directly.

LogTunnel Deployment Guide

Page 14 of 27

4.

Configuring LogTunnel PUSH mode
The PUSH scenario is based on remote devices connecting to a central log
server or SCADA system for delivering log data. An example of such data is
SNMP traps.
A LogTunnel Master for Push mode can be either a hardware SiteManager, or a
SiteManager Embedded activated by an Extended license.
The principle is that the LogTunnel Master instructs the LogTunnel Clients toestablish IP aliases (aka LogTunnel Server Addresses) and listening ports on
the DEV and/or Uplink ports on the SiteManager (or the IP address of a hostdevice having SiteManager Embedded installed), which the industrial devices
will regard as the log server destination.

Example: The agents and values in the following will establish this scenariothat you can return to for better understand the principles:
EasyLog Client1
EasyLog MasterA

172.16.16.179

192.168.0.3

WebCAM
192.168.0.96

PC remote172.16.16.101
Log Server

EasyLog Client2

172.16.16.191

172.26.2.50

172.26.2.35
172.26.2.231

PLC1

PLC2

The red coloured IP addresses on the right side depict the log server IP aliases(aka LogTunnel Server addresses) and the corresponding (real) server address(aka Log Server address) at the remote site on the left side.
For instance: PLC1 connects to 172.26.2.35, and the connection is forwarded toaddress 172.16.16.191 (aka Log Server Address)

LogTunnel Deployment Guide

Page 15 of 27

4.1. LogTunnel Client Push mode enabling
LogTunnel Clients for Push mode can be enabled on both SiteManager hardware and software models (SiteManager Embedded with Extended license).
1. Create a unique LogTunnel Agent (Generic > LogTunnel Client); give it ameaning full Device Name and select the Parameter details icon.

2. Complete the configuration

 Enter the IP address of the device that should access the log server todeliver data. Only one address is allowed per LogTunnel Agent, so you
have to create an agent per device.
 Configure the LogTunnel Server Address that the devices should accessfor being forwarded to the real log server address.

If left blank the DEV address will be assumed as default, but you can configure any address in the same subnet as the DEV or Uplink port, and the
SiteManager will create that “IP alias” as LogTunnel Server Address. You
can also specify the Uplink address, and then this will be used as LogTunnel Server Address.
LogTunnel Deployment Guide

Page 16 of 27

Note that this field is only available on hardware SiteManagers. SiteManager Embedded uses the socket interface of the host platform and it would be
the IP address of the host platforms network adapter matching the subnet ofthe entered Device Address that should be used as LogTunnel Server Address.
3. When pressing Save, note that the agent will stay “not connected” (N/C) until it is eventually linked to a LogTunnel Master on the GateManager, after
which it will go IDLE.

In the examples in the following, we will be working with two SiteManagers
named “EasyLog Client1 and Client2” respectively, with the following named
agents:
SiteManager: “EasyLog Client1”

SiteManager: “EasyLog Client2”

LogTunnel Deployment Guide

Page 17 of 27

4.2. Configuring the LogTunnel Master (Push) Agent
1. Enter the SiteManager Agents menu and create a Generic > LogTunnel
Master (PUSH) agent; give it a meaning full Device Name and select theParameter details icon:

2. Complete the configuration:

 Enter the IP address of the log server. DNS names are not supported.
Only the specified Master Address will be allowed access to, by the remotedevices. This is security precaution for preventing unauthorized access tothe network of the log server.

 You will need to configure the specific ports or port range for TCP ports
and/or UDP ports to listen on. You can combine single ports with ranges
like this ”23,80,5000-5010”. Note that the mandatory indicator * just meansthat values must be filled in at least one of the fields UDP or TCP.
 Idle timeout value in seconds. If left blank the default values will be 120
seconds for TCP connections and 30 seconds for UDP connections. Notethat if entering a value, this value will apply for both UDP and TCP.
3. When clicking Save, Back and Refresh a couple of times, you will noticethat the agent informs you to attach it on the GateManager. This is a Security precaution to avoid accidental access by remote devices.
LogTunnel Deployment Guide

Page 18 of 27

4. Login to the GateManager Portal and locate the LogTunnel Master (Push)agent, and attach it:

LogTunnel Deployment Guide

Page 19 of 27

4.3. Linking LogTunnel Clients to LogTunnel Master4.3.1. Drag-and-drop Clients onto LogTunnel Master
1. While standing on the LogTunnel Client agent, either drag the pin onto the
LogTunnel Master Agent, or simply drag the client agent in the tree onto the
LogTunnel Master.

2. The LogTunnel Master will automatically indicate the newly linked client:

Hint: Notice that the icons for linked agents change colour from

LogTunnel Deployment Guide

to.

Page 20 of 27

3. Continue doing step 1 for all LogTunnel Clients that should access theserver. The last linked agent is highlighted with green.

LogTunnel Deployment Guide

Page 21 of 27

5.

Push and Pull for the same devices
The fundamental principle and use case for LogTunnel is that either the serverend, or the device is initiator for the connection.
The LogTunnel concept does, however, allow both Pull and Push connections
for the same devices. It will just require:a. The central SiteManager to have both a Push and a Pull LogTunnel
Master agent configured,b. The Remote SiteManagers having two LogTunnel enabled agentsfor each device needing both Push and Pull.
For instance, this setup has both Push and Pull enabled for the WebCAM and
PLC2 respectively (Red indicates Push specific information, and Blue/Greenindicates Pull specific information)
EasyLog Client1
EasyLog MasterA

192.168.0.3

WebCAM
192.168.0.96

172.16.16.24
172.16.16.25
Log Server

EasyLog Client2

172.16.16.191
172.26.2.35
172.26.2.231

PLC2

5.1. Configuration on SiteManagers
Configuration on “LogTunnel Client 1”:

Configuration on “LogTunnel Client 2”:

Configuration on “EasyLog MasterA” (after agents are attached):

LogTunnel Deployment Guide

Page 22 of 27

5.2. Configuration on GateManager
Before linking agents on the GateManager the setup looks like this:When the “Pull” client agents have been linked to the “PullMaster” ref. thedescriptions in section 3.3 Linking LogTunnel Device addresses to LogTunnel Clients, it looks like this.

Notice that the icons for the agent have changed colour from

LogTunnel Deployment Guide

toPage 23 of 27

When the “Push” client agents have been linked to the “PushMaster” ref. thedescriptions in section 4.3 Linking LogTunnel Clients to LogTunnel Master it looks like this:

LogTunnel Deployment Guide

Page 24 of 27

APPENDIX A. Tech Hints and Known Limitations
Generally, you should consider the LogTunnel connections being connections
for specific ports or limited port ranges. Do NOT expect simulating a traditional
VPN connection using EasyLog.

Larger LogTunnel Device address ranges (Pull mode)
A LogTunnel Device address range (IP aliases) will always support the last octet regardless of the class. E.g. a class B subnet range of 192.168.1.100 192.168.2.250 / 255.255.0.0 would consist of 404 available addresses, but the
SiteManager will only create 254 addresses. If the full range should be support,
you must create two LogTunnel Master (Pull) agents; one with the IP range
192.168.1.100-254 and the other with IP range 192.168.2.1-250.

Address range entry formats
Address ranges can be entered in three different formats:
1. 192.168.200.11 (single address)
2. 192.168.200.11-75 (65 IP addresses starting from .11)
3. .11-75 (same as above but will always match DEV1 subnet)

Port range formats
Port range can be entered in three different formats:
1. 8001-8100 (100 ports starting from 8001)
2. 8001-100 (100 ports starting from 8001)
3. 0-65536 (all ports)

Limitations of Listening port and connections
Hardware SiteManager
For SiteManager Hardware models there is a limit of max. 16 single ports
and/or port ranges. If wanting to open for all ports, enter 0-65536.
SiteManager Embedded
On SiteManager Embedded there is a limit to a total of 16 ports. If e.g. specifying TCP ports 23,80,5000-5100 effectively only the ports 23,80,5000-5013 will
be opened only.
Also, note that TCP ports have preference over UDP ports. So, if TCP ports
23,80,5000-5010 is configured together with UDP port 8000-8010, then all the
TCP ports will be opened but only UDP port 8000-8003.
As SiteManager Embedded relies on the native socket API of the OS on which
it is installed, SiteManager Embedded is limited with regards to the number ofconcurrent connections. There is a hard limit of max 20 connections per agent(e.g. a web browser would create multiple connections on the same port
80/443). The total number of connections (agents x 20 connections) may also
be limited of the hosting OS. For instance, on Microsoft Windows, the current
limit is 256.
You can check the log of the SiteManager to troubleshoot if you encounter issues that you suspect may be caused by these limitations.

LogTunnel Deployment Guide

Page 25 of 27

Devices requiring the “real” log server address as destination
In case a PLC would require (or is programmed for) accessing the genuine
IP address of the log server (e.g. 172.16.16.191) but its own address is in
another subnet (e.g. 192.168.0.96), you will need to configure the log server
address as LogTunnel Server address on the LogTunnel Client agent of theremote SiteManager. For the SiteManager to create the LogTunnel Server
alias with another subnet than the SiteManager’s DEV port, you will need tomanually create the Alias in the SiteManager:

Note that this is only support on a hardware SiteManager. Also note that thedevice connecting to the log server must have the SiteManagers DEV1 IP
address as default gateway.

FTP data connections
SiteManager and SiteManager Embedded support both Active and Passivemode as long as the initial FTP control connection is on port 21. SiteManager is“FTP aware”, which means you do not have to configure additional ports associated with the FTP protocol (such as port 20 or > 1023).

LogTunnel Deployment Guide

Page 26 of 27

Notices
Publication and copyright© Copyright Secomea A/S 2016-2017. All rights reserved. You may download
and print a copy for your own use. As a high-level administrator, you may use
whatever you like from contents of this document to create your own instructions for deploying our products. Otherwise, no part of this document may becopied or reproduced in any way, without the written consent of Secomea A/S.
We would appreciate getting a copy of the material you produce in order tomake our own material better and – if you give us permission – to inspire otherusers.

Trademarks
SiteManager™, LinkManager™ and GateManager™ are trademarks of
Secomea A/S. Other trademarks are the property of their respective owners.

Disclaimer
Secomea A/S reserves the right to make changes to this publication and to the
products described herein without notice. The publication of this document does
not represent a commitment on the part of Secomea A/S. Considerable effort
has been made to ensure that this publication is free of inaccuracies and omissions but we cannot guarantee that there are none.
The following paragraph does not apply to any country or state where such provisions are inconsistent with local law:
SECOMEA A/S PROVIDES THIS PUBLICATION "AS IS" WITHOUTWARRANTY OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING,
BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
OR FITNESS FOR A PARTICULAR PURPOSE
SECOMEA A/S SHALL NOT BE LIABLE FOR ANY DIRECT, INDIRECT,INCIDENTAL, CONSEQUENTIAL, OR OTHER DAMAGE ALLEGED IN
CONNECTION WITH THE FURNISHING OR USE OF THIS INFORMATION.

Secomea A/S
Denmark
CVR No. DK 31 36 60 38
E-mail: sales@secomea.com
www.secomea.com

LogTunnel Deployment Guide

Page 27 of 27