Secure Deployment Guide
GFK-2830AA
Nov 2022

PACSystems™ RXi, RX3i and RSTi-EP
Controller Secure Deployment Guide

PACSystems™ RXi, RX3i and RSTi-EP Controller Secure Deployment Guide Warnings and Cautions
GFK-2830AA

Nov 2022

Warnings and Caution Notes as Used in this Publication
WARNING
Warning notices are used in this publication to emphasize that hazardous voltages, currents, temperatures, orother conditions that could cause personal injury exist in this equipment or may be associated with its use.
In situations where inattention could cause either personal injury or damage to equipment, a Warning notice isused.

CAUTION
Caution notices are used where equipment might be damaged if care is not taken.

Note:

Notes merely call attention to information that is especially significant to understanding and operating theequipment.

These instructions do not purport to cover all details or variations in equipment, nor to provide forevery possible contingency to be met during installation, operation, and maintenance. The information
is supplied for informational purposes only, and Emerson makes no warranty as to the accuracy of theinformation included herein. Changes, modifications, and/or improvements to equipment andspecifications are made periodically and these changes may or may not be reflected herein. It is
understood that Emerson may make changes, modifications, or improvements to the equipment
referenced herein or to the document itself at any time. This document is intended for trained
personnel familiar with the Emerson products referenced herein.

Emerson may have patents or pending patent applications covering subject matter in this document.
The furnishing of this document does not provide any license whatsoever to any of these patents.

Emerson provides the following document and the information included therein as-is and without
warranty of any kind, expressed or implied, including but not limited to any implied statutory warrantyof merchantability or fitness for particular purpose.

Warnings and CautionsiPACSystems™ RXi, RX3i and RSTi-EP Controller Secure Deployment Guide
GFK-2830AA

Contents

Nov 2022

Contents
Contents................................................................................................................................................ ii
Section 1:
1.1

About this Guide ................................................................................................... 1
Revisions in this Manual .................................................................................................. 2

Section 2:

Introduction .......................................................................................................... 5

2.1

What is Security? ............................................................................................................... 5

2.2

I have a firewall. Isn’t that enough? ............................................................................... 5

2.3

What is Defense in Depth? ............................................................................................... 5

2.4

General Recommendations.............................................................................................. 6

2.5

Checklist ............................................................................................................................. 6

2.6

Related Documentation ................................................................................................... 7

Section 3:
3.1

Communication Requirements ........................................................................... 9
Protocols Supported ......................................................................................................... 9

3.1.1

Ethernet Protocols ........................................................................................................... 9

3.1.2

Serial Protocols ...............................................................................................................123.2

Service Requests ............................................................................................................. 13
3.2.1

SRTP..................................................................................................................................14

3.2.2

SNP ...................................................................................................................................14

3.3

Server ............................................................................................................................... 16
3.3.1

Web Server ......................................................................................................................17

3.4

Client ................................................................................................................................ 18

3.5

PROFINET ......................................................................................................................... 19
3.5.1

Installing an I/O Device .................................................................................................19

3.5.2

Network Discovery & Device Identification ................................................................19

3.5.3

Using an I/O device ........................................................................................................20

3.6

IEC 61850 .......................................................................................................................... 20
3.6.1

Installing an IED –Intelligent Electronic Device (IEC 61850 Server) ........................20

3.6.2

Using an IED....................................................................................................................20

3.7

Ethernet Firewall Configuration.................................................................................... 21
3.7.1

Lower-level Protocols ....................................................................................................21

3.7.2

Application Layer Protocols ..........................................................................................21

Section 4:
4.1

Security Capabilities ........................................................................................... 25
Capabilities by Product................................................................................................... 25

4.1.1

PACSystems RXi modules ..............................................................................................25

4.1.2

PACSystems RX3i Modules............................................................................................25

4.1.3

PACSystems RSTi-EP Modules ......................................................................................26

4.2

Access Control and Authorization ................................................................................. 27
4.2.1

Authorization Framework .............................................................................................27

4.2.2

Specifying Access Rights ...............................................................................................28

4.2.3

Enforcement ...................................................................................................................33

Introductionii

PACSystems™ RXi, RX3i and RSTi-EP Controller Secure Deployment Guide Warnings and Cautions
GFK-2830AA

Nov 2022

4.2.4
4.3

Protecting User Logic ....................................................................................................33

Authentication ................................................................................................................ 34
4.3.1

Summary .........................................................................................................................34

4.3.2

Plaintext Login ................................................................................................................36

4.3.3

Secure Login ...................................................................................................................36

4.3.4

Recommendations .........................................................................................................37

4.4

Password Management .................................................................................................. 39

4.5

Confidentiality and Integrity ......................................................................................... 42
4.5.1

Communications Protocols ..........................................................................................42

4.5.2

Firmware Signatures .....................................................................................................43

4.5.3

Logging and Auditing ....................................................................................................44

Section 5:
5.1

Configuration Hardening................................................................................... 45
Controller ......................................................................................................................... 45

5.1.1

Serial Port Protocols ......................................................................................................45

5.1.2

Modbus TCP Server ........................................................................................................45

5.2

Ethernet Interface .......................................................................................................... 46

5.3

PROFINET Controller ....................................................................................................... 47

5.4

OPC UA ............................................................................................................................. 47

5.5

DNP3 Outstation ............................................................................................................. 47

Section 6:

Network Architecture and Secure Deployment .............................................. 48

6.1

Reference Architecture .................................................................................................. 48

6.2

Remote Access and Demilitarized Zones (DMZ) ........................................................... 50

6.3

Access to Process Control Networks ............................................................................. 50

6.4

Access to PROFINET Networks ...................................................................................... 51

6.5

Hot Standby CPU Redundancy with PROFINET IO ....................................................... 51

6.6

Access to IEC 61850 Networks ....................................................................................... 53

6.7

Hot Standby CPU Redundancy with DNP3 Outstation ................................................ 53

Section 7:

Other Considerations ......................................................................................... 55

7.1

Patch Management......................................................................................................... 55

7.2

Real-time Communication ............................................................................................. 55

7.3

RXi Compensating Controls ........................................................................................... 55
7.3.1

7.4

RSTi-EP Compensating Controls .................................................................................... 56
7.4.1

7.5

Contents

Network Bandwidth Limiting .......................................................................................55
Network Bandwidth Limiting .......................................................................................56

Additional Guidance ....................................................................................................... 56
7.5.1

Protocol-specific Guidance ...........................................................................................56

7.5.2

OPC UA Server ................................................................................................................57

7.5.3

PROFINET Controller Duplicate IP ...............................................................................57

7.5.4

Controller Ethernet Duplicate IP ..................................................................................57

7.5.5

MRP Ring Ethernet Traffic Storm Prevention .............................................................58

7.5.6

Government Agencies and Standards Organizations ..............................................59
iii

PACSystems™ RXi, RX3i and RSTi-EP Controller Secure Deployment Guide Warnings and Cautions
GFK-2830AA

Nov 2022

7.6

General Contact Information ........................................................................................ 60

7.7Technical Support ........................................................................................................... 60

Contentsiv

PACSystems™ RXi, RX3i and RSTi-EP Controller Secure Deployment Guide
GFK-2830AA

Section 1:

Section 1

Nov 2022

About this Guide

This document provides information that can be used to help improve the cyber securityof systems that include PACSystems products. It is intended for use by control engineers,
integrators, IT professionals, and developers responsible for deploying and configuring
PACSystems™ products.
Secure deployment information is provided in this manual for the following PACSystems
products:
FamilyCatalog Number

RXi Controller

ICRXICTL000
IC695CPE302
IC695CPE305

RX3i CPU with embedded
Ethernet Interface

IC695CPE310
IC695CPE330
IC695CPE400
IC695CPL410
IC695CPU310
IC695CPU315

RX3i CPUIC695CPU320
IC695NIU001
IC695NIU001+ versions –AAAA and later

RX3i Redundancy CPU

IC695CRU320
IC695ETM001

RX3i Ethernet Interface

IC695EDS001
IC695EIS001

RX3i PROFINET®
Controller
RX3i IEC 61850 Ethernet
Communication Module
RSTi-EP CPU withembedded Ethernet
Interface
RSTi-EP CPU withembedded Ethernet
Interface

IC695PNC001
IC695ECM850
EPSCPE100EPSCPE115

EPXCPE205
RSTi-EP Enhanced
Performance Backplane

EPXCPE210
EPXCPE215
EPXCPE220
EPXCPE240

About this Guide

1

PACSystems™ RXi, RX3i and RSTi-EP Controller Secure Deployment Guide
GFK-2830AA

1.1

Section 1

Nov 2022

Revisions in this Manual
Note: A given feature may not be implemented on all PACSystems Ethernet interfaces. To
determine whether a feature is available on a given model and firmware version, pleaserefer to the Important Product Information (IPI) document provided with the product.

Rev

Date

Description
•

AA

Z

Nov 2022

Feb 2020

X

Nov 2019

W

CPE210, CPE215, CPE220, and CPE240•

Updates for the release of CPE310-Bxxx•

Updates for ‘Legacy Client/Server Protocol Memory Access’

Jul 2022

Y

Aug 2019

Added RSTi-EP w/Backplane Controllers: EPXCPE205,

feature.
•Updates for the release of CPE302-Bxxx and CPE305-Bxxx.

•

Updates for CPE100, CPE115 security capabilities, SNTP,
and network bandwidth limiting.

•Updated to include DNP3 Protocol Support on
CPE400/CPL410 and CPE115.

•

Added ETM001-Kxxx and OPC UA Security•

Added Serial Protocols Support and Updated Security
Capabilities of RSTi-EP Controllers.

About this Guide

V

Jul 2018•

Added CPL410 Rackless CPU w/LinuxU

Apr 2018•

Added CPE115 moduleT

Feb 2018•

Added CPE302, CPE400 Serial I/O support, and CPE330 /S

Dec 2017

R

Oct 2017

P

Aug 2017

N

May 2017

M

Apr 2017

L

Dec 2016

K

Jun 2016

CPE400 firmware update password management.
•

Added notes for IC695PNC001 versions -Ax and -Bxxx (Rx3i
PROFINET IO Controller module).

•

Updated to include CPE400 and Hot Standby Redundancy
with PROFINET IO.

•

Updated to include MRP support for RSTi-EP CPE100.

•

Updated to include references to the RSTi-EP Standalone
controller CPE100.

•

Updated Ethernet Protocols to include SNTP for CPE305,
CPE310, CPE330, and CPE400•

Updated multiple sections to include references to the
CPE400.

•Updated section PROFINET Controller Duplicate IP to include
IC695PNC001 in the discussion.

2

PACSystems™ RXi, RX3i and RSTi-EP Controller Secure Deployment Guide
GFK-2830AA

Rev

Date

Section 1

Nov 2022

Description•

Updated the table•

Supported Ethernet Protocols RXi and RX3i Modules for theIC695CPE330.

•

Added new sections:••

OPC UA Server•

PROFINET Controller Duplicate IP•Controller Ethernet Duplicate IP•

The Controller IP conflict detection mechanism detects the duplicate IP
address for the Embedded Ethernet interface of the RSTi-EP CPE205,
CPE210, CPE215, CPE220, and CPE240 controllers.
The IP conflict detection mechanism works bygenerating an ARP message every two minutes to see
if any devices on the network have the same IP
address.
The IP conflict detection mechanism detects a network
device that has the same IP Address as its own in thefollowing scenarios:
1.

When a duplicate IP Address is detectedduring power-up, or upon new hardware
configuration, the Controller will log a faultJ

for itself to indicate Duplicate IP Address

May 2016

Detected.
1.

During controller operation when aduplicate IP Address is detected whenevera new device with a conflicting IP Address
announces its presence on the network,
the Controller will log a fault for itself toindicate Duplicate IP Address Detected.

Whenever an IP Address conflict exists, IP-based
network communication with the device(s) may be
disrupted. The IP Address conflict should be resolved
by disconnecting one of the offending devices fromthe network or assigning each a unique address. The
Duplicate IP Address Detected fault lists the MAC
address of the offending devices in the Fault Extra
Data.
Whenever the IP Address conflict is resolved, theController will log a Duplicate IP Address Resolved fault.
PME provides a configurable parameter named "Enable
IP conflict detection." If this parameter is enabled, thenthe IP Conflict is checked periodically. Otherwise, theperiodic check for IP conflicts is disabled (that means,
IP conflicts can still exist, but no faults are logged).

H
About this Guide

Apr 2016•

MRP Ring Ethernet Traffic Storm Prevention•

Added information for support of the IC695EDS001 andIC695EIS001 modules
3

PACSystems™ RXi, RX3i and RSTi-EP Controller Secure Deployment Guide
GFK-2830AA

Rev

Date

G

Feb 2016

F

Dec 2015

Section 1

Nov 2022

Description•

Updated password recommendations for Enhanced Security.

•

Updated RX7i Modules table information•

Updated the information in the section•

General Recommendations.

•

Added "OPC UA Server" as a supported protocol for some
PACSystems CPUs.

•

Encouraged the use of the Memory Protection Switch.
Added recommendations for compensating controls whenE

protocols are used with weak or no authentication.

Nov 2015•

Added a reference equating the Reference Architecture to the
Purdue Model.

•

Added specific compensating controls for the RX7i ETM module
and RXi.

D

Aug 2015•

Updated information in the table,•

Supported Ethernet Protocols RXi and RX3i Modules for IC695CPE330
to include Ethernet Global Data.

About this Guide•

Updated information for IC695PNC001 and added second security-C

Jun 2015

B

Mar 2015•

Added information for the support of the IC695CPE330 CPU.

A

Nov 2014•

Added information for support of the IC695ECM850 module

specific fault information.

4

PACSystems™ RXi, RX3i and RSTi-EP Controller Secure Deployment Guide
GFK-2830AA

Section 2:

Section 2

Nov 2022

Introduction

This section introduces the fundamentals of security and secure deployment.

2.1

What is Security?
Security is the process of maintaining the confidentiality, integrity, and availability of asystem:• Confidentiality: Ensure only authorized individuals can access the information.
• Integrity: Data is not modified or removed by unauthorized individuals.
• Availability: Ensure the system and data are available when and where it is needed.
Emerson recognizes the importance of building and deploying products with theseconcepts in mind and encourages customers to take the appropriate care in securing
their Emerson products and solutions.
Note: As Emerson product vulnerabilities are discovered and fixed, security advisories areissued to describe each vulnerability in a particular product version as well as the version
in which the vulnerability was fixed. Emerson Product Security Advisories can be found at
the following location:
https://www.Emerson.com/Industrial-Automation-Controls/support

2.2

I have a firewall. Isn’t that enough?
Firewalls and other network security products, including Data Diodes and Intrusion
Prevention Devices, can be an important component of any security strategy. However, astrategy based solely on any single security mechanism will not be as resilient as one
that includes multiple, independent layers of security.
Therefore, Emerson recommends taking a Defense in Depth approach to security.

2.3

What is Defense in Depth?
Defense in Depth is the concept of using multiple, independent layers of security to raise
the cost and complexity of a successful attack. To carry out a successful attack on asystem, an attacker would need to find not just a single exploitable vulnerability but
would need to exploit vulnerabilities in each layer of defense that protect an asset.
For example, if a system is protected because it is on a network protected by a firewall,
the attacker only needs to circumvent the firewall to gain unauthorized access. However,if there is an additional layer of defense, say a username/password authentication
requirement, now the attacker needs to find a way to circumvent both the firewall andthe username/password authentication.

Introduction

5

PACSystems™ RXi, RX3i and RSTi-EP Controller Secure Deployment Guide
GFK-2830AA

2.4

Section 2

Nov 2022

General Recommendations
The following security practices should be followed when using Emerson products andsolutions.
The controllers and supervisory level computers covered in this document were notdesigned for or intended to be connected directly to any wide area network, including
but not limited to a corporate network or the Internet at large. Additional routers andfirewalls (such as those illustrated in Section 6.1, Reference Architecture) that have been
configured with access rules customized to the site's specific needs must be used toaccess devices described in this document from outside the local control networks. If acontrol system requires external access•

Harden system configurations by enabling/using the available security features, andby disabling unnecessary ports, services, functionality, and network file shares.

•

Apply all of the latest operating system security patches to control systems PCs.

•

Use anti-virus software on control systems PCs and keep the associated anti-virus
signatures up-to-date.

•

2.5

Use whitelisting software on control systems PCs and keep the whitelist up-to-date.

Checklist
This section provides a sample checklist to help guide the process of securely deploying
PACSystems products.
1. Create or locate a network diagram.
2. Identify and record the required communication paths between nodes.
3. Identify and record the protocols required along each path, including the roleof each node (Refer to Section 3: Communication Requirements).
4. Revise the network as needed to ensure appropriate partitioning, adding
firewalls or other network security devices as appropriate. Update the network
diagram (Refer to Section 5.5 DNP3 Outstation).
5. This section provides information to use when hardening the configuration of a
DNP3 Outstation Protocol. Weigh these settings against the system’s
requirements.
6. Configure firewalls and other network security devices. (Refer to Section 3.7,
Ethernet Firewall Configuration and Section 5.5 DNP3 Outstation).
7. Enable and/or configure the appropriate security features on each PACSystems
module (Refer to Section 4: Security Capabilities).
8. On each PACSystems module, change every supported password to somethingother than its default value (Refer to Section 4.4: Password Management).
9. Harden the configuration of each PACSystems module, disabling unneededfeatures, protocols, and ports (Refer to Section 5: Configuration Hardening).
10. Test/qualify the system.
11. Create an update/maintenance plan
Note: Secure deployment is only one part of a robust security program. This document,
including the checklist above, is limited to only providing secure deployment guidance.

Introduction

6

PACSystems™ RXi, RX3i and RSTi-EP Controller Secure Deployment Guide
GFK-2830AA

Section 2

Nov 2022

For more information about security programs in general, refer to Section 7.5: Additional
Guidance.

2.6

Related Documentation
Doc #

Title

GFK-2904

PROFINET I/O Devices Secure Deployment Guide

GFK-2222

PACSystems RX3i and RSTi-EP CPU Reference Manual

GFK-2223

PACSystems Installation Manual

GFK-2224

PACSystems RX3i and RSTi-EP TCP/IP Ethernet Communications User Manual

GFK-2225

PACSystems TCP/IP Ethernet Communications Station Manager User Manual

GFK-2571

PACSystems RX3i PROFINET Controller Manual

GFK-2572

PACSystems RX3i PROFINET Controller Command Line Interface Manual

GFK–2849

PACSystems RX3i IEC 61850 Ethernet Communication Module

GFK-2911

PACSystems RX3i DNP3 Outstation Module User's Manual

GFK-2314

PACSystems RX3i System Manual

GFK-2949

PACSystems RX3i IEC 104 Server Module IC695EIS001 User's Manual

GFK-2439

PACSystems RX3i Ethernet Network Interface Unit User’s Manual

GFK-2950

PACSystems RX3i and RSTi-EP CPU Programmer's Reference Manual

GFK-2958

RSTi-EP User Manual

GFK-2816

PACSystems RXi Distributed I/O Controller User Manual

GFK-2849

PACSystems RX3i IEC 61850 Ethernet Communication Module User Manual

GFK-3053
GFK-3055

PACSystems IC695CPE400 64MB Rackless CPU with PACEdge + Connext & IC695CPE410
64MB Rackless CPU with PACEdge + WebHMI Quick Start Guide
PACSystems Controllers with Linux Secure Deployment Guide

Note that users of IC695CPL410 will need to consult the PACSystems Controllers with Linux
Secure Deployment Guide, GFK-3055, as well as this guide.
In addition to these manuals, datasheets and Important Product Information documents
describe individual modules and product revisions. The most recent PACSystems
documentation is available online on the Support website. Please see the support linkprovided at the end of this document.

Introduction

7

PACSystems™ RXi, RX3i and RSTi-EP Controller Secure Deployment Guide
GFK-2830AA

Section 3:

Section 3

Nov 2022

Communication Requirements

Communication between different parts of a control system is and must be, supported.
However, the security of a control system can be enhanced by limiting the protocols
allowed, and the paths across which they are allowed, to only what is needed. This canbe accomplished by disabling every communication protocol that isn’t needed on aparticular device (refer to Section 5: Configuration Hardening), and by using appropriately
configured and deployed network security devices (for example, firewalls and routers) toblock every protocol (whether disabled or not) that doesn’t need to pass from one
network/segment to another.
We recommend limiting the protocols allowed by the network infrastructure to theminimum set required for the intended application. Successfully doing this requires
knowing which protocol is needed for each system-level interaction.
This section describes how the supported serial and Ethernet application protocols areused with PACSystems and indicates the role of each participant in the communication.
Lower-level Ethernet protocols are not discussed here but are instead assumed to besupported when needed by the application protocol (For example, to support SRTP
communication between two nodes, the network must also support TCP, IP, and ARP in
both directions between the nodes).
Note that on a PACSystems node such as the RX3i, support for these protocols may beprovided by a peripheral module (for example, IC695ETM001, IC695PNC001, orIC695ECM850) or by an interface that is embedded in the CPU/NIU module.
This information is intended to be used to help guide the specification of the networkarchitecture and to help configure firewalls internal to that network, to support only therequired communications paths for any particular installation.

3.1

Protocols Supported

3.1.1

Ethernet Protocols
This section indicates which Ethernet protocols are supported, and by which PACSystems
modules. Note that some of the supported protocols may not be required in a given
system, since the installation may only be using a subset of the available protocols.

Communication Requirements

9

PACSystems™ RXi, RX3i and RSTi-EP Controller Secure Deployment Guide

Section 3

GFK-2830AA

Nov 2022

Supported Ethernet Protocols RXi and RX3i Modules
RXi
Protocol

ICRX

RX3i
IC695 IC695 IC695 IC695 IC695 IC695

Link

ICTL00 CPE30 CPE30 CPE31 CPE33 CPE40 CPL41

ARP
LLDP

Internet

IPv4
ICMP

Trans

IGMP
TCP
UDP

0

2

5

0

0

0

0

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

ETM001
✓

IC695
EDS00
1
✓

IC695

IC695

IC695

EIS001 PNC001 ECM850
✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓
✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓1

✓

✓

BOOTP Client
DCE/RPC Client

IC695

✓

✓

✓

✓

DNS Client
Ethernet Global

✓

✓

✓

✓

✓

✓

✓
✓1

✓

✓

✓

✓

✓

✓1

✓

✓

Data

Application Layer

FTP Server
HTTP Server

✓

✓2

✓2

✓

✓

✓

✓2

✓2

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

HTTPS Server
Modbus® TCP
MasterModbus TCP
Slave
OPC UA Server
PROFINET DCP
ClientPROFINET DCP
Server1

Not supported by IC695ETM001-Kxxx.

2

Only supported by IC695CPE302-Bxxx and IC695CPE305-Bxxx versions.

Communication Requirements

10

PACSystems™ RXi, RX3i and RSTi-EP Controller Secure Deployment Guide

Section 3

GFK-2830AA

RXi
Protocol

ICRX

RX3i
IC695 IC695 IC695 IC695 IC695 IC695

ICTL00 CPE30 CPE30 CPE31 CPE33 CPE40 CPL41
0
PROFINET I/O

Nov 2022

2

5

0

✓

0

0

0

✓

✓

✓

IC695
ETM001

IC695
EDS00
1

IC695

IC695

IC695

EIS001 PNC001 ECM850✓✓

IEC 61850 Client✓

DNP3 Outstation✓✓

IEC 60870-5-104✓

Server
MRP

✓

✓

✓

✓

Reliable

✓
✓

✓

✓

✓

✓

✓

✓

✓

✓

Datagram Client
Reliable
Datagram Server
Remote Station
Mgr Client
Remote Station

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓1

✓

✓

✓

✓

✓

Mgr Server
Set Temporary IP
Server
SNMP v2c Server

✓
✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

SNTP Client
SRTP Client
SRTP Server

✓

✓

✓3

Telnet Server
HSB Redundancy

✓

✓

✓

Link

3

Supported by IC695PNC001-Ax only. Not supported by IC695PNC001-Bxxx.

Communication Requirements

11

PACSystems™ RXi, RX3i and RSTi-EP Controller Secure Deployment Guide

Section 3

GFK-2830AA

Nov 2022

Supported Ethernet Protocols RSTi-EP Modules
RSTi-EP
EPS

EPX

EPX

EPX

EPX

EPX

CPE100

CPE115

CPE205

CPE210CPE215

CPE220

CPE240

ARP

✓

✓

✓

✓

✓

✓

✓

LLDP

✓

✓

✓

✓

✓

✓

✓

Internet

IPv4

✓

✓

✓

✓

✓

✓

✓

ICMP

✓

✓

✓

✓

✓

✓

✓

TCP

✓

✓

✓

✓

✓

✓

✓

UDP

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

HTTP Server

✓

✓

✓

✓

✓

✓

✓

HTTPS Server

✓

✓

✓

✓

✓

✓

✓

Modbus® TCP Master

✓

✓

✓

✓

✓

✓

✓

Modbus TCP Slave

✓

✓

✓

✓

✓

✓

✓

OPC UA Server

✓

✓

✓

✓

✓

✓

✓

PROFINET DCP Client

✓

✓

✓

✓

✓

✓

✓

PROFINET DCP Server

✓

✓

✓

✓

✓

✓

✓

PROFINET I/O

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

Link

EPS

Trans

Protocol

IGMP

BOOTP Client
DCE/RPC Client
DNS Client
Ethernet Global Data

Application Layer

FTP Server

IEC 61850 Client
DNP3 Outstation✓

IEC 60870-5-104 Server
MRP

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

Reliable Datagram Client
Reliable Datagram Server
Remote Station Mgr Client
Remote Station Mgr Server
Set Temporary IP Server
SNMP v2c Server
SNTP Client
SRTP Client

✓

✓

✓

SRTP Server

✓

✓

✓

Telnet Server

3.1.2

Serial Protocols

Communication Requirements

12

PACSystems™ RXi, RX3i and RSTi-EP Controller Secure Deployment Guide

Section 3

GFK-2830AA

Nov 2022

In addition to Ethernet, many PACSystems products4 also support communication overserial ports (RS-232, RS-485, and/or USB). The information provided here should be used
to help guide the specification of any external security controls required to restrict
remote serial access, as well as the specification of any required physical security.
This section indicates which serial protocols are supported, and by which PACSystems
modules. Note that some of the supported protocols may not be required in a given
system, since the installation may only be using a subset of the available protocols.

PACSystems RX3i Modules
IC695 IC695 IC695 IC695 IC695 IC695 IC695 IC695 IC695 IC695 IC695 IC695 IC695 IC695 IC695 IC695 IC695
ProtocolApplicationspecific5

CPE

CPE

CPE

CPU

CPU

CPU

CRU

CPE

CPE

CPL

ETM

EDS

EIS

NIU

NIU

PNC

ECM

302

305

310

310

315

320

320

330

400

410

001

001

001

001

001+

001

850

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓
✓1

✓

✓

✓3

✓

ASCII
Terminal
Modbus RTU

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

Slave
SNP Slave

PACSystems RSTi-EP Modules
ProtocolEPSCPE10EPSCPE1

EPXCPE205

EPXCPE210

EPXCPE215

EPXCPE220

EPXCPE240

0
✓

15
✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

Application- specific4
ASCII Terminal
Modbus RTU Slave
SNP Slave

3.2

Service Requests
The PACSystems Service Request protocol is a proprietary, media-independent
application protocol that provides access to all of the services supported by the
PACSystems Controller. This is the primary protocol used by PAC Machine Edition: Logic
Developer – PLC when communicating with a PACSystems CPU. It supports manydifferent operations, including:

4

RSTi-EP Controllers supports serial communications from release 9.85 or later.

5

Some modules can be configured so that one or more of their serial ports is controlled by the user application program that is
executing on the controller. Such “Application-specific” protocols are outside of the scope of this document and will not be
discussed further.

Communication Requirements

13

PACSystems™ RXi, RX3i and RSTi-EP Controller Secure Deployment Guide
GFK-2830AA

•
•
•
•
•
•
•

•

Section 3

Nov 2022

Upload/Download the user application and configuration to the Controller
Start/Stop the Controller
Read, write, verify, or clear Flash/EEPROM memory
Clear Controller memory
Gather diagnostic info from a Controller
Verify Equality
View and, in some cases, set the target Controller's operating parameters: device
information, memory usage, date and time, reference points/words, access levels,
passwords, and OEM key, and sweep information
View and optionally clear a log of any faults that have occurred in the Controller

The Service Request protocol is transported over a specific media by encapsulating it
within a media-specific protocol. Specifically, SRTP is used for transporting it over an
Ethernet network and SNP is used for transporting it over a serial channel. Almost all
SRTP and SNP transmissions contain at least a portion of a Service Request/Reply
embedded within them.
Supporting communication between any two nodes using Service Requests requires thatthe system support communicating using either SRTP or SNP between those two nodes.

3.2.1

SRTP
SRTP is used to send Service Requests to a Controller through an Ethernet network, andto convey the results back to the client. PACSystems can be both an SRTP Server(processing service requests) and an SRTP Client (sending service requests).

SRTP Server
SRTP Server functionality is enabled at all times on the modules that support thisprotocol.

SRTP Channels
The SRTP Channels feature allows a PACSystems controller to behave as an SRTP Client,sending a limited selection of Service Requests to other SRTP Servers. The user
application running on the controller dictates which requests to send (if any) and where
to send them.

3.2.2

SNP
SNP is used to send Service Requests to a Controller through a serial connection, and toconvey the results back to the client. Support for SNP Slave functionality is enabled
whenever a PACSystems Controller’s serial port is configured to support either SNP
Slave or Modbus RTU Slave. This is because the Controller’s serial ports will auto-switchfrom Modbus RTU mode to SNP mode when an SNP packet is received.

Firmware Update
The SNP protocol is also used to support updating the firmware on the PACSystems
Controller or on any installed module that supports having its firmware updated over theCommunication Requirements

14

PACSystems™ RXi, RX3i and RSTi-EP Controller Secure Deployment Guide
GFK-2830AA

Section 3

Nov 2022

backplane. This is accomplished through the use of Service Requests that are only
supported when received through a serial port. Firmware updates are not supported
over Ethernet using the SRTP protocol.

ProtocolWinLoader.exe

PACSystems(Windows® OS)
SNP

Mast

Slave

er

Communication Requirements

15

PACSystems™ RXi, RX3i and RSTi-EP Controller Secure Deployment Guide
GFK-2830AA

3.3

Section 3

Nov 2022

ServerThis section summarizes the available communication-centric functionality, where thecommunication is initiated by some other device or computer.
Functionality

Required Application Protocols

Example Clients
PAC Machine Edition

Service Requests

SRTP

HMI
Other controllers

EGD Consumption

Ethernet Global Data6

Other controllers

Process EGD Commands

Reliable Datagram Svc

Other controllers

Modbus TCP Slave

Modbus TCP

HMI
Other controllers
3rd-party Masters

Ethernet

stamgr24.exe on computer

Ethernet Station Manager

Remote Station Mgr

OPC UA Server

OPC UA

UaExpert

Telnettelnet.exe on computer

DNP3 Outstation or Server

DNP3

DNP3 Master or Client

IEC 60870-5-104 Server or Slave

IEC 60870-5-104

IEC 104 Master or Client

Web Server

HTTP, HTTPSWeb browser

Update Web Pages

FTP

ftp.exe on computer

Network Management

SNMP v2c

SNMP client on computer

Set Temporary IP

PAC Machine Edition

PROFINET Controller command
shell

Assign IP before configuring themoduleOther Ethernet interface

PAC Machine Edition
Service Requests

SNP Slave

SerialOther controllers
Firmware Update

6

HMI

SNP Slave

WinLoader.exe on computerThis is one-way communication, from client to server. No response is provided from the server back to the client. However, a single
PACSystems controller can be both a client and a server.

Communication Requirements

16

PACSystems™ RXi, RX3i and RSTi-EP Controller Secure Deployment Guide
GFK-2830AA

Functionality

Required Application Protocols

Section 3

Nov 2022

Example Clients
HMI

Modbus RTU Slave

Modbus RTU

Other controllers
3rd-party Masters

Serial Station Manager
PROFINET Controller commandshell
ECM850 command shell

3.3.1

ASCII Terminal

Terminal emulator on computer

ASCII Terminal

Terminal emulator on computer

ASCII Terminal

Terminal emulator on computer

Web Server
The Firmware Update webserver normally uses HTTP, but when the Password Reset
option is selected, the client reconnects using HTTPS or HTTP over SSL/TLS, to encrypt
communication between the client and the server.
Each time the Password Reset option is invoked, the webserver generates an RSA keypairthat is used to produce a short-lived, self-signed X.509 certificate to secure the TLS/SSL
connection. The common name (CN) attribute of the certificate subject and issuer is the
IP address of the device, and the lifetime of the certificate is five minutes. The keypair isdiscarded when the session ends.

Communication Requirements

17

PACSystems™ RXi, RX3i and RSTi-EP Controller Secure Deployment Guide
GFK-2830AA

3.4

Section 3

Nov 2022

ClientThis section summarizes the available communication-centric functionality, where thecommunication is initiated by the PACSystems controller. The servers involved in thesecommunications are selected by the user application and/or configuration.

Functionality

Ethernet

Required Application Protocols

Example Servers

SRTP Channels

SRTP

Other controllers

Modbus TCP Channels

Modbus TCP

EGD Production

Ethernet Global Data6

Other controllers

Send EGD Commands

Reliable Datagram Svc

Other controllers

Ethernet Station Manager

Remote Station Mgr

Other Ethernet interface

Time Synchronization

SNTP

SNTP server

BOOTP

BOOTP server

Lookup IP addresses by NameDNS

DNS server

IEC 61850 Client

IEC 61850 Client

Other IEC 61850 Servers

3rd-party device
Other controllers

Assign IP addresses using acentralized database ofaddresses

Communication Requirements

18

PACSystems™ RXi, RX3i and RSTi-EP Controller Secure Deployment Guide

Section 3

GFK-2830AA

3.5

Nov 2022

PROFINET
This section describes the communication paths needed to support common operations
on a PROFINET network.

3.5.1

Installing an I/O Device
Commissioning, adding, or replacing an I/O device requires that the device be assigned aunique name to use on the PROFINET network. Doing this requires supporting thefollowing communication path.
Protoco

PAC Machine Edition

I/O devicel DCP
PROFINET

ClientServerSupporting this path will allow PAC Machine Edition to directly discover all of the
PROFINET I/O devices that are connected to the same subnet as the computer (Note that
this protocol is not routable). It can then be used to (re-) assign a unique name to the I/O
device being installed.

Note:
This protocol can also be used to make other modifications to the I/O
device, such as assigning a new IP address or resetting it to factory defaults. However,those functions are not generally required when installing an I/O device.

3.5.2

Network Discovery & Device Identification
PAC Machine Edition can also request information about the devices on a PROFINET
network from a PACSystems Controller, and then retrieve additional identification
information about each device. This request is sent to the PACSystems Controller using
the Service Request protocol (described elsewhere) embedded within the SRTP or SNP
protocols. The PACSystems Controller satisfies those requests using the following
communication paths.
ProtocoLocal I/O controller

Remote I/O controllers

DCE/RPC

ClientI/OServer
devices

PROFINET DCP

ClientServerlandNote that no mechanism is provided through this communication path for assigning a
name to a new I/O device.

Communication Requirements

19

PACSystems™ RXi, RX3i and RSTi-EP Controller Secure Deployment Guide

Section 3

GFK-2830AA

3.5.3

Nov 2022

Using an I/O device
Using PROFINET I/O as part of the control application requires that all of the following
communication paths be supported throughout the life of the application.
ProtocolI/O controller

I/O devices

DCE/RPC

Clie

Server

DCE/RPCnt
Serve

ClientPROFINET DCPr
Clie

ServerPROFINET I/O

nt
Bi-directional

Bi-directional

In addition, if the PROFINET network is configured to support Media Redundancy (which
requires a physical ring topology) then the following application protocol must also be
supported.

3.6

ProtocolI/O controller

I/O device

MRP

Bi-directional

Bi-directional

IEC 61850
This section describes the communication paths needed to support common operations
on an IEC 61850 network.
IEC 61850 is a global standard for use in utility communication, in particular for the
information exchange between IEDs (Intelligent Electronic Devices) in powertransmission or distribution substations.

3.6.1

Installing an IED –Intelligent Electronic Device (IEC61850 Server)
Commissioning, adding, or replacing an IED requires that the device be available on theIEC 61850 network so that the Integrated IEC 61850 Configurator in PAC Machine Edition
can directly read the IEC 61850 Object model from the remote device. Doing thisrequires supporting the following communication path:
ProtocolPAC Machine Edition

IED

IEC 61850 (MMS – Self

ClientServerDescription)

Supporting this path allows PAC Machine Edition to directly discover or read the IEC
61850 object data model from an IED that is connected to the same subnet as thecomputer. The data model read is used by the configurator to select objects or variables
for monitoring and control.

3.6.2

Using an IED

Communication Requirements

20

PACSystems™ RXi, RX3i and RSTi-EP Controller Secure Deployment Guide

Section 3

GFK-2830AA

Nov 2022

Using IED’s objects as part of the control application requires that all of the following
communication paths be supported throughout the life of the application.

3.7

Protocol

Local communication module (e.g. ECM850)

IED(s)IEC 61850

ClientServerEthernet Firewall Configuration
Network-based and host-based firewalls should be configured to only allow expected
and required network traffic. This section identifies the EtherTypes and the TCP/UDP
ports used by the protocols supported on PACSystems products.
This information should be used to help configure network firewalls, to support only therequired communications paths for any particular installation.

3.7.1

Lower-level Protocols
Ethernet communication is typically described using four layers, each with its own set of
protocols. At the top of that hierarchy is the Application layer. Below the Application
layer are the Transport, Internet, and Link layers.
Information on the supported protocols from these three lower layers is summarized
here.

Link Layer Protocols
EtherTypProtocol

e

ARP

0x080
6
0x88c

LLDP

c

Internet Layer Protocols
ProtocolEtherTypeIP Protocol #

IPv4

0x080

(n/a)

ICMP

0
0x080

1

IGMP

0
0x080

2

Transport Layer Protocols

0ProtocolEtherTypeIP Protocol #

TCP

0x080

6

UDP

0
0x080

17

0 Application protocols supported on
Each of these lower-level protocols is required by one or more of thethe PACSystems family of products.

3.7.2

Application Layer Protocols

PACSystems devices are capable of acting as a server, responding to requests sent through any of several
different protocols. They are also capable of acting as a client, sending requests to other servers using
several different protocols. The exact set of protocols that are enabled/used will depend on which
Communication Requirements

21

PACSystems™ RXi, RX3i and RSTi-EP Controller Secure Deployment Guide

Section 3

GFK-2830AA

Nov 2022

modules are installed, how they are configured, and the details of the application program that is runningon the CPU.
ProtocolServer TCP
Port

EtherType(non-IP protocol)

67 on server

BOOTP

68 on client
34964 on server

DCE/RPC

DNS

Dest UDP Port

>1023 on client
53

Ethernet Global Data

53 on server>1023 on client
18246

FTP

20, 21

HTTP

80

HTTPS

443

Modbus TCP

502

OPC UA

4840

PROFINET DCP

0x8892PROFINET I/O

0x8892MRP

0x88e37937 on server

Reliable Datagram Svc>1023 on client

Remote Station Mgr

18245
161 on server

SNMP v2c>1023 on client

SNTP

123

SRTP

18245

Telnet23

Set Temporary IP

1

IEC 61850 Client

102

Communication Requirements

22

PACSystems™ RXi, RX3i and RSTi-EP Controller Secure Deployment Guide

Section 3

GFK-2830AA

Protocol7Server TCP
Port

DNP3 Outstation

200007

IEC 60870-5-104 Server

24048

Dest UDP PortNov 2022

EtherType(non-IP protocol)

The Port number for DNP3 outstation by convention is 20000. For module IC695EDS001, If the SoE (Sequence of Event) feature isenabled in the configuration, then port number 20001 will also be opened for transmitting buffered event data to the Master.
However, it should be noted that this port number can be configured to any number desired through a special COMMREQ block(say X), in which case the port number (X+1) will be opened for SOE connection if SOE is enabled in the configuration. Refer to the
PACSystems RX3i DNP3 Outstation Module User's Manual, GFK-2911 for details of such configuration.
For Controller IC695CPE400/CPL410, the Port number for DNP3 outstation can be configured to any desired number throughHardware Configurator in the PAC Machine Edition. Note that the Controller uses the same Port number for both the SoE(Sequence of Events) & Most recent Event Report transfers.

8

The Port number for IEC 60870-5-104 server by convention is 2404. In a typical case of Multiple Client configuration, there can be
multiple connections with different port numbers opened as (2404+i), where i=0 to Number of Client connections configured-1. If
the number of client connections is configured as 4, then the connections with port numbers 2404,2405,2406,2407 will be opened.
However, it should be noted that this port number can be configured to any number desired through a special COMMREQ block(say X), in which case the port numbers (X to X+i where i = Number of Client connections-1) will be opened for Multiple Client
configuration for a typical case. Refer to the PACSystems RX3i IEC 104 Server Module IC695EIS001 User's Manual, GFK-2949 for detailsof such configurations.

Communication Requirements

23

PACSystems™ RXi, RX3i and RSTi-EP Controller Secure Deployment Guide

Section 4

GFK-2830AA

Section 4:

Nov 2022

Security Capabilities

This section describes the PACSystems capabilities and security features that can be usedas part of a defense-in-depth strategy to secure your control system.

4.1

Capabilities by ProductThis section provides a summary view of the security capabilities supported on each
PACSystems module.

4.1.1

PACSystems RXi modules
Security Capability

4.1.2
Security
Capability

ICRXICTL000

The predefined set of Subjects & Access Rights✓

Plaintext Login✓

Secure Login (SRP-6a)✓

Access Control List✓

Firmware Signatures✓

Internal Firewall✓

PACSystems RX3i Modules
IC695 IC695 IC695 IC695 IC695 IC695 IC695 IC695 IC695 IC695 IC695 IC695 IC695 IC695 IC695 IC695 IC695
CPE

CPE

CPE

CPU

CPU

CPU

CRU

CPE

CPE

CPL

ETM

EDS

EIS

NIU

NIU

PNC

ECM

302

305

310

310

315

320

320

330

400

410

001

001

001

001

001+

001

850

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓3

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

Predefined
set of
Subjects &Access Rights
Plaintext
Login
Secure Login(SRP-6a)AccessControl List

Security Capabilities

25

PACSystems™ RXi, RX3i and RSTi-EP Controller Secure Deployment Guide

Section 4

GFK-2830AA

Security
Capability

Nov 2022

IC695 IC695 IC695 IC695 IC695 IC695 IC695 IC695 IC695 IC695 IC695 IC695 IC695 IC695 IC695 IC695 IC695
CPE

CPE

CPE

CPU

CPU

CPU

CRU

CPE

CPE

CPL

ETM

EDS

EIS

NIU

NIU

PNC

ECM

302

305

310

310

315

320

320

330

400

410

001

001

001

001

001+

001

850

✓

✓

✓

✓10

✓11

✓12

✓

✓

✓

Error! B

Firmware✓9

Signaturesookmark
notdefined.

✓Error! ✓Error! B
Secure Boot

Bookmarkookmark

notnotdefined.

defined.

✓Error! ✓Error! B
Internal

Bookmarkookmark

Firewallnotnotdefined.

defined.

4.1.3✓Error! B✓✓✓

ookmark✓11

notdefined.

PACSystems RSTi-EP Modules

Security Capability

EPSCPE100EPSCPE115

EPXCPE205

EPXCPE210

EPXCPE215

EPXCPE220

EPXCPE240

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

Predefined set of
Subjects & Access
RightsPlaintext Login
Secure Login(SRP-6a)✓✓Access Control List

✓

✓

✓

✓

✓

✓

✓

Firmware Signatures

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

Secure Boot

9

Verified Boot

✓

✓

✓

✓

✓

✓

✓

Internal Firewall

✓

✓

✓

✓

✓

✓

✓

Only supported by IC695CPE302-Bxxx,IC695CPE305-Bxxx and IC695CPE310-Bxxx versions.

10

Supported by IC695ETM001-Kxxx only. Not supported by IC695ETM001-Jx.

11

Supported by IC695PNC-Bxxx only. Not supported by IC695PNC001-Ax.

12

Secure Firmware upgrade supported via RX3i Controllers using WinLoader.

Security Capabilities

26

PACSystems™ RXi, RX3i and RSTi-EP Controller Secure Deployment Guide
GFK-2830AA

4.2

Section 4

Nov 2022

Access Control and Authorization
The Access Control process can be divided into two phases:
Definition – Specifying the access rights for each subject (referred to as Authorization),andEnforcement – Approving or rejecting access requests.
This section describes the Access Control capabilities supported by PACSystems, which
includes its Authorization capabilities.

4.2.1

Authorization Framework
Defining the access rights for each subject implies that the system must have somemeans to identify each subject. The most familiar way this is achieved is by assigning aunique User ID to each person who will access the system.
PACSystems, however, doesn’t provide such a facility – there is no support for creating
User IDs. In many cases, a User ID doesn’t even have to be specified to authenticate. In
such cases, authorization is based on the functionality being used and the password thatis provided for authentication. Nevertheless, the authentication features supported on
PACSystems implicitly define a fixed set of subjects, which are identified here.
The set of implicitly defined subjects will vary depending on the server protocols that aresupported, which depends on what modules are installed and how they are configured.
Each kind of server has its own set of predefined subjects – there are no subjects that
apply across multiple servers (other than anonymous). Further, each instance of a server
has its instances of the predefined subjects – access rights for each subject must be
separately managed for each instance of a given kind of server.
For example, each PACSystems controller acts as a Service Request server. Therefore,
access rights for each PACSystems controller in the system must be independently
managed. Similarly, each Ethernet Interface supports the Ethernet Station Manager
server. Therefore, access rights for each Ethernet Interface must be individually
managed – even when multiple Ethernet Interface modules are located in a single rack,
providing service to a single PACSystems controller.
The subjects defined and supported by each server protocol are indicated in thefollowing table.

Security Capabilities

27

PACSystems™ RXi, RX3i and RSTi-EP Controller Secure Deployment Guide

Section 4

GFK-2830AA

Functionality

Application Protocol

Nov 2022

Subjects Available
Anonymous
PRIV

Service Requests

SRTP

Level 1 user
PRIV Level 2 user
PRIV Level 3 user
PRIV Level 4 user
OEM user

Ethernet

EGD Consumption

Ethernet Global Data

Anonymous

Process EGD Commands

Reliable Datagram Svc

Anonymous

Modbus TCP Slave

Modbus TCP

Anonymous

Ethernet Station Manager

Remote Station Mgr

Anonymous
STA Modify-level user
Anonymous

OPC UA Server

OPC UA

PRIV Level 2 user
PRIV Level 3 user
PRIV Level 4 user

DNP3 Outstation or Server

DNP3

Anonymous

IEC 60870-5-104 Server or Slave

IEC 60870-5-104

Anonymous

PROFINET Controller command shell

Telnet 3

Web Server

HTTP, HTTPSAnonymous

Update Web Pages

FTP

FTP user

Network Management

SNMP v2c

Anonymous

Assign IP before configuring the module

Set Temporary IP

AnonymousAnonymous
PNC admin

Anonymous
PRIV Level 1 user
Service Requests

SNP Slave

PRIV Level 2 user
PRIV Level 3 user
PRIV Level 4 user
OEM user

SerialFirmware Update

SNP Slave

Anonymous

Modbus RTU Slave

Modbus RTU

Anonymous

Serial Station Manager

ASCII Terminal

PROFINET Controller command shell

ASCII Terminal 3

ECM850 command shell

ASCII Terminal

4.2.2
Security Capabilities

Anonymous
STA Modify-level user
Anonymous
PNC admin
Anonymous
admin

Specifying Access Rights
28

PACSystems™ RXi, RX3i and RSTi-EP Controller Secure Deployment Guide

Section 4

GFK-2830AA

Nov 2022

For each subject, PACSystems provides predefined access rights. In some cases, thoseaccess rights can be partially restricted, while in other cases they either cannot bechanged at all or can only be revoked by disabling the associated server/protocol.

Predefined Access Rights
The Access Rights to data on the PACSystems controller itself, regardless of the protocol
being used, are the most complex. The services provided directly by other PACSystems
modules have simple, well-documented access rights and so aren’t discussed here
further. These specifically include the PROFINET Controller command shell, Ethernet
Station Manager, the SNMP server, the Web server, and the FTP server. See the user
manuals for each of those services for more details.
While the PACSystems RX3i and RSTi-EP CPU Reference Manual, GFK-2222, includes a
description of the features allowed at each of the Service Request authentication levels(refer to the System Security section of that manual), it does not present the informationin the complete Access Control context. Therefore, a summary table has been provided
here to explicitly show the access rights granted to each subject. Note that the accessright granted to an Anonymous subject may vary based on the protocol being used tocommunicate with the PACSystems server.

Access Rights on PACSystems Controller
Application Application
Subject

OEM user
PRIV Level 4
user
PRIV Level 3
user
PRIV Level 2
user
PRIV Level 1
user

Applicatio

Application

Logic

Logic

Applicationn DataFault

Configuration(while in(while in

Data

Overrides/

Tables

STOP)

RUN)

A

A

—

—

—

—

RWD

RWD

RW

RWD

RWD

RWD

RWD

R

RWD

R

R

R

R

R

R

Controller

PRIV Level

ModulePasswords

Firmware

—

—

—

RD

RW

WD

W

RWD

RD

RW

—

—

RW

R

RD

RW

—

—

R

R

R

R

—

—

—

—

ForcesStatus (e.g.
RUN/STOP)

Anonymous(SRTP, SNP)

Same as the highest PRIV Level user that currently has no password.

*
Anonymous(EGD CMDs,
Modbus TCP

—

—

—

RW

RW

—

—

& RTU) *Security Capabilities

29

PACSystems™ RXi, RX3i and RSTi-EP Controller Secure Deployment Guide

Section 4

GFK-2830AA

Application Application
Subject

Applicatio

Application

Logic

Logic

Applicationn DataFault

Configuration(while in(while in

Data

Overrides/

Tables

STOP)

RUN)

—

—

Anonymous(EGD IO)—

ForcesRW

RW—

Controller
Status (e.g.
RUN/STOP)—Nov 2022

PRIV Level

ModulePasswords

Firmware——

Key: A=access control, R=read, W=write, D=delete/clear
Since the set of subjects is fixed and the access rights for each subject are predefined, likely, there won’t be a one-to-one mappingfrom the subjects identified here, to the people who act as those subjects. Multiple subjects may be mapped onto a single person,
and/or multiple people may need to all share a single subject (in which case they will all need to know the same password).

* NOTE: There is a setting ‘Legacy Client/Server Protocol Memory Access’ in PME that allows Legacy (non-programmer) Clients tostill connect with the equivalent of PRIV Level 2 minus the ability to change the controller RUN/STOP state. That is, set to‘Unauthenticated’ mode, this setting gives non-programmer connections permissions to perform the following PLC operations
without requiring a login with a Level 2 password provided:•

Read/Write from/to Data Memory•

Verify Logic & Hardware Configuration•

Reading & Clearing Fault Tables•

Uploading Logic & Hardware Configuration•

Modbus Reads•

SRTP Reads & Writes
By default, ’Legacy Client/Server Protocol Memory Access’ is set to ‘Authenticated’, and it is recommended that it be left in the‘Authenticated’ state unless the user follows the recommendations in this document to help maintain the confidentiality, integrity,
and availability of their system. See GFK-2222 section 4.10.1 for more details on the Legacy Client/Server Protocol Memory Accessfeature.

The OEM user can prohibit any subject from reading or writing the Application
configuration or logic. That subject cannot grant additional access rights to any of thesubjects.

Physical Access
The PACSystems RX3i controllers support a configuration setting that can be used torequire physical access to the controller to change the application configuration,
application logic, and/or overrides/forces of application data. This is controlled using theMemory Protection Switch setting in the hardware configuration that is downloaded to thecontroller. Emerson strongly recommends the use of the Memory Protection Switch inconjunction with passwords set at PRIV Levels 2, 3, and 4 whenever possible to prevent
remote, unauthorized modifications to the PLC.
When the Memory Protection Switch setting is enabled and the RUN/STOP switch is
physically in the RUN position, then the predefined Access Rights are changed to thefollowing.

Security Capabilities

30

PACSystems™ RXi, RX3i and RSTi-EP Controller Secure Deployment Guide

Section 4

GFK-2830AA

Nov 2022

Access Rights with Memory Protection ENABLED andphysical switch in RUN position
Application Application
Subject

Application

Logic

Logic

Application

Configuration(while in(while in

Data

STOP)

RUN)

A

A

—

—

—

—

—

—

—

R

R

R

RW

R

RD

RW

WD

W

R

R

R

RW

R

RD

RW

—

—

R

R

R

RW

R

RD

RW

—

—

R

R

R

R

R

R

R

—

—

OEM user
PRIV Level 4
user
PRIV Level 3
user
PRIV Level 2
user
PRIV Level 1
user
Anonymous

Data

Fault

Controller

Application

Overrides Tables/Forces

Status (e.g.
RUN/STOP)

PRIV Level

ModulePasswords Firmware

Same as the highest PRIV Level user that currently has no password.

(SRTP, SNP) *Anonymous(EGD CMDs,
Modbus TCP

—

—

—

RW

R

—

—

—

—

—

—

—

RW

R

—

—

—

—

& RTU) *Anonymous(EGD IO)

Security Capabilities

31

PACSystems™ RXi, RX3i and RSTi-EP Controller Secure Deployment Guide
GFK-2830AA

Application Application
Subject

Application

Application

Logic

Logic

Application

Configuration(while in(while in

Data

STOP)

RUN)

Data

Fault

Overrides Tables/Forces

Controller
Status (e.g.
RUN/STOP)

Section 4

Nov 2022

PRIV Level

ModulePasswords Firmware

Key: A=access control, R=read, W=write, D=delete/clear
Since the set of subjects is fixed and the access rights for each subject are predefined, likely, there won’t be a one-toone mapping from the subjects identified here, to the people who act as those subjects. Multiple subjects may bemapped onto a single person, and/or multiple people may need to all share a single subject (in which case they will allneed to know the same password).

* NOTE: There is a setting ‘Legacy Client/Server Protocol Memory Access’ in PME that allows Legacy (nonprogrammer) Clients to still connect with the equivalent of PRIV Level 2 minus the ability to change the controller
RUN/STOP state. That is, set to ‘Unauthenticated’ mode, this setting gives non-programmer connections permissions
to perform the following PLC operations without requiring a login with a Level 2 password provided:•

Read/Write from/to Data Memory•

Verify Logic & Hardware Configuration•

Reading & Clearing Fault Tables•

Uploading Logic & Hardware Configuration•

Modbus Reads•

SRTP Reads & Writes

By default, ’Legacy Client/Server Protocol Memory Access’ is set to ‘Authenticated’, and it is recommended that it beleft in the ‘Authenticated’ state unless the user follows the recommendations in this document to help maintain theconfidentiality, integrity, and availability of their system. See GFK-2222 section 4.10.1 for more details on the Legacy
Client/Server Protocol Memory Access feature.

Modbus-specific Limitations
Access to Application Data through any of the Modbus servers (Modbus TCP, Modbus
RTU) is limited to only those data items that have been mapped into the Modbus address
space. For both Modbus TCP and RTU, this mapping is fixed and cannot be altered, but
Modbus TCP and/or Modbus RTU can be disabled if they are not needed (refer to Section
5: Configuration Hardening).
For details on the default mapping between Modbus Registers and the Application Data
in a PACSystems RXi Controller, refer to the PACSystems RXi Distributed I/O Controller User
Manual, GFK-2816. For other PACSystems controllers, refer to the PACSystems RX3i and
RSTi-EP TCP/IP Ethernet Communications User Manual, GFK-2224.

Access Control Lists
Some PACSystems controllers (refer to Section 4.1, Capabilities by Product) allow finegrain control over the access rights to the Application Data. An Access Control List may
optionally be defined to further restrict which application variables can be read and/or
written by external clients but cannot be used to grant additional access rights.
The Access Control List will restrict access from external clients communicating over oneof the following protocols:
Security Capabilities

32

PACSystems™ RXi, RX3i and RSTi-EP Controller Secure Deployment Guide
GFK-2830AA◼

Modbus TCP◼

Reliable Datagram Svc (i.e. EGD Commands)

Section 4

Nov 2022

Access to the Application Data using other protocols is either unaffected by the AccessControl List (Modbus RTU, EGD Exchanges) or is only affected by the cooperation of theclient (SRTP and SNP), and so cannot be relied upon for data security.
For details on enabling and using an Access Control List with PACSystems, see the
PACSystems RXi and RX3i Security topic in the HELP for PAC Machine Edition.

Internal Firewall
Some PACSystems modules have a built-in firewall (refer to Section 4.1, Capabilities by
Product). These firewalls do not support user-specific configuration but limit theincoming traffic to supported protocols and rates of the particular module.

4.2.3

Enforcement
Each of the PACSystems modules enforces the access rights for the data and services
that it provides. Thus, the PACSystems controller ensures that the Application
Configuration can only be updated by a user with the access rights to write/delete theApplication Configuration. Similarly, the PACSystems Ethernet Interface ensures that
only the STA Modify-level user can execute Ethernet Station Manager commands that arecapable of modifying the operation of the module.

4.2.4

Protecting User Logic
It is important to note that without setting PACSystems Controller passwords at PRIV
Levels 2, 3, and 4, it may be possible for an attacker on the same network as thecontroller to attempt to modify the user application or application data. To mitigate thisthreat, Emerson recommends always setting PRIV Level 2, 3, and 4 passwords andenabling Enhanced Security as described in Section 4.3.
Controlling access to all application logic is a very important step in protecting theoverall system. This is particularly important for applications with C blocks as they
provide a very flexible way for customers to implement application logic, but also a very
flexible method for attackers to manipulate the user application.
For this reason, customers must add controls to their application development anddeployment processes to ensure that malicious user application code (including C
applications) is not being accidentally included and downloaded by a legitimate user.
These controls can include a manual inspection of the application, static analysis of thecodebase, and maintaining cryptographic hashes of the application to ensure
modifications, accidental or otherwise, are noticed before a legitimate user downloads
an application that has been maliciously tampered with on the computer running the
programming software.
Users should not include C blocks or other logic blocks (including C code) from theInternet or other untrusted sources into user applications without manual inspection
and static analysis of the code at a minimum.

Security Capabilities

33

PACSystems™ RXi, RX3i and RSTi-EP Controller Secure Deployment Guide
GFK-2830AA

4.3

Section 4

Nov 2022

Authentication
PACSystems provides password-based authentication for some, but not all, of its server
protocols. For each unauthenticated protocol that is enabled, compensating controls
may be needed to satisfy the security requirements of a particular installation.
Note: The default configuration for all Server protocols is for no authentication, orauthentication using well-known default values.

4.3.1

SummaryThis section summarizes the authentication mechanisms supported by PACSystems foreach protocol. It is important to note that some PACSystems controllers only support a
subset of the authentication options listed here. Refer to Section 4.1: Capabilities by
Product for more details.

Security Capabilities

34

PACSystems™ RXi, RX3i and RSTi-EP Controller Secure Deployment Guide

Section 4

GFK-2830AA

Nov 2022

Authentication Available on PACSystems Servers
Functionality

Application Protocol

Authentication Options
Secure login (SRP-6a)

Service Requests

SRTP

Plaintext login
Disabled

EGD Consumption

Ethernet Global Data

None

Process EGD Commands

Reliable Datagram Svc

None

Modbus TCP Slave

Modbus TCP

None

Ethernet Station Manager

Remote Station Mgr

Plaintext login
None

OPC UA Server
Ethernet

OPC UA

Plaintext login
Encrypted login

DNP3 Outstation or Server

DNP3

None

IEC 60870-5-104 Server or Slave

IEC 60870-5-104

None

TelnetPlaintext login

Web Server

HTTP, HTTPS

None

Update Web Pages

FTP

Plaintext login

Web Server Firmware Update

HTTP

None13

Network Management

SNMP v2c

None14

Set Temporary IP

None

PROFINET Controller command
shell

Assign IP before configuring themoduleSecure Login (SRP-6a)
Service Requests

SNP Slave

Plaintext Login
Disabled

SerialFirmware Update

SNP Slave

None – must be Disabled

Modbus RTU Slave

Modbus RTU

None

Serial Station Manager

ASCII Terminal

Plaintext login

ASCII Terminal

Plaintext login

ASCII Terminal

Plaintext login

PROFINET Controller commandshell
ECM850 command shell

Authentication Supported by PACSystems Clients

13
14

Web Server Firmware Update on the RXi supports a plaintext User ID and password, but they are set to well-known, fixed values.
SNMP v2c supports a plaintext community string. Refer to each PACSystems product manual for details on the community string
settings and what SNMP features are accessible by the community string.

Security Capabilities

35

PACSystems™ RXi, RX3i and RSTi-EP Controller Secure Deployment Guide
GFK-2830AA

Functionality

Ethernet

Required Application
Protocols
SRTP

None

EGD Production

Ethernet Global Data6

None

Send EGD Commands

Reliable Datagram Svc

None

Modbus TCP Channels

Modbus TCP

None

Ethernet Station Manager

Remote Station Mgr

Plaintext login1

Time Synchronization

SNTP

None

BOOTP

None

DNS

None

centralized database of addresses
Lookup IP addresses by Name

Nov 2022

Authentication Supported

SRTP Channels

Assign IP addresses using a

Section 4

Note: Login is not supported by SRTP Channels, even though passwords may be enabledon the SRTP server. When using SRTP Channels, the SRTP server cannot have password
protection enabled for PRIV level 2 if data writes are required.

Authentication Supported by the PROFINET Protocol
The PROFINET I/O specification does not define an authentication mechanism and sonone is supported on PACSystems for any PROFINET communications.

4.3.2

Plaintext Login
Authentication for many of the supported protocols involves sending a plaintext
password to the PACSystems controller. A plaintext password is sent over the network
without any confidentiality protection, such as encryption. The consequence is that any
network entity between the two endpoints exchanging authentication information could
sniff the network traffic and observe the plaintext password. In some cases, theseplaintext passwords cannot be more than seven (7) characters long. When suchprotocols are required, additional compensating controls may be needed to satisfy the
security requirements of a particular installation.

4.3.3

Secure Login
Some models of PACSystems controllers support a cryptographically secure password
login mechanism when using the SRTP or SNP protocols. The algorithm used is the
Secure Remote Password protocol (SRP-6a). This feature is controlled by the Enhanced

Security Capabilities

36

PACSystems™ RXi, RX3i and RSTi-EP Controller Secure Deployment Guide
GFK-2830AA

Section 4

Nov 2022

Security setting in PAC Machine Edition – the same setting that enables the use of an
Access Control List.
For details on enabling the Secure Login feature, refer to the PACSystems RXi and RX3i
Security topics in the HELP for PAC Machine Edition.

4.3.4

Recommendations
Emerson strongly recommends that authentication be used for every enabled protocolthat supports authentication, that all default passwords be changed, and that access beappropriately restricted to any computer-based file that includes a plaintext password.
When a choice between a plaintext-based login and a Secure Login is available, Emersonstrongly recommends that the Secure Login feature be used since it prevents network
entities from sniffing plaintext passwords and increases the password maximum length
to 31 characters.
Whenever protocols are used with no authentication mechanism, or when authentication
is disabled or relies on sending credentials in plaintext across the network, it is critical tocontrol physical and electronic access to the network to prevent unauthorized messages
from being sent and acted upon.
Below are recommended actions to be taken to mitigate the risk of external or internal
entities accessing an Industrial Control System (ICS) network and sending unauthorized
messages.

Personnel Security Protection
All individuals with permission to physically access ICS systems should have backgroundchecks and be trained in the proper use and maintenance of ICS systems.

Security Capabilities

37

PACSystems™ RXi, RX3i and RSTi-EP Controller Secure Deployment Guide
GFK-2830AA

Section 4

Nov 2022

Physical Security Perimeter Protection
1. All ICS hardware should be placed in locked cabinets, with policies andprocedures to restrict access to the key.
2. Network equipment such as switches, routers, firewalls, and Ethernet cabling
should be physically protected in locked enclosures such as cabinets, closets,
and metal pipes with policies and procedures to restrict access to theseenclosures.
3. Whenever possible, there should be no physical network path from an ICS
network to the Internet. It should not be possible for an attacker to reach an
ICS network from any Internet-facing computer.
4. Networks should always be physically segmented as suggested in the
Reference Network Architecture diagram to avoid exposure to ICS networks.
5. Each ICS system asset should be visibly labeled by a unique identifier, with all
expected asset identification compiled into an access-controlled list.

Electronic Security Perimeter Protection
1.

All external access to an ICS network should be managed through a Virtual
Private Network (VPN) or similar technology leveraging two-factor
authentication. Next-Generation Firewalls should be properly configured anddeployed at each conduit between physical networks that deny all but the
specifically allowed protocol families, source addresses, destination addresses,
and specific application-level commands between the two adjacent networks.
For example, a Next-Generation Firewall could prohibit write operations acrossnetworks while allowing read operations.

2. If one network node such as a PLC or HMI uses unauthenticated protocols to
exchange information or commands with another network node on the same
physical network, a Next-Generation Firewall could be deployed between thetwo network nodes. This Next-Generation Firewall should be configured to
explicitly whitelist all expected messages between the two network nodes, anddeny all other unexpected messages.
3. To detect and alert for unexpected, unauthenticated messages on a given
network, an Intrusion Detection System (IDS) could be configured anddeployed. Consider configuring the IDS to log all events to a Security
Information and Event Management (SIEM) system that aggregates all security
information on the ICS network.
4. To detect and actively prevent unexpected, unauthenticated messages on agiven network from reaching a given network node, an Intrusion Prevention
System (IPS) could be configured and deployed. Consider configuring the IPS tolog all events to a Security Information and Event Management (SIEM) systemthat aggregates all security information on the ICS network.
Security Capabilities

38

PACSystems™ RXi, RX3i and RSTi-EP Controller Secure Deployment Guide
GFK-2830AA

Section 4

Nov 2022

5. To limit the impact of the compromise of any single user account, it isrecommended to divide administrator privileges into several user accounts,
each for its operational function.
6. To limit the impact of the compromise of any single set of credentials (username, password) for any ICS equipment, it is recommended to never re-use
credentials for different tools or purposes.
7. Carefully protect sources of and access to credentials (user names, passwords)
for all ICS equipment, including switches, routers, firewalls, IDS, IPS, etc.
8. Enforce a policy of rotating credentials for ICS equipment periodically and after
personnel changes. Note that products with no support for enforcement of
unique passwords over time should be compensated for with policies andprocedures that require a history of unique passwords.
Recommendations on password complexity and management can be found in NIST 800118, Guide to Enterprise Password Management.

4.4

Password Management
As described in Section 4.2.1 Authorization Framework, each instance of a server has its
instances of the predefined subjects. As a result, passwords for each subject must be
separately managed for each instance of a given kind of server.
For example, each PACSystems controller acts as a Service Request server. Therefore, thepasswords for each PACSystems controller in the system must be independently
managed. Similarly, each Ethernet Interface supports the Ethernet Station Manager
server. Therefore, the passwords for each Ethernet Interface must be independently
managed – even when multiple Ethernet Interface modules are located in a single rack,
providing service to a single PACSystems controller.
Emerson strongly recommends the use of long (12 characters or more), complex
passwords wherever passwords are used for authentication. Whenever using a password
scheme with a fixed maximum character length for passwords, Emerson recommends
setting passwords to utilize the full character length available whenever possible to
make it more difficult for attackers to crack passwords. Recommendations on password
complexity and management can be found in the Guide to Enterprise Password
Management, NIST 800-118.
Emerson strongly recommends that any default password be changed before
deployment of the device. The table below identifies services that contain a default
password.

Security Capabilities

39

PACSystems™ RXi, RX3i and RSTi-EP Controller Secure Deployment Guide
GFK-2830AA

Functionality

Authenticated Subjects

How Passwords are assigned

Section 4

Nov 2022

Default Provided

All of these passwords arecontrolled by the PRIV Level 4
user. Refer to the PACSystems RXi

Service Requests

PRIV Level 1 user

and RX3i Security topic in the HELP

PRIV Level 2 user

for PAC Machine Edition for details

PRIV Level 3 user

on how to specify these

PRIV Level 4 user

passwords.

OEM userMax of 31 characters in aNopassword when Secure Login isenabled.
Max of 7 characters otherwise.

OPC UA

PRIV Level 2 user

All of these passwords are

PRIV Level 3 user

controlled by the PRIV Level 4

PRIV Level 4 user

user. See above.

No

Changed directly on the PROFINET
Controller command shell by
PROFINET Controller
command shell 3

running the following command:
PNC admin

loginCfg passwordYes

Max of 10 characters in a
password.
Changed directly on the ECM850
command shell by running thefollowing command:
ECM command shell

admin

loginCfg passwordYes

Max of 10 characters in a
password.
Included in plaintext in an AUP filethat must be imported into the
Ethernet Configuration andEthernet Station
Manager

1

STA Modify-level user

downloaded to the PACSystems
controller.

No

stpasswd=<newpass>
Max of 7 characters in a password

Security Capabilities

40

PACSystems™ RXi, RX3i and RSTi-EP Controller Secure Deployment Guide
GFK-2830AA

Functionality

Authenticated Subjects

How Passwords are assigned

Section 4

Nov 2022

Default Provided

Included in plaintext in an AUP filethat must be imported into the
Ethernet Configuration andUpdate Web Pages1

FTP userdownloaded to the PACSystems
controller.

Yes

tpasswd=<newpass>
Max of 7 characters in a password.
Changed using the web portal.
Password must have 8-16
characters, use both uppercase
and lowercase letters, and include
at least one number and special
character. To reset your password,
go to the "Administrator" menu
Web Server Firmware
Updatefound on the web portal
FW update user

homepage.

Yes

For more information on thedefault web-based firmware
update password and/or resettinga web-based firmware update
password, refer to the firmware
upgrade instructions included in a
firmware upgrade kit for thecontroller in question.

For more detailed information on assigning these passwords, see the User’s Manual for the appropriate
product.

Security Capabilities

41

PACSystems™ RXi, RX3i and RSTi-EP Controller Secure Deployment Guide
GFK-2830AA

4.5

Confidentiality and Integrity

4.5.1

Communications Protocols

Section 4

Nov 2022

Some communications protocols provide features that help protect data while it is inflight– actively moving through a network. The most common of these features include:•

Encryption – Protects the confidentiality of the data being transmitted.

•

Message Authentication Codes – Ensures message authenticity andintegrity by cryptographically detecting message tampering or forgery. This
ensures the data originated from the expected source and was not alteredsince it was transmitted, regardless of whether it was malicious or not.

Currently, few of the communications protocols supported by PACSystems provide eitherof these features, as detailed in the following table. Therefore, compensating controls
may be required to meet an installation’s security requirements for protecting data inflight.

Protocol-Provided Security Capabilities
Data Encryption

Message Authentication Codes

BOOTP

ProtocolN

N

DCE/RPC

N

N

DNS

N

N

Ethernet Global Data

N

N

FTP

N

N

HTTP

N

N

HTTPS

Y

N

Modbus TCP

N

N

OPC UA Server

Y

Y

DNP3 Outstation or Server

NN

IEC 60870-5-104 Server or Slave

N

N

PROFINET DCP

N

N

PROFINET I/ONN

IEC 61850 Client

N

N

Ethernet

Security Capabilities

42

PACSystems™ RXi, RX3i and RSTi-EP Controller Secure Deployment Guide
GFK-2830AA

ProtocolSerialSection 4

Nov 2022

Data Encryption

Message Authentication Codes

MRP

N

N

RDS

N

N

Remote Station Manager

N

N

SNMP v2c

N

N

SNTP

N

N

SRTP

N

N

TelnetN

N

Set Temporary IP

N

N

ASCII Terminal

N

N

Modbus RTU SlaveN

N

SNP Slave

N

N

4.5.2

Firmware Signatures
Some PACSystems controllers have digitally signed firmware images to provide
cryptographic assurance of the firmware’s integrity. For controllers that support thisfeature, a digital signature is used to verify that any firmware being loaded onto thecontroller was supplied by Intelligent Platforms LLC and has not been modified. If thedigital signature validation fails, the new firmware will not be installed onto the device.

Security Capabilities

43

PACSystems™ RXi, RX3i and RSTi-EP Controller Secure Deployment Guide
GFK-2830AA

4.5.3

Section 4

Nov 2022

Logging and Auditing
The PACSystems controller doesn’t provide a dedicated security log embedded within thecontroller, nor does it integrate with an external Security Information and EventManagement (SIEM) system. However, the PACSystems controller does log operational
events into two small (64-entry) fault tables. Each fault entry includes the time & datethat the fault was logged, using the date/time maintained on the Controller.

These fault tables can be read by remote clients as well as by the user application
running on the controller. Thus, logged events could be communicated to an external
system for persistent storage and auditing, if required by an installation’s security policy.
PAC Machine Edition can be used to export the fault tables to an XML file or print them.
The fault tables can also be remotely retrieved using the PACSAnalyzer tool and stored ina text file.

Most of the events that are logged in the PACSystems fault tables represent functional
issues, such as hardware failures and unexpected firmware operations. While those are
not specific to security, they may still provide information that is useful during a security
audit. Two security-specific faults can be logged.

Security Capabilities

1.

When an attempt to authenticate using the Service
Request protocol fails, a specific fault is logged in theController Fault Table and a system variable (#BAD_PWD)
is set to signal that a login attempt has failed. The fault
text is “Password Access Failure”, and the fault extra data
encodes information specific to the event.

2.

When an attempt to use an access-controlled feature fails
due to insufficient privileges, a specific fault is logged in
the Controller Fault Table. The fault text is “Access Control
List violation detected”, and the fault extra data encodes
information specific to the event.

44

PACSystems™ RXi, RX3i and RSTi-EP Controller Secure Deployment Guide
GFK-2830AA

Section 5:

Section 5

Nov 2022

Configuration Hardening

This section is intended to assist in reducing the potential attack surface by providing
information that can be used to harden the configuration of the PACSystems productsthat are present in a particular installation. Configuration Hardening should beconsidered in addition to enabling and using security features such as Authentication,
Access Control, and Authorization.
On each PACSystems product, all ports, services, and protocols that are not required forthe intended application should be disabled.

5.1

Controller
This section provides information to use when hardening the configuration of a
PACSystems controller. These options should be considered when configuring any
PACSystems controller that supports them.
These settings are specified within the hardware configuration that is downloaded to the
PACSystems controller.

5.1.1

Serial Port Protocols
The hardware configuration for the PACSystems controller includes the ability to modify
the operation of the serial ports embedded on the controller, including which server
protocols will be supported. This selection is controlled by the Port Mode setting, whichmust be individually specified for each serial port. The protocols that will be supported
for each option are summarized here.

Serial Port Configuration
Port Mode
RTU Slave

Supported Protocols
Modbus RTU Slave
SNP Slave

SNP Slave

SNP Slave

Serial I/O Message Mode

Application-defined

Available(none)To reduce the potential attack surface, configure each serial port using the mostrestrictive option that still supports the required protocol(s). Setting the Port Mode to
Available will disable all protocols for a given serial port, but very low-level handling ofdata received on that port will still occur.

5.1.2

Modbus TCP Server

Configuration Hardening

45

PACSystems™ RXi, RX3i and RSTi-EP Controller Secure Deployment Guide
GFK-2830AA

Section 5

Nov 2022

The hardware configuration for the PACSystems controller can be used to disable
Modbus TCP server access to data on the controller. This is managed using the Modbus
Address Space Mapping Type setting.

Modbus TCP configuration
Modbus Address Space Mapping Type Modbus TCP Data AccessStandard Modbus Addressing

AllowedDisabled

Not allowed

Note: This setting affects all the Ethernet Interfaces for the controller. Even when using a
modular PACSystems platform such as the RX3i, there is no way to enable the Modbus
TCP server on one Ethernet Interface while having it disabled on another.

5.2

Ethernet Interface
This section provides information to use when hardening the configuration of a
PACSystems Ethernet Interface. These settings should be considered when configuring
any PACSystems Ethernet Interface.
The Ethernet Interface can be configured to disable several services. The table below lists
those services and indicates the configuration value that will disable each. Note thatsome of these settings will not entirely close the TCP/UDP port, but they will still reduce
the attack surface.

Disabling Ethernet Services
Service
BOOTP Client

Parameter Name

Value

Use BOOTP for IP Address

False

FTP Server1

Max FTP Server Connections

0

IP Routing

Gateway IP Address

0.0.0.0

Name Server IP Address

0.0.0.0

SNTP Client

Network Time Sync

None

Web Server

Max Web Server Connections

0

DNS Client

1

1

1

These settings are specified within the hardware configuration that is downloaded to the
PACSystems controller. For more information on these parameters, refer to the TCP/IP
Ethernet Communications for PACSystems User’s Manual, GFK-2224.

Configuration Hardening

46

PACSystems™ RXi, RX3i and RSTi-EP Controller Secure Deployment Guide
GFK-2830AA

5.3

Section 5

Nov 2022

PROFINET Controller
This section provides information to use when hardening the configuration of a
PACSystems PROFINET Controller. These settings should be considered when
configuring any PACSystems PROFINET Controller.
Service
IP Routing

How to Disable
Set Gateway IP Address to 0.0.0.0 in the hardware configuration anddownload it to the PACSystems controller.
Login to the PROFINET Controller3 Command Line Interface asadmin. Run the following command:

Telnet Server

no telnet
Note:

Telnet server is disabled by default. The current state of thetelnet server can be confirmed by running:show telnetd

5.4

OPC UAThis section shows those OPC UA parameter settings that provide the maximum
hardening. Weigh these settings against the system’s requirements.
Parameters

How to Harden
Set this parameter to False if the OPC UA protocol will not be

Server Enabledused. This will eliminate all OPC UA attack surfaces from thecontroller.
Set this parameter to Strict to force the controller to check forvalid dates on all installed security certificates. Please be aware

Certificate Expiration Datethat if this parameter is Strict, when a previously installed

Checking

certificate expires, all communication with the associated OPC
UA client will cease. A new, valid certificate must be installed toallow communication to resume.

Certificate Debug
Commands

5.5

Set this parameter to Disabled. This will prevent anyone fromlooking at the contents of the controller’s certificate stores with
the OPC UA Station Manager command.

DNP3 Outstation
This section provides information to use when hardening the configuration of a DNP3
Outstation Protocol. Weigh these settings against the system’s requirements.
Parameters

How to Harden
Set this parameter to Disabled if the DNP3 Outstation protocol

DNP3 Outstation Protocol

will not be used. This will eliminate all DNP3 Outstation attack
surfaces from the controller.

Configuration Hardening

47

PACSystems™ RXi, RX3i and RSTi-EP Controller Secure Deployment Guide
GFK-2830AA

Section 6:

Section 6

Nov 2022

Network Architecture andSecure Deployment
This section provides security recommendations for deploying PACSystems controllers in
the context of a larger network.

6.1

Reference Architecture
Figure 1 shows a reference deployment of PACSystems components using the logicalsegmentation of the Purdue Enterprise Reference Architecture, otherwise known as the
Purdue Model.

Netowrk Architecture and Secureployment

48

PACSystems™ RXi, RX3i and RSTi-EP Controller Secure Deployment Guide
GFK-2830AA

Section 6

Nov 2022

Figure 1: PACSystems Deployed in Purdue Model

Netowrk Architecture and Secureployment

49

PACSystems™ RXi, RX3i and RSTi-EP Controller Secure Deployment Guide
GFK-2830AA

Section 6

Nov 2022

The Manufacturing Zone networks (which include the Manufacturing Operations,Supervisory Control, and Process Control networks) are segregated from other untrusted
networks such as the enterprise network (also referred to as the business network,
corporate network, or intranet) and the internet using a Demilitarized Zone (DMZ)
architecture. The Process Control networks have limited exposure to traffic from higherlevel networks, including other networks in the Manufacturing Zone, as well as fromother Process Control networks.

6.2

Remote Access and Demilitarized Zones (DMZ)
A DMZ architecture uses two firewalls to isolate servers that are accessible from
untrusted networks. The DMZ should be deployed such that only specific (restricted)
communication is allowed between the business network and the DMZ, and between thecontrol network and the DMZ. The business network and the control networks should
ideally not communicate directly with each other.
If direct communication to a control network is required from the business network or
the internet, carefully control limit and monitor all access. For example, require twofactor authentication for a user to obtain access to the control network using Virtual
Private Networking (VPN) and even then, restrict the allowed protocols/ports to just theminimum set required. Further, every access attempt (successful or not) and all blocked
traffic should be recorded in a security log that is regularly audited.

6.3

Access to Process Control Networks
Ethernet traffic from the Supervisory Control network to the Process Control networks
should be restricted to support only the functionality that is required. For example, since
PAC Machine Edition uses SRTP to download the application to the PACSystems
controllers and NIUs, then SRTP traffic must be allowed through the firewall. However, if
a particular protocol (such as Modbus TCP) doesn’t need to be used between thoseregions, then the firewall should be configured to block that protocol. If, in addition tothat, a controller has no other need for that protocol, then – in addition to blocking it at
the firewall – the controller itself should be configured to disable support for the
protocol itself.
Note: Network Address Translation (NAT) firewalls typically do not expose all of thedevices on the trusted side of the firewall to devices on the untrusted side of the firewall.
Further, NAT firewalls rely on mapping the IP address/port on the trusted side of thefirewall to a different IP address/port on the untrusted side of the firewall. Since
communication to PACSystems controllers will typically be initiated from a computer on
the untrusted side of the Process Control network firewall, protecting a Process Control
network using a NAT firewall may cause additional communication challenges. Before
deploying NAT, carefully consider its impact on the required communications paths.

Netowrk Architecture and Secureployment

50

PACSystems™ RXi, RX3i and RSTi-EP Controller Secure Deployment Guide
GFK-2830AA

6.4

Section 6

Nov 2022

Access to PROFINET Networks
Commissioning and maintaining the devices on the PROFINET network requires theability to communicate from a computer to the I/O devices on that network. For example,
if a PROFINET I/O device fails and needs to be replaced, the replacement I/O device willneed to be assigned a name. As described in Section 3.5, PROFINET, this is done using the
PROFINET DCP protocol. However, to help ensure that the Maintenance computer
cannot be used to launch attacks on the I/O devices using other protocols, the firewall it
connects through should block all protocols that are not needed for performing themaintenance functions.
Note: Since the PROFINET DCP protocol is not routable, the firewall used will most likely
need to be configured so it operates in Transparent mode (This is noted by the use of a“T” on the firewall in the Reference Architecture diagram.). This will allow theMaintenance computer to be part of the same subnet as the PROFINET I/O devices, as
required by the PROFINET DCP protocol.

6.5

Hot Standby CPU Redundancy with PROFINET
IO
Hot Standby CPU Redundancy allows a critical application or process to continue
operating if a failure occurs in any single component. A Hot Standby system employs two
CPUs:◼

an Active unit that is actively controlling the process at a given moment, and◼

a Backup unit that is synchronized with the Active unit and can take over theprocess in a bumpless fashion, should that become necessary.

The two units are synchronized when both are in Run Mode, the Backup unit hasreceived the latest status and synchronization information from the Active unit via aredundancy link, and both are running their logic solutions in parallel.
In the case of CPE400 or CPL410, LAN3 is utilized as the high-speed data synchronization
link between the redundant CPUs. This is a dedicated Ethernet link connecting the two
LAN3 ports on the Active CPU to the equivalent ports on the Backup CPU, as shown in
Figure 2. The upper port of the Primary is connected to the upper port of the Secondary,and the lower port to the lower port. No crossing is permitted.

Netowrk Architecture and Secureployment

51

PACSystems™ RXi, RX3i and RSTi-EP Controller Secure Deployment Guide
GFK-2830AA

Section 6

Nov 2022

Figure 2: CPE400/CPL410 LAN3 Connections for Hot Standby Redundancy

Note that CPE400/CPL410 LAN3 is used as a dedicated link, solely for CPU datasynchronization in Hot Standby Redundancy Systems. Although the underlying network
is a standard Ethernet network, no other Ethernet devices are permitted, except the two
matched LAN3 ports on the Primary and Secondary CPUs. Failure to observe thisrestriction will invalidate the configuration.
The system is completely functional with only one Ethernet link operating on LAN3, butboth links should nevertheless be connected to provide for communications redundancy
on the link itself. Refer to the PACSystems RX3i IC695CPE400 1.2GHz 64MB Rackless CPU
w/Field Agent Quick Start Guide, GFK 3002A or later for Hot Standby Redundancy set up.
For CPL410, refer to the PACSystems RX3i IC695CPL410 1.2GHz 64MB Rackless CPU w/Linux
Quick Start Guide, GFK-3053.
From a security perspective, the Ethernet network features of LAN3 are subject to thesame security requirements as any Ethernet network. However, since no other devices
may be attached, and the link is hard-wired, there is nothing additional that the userneeds to consider.
A second aspect of implementing Hot Standby CPU Redundancy with RX3i CPE400/
CPL410 is its total reliance on PROFINET IO. Most other rack-based CPU systems employ
rack-based or Genius I/O, but these are not compatible with the CPE400/CPL410. From asecurity perspective, the PROFINET features of LAN1 and LAN2 are subject to the same
security requirements as any PROFINET network.

Netowrk Architecture and Secureployment

52

PACSystems™ RXi, RX3i and RSTi-EP Controller Secure Deployment Guide
GFK-2830AA

6.6

Section 6

Nov 2022

Access to IEC 61850 Networks
Commissioning and maintaining the devices on an IEC 61850 network requires the ability
to communicate from a Maintenance PC in the Manufacturing Operations & Supervisory
Control network to remote devices like Intelligent Electronic Devices (IED) on the IEC
61850 network, which typically implements an IEC 61850 server. For example, theintegrated IEC 61850 configurator in PAC Machine Edition can connect to a remote IED
and directly read its IEC 61850 object model over the IEC 61850 protocol. This is
described in Section 3.6:IEC 61850. Refer to the PACSystems RX3i IEC 61850 Ethernet
Communication Module User Manual, GFK-2849, for more details. However, to mitigate
attacks launched from the Maintenance PC using other protocols, the firewall between
the Maintenance PC and the IEC 61850 network should block all protocols that are notneeded for performing maintenance functions.

6.7

Hot Standby CPU Redundancy with DNP3
Outstation
Hot Standby CPU Redundancy allows a critical application or process to continue
operating if a failure occurs in any single component. A Hot Standby system employs two
CPUs:◼

an Active unit that is actively controlling the process at a given moment whilestoring the Event Reports (SOE / Most Recent), and◼

a Backup unit that is synchronized with the Active unit including the Event
Reports.

The two units are synchronized when both are in Run Mode, the Backup unit hasreceived the latest status and synchronization information such as Event Reports fromthe Active unit via a redundancy link, and both are running their logic solutions inparallel. For more information, please refer to GFK-3103 (PACSystems DNP3 Outstation
user Manual).

Netowrk Architecture and Secureployment

53

PACSystems™ RXi, RX3i and RSTi-EP Controller Secure Deployment Guide
GFK-2830AA

Section 7:
7.1

Section 7

Nov 2022

Other Considerations

Patch Management
A strategy for applying security fixes, including patches, firmware updates, andconfiguration changes, should be included in a facility’s security plan. Applying these
updates will often require that an affected PACSystems controller be temporarily takenout of service.
If temporarily taking a controller out of service to apply security fixes is expected tocause unacceptable disruption to the system’s availability, then consider designing thecontrol system to use redundancy. PACSystems supports Hot-Standby CPU Redundancy
which will allow many, if not all, security fixes to be applied to the redundant controllers
while continuing to control the process.
Finally, some installations require extensive qualification to be performed beforechanges are deployed to the production environment. While this requirement is
independent of security, ensuring the ability to promptly apply security fixes while
minimizing downtime may drive the need for additional infrastructure to help with thisqualification.

7.2

Real-time Communication
When designing the network architecture, it is important to understand what impact the
network protection devices (such as firewalls) will have on the real-time characteristics ofthe communications traffic that must pass through them. In particular, the PROFINET
I/O, Ethernet Global Data, and Reliable Datagram Service protocols are generally
expected to operate with small, known, worst-case bounds on their communications
latency and jitter. As a result, network architectures that require real-timecommunications to pass through such devices may limit the applications that can be
successfully deployed.

7.3

RXi Compensating Controls

7.3.1

Network Bandwidth Limiting
The RXi Controller's Ethernet interfaces are not capable of sustaining Ethernet
communications above a speed of 8 Mbps over the SRTP Server's TCP port (18245/TCP)
and 10 Mbps in general. Above these thresholds, ARP, IMCP, UDP, and TCP services may
become unavailable. Care must be taken to design and implement the network toprevent excessive traffic to RXi Controller Ethernet interfaces.
To reduce the likelihood of intentional or accidental network flooding that could cause aloss of availability in RXi Controller Ethernet interfaces. Please follow the relevant
recommendations in Section 4.3.4. To further mitigate the loss of availability for aparticularly critical asset, a switch or firewall configured for ingress and egress ratelimiting can be placed directly between the RXi Controller and the rest of the network. In

Other Considerations

55

PACSystems™ RXi, RX3i and RSTi-EP Controller Secure Deployment Guide
GFK-2830AA

Section 7

Nov 2022

the event of a network storm, the switch or firewall will selectively drop traffic to limit therate of traffic that reaches a given RXi Controller. Additionally, it is recommended toleave the OPC UA Server in its default disabled state unless the application leverages
OPC UA.

7.4

RSTi-EP Compensating Controls

7.4.1

Network Bandwidth Limiting
The RSTi-EP CPE100 and CPE115 Controllers’ Ethernet interfaces are not capable ofsustaining Ethernet communications above a speed of 5 Mbps over the SRTP Server's
TCP port (18245/TCP) and 10 Mbps in general. Above these thresholds, ARP, IMCP, UDP,
and TCP services may become unavailable. Care must be taken to design and implement
the network to prevent excessive traffic to RSTi-EP CPE100 and CPE115 Controller
Ethernet interfaces.
To reduce the likelihood of intentional or accidental network flooding that could cause aloss of availability in RSTi-EP CPE100 and CPE115 Controller Ethernet interfaces. Please
follow the relevant recommendations in Section 4.3.4. To further mitigate the loss ofavailability for a particularly critical asset, a switch or firewall configured for ingress andegress rate-limiting can be placed directly between the RSTi-EP CPE100 or CPE115
Controller and the rest of the network. In the event of a network storm, the switch or
firewall will selectively drop traffic to limit the rate of traffic that reaches a given RSTi-EP
Controller. Additionally, it is recommended to leave the OPC UA Server in its default
disabled state unless the application leverages OPC UA.

7.5

Additional Guidance

7.5.1

Protocol-specific GuidanceProtocol standards bodies may publish guidance on how to securely deploy and use their
protocols. Such documentation, when available, should be considered in addition to thisdocument. This includes, but is not limited to the following document:◼

Other Considerations

PROFINET Security Guideline (TC3-04-0004a) by PROFIBUS INTERNATIONAL

56

PACSystems™ RXi, RX3i and RSTi-EP Controller Secure Deployment Guide
GFK-2830AA

7.5.2

Section 7

Nov 2022

OPC UA Server
When running an OPC UA Server with a Limited Communications Window, the server canprocess enough requests to use the entire window, which will add that time to your PLC
Logic sweep. For example, a 100 ms Limited Backplane Communications Window could add
the full 100 ms to your PLC Logic Sweep. Caution should be taken to ensure theCommunication Window is configured within the tolerances of the system.

7.5.3

PROFINET Controller Duplicate IP
The duplicate IP address handling for the RX3i PROFINET Controller (IC695PNC001
firmware revision 2.26 and above) and the Embedded PROFINET Controller on the RX3i
CPE330, CPE400, and CPL410, and the RSTi-EP CPE100, CPE115, CPE205, CPE210, CPE215,
CPE220, and CPE240 behaves as follows.
In each case, the system has an active PROFINET network with a PROFINET Controller
connected to at least one PROFINET Device.
1. If a second PROFINET Controller with an identical IP address to the active
PROFINET Controller is added to the network, the second Controller will notenter the network and will log a fault to indicate Duplicate IP Detected. The firstController will maintain all device connections.
2. If a device with an identical IP address to an active PROFINET Controller isadded to the network, the Controller will log a Duplicate IP Detected fault andmaintain all device connections.
3. If a device with an identical IP address to an active PROFINET Device is added to
the network, the Controller will log a Duplicate IP Detected fault and maintain all
device connections.

7.5.4

Controller Ethernet Duplicate IP
The Controller IP conflict detection mechanism detects the duplicate IP address for theEmbedded Ethernet interface of the RSTi-EP CPE205, CPE210, CPE215, CPE220, and
CPE240 controllers.
The IP conflict detection mechanism works by generating an ARP message every two
minutes to see if any devices on the network have the same IP address.
The IP conflict detection mechanism detects a network device that has the same IP
Address as its own in the following scenarios:
4. When a duplicate IP Address is detected during power-up, or upon new
hardware configuration, the Controller will log a fault for itself to indicate
Duplicate IP Address Detected.
5. During controller operation when a duplicate IP Address is detected whenevera new device with a conflicting IP Address announces its presence on the
network, the Controller will log a fault for itself to indicate Duplicate IP Address
Detected.

Other Considerations

57

PACSystems™ RXi, RX3i and RSTi-EP Controller Secure Deployment Guide
GFK-2830AA

Section 7

Nov 2022

Whenever an IP Address conflict exists, IP-based network communication with thedevice(s) may be disrupted. The IP Address conflict should be resolved by disconnecting
one of the offending devices from the network or assigning each a unique address. The
Duplicate IP Address Detected fault lists the MAC address of the offending devices in theFault Extra Data.
Whenever the IP Address conflict is resolved, the Controller will log a Duplicate IP Address
Resolved fault.
PME provides a configurable parameter named "Enable IP conflict detection." If thisparameter is enabled, then the IP Conflict is checked periodically. Otherwise, the periodic
check for IP conflicts is disabled (that means, IP conflicts can still exist, but no faults arelogged).

7.5.5

MRP Ring Ethernet Traffic Storm Prevention
The RX3i CPE330, CPE400, and CPL410 and the RSTi-EP CPE100, CPE115 LAN 2, CPE205
LAN, CPE210, CPE215, CPE220, and CPE240 LAN2 and the RX3i PNC001 can all be
configured as an MRP Ring Manager (MRM). However, none of these default to be an
MRM.
To prevent an Ethernet Traffic Storm, the physical ring must not be completely
connected until the MRM configuration is stored to an Ethernet node on the ring. Failure
to have an active MRM configured in an Ethernet ring configuration will result in an
Ethernet Traffic Storm caused by the ring’s network loop topology. An Ethernet Traffic
Storm will prevent communication to all Ethernet nodes connected to the ring until thering is physically broken or an MRM is configured.
Before clearing and power cycling the configuration of a CPU that is configured as an
MRM in a ring topology, it is recommended that either (a) the ring be broken byphysically disconnecting an Ethernet port on any network node in the ring, or (b) someother network nodes in the ring be configured as an MRM.
To prevent storms in a ring where a PROFINET Controller is configured as an MRM, thecontroller will maintain that functionality even after a clear and power cycle and willcontinue to do so until a different configuration is stored to that controller, providing the
new configuration prevents the controller from operating as an MRM. It is still
recommended that the ring be broken by physically disconnecting an Ethernet port on
any network node in the ring until a single MRM is configured for the ring.

Other Considerations

58

PACSystems™ RXi, RX3i and RSTi-EP Controller Secure Deployment Guide
GFK-2830AA

7.5.6

Section 7

Nov 2022

Government Agencies and Standards Organizations
Government agencies and international standards organizations may guide on creating
and maintaining a robust security program, including how to securely deploy and use
Industrial Control Systems. For example, the U.S. Department of Homeland Security has
published guidance on Secure Architecture Design and Recommended Practices forcybersecurity with Industrial Control Systems. Similarly, the International Society ofAutomation publishes the ISA-99 specifications to guide establishing & operating acyber-security program, including recommended technologies for industrial automationand control systems. Such documentation, when appropriate, should be considered inaddition to this document.

Other Considerations

59

General Contact Information
Home link:

http://www.emerson.com/industrial-automation-controls

Knowledge Base:https://www.emerson.com/industrial-automation-controls/support

Technical Support
Americas
Phone:

1-888-565-4155
1-434-214-8532 (If toll-free option is unavailable)
Customer Care (Quotes/Orders/Returns): customercare.mas@emerson.com
Technical Support: support.mas@emerson.com

EuropePhone:+800-4444-8001+420-225-379-328 (If toll-free option is unavailable)
Customer Care (Quotes/Orders/Returns): customercare.emea.mas@emerson.com
Technical Support: support.mas.emea@emerson.com

Asia
Phone:+86-400-842-8599+65-6955-9413 (All other Countries)
Customer Care (Quotes/Orders/Returns): customercare.cn.mas@emerson.com
Technical Support: support.mas.apac@emerson.com

Any escalation request should be sent to: mas.sfdcescalation@emerson.com

Note: If the product is purchased through an Authorized Channel Partner, please contact the seller directly
for any support.
Emerson reserves the right to modify or improve the designs or specifications of the products mentioned in this manualat any time without notice. Emerson does not assume responsibility for the selection, use or maintenance of any product.
Responsibility for proper selection, use and maintenance of any Emerson product remains solely with the purchaser.
© 2022 Emerson. All rights reserved.
Emerson Terms and Conditions of Sale are available upon request. The Emerson logo is a trademark and service markof Emerson Electric Co. All other marks are the property of their respective owners.