EdgeFire™
Administrator’s Guide

2021-12-24

Copyright © 2021 Trend Micro Incorporated. All rights reserved. No part of this publication may be
reproduced, photocopied, stored in a retrieval system, or transmitted without the express prior writtenconsent of Trend Micro Incorporated.

Trend Micro Incorporated reserves the right to make changes to this document and to
the product described herein without notice. Before installing and using the product,
review the readme files, release notes, and/or the latest version of the applicable
documentation, which are available from the Trend Micro website at:
http://docs.trendmicro.com/en-us/home.aspx

Trend Micro, the Trend Micro t-ball logo, and TXOne Networks aretrademarks or registered trademarks of Trend Micro Incorporated. All other product orcompany names may be trademarks or registered trademarks of their owners.

This documentation introduces the main features of the product and/or provides
installation instructions for a production environment. Read through the documentation
before installing or using the product.

Detailed information about how to use specific features within the product may beavailable at the Trend Micro Online Help Center and/or the Trend Micro Knowledge
Base.

2

Table of Contents
Table of Contents ..................................................................................................................................... 3
Chapter 1 .................................................................................................................................................. 9
About EdgeFire™ .................................................................................................................................... 9
Introduction .......................................................................................................................................... 9Main Functions ................................................................................................................................... 10
Extensive Support for Industrial Protocols ................................................................................... 10
Policy Enforcement for Mission-Critical Machines ...................................................................... 10Intelligence Learning and Rule Generation for Daily Network Traffic ........................................ 10
Improve Shadow OT Visibility by Integrating IT and OT Networks ........................................... 10
Intrusion Prevention and Intrusion Detection ............................................................................... 10
Switch Between Two Flexible Modes, ‘Monitor’ & ‘Prevention’ ................................................ 10
Top Threat Intelligence and Analytics .......................................................................................... 10
Centralized Management .............................................................................................................. 11
Flexible Segmentation and Isolation ............................................................................................. 11
Chapter 2 ................................................................................................................................................ 12
Getting Started ........................................................................................................................................ 12
Getting Started: Task List ................................................................................................................... 12
Opening the Management Console ..................................................................................................... 13
Changing the Administrator’s Password ............................................................................................ 14
Chapter 3 ................................................................................................................................................ 15
The System Tab ...................................................................................................................................... 15
Device Information ....................................................................................................................... 16
Secured Service Status .................................................................................................................. 16
System Resources ......................................................................................................................... 17
WAN Interface Summary ............................................................................................................. 17
LAN Interface Summary ............................................................................................................... 17
Throughput / Connection .............................................................................................................. 18
Bandwidth Utilization (In Gateway Mode) ................................................................................... 18
Real Time Session Status (In Gateway Mode) .............................................................................. 18
Device Information (In Gateway Mode) ....................................................................................... 19
Chapter 4 ................................................................................................................................................ 20
The Visibility Tab .................................................................................................................................. 20

3

Active Query ...................................................................................................................................... 20
Viewing Asset Information ................................................................................................................ 20
Viewing Real Time Network Application Traffic .............................................................................. 21
Chapter 5 ................................................................................................................................................ 22
The Network Tab.................................................................................................................................... 22Port Settings ....................................................................................................................................... 22
Configuring the Ports .................................................................................................................... 22Port Mapping ...................................................................................................................................... 23
Viewing the Port Mapping (In Gateway Mode) ............................................................................ 23
Viewing the Port Mapping (In Bridge Mode) ............................................................................... 24
Network Interface (In Gateway Mode Only) ...................................................................................... 24
Configuring LAN Network Interface ............................................................................................ 24
Configuring DMZ Network Interface ........................................................................................... 27
Configuring WAN Network Interface .......................................................................................... 28
MGMT Settings (In Gateway Mode) ................................................................................................. 31
Configuring MGMT Port .............................................................................................................. 31
HA Settings ........................................................................................................................................ 32
Port Mirror Settings ............................................................................................................................ 33
Operation Mode .................................................................................................................................. 34
Gateway Mode .............................................................................................................................. 34
Bridge Mode ................................................................................................................................. 34
Switch to Gateway Mode .............................................................................................................. 35
Switch to Bridge Mode ................................................................................................................. 36
Chapter 6 ................................................................................................................................................ 38
The NAT Tab ......................................................................................................................................... 38
NAT Rule ........................................................................................................................................... 38
Configuring a 1 to 1 NAT Rule .................................................................................................... 38
Configuring a Multiple 1 to 1 NAT Rule: CIDR .......................................................................... 40
Configuring a Multiple 1 to 1 NAT Rule: IP Range ..................................................................... 41
Configuring Port Forwarding ........................................................................................................ 43
ALG .................................................................................................................................................... 44
Configuring ALG Settings ............................................................................................................ 44
Chapter 7 ................................................................................................................................................ 46

4

The Routing Tab ..................................................................................................................................... 46
Static Route ........................................................................................................................................ 46
Configuring a Static Route ............................................................................................................ 46
Chapter 8 ................................................................................................................................................ 48
The Object Profiles Tab.......................................................................................................................... 48
Configuring IP Object Profiles ........................................................................................................... 49
Configuring Service Object Profiles ................................................................................................... 50
Configuring Protocol Filter Profiles ................................................................................................... 50
Specifying Commands Allowed in an ICS Protocol ..................................................................... 52
Applying the Drop Malformed Option to an ICS Protocol ........................................................... 53
Advanced Settings ........................................................................................................................ 53
Advanced Settings for Modbus Protocol ...................................................................................... 53
Advanced Settings for CIP Protocol ............................................................................................. 56
Advanced Settings for S7COMM ................................................................................................. 59
Advanced Settings for S7COMM_PLUS ..................................................................................... 62
Advanced Settings for SLMP ....................................................................................................... 65
Advanced Settings for MELSOFT ................................................................................................ 68
Advanced Settings for TOYOPUC ............................................................................................... 72
Advanced Settings for SMB ......................................................................................................... 75
Configuring IPS Profiles .................................................................................................................... 76
Configuring a Pattern Rule for Granular Control .......................................................................... 76
Configuring File Filter Profiles .......................................................................................................... 79
Chapter 9 ................................................................................................................................................ 81
The Security Tab .................................................................................................................................... 81
Cyber Security .................................................................................................................................... 81
Configuring Cyber Security – Denial of Service Prevention ........................................................ 81
Policy Enforcement ............................................................................................................................ 82
Configuring Policy Enforcement .................................................................................................. 82
Adding Policy Enforcement Rules (In Gateway Mode) ............................................................... 83
Adding Policy Enforcement Rules (In Bridge Mode) ................................................................... 86
Managing Policy Enforcement Rules............................................................................................ 88
Policy Rule Auto-Learning ................................................................................................................. 89
Configuring Policy Rule Auto-Learning ....................................................................................... 89

5

Stopping Policy Rule Auto-Learning ............................................................................................ 90
Canceling Policy Rule Auto-Learning .......................................................................................... 91
Generating the Learning Results ................................................................................................... 92
Deleting the Learning Results ....................................................................................................... 94
Chapter 10 .............................................................................................................................................. 96
The Pattern Tab ...................................................................................................................................... 96
Viewing Device Pattern Information .................................................................................................. 96
Manually Updating the Pattern ........................................................................................................... 96
Downloading Release Notes/IPS Rule Metadata ................................................................................ 97
Chapter 11 .............................................................................................................................................. 98
The Application Tab ............................................................................................................................... 98
USB Application ................................................................................................................................ 98
Advanced USB Application .......................................................................................................... 98
Packet Capture .................................................................................................................................... 99
Enabling Packet Capture ............................................................................................................... 99
Download Captured Packet ......................................................................................................... 100
Chapter 12 ............................................................................................................................................ 101
The Logs Tab........................................................................................................................................ 101
Viewing Cyber Security Logs .......................................................................................................... 101
Viewing Policy Enforcement Logs ................................................................................................... 102
Viewing Protocol Filter Logs ........................................................................................................... 102
Viewing File Filter Logs................................................................................................................... 103
Viewing Suspicious Object Logs ..................................................................................................... 104
Viewing Asset Detection Logs ......................................................................................................... 104
Viewing System Logs ....................................................................................................................... 105
Viewing Audit Logs ......................................................................................................................... 105
Chapter 13 ............................................................................................................................................ 106
The Administration Tab ....................................................................................................................... 106
Account Management ....................................................................................................................... 106
User Roles ................................................................................................................................... 106
Built-in User Accounts ............................................................................................................... 107
Adding a User Account ............................................................................................................... 107
Changing Your Password ........................................................................................................... 107

6

Configuring Password Policy Settings ........................................................................................ 108
Auth Service ..................................................................................................................................... 108
Configuring TACACS+ .............................................................................................................. 108
System Management ........................................................................................................................ 110
Configuring Device Name and Device Location Information .................................................... 110
Configuring Management Method and Access Control List ....................................................... 110
Configuring Management Protocols and Ports ........................................................................... 110
Configuring Access Control List from Management Clients ...................................................... 111
The Sync Settings Tab ...................................................................................................................... 111
Configuring Syslog Settings ............................................................................................................. 112
Syslog Severity Levels ................................................................................................................ 114
Syslog Severity Level Mapping Table ........................................................................................ 114
Configuring System Time ................................................................................................................ 115
The SNMP Tab ................................................................................................................................. 115
Configuring SNMP v1/v2c ......................................................................................................... 116
Configuring SNMP v3 ................................................................................................................ 116
Configuring SNMP Trap Receivers ............................................................................................ 117
The Back Up / Restore Tab .............................................................................................................. 118
Backing Up a Configuration ....................................................................................................... 119
Restoring a Configuration ........................................................................................................... 119
The Firmware Management Tab ...................................................................................................... 119
Viewing Device Firmware Information ...................................................................................... 119
Updating Firmware ..................................................................................................................... 120
Rebooting and Applying Firmware ............................................................................................. 121
Reboot System .................................................................................................................................. 121
Chapter 13 ............................................................................................................................................ 122
Supported USB Devices ....................................................................................................................... 122
Supported actions via USB Disk ...................................................................................................... 122
On-demand Configuration backup ................................................................................................... 124
Load Pattern from Disk .................................................................................................................... 124
Load Configuration from Disk ......................................................................................................... 125
Load Firmware from Disk ................................................................................................................ 126
Appendix A .......................................................................................................................................... 127

7

Terms and Acronyms ........................................................................................................................... 127

8

Chapter 1

About EdgeFire™
Introduction
EdgeFire™, a next generation firewall, is a highly integrated industrial multiport secure router with
firewall, NAT, and IPS functions. It is designed for Ethernet-based security applications on factory
networks, and it provides an electronic security perimeter for the protection of critical cyber assets
including pump-and-treat systems in water stations, DCS systems in oil and gas applications, and
PLC/SCADA systems in factory automation. Users can access its web-based console that provides agraphical user interface for device configuration and security policy settings. The whole management
process is designed to comply with the manufacturing SOPs of the industry.
IT and OT traditionally are operated separately, each with its own network, transportation team,goals, and needs. In addition, each industrial environment is equipped with tools and devices thatwere not designed to connect to a corporate network, thus making provisioning timely security
updates or patches difficult. Therefore, the need for security products that provide proper security
protection and visibility is on the rise.
Trend Micro provides a wide range of security products that cover both your IT and OT layers. Theseeasy-to-build solutions provide an active and immediate protection to Industrial Control System (ICS)
environments with the following features:▪

Certified industrial-grade hardware with size, power consumption, and durability tailored for
OT environments, as well as the ability to tolerate a wide range of temperature variations▪

Threat detection and interception, with safeguards against the spread of worms▪

Protection against Advanced Persistent Threats (APTs) and Denial of Service (DoS) attacks
that target vulnerable legacy devices▪

Virtual patch protection against OT device exploits

Figure 1.

Trend Micro security solutions for OT networks

9Main Functions
EdgeFire™ is a security device which can be managed by the OT Defense Console. The main functionsof the product are as follows:

Extensive Support for Industrial Protocols
EdgeFire™ supports the identification of a wide range of industrial control protocols, including Modbus
and other protocols used by well-known international companies such Siemens, Mitsubishi, Schneider
Electric, ABB, Rockwell, Omron, and Emerson. In addition to allowing OT and IT security systemadministrators to work together, this feature also allows the flexibility to deploy defense measures inappropriate network segments and seamlessly connects them to existing factory networks.

Policy Enforcement for Mission-Critical Machines
EdgeFire™’s core technology TXODI allows administrators to maintain a policy enforcement database.
By analyzing Layer 3 to Layer 7 network traffic between mission-critical production machines, policy
enforcement executes filtering of control commands within the protocols and blocks traffic that is notdefined in the policy rules. This feature can help prevent unexpected operational traffic, block
unknown network attacks, and block other activity that matches a defined policy.

Intelligence Learning and Rule Generation for Daily Network Traffic
EdgeFire™’s machine learning technology, ICS Foresight Strike, allows administrators to generate alearning task that will analyze the network traffic of daily operations and generate baseline policy
rules as a trust list. During the learning process, it creates a rule list for rapid deployment and filters
potential cyber threats. This feature can help OT and IT security system administrators to silently
deploy security solutions without affecting daily operations and efficiently generate policy rules withthe minimal manpower.

Improve Shadow OT Visibility by Integrating IT and OT Networks
EdgeFire™ comes equipped to make your IT and OT networks as integrated and coordinated with eachother as possible, and to grant visibility of your shadow OT environment.

Intrusion Prevention and Intrusion Detection
IPS/IDS provides a powerful, up-to-date first line of defense against known threats. Vulnerability
filtering rules provide effective protection against all exploits at the network level. Manufacturingpersonnel manage patching and updating, providing pre-emptive protection against critical production
failures, and additional protection for old or terminated software.

Switch Between Two Flexible Modes, ‘Monitor’ & ‘Prevention’
EdgeFire™ flexibly switches between ‘Monitor’ and ‘Prevention’ modes. ‘Monitor’ mode will log traffic
without interfering, while ‘Prevention’ mode will filter traffic based on policies you create. These
modes work together to preserve your productivity while maximizing security.

Top Threat Intelligence and Analytics
EdgeFire™ provides advanced protection against unknown threats with its up-to-date threat
information. With the help of the Zero Day Initiative (ZDI) vulnerability reward program, EdgeFire™
offers your systems exclusive protection from undisclosed and zero-day threats.

10Centralized Management
Trend Micro’s OT Defense Console (ODC) provides a graphical user interface for policy management incompliance with manufacturing SOP. It centrally monitors operations information, edits network
protection policies, and sets patterns for attack behaviors.
All protections are deployed throughout the entire information technology (IT) and operational
technology (OT) infrastructure. These include:▪

A centralized policy deployment and reporting system▪

Full visibility into assets, operations, and security threats▪

IPS and policy enforcement configuration can be assigned per device group, allowing all
devices in the same device group to share the same policy configuration▪

Management permissions for device groups can be assigned per user account

Flexible Segmentation and Isolation
EdgeFire™ is the ideal solution for segmenting a network into easily managed security zones. It
segments networks and isolates connectivity both to and between facilities as well as production
zones. EdgeFire™ comes equipped to make your IT and OT networks as integrated and coordinatedwith each other as possible, and to grant visibility of your shadow OT environment.

11

Chapter 2

Getting Started
This chapter describes the EdgeFire™ and how to get started with configuring the initial settings.

Note:

For an overview of the physical hardware and characteristics or a condensed version ofhelp with initial setup of the device, please refer to the EdgeFire™ Quick Setup Guide

Getting Started: Task List
The Getting Started Task List provides a high-level overview of all procedures required to get
EdgeFire™ up and running as quickly as possible. Each step links to more detailed instructions later inthe document.

Procedure
1.

Open the management console.
For more information, see Opening the Management Console on page 13.

2.

Change the administrator password.
For more information, see Changing the Administrator’s Password on page 14.

3.

Ensure that the link speed modes of the network ports are correct for your environment.
For more information, see Configuring the Ports on page 22.

4.

Change the default web management console IP address.
The default web management console IP address is 192.168.127.254. The IP address isbound to LAN1 network interface. To change the default IP address, see Configuring LAN
Network Interface on page 24.

5.

Configure the network interfaces.
For more information, see The Network on page 24.

6.

Configure the system time.
For more information, see Configuring System Time on page 115.

7.

(Optional) Configure the Syslog settings.
For more information, see Configuring Syslog Settings on page 112.

8.

Configure Object Profiles.
For more information, see The Object Profiles on page 48.

9.

Configure security policies.
For more information, see The Security on page 81.

10. Configure the device name and device location information.
For more information, see Configuring Device Name and Device Location Information on page110.
11. (Optional) Configure management protocols and ports.
For more information, see Configuring Management Protocols and Ports on page 110.
(Optional) Configure access control list from management clients.
For more information, see Configuring Access Control List from Management Clients on page111.
12. (Optional) Update the DPI (Deep Packet Inspection) pattern for the device.
For more information, see Manually Updating the Pattern on page 96.
13. (Optional) Enabling Management by ODC.
For more information, see The Sync Settings Tab on page 111.

12

14. (Optional) Configuring password policy.
For more information, see Configuring Password Policy Settings on page 108.

Opening the Management Console
EdgeFire™ provides a built-in management web console that you can use to configure and manage
the product. View the management console using a web browser.

Note:

View the management console using Google Chrome version 63 or later; Firefox version
53 or later; Safari version 10.1 or later; or Edge version 15 or later.

Procedure1.

In a web browser, type enter the address of the EdgeFire™ in the following format:
https://192.168.127.254
The logon screen will appear.

Note:

The default IP address of EdgeFire™ is 192.168.127.254 with subnet 255.255.255.0.
Before connecting a PC/Laptop to EdgeFire™, the PC's IP address should be set to an IP
address that is able to access the default IP address. After that, connect the PC and
EdgeFire™ using an Ethernet cable.

2.

Input the logon credentials (user name and password).
Use the default administrator logon credentials when logging on for the first time:▪

User name: admin▪

Password: txone

3.

Click Log On.

4.

When logging in for the first time or after a factory reset, you will be prompted to change thedefault user ID and password. The default user ID and password cannot be used.

13

5.

Login with newly changed user ID/password credentials.

Changing the Administrator’s Password
Refer to chapter "The Administration Tab", under sub-topic Account Management > Changing
Your Password.

14

Chapter 3

The System Tab
Monitor the following on the [System] tab:▪

Device information▪

Status of secured services▪

System resource usage▪

WAN interface information▪

LAN interface information▪

Throughput/connection information for this device▪

Bandwidth utilization (in gateway mode)▪

Real time session status (in gateway mode)▪

Packet transmission status (in gateway mode)

The System tab in gateway mode is shown as below:

15

The System tab in bridge mode is shown as below:

Device Information
This widget shows the system boot time, device name, model, firmware version, and firmware build
date / time.

Secured Service Status
This widget shows the statuses (enabled/disabled) of the security services the device provides, as wellas the signature version used and sync status with ODC.

16

System Resources
This widget shows the following:▪

CPU Utilization - Real time CPU utilization % (according to refresh time settings).

▪

Memory Utilization - Real time memory utilization % (according to refresh time settings).

WAN Interface Summary
This widget shows a summary of information for the WAN interface.

LAN Interface Summary
This widget shows a summary of information for the LAN, LAN2 interfaces.

17Throughput / Connection
This widget shows the throughput/connection (real time throughput and connection usage) of thedevice.

Bandwidth Utilization (In Gateway Mode)
This widget shows the amount of bandwidth consumed on the network via different interfaces in theregular time interval.

Real Time Session Status (In Gateway Mode)
This widget shows the status of real time session with the percentage of connection.

18

Device Information (In Gateway Mode)
This widget shows the packet transmission status via error(s) in the total counts.

19

Chapter 4

The Visibility Tab
The [Visibility] tab gives you an overview of asset visibility for your managed assets. The tab
provides you with timely and accurate information on the assets that are managed by
EdgeFire™.

The assets, listed on the tab, are automatically detected by the EdgeFire™ device.

Note:

The term asset in this chapter refers to the devices or hosts that are protected by the
EdgeFire™.

Active Query
Active query can detect inactive or dormant assets or passive assets in the network.

Note:

In firmware 1.1, Active query supports 4 protocols (Modbus, CIP, OMRON FINS and
SMB)

Viewing Asset Information
Procedure
1.

Go to [Visibility] > [Assets View].

2.

Click an asset icon to view its detailed information.

20

The [Assets Information] pane shows the following information for the asset:
Field

Description

Host Name

The name of the asset.

IP Address

The IP address of the asset.

MAC Address

The MAC address of the asset.

Interface

The interface of the asset.

Asset TypeThe asset type of the asset.

Vendor Name

The vendor name of the asset.

Model Name

The model name of the asset.

Firmware Version

The firmware version of the asset.

OS

The operating system of the asset.

Serial Number

The serial number of the asset.

First Seen

The date and time the asset was first seen.

Last Seen

The date and time the asset was last seen.

Viewing Real Time Network Application Traffic
Procedure
1.

Go to [Visibility] > [Assets View].

2.

Click an asset icon and view its detailed information.

3.

The [Real Time Network Application Traffic] pane shows a list of network traffic statistics for the
asset
Field

Description

No.

Ordinal number of the application traffic.

Application Name

The application type of the traffic.

TX

The amount of traffic transmitted for this traffic.

RX

The amount of traffic received for this traffic.

Note:

Click the [Manual asset info refresh] to refresh the information displayed.

Note:Specify the refresh time under the [Refresh Time] dropdown menu.

21Chapter 5

The Network Tab
This chapter describes how to configure the physical ports and network interfaces for your EdgeFire™.

Port Settings
The [Port Settings] option allows you to enable/disable the ports and select the desired link speed forthe ports.

Note:

The term Port in this document refers to the physical port to which the network cable isconnected.

Configuring the Ports
Procedure
1.

Go to [Network] > [Port Settings].

2.

Click a port in the [Port Name] column to configure the port:a.

Use the toggle to enable or disable the port.

b.

Under the [Link Speed] drop down menu, select the speed and negotiation method of the
port.

22

3.

Note:

The pane picture on the tab shows a graphical depiction of the ports that are connectedon the device.

Note:

Dual WAN is currently not supported. The WAN2 is disabled.

(Optional) Click the [Manual Port Refresh] button to refresh the information displayed.

Port Mapping
Use the [Port Mapping] tab to view the mapping between the ports and the interfaces.

Viewing the Port Mapping (In Gateway Mode)
Procedure
1.

Go to [Network] > [Port Mapping].

2.

The Port Mapping tab will appear. This tab shows the mapping between the physical ports and the
network interfaces (WAN interface, LAN interfaces or independent ports).

23

Viewing the Port Mapping (In Bridge Mode)
Procedure
3.

Go to [Network] > [Port Mapping].

4.

The Port Mapping tab will appear. This tab shows the mapping between the physical ports and theinterfaces (Bridge port or independent ports).

Network Interface (In Gateway Mode Only)
Use the [Network Interface] tab to configure the following:▪

Network settings of the network interfaces of the device▪

DHCP settings on the LAN network interface, including:▪

▪

Disabling DHCP service▪

Enabling DHCP service▪

Configuring DHCP Relay

Connection type for the WAN network interface, including:▪

Static IP address settings▪

DHCP client

Note:

The term Network Interface or Interface in this document refers to the logicalinterface that maps to one or more physical ports.

Note:

The default web management console IP address is 192.168.127.254. The IP address
is bound to LAN1 network interface. To change the default IP address, see Configuring
LAN Network Interface on page 24.

Configuring LAN Network Interface
Procedure
1.

Go to [Network] > [Network Interface].
The [Network Interface] tab will appear.

24

2.

Click an LAN interface.
The [Edit Network Interface] tab will appear.

3.

Use the toggle to enable or disable the network interface.

4.

Input a descriptive name for the network interface.

5.

In the [Network Setting] section, configure the network settings for the interface:

6.

a.

Input an IP address.

b.

Input a subnet mask.

c.

(Optional) Use the toggle to enable or disable VLAN ID. If VNLAN ID is enabled, input the
VLAN ID.

In the [DHCP] section, configure the DHCP settings for the interface. Possible choices are:a.

Disabled. No DHCP service will be provided at this interface.

b.

DHCP Server. This interface will provide DHCP service to the devices that connect to theinterface. Once this is selected, you need to provide the following information:25

▪

Start IP address of the DHCP service▪

End IP address of the DHCP service▪

Gateway IP address that will be assigned to the clients▪

Lease time - The amount of time in seconds that a client device can use the IP address
settings assigned by the DHCP server▪

DNS server IP addresses that will be assigned to the clientsc.

DHCP Relay. This interface will relay the traffic from the clients to a relayed server for
DHCP service. Once this is selected, you need to provide the following information:▪

Relay Server Address: The IP address of the server that will provide DHCP service

26

Configuring DMZ Network Interface
Procedure
1.

Go to [Network] > [Network Interface].
The [Network Interface] tab will appear.

2.

Click an DMZ interface.
The [Edit Network Interface] tab will appear.

3.

Use the toggle to enable or disable the network interface.

4.

Input a descriptive name for the network interface.

5.

In the [Network Setting] section, configure the network settings for the interface:

6.

a.

Input an IP address.

b.

Input a subnet mask.

c.

(Optional) Use the toggle to enable or disable VLAN ID. If VNLAN ID is enabled, input the
VLAN ID.

In the [DHCP] section, configure the DHCP settings for the interface. Possible choices are:a.

Disabled. No DHCP service will be provided at this interface.

27

b.

DHCP Server. This interface will provide DHCP service to the devices that connect to theinterface. Once this is selected, you need to provide the following information:▪

Start IP address of the DHCP service▪

End IP address of the DHCP service▪

Gateway IP address that will be assigned to the clients▪

Lease time - The amount of time in seconds that a client device can use the IP address
settings assigned by the DHCP server▪

DNS server IP addresses that will be assigned to the clientsc.

DHCP Relay. This interface will relay the traffic from the clients to a relayed server for
DHCP service. Once this is selected, you need to provide the following information:▪

Relay Server Address: The IP address of the server that will provide DHCP service

Configuring WAN Network Interface
Procedure
1.

Go to [Network] > [Network Interface].
The [Network Interface] tab will appear.

28

2.

Click a WAN interface.
The [Edit Network Interface] tab will appear.

3.

Use the toggle to enable or disable the network interface.

4.

Input a descriptive name for the network interface.

5.

In the [Network Settings] section, choose a [Connection Type] for the interface. Possible choicesare:a.

Static IP: This device will use a static IP address for this interface. Once selected, youneed to provide the following information:

29▪

IP Address: IP address of the interface▪

Subnet Mask: Subnet mask of the interface▪

Gateway Address: Gateway IP address of the interface▪

DNS server: DNS server IP address of the interface▪

(Optional) Use the toggle to enable VLAN ID. Once enabled, input the VLAN ID for theinterface.

b.

DHCP Client: The interface will function as a DHCP client to get an IP address from a
DHCP server. Once selected, you need to provide the following information:▪

(Optional) Use the toggle to enable VLAN ID. Once enabled, input the VLAN ID for theinterface.

30

MGMT Settings (In Gateway Mode)
MGMT Settings are the settings for the MGMT Port, which is the reserved port used for the
remote system management and the configuration of the network device(s).

Configuring MGMT Port
Procedure
1.

Go to [Network] > [MGMT Settings].
The [MGMT Settings] tab will appear.

2.

Use the toggle to enable or disable the [Independent MGMT] function.

3.

If Independent MGMT is enabled, configure the following MGMT port settings:

4.

a.

Input an IP address.

b.

Input a subnet mask.

c.

Input a gateway.

d.

Input a DNS.

(Optional) Use the toggle to enable or disable VLAN ID. If VNLAN ID is enabled, input the VLAN
ID. (VLAN ID: 1~4094)

Note:

MGMT Port is WAN2 by default.

31

HA Settings
Using a single device for network security and traffic flow can create a single point of failure.
EdgeFire™ provides a High Availability (HA) feature that enables redundancy by way of the ability
to add and synchronize configurations with a secondary backup device. This eliminates the single
point of failure and allows for a seamless switchover from the primary device to the secondary
backup in case of the primary device failure. It thus allows for the planning and building of a
fault-tolerant, resilient, and secure network to minimize any OT operational downtime.
The HA feature allows for the grouping of two devices to form an HA group where configurationsof the devices in the group are synchronized to support full fail-over redundancy. This section
describes how to configure HA.

Procedure
1.

Go to [Network] > [HA Settings]

2.

In the [HA Settings] pane, configure the network settings for the device
Field

Description

StatusShows HA sync status between two EdgeFire™ devices in thesame HA group. This also displays the sync progress.

Mode

Active/Standby: Only one device in the HA group is active
and online. The secondary/standby device is only brought
online in case of primary device failure and traffic only flows
via the active device. In this mode, the switching of traffic
between devices is handled internally on the devices via HA
protocol logic set up between the devices.

HA Interface IP Address

IP Address of the HA interface that will send/receive HAheartbeats and data messages to/from its peer

HA Interface Submask

Subnet mask of the HA interface

Enable/Disable VLAN ID

VLAN ID of the HA Interface

Unicast Heartbeat Peer IP

The IP address of the HA peer

32

Shared Secret key

Shared secret key to allow for two HA peers to authenticate
and communciate with each other

Heartbeat IntervalInterval between sent heartbeats – supported range of: 110 seconds

Failover Trigger Level

Failover retry time – supported range of 1-10 heartbeats:
Maximum number of consecutive missed hearbeats before
secondary to primary switch is triggered

Port Mirror Settings
To monitor the network, all the traffic from any of the protected segment will be mirrored to thereserved port, the Mirror Port.

Procedure
1.

Go to [Network] > [Port Mirror Settings]

2.

Click on a front panel port to configure it:a.

Use the toggle to enable or disable the port.

b.

Under the [TX/RX] drop down menu, select the mirror traffic direction for the port.

Note:

The pane picture on the tab shows a graphical depiction of the ports that are connectedon the device.

33

Operation Mode
EdgeFire™ offers two system operation modes:▪

Gateway Mode▪

Bridge Mode

The following sections describe these two modes in detail.

Gateway Mode
EdgeFire™ operates as a gateway with NAT and routing main features between multiple different
network segments, actively analyzing, filtering, and taking actions on all traffic that passes through it.

Bridge Mode
EdgeFire™ sits in the direct communication path between source and destination, actively analyzing,
filtering, and taking actions on all traffic that passes through it.

34

Use the [Operation Mode] tab to configure or view the following:▪

Select Gateway mode or Bridge mode of the device▪

Enable or disable LLDP (Link Layer Discovery Protocol) settings

Switch to Gateway Mode
Procedure
1.

Go to [Network] > [Operation Mode].
The [Operation Mode] tab will appear.

2.

Click the radio button [Gateway Mode].
The [LAN1 Network Settings and LAN1 DHCP Service] pane for the gateway mode willappear.

3.

4.

In the [LAN1 Network Settings] section, configure the network settings for gateway mode:a.

Input an IP address.

b.

Input a subnet mask.

In the [LAN1 DHCP Service Settings] section, configure the network settings for gateway mode:a.

Showing the status of DHCP service.

35

5.

b.

Input a start IP address.

c.

Input an end IP address.

d.

Input a gateway address.

e.

Input the lease time (86400 seconds by default).

Click [Save] to save the settings.

Note:

In bridge mode, the LAN1 network settings / LAN1 DHCP Service for Gateway mode isfor viewing only.

Note:

The configuration of the policy enforcement rule is not compatible between Gateway
mode and Bridge mode. Therefore, the policy enforcement rule needs to bereconfigured after switching from Bridge mode to Gateway mode.

Switch to Bridge Mode
Procedure
1.

Go to [Network] > [Operation Mode].
The [Operation Mode] tab will appear.

2.

Click the radio button [Bridge Mode].
The [Network Settings] section for bridge mode will appear.

36

3.

In the [Network Settings] section, configure the network settings for bridge mode:f.

Select a management interface: Bridge Port or Independent MGMT Port.

g.

Input an IP address.

h.

Input a subnet mask.

i.

Input a gateway address.

j.

Input a DNS address.

k.

(Optional) Use the toggle to enable or disable VLAN ID. If VNLAN ID is enabled, input the
VLAN ID.

l.

(Optional) Use the toggle to enable or disable STP (Spanning Tree Protocol).

m. Click [Save] to save the settings.

4.

Click [Save] to save the settings.

Note:

When EdgeFire™ is switched from gateway mode to Bridge mode, the features of Port
Mapping, Network Interface, NAT Rules, ALG, and Static Route will not operate and not
be configurable.

Note:

The configuration of the policy enforcement rule is not compatible between Gateway
mode and Bridge mode. Therefore, the policy enforcement rule needs to bereconfigured after switching from Gateway mode to Bridge mode.

37

Chapter 6

The NAT Tab
Use the NAT (Network Address Translation) tab to view and configure NAT rules, and enable or disable
application layer gateways.

NAT Rule
Use the NAT tab to configure the following:▪

1 to 1 network address translation for the incoming traffic on the specific interface▪

Multiple 1 to 1 network address translation for the incoming traffic on the specific interface(CIDR, Classless Inter-Domain Routing)▪

Multiple 1 to 1 network address translation for the incoming traffic on the specific interface(IP range)▪

Port forwarding address translation for the incoming traffic on the specific interface

The following table describes the tasks you can perform on the [NAT Rule] tab.
Task

Description

Add a NAT rule

Click [Add] to create a new NAT rule.

Edit a NAT rule

Click a NAT Rule Name to edit its settings.

Delete a NAT rule

Select one or more NAT rules and click [Delete].

Copy a NAT rule

Select one NAT rule and click [Copy].

Change Priority

Select one NAT rule and click [Change Priority].

Configuring a 1 to 1 NAT RuleA 1 to 1 NAT rule allows you to map a destination IP address in the incoming traffic to another IP
address located in the specific network.

Procedure
1.

Go to [NAT] > [NAT Rule].
The [NAT] tab will appear.

2.

3.

Do one of the following:▪

Click [Add] to create a NAT rule.

▪

Click a NAT rule name to edit its settings.

Configuring a NAT rule:a.

Use the toggle to enable or disable the rule.

38

b.

Under the [NAT Type] drop-down menu, select [1 to 1 NAT].

c.

Input a name for the rule.

d.

Input a description for the rule.

e.

Under the [Incoming Interface] drop-down menu, select the interface that will process
the incoming traffic for this rule.

f.

In the [Original IP] field, input the destination IP address that will be translated. Whenthe device receives an incoming packet going through the interface specified in the[Incoming Interface], the destination IP address in the packet that matches this [Original
IP] field will be mapped another IP address.

g.

In the [Mapped IP] field, input the IP address you will map to. This IP address is usuallya private IP address in your local network.

h.

(Optional) Use the toggle to enable NAT loopback.

4.

Click [OK] to accept the rule.

5.

Click [Save] to save the settings.

Note:

Starting from firmware 1.1, [Network Interface] now can support WAN1, LAN1, LAN2
and DMZ interface when [NAT Type] is selected to “1 to 1 NAT”.

39

Configuring a Multiple 1 to 1 NAT Rule: CIDR
A multiple 1 to 1 NAT rule (CIDR) allows you to map the destination IP addresses in the incoming
traffic to different IP addresses located in the specific network. The following table shows an example.
Original Destination IP Addresses… Are Mapped to These Destination IP
Addresses

172.1.1.5

192.168.100.5

172.1.1.20

192.168.100.20

172.1.1.50

192.168.100.50

172.1.1.69

192.168.100.69

Procedure
1.

Go to [NAT] > [NAT Rule].
The [NAT] tab will appear.

2.

3.

Do one of the following:▪

Click [Add] to create a NAT rule.

▪

Click a NAT rule name to edit its settings.

Configuring the NAT rule:a.

Use the toggle to enable or disable the rule.

b.

Under the [NAT Type] drop-down menu, select [Multi 1 to 1 NAT (CIDR)].

c.

Input a name for the rule.

d.

Input a description for the rule.

e.

Under the [Incoming Interface] drop-down menu, select the interface that will process
the incoming traffic for this rule.

f.

In the [Original IP] field, input with the CIDR (Classless Inter-Domain Routing) format topresent the IP addresses that will be translated; for example, 172.1.1.0 / 24. When thedevice receives an incoming packet going through the interface specified in the[Incoming Interface], the destination IP address in the packet that matches this [Original
IP] field will be mapped to another IP address. These IP addresses are usually the ones
assigned by an ISP (Internet Service Provider).

g.

In the [Mapped IP] field, input with the CIDR (Classless Inter-Domain Routing) format topresent the IP addresses that will be mapped to; for example, 192.168.100.0 / 24.

h.

(Optional) Use the toggle to enable NAT loopback.

40

4.

Click [OK] to accept the rule.

5.

Click [Save] to save the settings.

Starting from firmware 1.1, [Network Interface] now can support WAN1, LAN1, LAN2
and DMZ interface when [NAT Type] is selected to “Multi 1 to 1 NAT”.

Note:

Configuring a Multiple 1 to 1 NAT Rule: IP Range
A multiple 1 to 1 NAT rule (IP range) allows you to map the destination IP addresses in the incoming
traffic to different IP addresses located in the specific network. The following table shows an example.
Original Destination IP Addresses… Are Mapped to These Destination IP
Addresses

172.1.1.5

192.168.100.5

172.1.1.20

192.168.100.20

172.1.1.50

192.168.100.50

172.1.1.69

192.168.100.69

Procedure
1.

Go to [NAT] > [NAT Rule].
The [NAT] tab will appear.

41

2.

3.

4.

Do one of the following:▪

Click [Add] to create a NAT rule.

▪

Click a NAT rule name to edit its settings.

Configuring the NAT rule:a.

Use the toggle to enable or disable the rule.

b.

Under the [NAT Type] drop-down menu, select [Multi 1 to 1 NAT (IP Range)].

c.

Input a name for the rule.

d.

Input a description for the rule.

e.

Under the [Incoming Interface] drop-down menu, select the interface that will process
the incoming traffic for this rule.

f.

In the [Original IP] field, input with the IP Range format to present the IP addresses thatwill be translated; for example, 172.1.1.0 / 24. When the device receives an incoming
packet going through the interface specified in the [Incoming Interface], the destination
IP address in the packet that matches this [Original IP] field will be mapped to another
IP address. These IP addresses are usually the ones assigned by an ISP (Internet Service
Provider).

g.

In the [Mapped IP] field, input with the IP Range format to present the IP addresses thatwill be mapped to; for example, 192.168.100.0 / 24.

h.

(Optional) Use the toggle to enable NAT loopback.

Click [OK] to accept the rule.

42

5.

Click [Save] to save the settings.

Note:

Starting from firmware 1.1, [Network Interface] now can support WAN1, LAN1, LAN2
and DMZ interface when [NAT Type] is selected to “Multi 1 to 1 NAT”.

Configuring Port Forwarding
A port forwarding rule allows you to map a host IP address in the incoming traffic to another IP
address located in your local network.

Procedure
1.

Go to [NAT] > [NAT Rule].
The [NAT] tab will appear.

2.

3.

Do one of the following:▪

Click [Add] to create a NAT rule.

▪

Click a NAT rule name to edit its settings.

Configuring a NAT rule:a.

Use the toggle to enable or disable the rule.

b.

Under the [NAT Type] drop down menu, select [Port Forward].

c.

Input a descriptive name for the rule.

d.

Input a description for the rule.

e.

Under the [Incoming Interface] drop-down menu, select the interface that will process
the incoming traffic for this rule.

f.

Under the [Protocol] drop-down menu, select the protocol that will process the incoming
traffic for this rule.

g.

In the [Original IP] field, input the start port and the end port that will be translated.
When the device receives an incoming packet going through the interface specified in the[Incoming Interface], the destination IP address in the packet that matches this [Original
IP] field will be mapped another IP and port address.

h.

In the [Mapped IP] field, input the IP address and port range you will map to. This IP
address is usually a private IP address in your local network.

i.

(Optional) Use the toggle to enable NAT loopback.

43

4.

Click [OK] to accept the rule.

5.

Click [Save] to save the settings.

ALG
An ALG or Application Layer Gateway allows the client applications to communicate with the server
applications when the server ports are dynamically opened to client applications. These ports areusually dynamically assigned in the application protocol. An ALG understands application protocols,
recognizes application specific commands, and helps open the ports dynamically on the device forcommunication. Without ALG, client applications like FTP would not be able to transfer files when the
FTP client is in an NAT network.
Use the ALG (Application Layer Gateway) tab to configure the following:▪

FTP ALG▪

SIP ALG▪

H.323 ALG

Configuring ALG Settings
Procedure
1.

Go to [NAT] > [ALG].

2.

Use the toggle to enable or disable FTP, SIP and H.323 ALG.

3.

Click [Save].

The [ALG Settings] tab will appear.

44

45

Chapter 7

The Routing Tab
Use the [Routing] tab to view and configure static routes on the device.

Static Route
Static routes are generally used when no appropriate dynamic route is present, or when you want thetraffic to follow the static route you specify as opposed to following the dynamic route that is
automatically learned and generated by the device.
Use the [Static Route] tab to view a list of current static routes on the device and configure their
settings.
The following table describes the tasks you can perform on the [Static Route] tab.
Description

Task
Add a static route

Click [Add] to create a new static route.

Edit a static route

Click a static route name to edit the rule settings.

Delete a static route

Select one or more static routes and click [Delete].

Copy a static route

Select one static route and click [Copy].

Configuring a Static Route
Procedure
1.

Go to [Routing] > [Static Route].

2.

Do one of the following:

3.

▪

Click [Add] to create a static route.

▪

Click a static route name to edit settings.

Configuring the static route:a.

Use the toggle to enable or disable the route.

b.

Input a name for the rule.

c.

Input a description for the rule.

d.

Configure the destination:▪

In the [Destination Address] field, input IP address.

▪

In the [Subnet Mask] field, input the subnet mask.
If the destination is a single IP address, then input 255.255.255.255 in the [Subnet
Mask] field. If the destination is a subnet of IP addresses, then input, for example,
255.255.255.0, in the [Subnet Mask] to present the destination IP address range.

Tip:

e.

Configure the next hop:▪

If the next hop is a gateway, then under [Next Hop Type], select [Gateway IP Address]
and input the IP address. The gateway needs to be on the same network as theinterface.

▪

If the next hop is a network interface on the device, then under [Next Hop Type], select[Network Interface], and select a network interface from the drop-down menu. [Note]

46

For this firmware of the device, the available network interface to be selected is fixed to[WAN 1].
For more information about the network interface, see Network Interface on page 22.

Tip:
f.

Input the metric value:▪

In the [Metric] field, input a metric value for this static route. The device determines
which static route to use based on the metric value, with the lower number representing
higher priority.

g.

Click [OK] to accept the settings.

h.

Click [Save] to save the rule.

47

Chapter 8

The Object Profiles Tab
Object profiles simplify policy management by storing configurations that can be used by EdgeFire™.
You can configure the following types of object profiles in this device:▪

IP Object Profiles: Contains the IP addresses that you can apply to a policy rule.

▪

Service Object Profiles: Contains the service definitions that you can apply to a policy rule.
TCP port range, UDP port range, ICMP, and custom protocol number are defined here.

▪

Protocol Filter Profiles: Contains more sophisticated and advanced protocol settings thatyou can apply to a policy rule. Details of ICS (Industrial Control System) protocols aredefined here.

▪

IPS Profiles: Contains the settings of IPS (Intrusion Prevention System) pattern rules thatyou can create profiles or edit profiles to apply on a policy rule. Details of ICS (Industrial
Control System) protocols are defined here.

▪

File Filter Profiles: Contains the settings of file filter profiles that you can apply on a policy
rule. Details of file filter by protocol are defined here.

Each type of object profiles has the following types of sub-profile list for this device:▪

Device Profiles: Contains the IP Object(s), Service Object(s), Protocol Filter Profile(s), IPS
Profile(s) and File Filter Profile(s) that users with local account privileges for EdgeFire™ canapply to a policy rule.

▪

Master Profiles: Contains the IP Object(s), Service Object(s), Protocol Filter Profile(s), IPS
Profile(s), and File Filter Profile(s) synced from ODC that users with local account privilege in
ODC can apply to a policy rule. Users with local account privilege for EdgeFire™ can only viewand copy profiles(s) from Master Profiles(s) to Device Profiles.

The following table describes the tasks you can perform when you view a list of the profiles:•

Device Profiles:
Description

Task

•

Add a profile

Click [Add] to create a new profile.

Edit a profile

Click a profile name to edit the settings.

Delete a profile

Select one or more profiles and click [Delete].

Copy a profile

Select on profile and click [Copy].

Master Profiles:
Description

Task
Copy a profile

Select one or more profiles and click [Copy Master Profiles
to Device Profiles].

Click the down arrow icon next to the checkbox and the drop-down menu to select the profile(s) will
be shown:

48

Configuring IP Object Profiles
You can configure the IP address in an IP object profile, which can be used by other policy rules.
The types of IP address you can assign are:▪

Single IP▪

IP range▪

IP subnet

Procedure
1.

Go to [Object Profiles] > [IP Object Profiles].

2.

Do one of the following:▪

Click [Add] to create a profile.

▪

Click a profile name to edit settings.

3.

Type a name for the IP Object Profile.

4.

Type a description.

5.

Under the [IP Object List], specify an IP address, an IP range, or an IP subnet.

6.

If you want to add another entry, click the

7.

Click [OK].

button.

49

Configuring Service Object Profiles
In a service object profile, you can define the following:▪

TCP protocol port range▪

UDP protocol port range▪

ICMP protocol type and code▪

Custom protocol with the specified protocol number

Note:

The term ‘protocol number’ refers to the protocol number defined in the internet
protocol suite.

Procedure
1.

Go to [Object Profiles] > [Service Object Profiles].

2.

Do one of the following:▪

Click [Add] to create a profile.

▪

Click a profile name to edit settings.

3.

Type a name for the Service Object Profile.

4.

Type a description.

5.

Provide one of the following definitions:•

TCP protocol and its port range•

UDP protocol and its port range•

ICMP protocol and its type and code•

Custom protocol with the specified protocol number

3.

If you want to add another entry, click the

4.

Click [OK].

button.

Configuring Protocol Filter Profiles
A protocol filter profile contains more sophisticated and advanced protocol settings that you can apply
to a policy rule.
The following can be configured in a protocol filter profile:50

▪

Details of ICS protocols, including:▪

Factory Automation

▪

▪

▪

▪

▪

Modbus▪

SECS/GEM

▪

CIP

▪

TOYOPUC▪

S7COMM▪

OPC UA▪

S7COMM PLUS▪

OPC CLASSIC▪

PROFINET▪

GE SDI▪

SLMP▪

GE-SRTP▪

MELSOFT▪

HART-IP

▪

FINS

▪

HL7

▪

IEC61850-MMS

Building Automation▪

BACnet▪

DICOM

HealthCare

Power and Electricity
▪

DNP3

▪

IEC104General Protocol, including:
▪

HTTP

▪

SMTP

▪

FTP

▪

SNMP

▪

SMB

▪

SSH

▪

RDP

▪

TELNET

▪

MQTT

▪

TFTP

▪

MSRPC

▪

VNC

▪

SIP

▪

DNS

51

Specifying Commands Allowed in an ICS Protocol
When configuring an ICS protocol, you can specify which commands will be included in the protocol
profile, as the following picture shows.

52

Applying the Drop Malformed Option to an ICS Protocol
When configuring an ICS protocol, you can specify which OT protocols will be applied to the option[Drop Malformed] in the protocol profile, as the following picture shows.
When the option [Drop Malformed] is enabled, EdgeFire™ will strictly check the packet format of thespecified ICS protocol. If the packet format is incorrect, EdgeFire™ will drop the packets of the ICS
protocol.

Note:

In firmware 1.1, Drop Malformed supports 4 protocols (Modbus, CIP, OMRON FINS andTOYOPUC)

Advanced Settings
Below is a list of advanced settings for OT protocols supported by EdgeFire™.

Advanced Settings for Modbus Protocol
The device features more detailed configurations for the Modbus ICS protocol. Through the [Advanced
Settings] pane, you can further specify the function code/function, unit ID, and address/addresses
range against which the function will operate.

53

Procedure
1.

Go to [Object Profiles] > [Protocol Filter Profiles].

2.

Click [Add] to add a protocol filter profile.
The [Create Protocol Filter Profile] screen will appear.

3.

Type a profile name for the protocol filter.

4.

Type a description.

54

5.

Select the protocols you want to include in the protocol filter.
•

Click the enable switch in the [status] column.

•

Click the [ ] icon in the [Advance Settings] column, then select one of the following:•▪

Any - Specify all available commands or function access in this protocol.

▪

Basic - Multiple selections of the following:▪

Read Only: Read commands sent from HMI (Human-MachineInterface) / EWS (Engineering Work Station) / SCADA (Supervisory
Control and Data Acquisition) to PLC (Programmable Logic Controller).

▪

Read / Write: Read and write commands sent from HMI/EWS/SCADA
to PLC.

▪

Admin Config: Firmware update commands sent from EWS to PLC,
Project update (i.e., PLC code download) commands sent from EWS to
PLC, and administration configuration relevant commands sent from
EWS to PLC.

▪

Others: Private commands, un-documented commands, or particular
protocols provided by an ICS vendor.

If you have selected [Modbus], you can optionally configure advanced settings for thisprotocol:▪

Click the [ ] icon in the [Advance Settings] column, and select [Advanced
Matching Criteria].

▪

At the [Function list] drop down menu, select a function of this protocol.

55

6.

▪

If you want to specify a function code by yourself, then select [Custom]and input a function code in the [Function Code] field.

▪

Type a unit ID in the [Unit ID] field.

▪

Type the address or range of addresses against which the function will
operate.

▪

Click [Add].

▪

Repeat the above steps if you want to add more protocol definition entries.

▪

Click [OK].

Click [OK].

Advanced Settings for CIP Protocol
The device features more detailed configurations for the CIP ICS protocol. Through the [Advanced
Settings] pane, you can further specify the Object Class ID, and Service Code against which thefunction will operate.

Procedure
1.
2.

Go to [Object Profiles] > [Protocol Filter Profiles].
Click [Add] to add a protocol filter profile.
The [Create Protocol Filter Profile] screen will appear.

56

3.

Type a profile name for the protocol filter.

4.

Type a description.

5.

Select the protocols you want to include in the protocol filter.
•

Click the enable switch in the [status] column.

•

Click the [ ] icon in the [Advance Settings] column, then select one of the following:•▪

Any - Specify all available commands or function access in this protocol.

▪

Basic - Multiple selections of the following:▪

Read Only: Read commands sent from HMI (Human-MachineInterface) / EWS (Engineering Work Station) / SCADA (Supervisory
Control and Data Acquisition) to PLC (Programmable Logic Controller).

▪

Read / Write: Read and write commands sent from HMI/EWS/SCADA
to PLC.

▪

Admin Config: Firmware update commands sent from EWS to PLC,
Project update (i.e., PLC code download) commands sent from EWS to
PLC, and administration configuration relevant commands sent from
EWS to PLC.

▪

Others: Private commands, un-documented commands, or particular
protocols provided by an ICS vendor.

If you have selected [CIP], you can optionally configure advanced settings for thisprotocol:

57

6.

▪

Click the [ ] icon in the [Advance Settings] column, and select [Advanced
Matching Criteria].

▪

At the [Object Class List] drop down menu, select a function of thisprotocol.

▪

If you want to all the service codes within the function you specified to be
applied, then select [Any Service Code]▪

If you want to specify one service code or multiple service codes, thenselect [Preset Service Code] and move the service code(s) from the[Available Service Code] field to the [Selected Service Code] field.

▪

If you want to specify a service code by yourself, then select [Custom
Service Code] and input a service code in the [Custom Service Code] field.

▪

Click [Add].

▪

Repeat the above steps if you want to add more protocol definition entries.

▪

Click [OK].

Click [OK].

58

Advanced Settings for S7COMM
The device features more detailed configurations for the S7COMM ICS protocol. Through the[Advanced Settings] pane, you can further specify the function code, function group code, and subfunction code against which the function will operate.

59

Procedure
1.
2.

Go to [Object Profiles] > [Protocol Filter Profiles].
Click [Add] to add a protocol filter profile.
The [Create Protocol Filter Profile] screen will appear.

3.

Type a profile name for the protocol filter.

4.

Type a description.

5.

Select the protocols you want to include in the protocol filter.
•

Click the enable switch in the [status] column.

•

Click the [ ] icon in the [Advance Settings] column, then select one of the following:•▪

Any - Specify all available commands or function access in this protocol.

▪

Basic - Multiple selections of the following:▪

Read Only: Read commands sent from HMI (Human-MachineInterface) / EWS (Engineering Work Station) / SCADA (Supervisory
Control and Data Acquisition) to PLC (Programmable Logic Controller).

▪

Read / Write: Read and write commands sent from HMI/EWS/SCADA
to PLC.

▪

Admin Config: Firmware update commands sent from EWS to PLC,
Project update (i.e., PLC code download) commands sent from EWS to
PLC, and administration configuration relevant commands sent from
EWS to PLC.

▪

Others: Private commands, un-documented commands, or particular
protocols provided by an ICS vendor.

If you have selected [S7COMM], you can optionally configure advanced settings for thisprotocol:60▪

Click the [ ] icon in the [Advanced Settings] column and select [Advanced
Matching Criteria].

▪

If you want to specify one function code from the category [Job], thenselect the category [Job] and select a function at the [Function list] drop
down menu.

▪

If you want to specify one function group code from the category [UserData], then select the category [User Data] and select a function group
code at the [Function Group List] drop down menu.

o

If you want to all the sub-function codes within the function group code you
specified to be applied, then select [Any Sub-function Code]o

If you want to specify one sub-function code or multiple sub-function
codes, then select [Preset Sub-function Code] and move the sub-function61code(s) from the [Available Sub-function Code] to the [Selected Subfunction Code] field.

6.

o

If you want to specify a service code by yourself, then select [Custom Subfunction Code] and input a sub-function code in the [Custom Sub-function
Code] field.

▪

Click [Add].

▪

Repeat the above steps if you want to add more protocol definition entries.

▪

Click [OK].

Click [OK].

Advanced Settings for S7COMM_PLUS
The device features more detailed configurations for the S7Comm Plus ICS protocol. Through the[Advanced Settings] pane, you can further specify the function code against which the function will
operate.

Procedure
1.

Go to [Object Profiles] > [Protocol Filter Profiles].

2.

Click [Add] to add a protocol filter profile.
The [Create Protocol Filter Profile] screen will appear.

62

3.

Type a profile name for the protocol filter.

4.

Type a description.

5.

Select the protocols you want to include in the protocol filter.
•

Click the enable switch in the [status] column.

•

Click the [ ] icon in the [Advance Settings] column, then select one of the following:•▪

Any - Specify all available commands or function access in this protocol.

▪

Basic - Multiple selections of the following:▪

Read Only: Read commands sent from HMI (Human-MachineInterface) / EWS (Engineering Work Station) / SCADA (Supervisory
Control and Data Acquisition) to PLC (Programmable Logic Controller).

▪

Read / Write: Read and write commands sent from HMI/EWS/SCADA
to PLC.

▪

Admin Config: Firmware update commands sent from EWS to PLC,
Project update (i.e., PLC code download) commands sent from EWS to
PLC, and administration configuration relevant commands sent from
EWS to PLC.

▪

Others: Private commands, un-documented commands, or particular
protocols provided by an ICS vendor.

If you have selected [S7COMM_PLUS], you can optionally configure advanced settings
for this protocol:

63

6.

▪

Click the [ ] icon in the [Advance Settings] column, and select [Advanced
Matching Criteria].

▪

At the [Function Code List] drop down menu, select a function of thisprotocol.

▪

Click [Add].

▪

Repeat the above steps if you want to add more protocol definition entries.

▪

Click [OK].

Click [OK].

64Advanced Settings for SLMPThe device features more detailed configurations for the SLMP ICS protocol. Through the [Advanced
Settings] pane, you can further specify the command code against which the function will operate.

Procedure
1.
2.

Go to [Object Profiles] > [Protocol Filter Profiles].
Click [Add] to add a protocol filter profile.
The [Create Protocol Filter Profile] screen will appear.

3.

Type a profile name for the protocol filter.

65

4.

Type a description.

5.

Select the protocols you want to include in the protocol filter.
•

Click the enable switch in the [status] column.

•

Click the [ ] icon in the [Advance Settings] column, then select one of the following:•▪

Any - Specify all available commands or function access in this protocol.

▪

Basic - Multiple selections of the following:▪

Read Only: Read commands sent from HMI (Human-MachineInterface) / EWS (Engineering Work Station) / SCADA (Supervisory
Control and Data Acquisition) to PLC (Programmable Logic Controller).

▪

Read / Write: Read and write commands sent from HMI/EWS/SCADA
to PLC.

▪

Admin Config: Firmware update commands sent from EWS to PLC,
Project update (i.e., PLC code download) commands sent from EWS to
PLC, and administration configuration relevant commands sent from
EWS to PLC.

▪

Others: Private commands, un-documented commands, or particular
protocols provided by an ICS vendor.

If you have selected [SLMP], you can optionally configure advanced settings for thisprotocol:

66

6.

▪

Click the [ ] icon in the [Advance Settings] column, and select [Advanced
Matching Criteria].

▪

At the [Command Code List] drop down menu, select a command code ofthis protocol.

▪

Click [Add].

▪

Repeat the above steps if you want to add more protocol definition entries.

▪

Click [OK].

Click [OK].

67Advanced Settings for MELSOFT
The device features more detailed configurations for the MELSOFT ICS protocol. Through the[Advanced Settings] pane, you can further specify the command code against which the function will
operate.

Procedure
1.

Go to [Object Profiles] > [Protocol Filter Profile].

2.

Click [Add] to add a protocol filter profile.
The [Create Protocol Filter Profile] screen will appear.

68

3.

Type a profile name for the protocol filter.

4.

Type a description.

5.

Select the protocols you want to include in the protocol filter.
•

Click the enable switch in the [status] column.

•

Click the [ ] icon in the [Advance Settings] column, then select one of the following:•▪

Any - Specify all available commands or function access in this protocol.

▪

Basic - Multiple selections of the following:▪

Read Only: Read commands sent from HMI (Human-MachineInterface) / EWS (Engineering Work Station) / SCADA (Supervisory
Control and Data Acquisition) to PLC (Programmable Logic Controller).

▪

Read / Write: Read and write commands sent from HMI/EWS/SCADA
to PLC.

▪

Admin Config: Firmware update commands sent from EWS to PLC,
Project update (i.e., PLC code download) commands sent from EWS to
PLC, and administration configuration relevant commands sent from
EWS to PLC.

▪

Others: Private commands, un-documented commands, or particular
protocols provided by an ICS vendor.

If you have selected [MELSOFT], you can optionally configure advanced settings for thisprotocol:69

▪

Click the [ ] icon in the [Advance Settings] column, and select [Advanced
Matching Criteria].

▪

At the [Command Code List] drop down menu, select a function of thisprotocol.

70

6.

▪

If you want to specify one device code, then select [Preset Device] andselect one of the device code(s) from the drop list.

▪

If you don’t want to include a device number as a filter criteria, then select[Any] from the drop list.

▪

If you want to specify a device number, then select [Single] from the drop
list.

▪

If you want to specify a range of device numbers, then select [Range] fromthe drop list.

▪

Click [Add].

▪

Repeat the above steps if you want to add more protocol definition entries.

▪

Click [OK].

Click [OK].

71Advanced Settings for TOYOPUC
The device features more detailed configurations for the TOYOPUC ICS protocol. Through the[Advanced Settings] pane, you can further specify the command code, preset sub-command code andcustom sub-command code against which the function will operate.

Procedure
1.

Go to [Object Profiles] > [Protocol Filter Profiles].

2.

Click [Add] to add a protocol filter profile.
The [Create Protocol Filter Profile] screen will appear.

72

3.

Type a profile name for the protocol filter.

4.

Type a description.

5.

Select the protocols you want to include in the protocol filter.
•

Click the enable switch in the [status] column.

•

Click the [ ] icon in the [Advance Settings] column, then select one of the following:•▪

Any - Specify all available commands or function access in this protocol.

▪

Basic - Multiple selections of the following:▪

Read Only: Read commands sent from HMI (Human-MachineInterface) / EWS (Engineering Work Station) / SCADA (Supervisory
Control and Data Acquisition) to PLC (Programmable Logic Controller).

▪

Read / Write: Read and write commands sent from HMI/EWS/SCADA
to PLC.

▪

Admin Config: Firmware update commands sent from EWS to PLC,
Project update (i.e., PLC code download) commands sent from EWS to
PLC, and administration configuration relevant commands sent from
EWS to PLC.

▪

Others: Private commands, un-documented commands, or particular
protocols provided by an ICS vendor.

If you have selected [TOYOPUC], you can optionally configure advanced settings for thisprotocol:73

Note:

6.

▪

Click the [ ] icon in the [Advance Settings] column, and select [Advanced
Matching Criteria].

▪

At the [Command Code List] drop down menu, select a function of thisprotocol.

▪

If you want to specify one sub-command code or multiple sub-commandcodes, then select [Preset Sub-command Code] and move the sub-functioncode(s) from the [Available Sub-command Code] field to the [Selected
Sub-command Code] field.

▪

If you want to specify a sub-command code by yourself, then select[Custom Sub-command Code] and input a sub-command code in the[Custom Sub-command Code] field.

▪

Click [Add].

▪

Repeat the above steps if you want to add more protocol definition entries.

▪

Click [OK].

Not all the command codes support the feature of [Preset Sub-cmd code] and [Custom
Sub-cmd]. Only the command code “(0x32) Function Call” and “(0xA0) Expansion
Function Call” support them.

Click [OK].

74Advanced Settings for SMB
The device features more detailed configurations for the SMB protocol. Through the [SMB Advanced
Settings] column, you can specify the settings in more detail.

Procedure
1.
2.

Go to [Object Profiles] > [Protocol Filter Profiles].
Click [Add] to add a protocol filter profile.
The [Create Protocol Filter Profile] screen will appear.

3.

Type a profile name for the protocol filter.

4.

Type a description.

5.

Select the protocols you want to include in the protocol filter.
•

Click the enable button in the [Status] column.

•

Click the [ ] icon in the [Advanced Settings] column, then select one of the following:•

SMB Protocol - Specify SMB the protocol version combination – options include
SMBv1/v2/v3, SMBv1 and SMB v2/v3.

•

File Access – Select access permission behavior:•

Read / Write: Read and write file access•

Read Only: File access for reading only•

Write Only: File access for writing only75•

Drop Anonymous Access for SMB v1/v2/v3: Drop access over SMB v1/v2/v3 forAnonymous accounts.

Configuring IPS Profiles
An IPS profile contains more sophisticated pattern rules that you can do granular control and apply toa policy rule.
The following can be configured in an IPS profile:▪

▪

▪

Details of IPS protocol category, including:▪

File Vulnerabilities▪

Buffer Overflow▪

DoS Attacks▪

Exploits▪

Malware Traffic▪

Reconnaissance▪

Web Threats▪

ICS Threats▪

Others▪

Misc.

Details of IPS protocol risk level category, including:▪

Information

▪

Low

▪

Medium▪

High▪

Critical

Details of default action list for IPS patterns, including:▪

All Actions▪

Accept and Log▪

Deny and Log

Configuring a Pattern Rule for Granular Control
When configuring an IPS pattern rule, you can specify which action should be taken for the specificcategory/risk level of pattern and add it in the IPS profile, as the following picture shows.

76Procedure
1.

Go to [Object Profiles] > [IPS Profiles].

2.

Click [Add] to add an IPS profile.
The [Create IPS Profile] screen will appear.

77

3.

Type a name for the IPS profile.

4.

Type a description.

5.

Select a pattern rule you want to configure by clicking on the rule ID.

6.

IPS rule details will show up. Select one of the following:▪

Status - Specify the pattern rule to be enabled or disabled.

▪

Actions - Multiple selections of the following:▪

Accept and Log: When the attack is detected by EdgeFire™, the attack will be
bypassed and logged for monitoring.

▪

Deny and Log: When the attack is detected by EdgeFire™, the attack will beblocked and logged for monitoring.
Field

7.

Description

StatusThe operational status of the pattern rule

Rule ID

The pattern rule ID

Rule Name

The pattern name for the cyber attack

Category

The threat category for the cyber attack

Risk Level

The suggested security level for the cyber attack

Impact

The damage that will cause to the target network device
if the cyberattack succeeds

Actions

The preset action for the cyber attacks

Reference

The vulnerability ID of the cyber attacks(e.g. CVE-2017-0147)

TID

MITRE ID information

keyword

The word(s) for searching the pattern rules

If you already configure the pattern rule, press [Save].

78

Configuring File Filter Profiles
The File Filter Profiles contains the detailed access protocols, dropping executable file types and Active
Directory (AD) GPO dispatch settings, allowing you to create or edit profiles to apply to a policy rule.
In a profile, you can define the following:▪

File Filter by Protocol
Including: HTTP, FTP and SMB▪

Drop the Executable File(s)Includes: Windows (PE files) and Linux (ELF file)▪

Filter AD GPO
Enable or disable Drop Active Directory (AD) GPO

Procedure
1.

Go to [Object Profiles] > [File Filter Profiles].

2.

Do one of the following:▪

Click [Add] to create a profile.

▪

Click a profile name to edit settings.

3.

Type a name for the File Filter Profile.

4.

Type a description.

79

5.

Under the [File Filter Profile Settings], enable file filter by protocol•

File Filter by Protocol, including: HTTP、FTP and SMB.

•

Drop Executable Files, including: Windows (PE files) and Linux (ELF files)

6.

If you want to filter AD GPOs, you can enable “Drop Active Directory (AD) GPO Dispatch”.

7.

Click [Save] to save profile.

Note:

The support list of archive file type include zip and gzip file types.

80

Chapter 9

The Security Tab
This chapter describes the following configurations:▪

Cyber Security configuration, which allows you to define denial of service attack
prevention settings.

▪

Policy Enforcement configuration, which allows you to define a custom protocol thatmatches to industrial protocol(s), and then allow or block activities fitting that protocol inyour network environment.

▪

Policy Rule Auto-Learning, which allows you to create a learning task with a scheduled
period of time, generating a trust list for policy enforcement in your network.

▪

Suspicious Objects, which allows you to sync the node-based list that matches to the hashvalue of a network node with the ODC, and then allow or block activities fitting that network
node/network link in your network environment

Cyber Security
The feature, Cyber Security, is used to deny the service attack prevention. The signature rules of
intrusion prevention are called the ‘Trend Micro DPI (Deep Packet Inspection) Pattern’. This pattern isprovided by Trend Micro and can be regularly updated through ODC as well as through the manual
import on the web management UI of the device.

Configuring Cyber Security – Denial of Service Prevention
Procedure
1.

Go to [Security] > [Cyber Security]2.

In the [Cyber Security] tab, you will see the [Denial of Service Prevention] pane.

3.

Use the toggle to enable or disable the denial of service prevention feature.

4.

Select an action ([Monitor and Log] or [Prevent and Log]) for the feature.

5.

You can optionally configure the thresholds of the denial of service rules.

Note:

Flood/Scan Attack Protection rules utilize the detection period and thresholdmechanisms to detect an attack. During a detection period (typically every 5 seconds),
if the number of anomalous packets reaches the specified threshold, an attack detection
occurs. If the rule action is ‘block’, the security node blocks the subsequent anomalous81

packets until the end of the detection period. After the detection period, the security
node allows anomalous packets until it reached the threshold again.
6.

Click [Save].

The following table summarizes the settings:
Mode(Cyber Security)
Monitor and Log

Prevention and Log

Action Performed▪

Detects and monitors network attacks, but does not block
network attacks.

▪

Generates logs.

▪

Blocks network attacks.

▪

Generates logs.

Policy Enforcement
Policy enforcement allows you to define a custom protocol that matches to an industrial protocol, andthen allow or block activities fitting that protocol in your network environment.
There are two types of policy enforcement rule list for this device:▪

Device Rule List: Contains the policy rule(s) created and configured by users with local
account privileges for EdgeFire™.

▪

Master Rule List: Contains the policy rule(s) synced from ODC that the user who has
local account privileges in ODC can apply to a policy rule. Users with local accountprivileges for EdgeFire™ can only view policy rules.

Note: For rule checking, the device rule list is of higher priority than the master rule list.

The following table describes the tasks you can perform when you view a list of the profiles:•

Device Rule List:
Description

Task

•

Add a policy rule

Click [Add] to create a new policy rule.

Edit a policy rule

Click a policy rule name to edit the settings.

Delete a policy rule

Select one or more policy rules and click [Delete].

Copy a policy rule

Select a policy rule and click [Copy].

Change priority

Select a policy rule and click [Change Priority].

Master Rule List:
Description

Task
N/A

The rule(s) on the Master Rule List are view-only.

Configuring Policy Enforcement
Procedure
1.

Go to [Security] > [Policy Enforcement]

2.

In the [Policy Enforcement] tab, you will see the [Policy Enforcement General Settings] pane.

82

3.

Use the toggle to enable or disable the policy enforcement feature.

4.

From the [Policy Enforcement Operation Mode] drop-down menu, select a mode, [Monitor Mode]or [Prevention Mode] for the policy enforcement.

5.

From the [Policy Enforcement Default Rule Action] drop-down menu, select a default action,[Accept], [Accept and Log] or [Deny and Log] when no user-defined policy enforcement rule ismatched.

The following table summarizes the settings:
Mode(Policy Enforcement)
Monitor Mode

Action Performed▪

Detects and monitors protocol access to OT assets, butdoes not block network attacks.

Prevention Mode▪

Generates logs.

▪

Blocks abnormal protocol access to OT assets.

▪

Generates logs.

Adding Policy Enforcement Rules (In Gateway Mode)
Procedure
1.

Configure the required object(s).
▪

IP object profiles
For more information, see Configuring IP Object Profile on page 49.

▪

Service object profiles
For more information, see Configuring Service Object Profile on page 50.

▪

Protocol filter profiles
For more information, see Configuring Protocol Filter Profile on page 50.

▪

IPS profiles
For more information, see Configuring IPS Profiles on page 76.

▪

File filter profiles
For more information, see Configuring File Filter Profiles on page 79.

2.

Go to [Security] > [Policy Enforcement]

3.

Under the [Policy Enforcement] tab you will see the following pane.

4.

Click the [Add] button to add a new policy rule.

5.

Use the toggle to enable or disable the policy rule.

83

6.

Input a name for the rule.

7.

Input a description for the rule.

8.

Under the caption of [Basic Filter], the basic networking setting should be configured.
Under the [Interface Direction] drop-down menu, select one of the following for the network
traffic direction:
•

Any

•

WAN to LAN•

LAN to WAN•

WAN to DMZ•DMZ to WAN•

LAN to DMZ•DMZ to LAN•

LAN to LAN

Note: The network interface in the drop-down menu does not specify which exact network
interface, but two or more network interfaces of a kind from the broad view. For example, if you
select [WAN to LAN], then the policy enforcement rule will be effective on the traffic from WAN1
interface to LAN1 interface or WAN1 interface to LAN2 interface. If you select [LAN to LAN], thenthe policy enforcement rule will be effective on the traffic from LAN1 interface to LAN2 interface
or LAN2 interface to LAN1 interface.

Note: If you select [Any], then the policy enforcement rule will be effective on the traffic fromall network interfaces.

9.

Under the [Source IP / IP Object] drop-down menu, select one of the following for the source
IP address(es):

84

•

Any

•

Single IP•

IP Range•

IP Subnet•

IP Object

Note: If you select [IP Object], then you need to select the IP object from an IP object profiles
that have been created beforehand.
10. Under the [Destination IP / IP Object] drop-down menu, select either one of the following forthe destination IP address(es):
•

Any

•

Single IP•

IP Range•

IP Subnet•

IP Object

11. Under the [Service Object] drop-down menu, select one of the following for the layer 4
criteria:
•

Any

•

TCP
You can further specify the port range for this protocol.

•

UDP
You can further specify the port range for this protocol.

•

ICMP
You can further specify the type and code for this protocol.

•

Custom
You can further specify the protocol number for this protocol. The term protocol number
refers to the one defined in the internet protocol suite.

•

Note:

Service Object

You need to select the service object from service object profiles that have been created
beforehand.

10. Under the [Action] drop-down menu, select one of the following:•

Accept: Select this option to allow network traffic that matches this rule.

•

Accept and Log: Select this option to allow network traffic that matches this rule andgenerate log(s).

•Deny and Log: Select this option to block network traffic that matches this rule andgenerate log(s).

11. Under the caption of [Advanced Filter], the following settings of profiles will be configured.
The node will further take actions based on the protocol filter, the IPS profile or the File filter
Profile.
▪

Under the [Protocol Filter Profile] drop-down menu, select a protocol filter profile you
have defined beforehand. From the [Action] drop-down menu, select one of thefollowing:a.

Accept: Select this option to allow network traffic that matches this rule.

b.

Accept and Log: Select this option to allow network traffic that matches this ruleand generate log(s).

85

c.

Deny and Log: Select this option to block network traffic that matches this rule andgenerate log(s).

▪

Under the [IPS Profile] drop-down menu, select an IPS profile you have defined
beforehand.

▪

Under the [File Filter Profile] drop-down menu, select a file filter profile you have defined
beforehand.

12. Click [OK] to save the configurations.

Note:

The policy enforcement rule in gateway mode is effective on the level of network
interface only, not on the level of network physical ports. The policy enforcement rulecannot inspect the traffic between the physical ports under the same network interface.

Adding Policy Enforcement Rules (In Bridge Mode)
Procedure
1.

Configure the required object or objects(s).
▪

IP object profiles
For more information, see Configuring IP Object Profile on page 49.

▪

Service object profiles
For more information, see Configuring Service Object Profile on page 50.

▪

Protocol filter profiles
For more information, see Configuring Protocol Filter Profile on page 50.

▪

IPS profiles
For more information, see Configuring IPS Profiles on page 76.

▪

File filter profiles
For more information, see Configuring File Filter Profiles on page 79.

2.

Go to [Security] > [Policy Enforcement]

3.

In the [Policy Enforcement] tab, you will see the following pane.

4.

Click the [Add] button to add a new policy rule.

5.

Use the toggle to enable or disable the policy rule.

86

6.

Input a name for the rule.

7.

Input a description for the rule.

8.

Under the caption of [Basic Filter], the basic networking setting should be configured. Fromthe [Source IP / IP Object Profile] drop-down menu, select one of the following for the source
IP address(es):
•

Any

•

Single IP•

IP Range•

IP Subnet•

IP Object

Note: If you select [IP Object], then you need to select the IP object from an IP object profiles
that have been created beforehand.
9.

From the [Destination IP / IP Object Profile] drop-down menu, select either one of thefollowing for the destination IP address(es):
•

Any

•

Single IP•

IP Range•

IP Subnet•

IP Object

10. From the [Service Object] drop-down menu, select one of the following for the layer 4
criteria:
▪

Any

▪

TCP
You can further specify the port range for this protocol.

87

▪

UDP
You can further specify the port range for this protocol.

▪

ICMP
You can further specify the type and code for this protocol.

▪

Custom
You can further specify the protocol number for this protocol. The term protocol number
refers to the one defined in the internet protocol suite.

▪

Note:

Service Object
You need to select the service object from service object profiles that have been created
beforehand.

11. From the [VLAN ID] drop-down menu, select one of the following:•

Any: Select this option to configure any VLAN ID(s).

•Custom: Select this option to configure custom VLAN ID(s).

Note:

You can input up to 5 VLAN IDs in one policy enforcement rule.

12. Under the [Action] drop-down menu, select one of the following:•

Accept: Select this option to allow network traffic that matches this rule.

•

Accept and Log: Select this option to allow network traffic that matches this rule andgenerate log(s).

•Deny and Log: Select this option to block network traffic that matches this rule andgenerate log(s).

13. Under the caption of [Advanced Filter], the following settings of profiles will be configured.
The node will further take actions based on the protocol filter, the IPS profile or the File filter
Profile.
▪

Under the [Protocol Filter Profile] drop-down menu, select a protocol filter profile you
have defined beforehand. From the [Action] drop-down menu, select one of thefollowing:a.

Accept: Select this option to allow network traffic that matches this rule.

b.

Accept and Log: Select this option to allow network traffic that matches this ruleand generate log(s).

c.

Deny and Log: Select this option to block network traffic that matches this rule andgenerate log(s).

▪

Under the [IPS Profile] drop-down menu, select an IPS profile you have defined
beforehand.

▪

Under the [File Filter Profile] drop-down menu, select a file filter profile you have defined
beforehand.

14. Click [OK] to save the configurations.

Managing Policy Enforcement Rules
The following table lists the common tasks that are used to manage the policy enforcement rules.
Task

ActionTo delete a policy enforcement
rule

Click the check box in front of the policy enforcement
rule and click the [Delete] button.

88

To duplicate a policy
enforcement rule

Click the check box in front of the policy enforcement
rule and click the [Copy] button.

To edit a policy enforcement
rule

Click the name of the rule, and an [Edit Policy Rule]window will appear.

To change the priority of apolicy enforcement rule

Click the check box in front of the policy enforcement
rule, click the [Change Priority] button, and specify a
new priority for this rule.

Note:

When more than one policy enforcement rule is matched, the device takes the action of
the rule with the highest priority, and ignores the rest of the rules. The rules are listedon the table under the UI tab by priority, starting with the highest priority rule at the
top.

Policy Rule Auto-Learning
Policy Rule Auto-Learning allows you to create a learning task within a scheduled period of time thatcollects information about the legitimate network traffic then uses it to generate a trust list for policy
enforcement of baseline rule(s) in your network environment.

Note:

Before you create the task in Policy Rule Auto-Learning, please make sure that an IPS
Profile in the [Device Profiles] pane in [Object Profiles] > [IPS Profiles] is properly
configured.

Configuring Policy Rule Auto-Learning
Procedure
1.

Go to [Security] > [Policy Rule Auto-Learning].

2.

On the [Policy Rule Auto-Learning Task] pane, you will see the [Create the Task] button.

3.

Click the [Create the Task] button to create the auto-learning task.

4.

Select the IPS Profile to apply to the learning task.

5.

Select the IPS mode ([Monitor Mode], or [Prevention Mode]) to apply to the learning task.

89

6.

Select the time period ([Running Now], or [Start Time]) to determine when the learning task
starts auto-learning.

7.

Click [Apply] to create the task.

Note:

When a learning task is running, the configuration file cannot be uploaded to EdgeFire™
to restore settings.

Stopping Policy Rule Auto-Learning

Procedure
1.

When the learning task is in progress, go to [Security] > [Policy Rule Auto-Learning].

90

2.

On the [Policy Rule Auto-Learning Task] pane, you will see the [Stop the Task] and [Cancel
the Task] buttons.

3.

Click the [Stop the Task] button to stop the auto-learning task.

4.

A warning message will show up for confirmation.

5.

Click [Confirm] to stop the task. The learning result still be generated and waits for yourreview.

Canceling Policy Rule Auto-Learning

Procedure
1.

When the learning task is in progress, go to [Security] > [Policy Rule Auto-Learning].

2.

On the [Policy Rule Auto-Learning Task] pane, you will see the [Stop the Task] and [Cancel
the Task] buttons.

3.

Click the [Cancel the Task] button to cancel the auto-learning task.

4.

A warning message will show up for confirmation.

91

5.

Click [Confirm] to cancel the task. All the learned policy rules within the preset period will bediscarded.

Generating the Learning Results

Procedure
1.

After the learning task process is completed, or stopped, go to [Security] > [Policy Rule
Auto-Learning].

2.

On the [Policy Rule Auto-Learning Result] pane, you will see the [Generate Policy Rule] and[Delete the Learning Result] buttons.

3.

Click the [Generate Policy Rules] button to list the policy rule list for review.

92

4.

You can activate or deactivate policy rule(s) by clicking the checkbox on the left of thewindow before you apply to generate the policy rule(s) as a trust list.

5.

Click [Apply] and the policy rule list will be generated and moved to the device rule list inpolicy enforcement page.

Note:

In [Generate Policy Rule List], you can review the policy rule(s) and the protocol filter
profile(s) but you can only edit rule names.

93Deleting the Learning Results

Procedure
1.

After the learning task is completed, go to [Security] > [Policy Rule Auto-Learning].

2.

At the [Policy Rule Auto-Learning Result] plane you will see the [Generate Policy Rule] and[Delete the Learning Result] button.

3.

Click the [Delete the Learning Result] button.

4.

A warning message will show up for confirmation.

5.

Click [Confirm] to delete all learned results.

94

Suspicious Objects
Suspicious Objects allows you to define a custom node-based/link-based list that matches to thehash value of a network node or a network link, and then allow or block activities fitting that
network node/network link in your network environment.

Note:

Before you enable Suspicious Objects feature, please note that the [ODC Settings] panein [Administration] > [Sync Settings], is properly configured and ODC is connected withthe 3rd party API from the source of the suspicious object.

Configuring Suspicious Objects
Procedure
1.

Go to [Security] > [Suspicious Objects].

•

In the [Suspicious Objects] tab, you will see the [Suspicious Object General Settings] pane.

•

Use the toggle to enable or disable the suspicious object feature.

•

Select a mode ([Monitor Mode], or [Prevention Mode]) for the feature.

•

If you want to change the action of the specific suspicious object at the [Suspicious Object
Rule List] table, select the specific suspicious object and choose the action [Drop and Log] or[Bypass and Log] when the pattern is matched.

The following table summarizes the settings:
Mode(Suspicious Objects)
Monitor Mode

Prevention Mode

Note:

Action Performed▪

Detects network node(s) or network link(s), but does notblock the traffic related to the network node(s) or networklink(s).

▪

Generates logs.

▪

Blocks network node(s) or network link(s).

▪

Generates logs.

The suspicious object rule list is of higher priority than the device rule and master rulelists.

95

Chapter 10

The Pattern Tab
This chapter describes how to view the pattern information and how to import a DPI (Deep Packet
Inspection) pattern to the EdgeFire™ device.
The DPI pattern, prepared by Trend Micro, contains signatures to enable the intrusion prevention
features on the device. The intrusion prevention features detect and prevent behaviors related to
network intrusion attempts or targeted attacks at the network level.

Viewing Device Pattern Information
Procedure
1.

Go to [Pattern] > [Pattern Update].

2.

In the [Pattern Update] tab you will see the following information.

3.

The [IPS Pattern Update] pane shows the current [IPS Pattern Version] and [IPS Pattern
Build Date].

Manually Updating the Pattern
Procedure
1.

Go to [Pattern] > [Pattern Update].

2.

In the [Pattern Update] tab you will see the following field.

3.

Click [Select].

4.

Manually select the pattern to be deployed to the device.

5.

Click [Upload] and then [Confirm].

96

Downloading Release Notes/IPS Rule Metadata
Procedure
1.

Go to [Pattern] > [Pattern Update].

2.
3.

Click the [Download Release Notes] button to view the detailed release information.
Click the [Download IPS Rule Metadata] button to view the IPS Rule Metadata.

97

Chapter 11

The Application Tab
This chapter describes how to use the USB application and packet capture functions.

USB Application
Procedure
1.

Go to [Applications] > [USB Application].

2.

At the [USB Application] tab, you will see the following pane.

3.

Use the toggle to enable USB Application usage by enabling the USB port.

4.

Once the USB Application is enabled and a USB device is plugged in, you can see its
connection status.

Note:

If USB Application is disabled, the USB port on the front panel will not connect to theplugged-in USB devices.

Note:

With regard to the supported USB devices, please refer to “Supported USB Devices ”.

Advanced USB Application
1.

Click [Enable] to enable adaptive configuration backup for a USB-based device.

2.

Back up behavior can be configured as follows:•

Regularly backup configurations to a USB device – 5 different time periods aresupported.

•

Back up configurations to a USB device only when the settings are changed.

98

Packet Capture
The Packet Capture feature allows you capture packets for further analysis. This feature allows theuser to configure the capture of packets by IPS event rules. Packets that trigger IPS events can thenbe further analyzed and can help support teams to quickly address false positive/false negative
matching of IPS rules in the security module.

Enabling Packet Capture
Procedure
1.

Go to [Applications] > [Packet Capture].

2.

Click [Enable] to enable IPS packet capture.

3.

You can see the entire IPS rule list and select a rule to “Enable” for IPS rule capture.

4.

Up to 5 IPS rules can be selected for packet capture.

Note:

The Packet Capture feature will save the selected IPS Rule event packets once the IPS
rule is hit and will only save the last 10 occurrences of a particular rule. Older events
will be overwritten.

99

Download Captured Packet
Procedure
1.

Go to [Application] > [Packet Capture]2.

Click [Download List] to show a list of IPS rules.

3.

You can click the download icon to download the zipped archive on your computer.

4.

Disabling Packet Capture will cause the previously-downloaded packet captures to be deleted.
To confirm disabling of the feature, the above warning will be shown to the user.

Note:

The download list will be refreshed every 10 seconds. If you want to get the latest
updates, please click the “manual” refresh button.

100

Chapter 12

The Logs Tab
This chapter describes the system event logs and security detection logs you can view on the
management console.

Note:

For a list of all possible log messages and types, please refer to the document,"EdgeIPS™ / EdgeFire™ / ODC - Log Description".

You can view the following logs on EdgeFire™:▪

Cyber security logs▪

Policy enforcement logs▪

Protocol filter logs▪

File filter logs▪

Suspicious object logs▪

Asset detection logs▪

System logs

Viewing Cyber Security Logs
The cyber security logs cover logs detected by denial-of service attacks.

Procedure
1.

Go to [Logs] > [Cyber Security Logs].
The following table describes the log table.
Field

Description

Time

The time the log entry was created.

Rule Name

The name of the rule

Profile Name

The name of the profile

Event ID

The ID of the matched signature.

TID

MITRE ID information

Security Category

The category of the matched signature.

Security Severity

The severity level assigned to the matched signature.

Security Rule Name

The name of the matched signature.

Direction

The direction flow of the connection.

Interface

The network interface which receives the connection.

Attacker

The IP address of host device which initiates the cyber attack

Source MAC Address

The source MAC address of the connection.

Source IP Address

The source IP address of the connection.

Source PortThe ‘source port’ of the packet, if the protocol is TCP/UDP.
The ‘ICMP type’ of the packet, if the protocol is ICMP.

Destination MAC
Address

The destination MAC address of the connection.

Destination IP Address

The destination IP address of the connection.

Destination PortThe ‘destination port’ of the packet, if the protocol is TCP/UDP.
The ‘ICMP code’ of the packet, if the protocol is ICMP.

VLAN ID

The VLAN ID of the connection.

Ethernet TypeThe Ethernet type of the connection.

101

FieldDescription

IP Protocol NameThe IP protocol name of the connection.

ActionThe action performed based on the policy settings.

Count

The number of detected network packets within the detection
period after the detection threshold is reached.

Viewing Policy Enforcement Logs
The policy enforcement logs cover logs created by the [Policy Enforcement] feature without [Advanced
Filter] being enabled, i.e., the [Action] of the policy enforcement rule is either to allow or to deny.

Procedure
1.

Go to [Logs] > [Policy Enforcement Logs].
The following table describes the log table.
Field

Description

Time

The time the log entry was created.

Rule Name

The name of the policy enforcement rule that was used togenerate the log.

Direction

The direction flow of the connection.

Interface

The network interface which receives the connection.

Source MAC Address

The source MAC address of the connection.

Source IP Address

The source IP address of the connection.

Source Port

If the protocol is TCP/UDP, it indicates the source port.
If the protocol is ICMP, it indicates the ICMP type.

Destination MAC
Address

The destination MAC address of the connection.

Destination IP Address

The destination IP address of the connection.

Destination Port

If the protocol is TCP/UDP, it indicates the destination port.
If the protocol is ICMP, it indicates the ICMP code.

VLAN ID

The VLAN ID of the connection.

IP Protocol NameThe IP protocol name of the connection.

ActionThe action performed based on the policy settings.

Viewing Protocol Filter Logs
The protocol filter logs cover logs detected by the [Protocol Filter] feature. ‘Protocol filter’ is advanced
configurations when you configure the [Policy Enforcement] settings.

Procedure
1.

Go to [Logs] > [Protocol Filter Logs].
The following table describes the log table.
Field

Description

Time

The time the log entry was created.

Rule Name

The name of the policy enforcement rule that was used togenerate the log.

Profile Name

The name of the protocol filter profile that was used togenerate the log.

Direction

The direction flow of the connection.

Interface

The network interface which receives the connection

Source MAC Address

The source MAC address of the connection.

102

FieldDescription

Source IP Address

The source IP address of the connection.

Source Port

If the protocol is TCP/UDP, it indicates the source port.
If the protocol is ICMP, it indicates the ICMP type.

Destination MAC
address

The destination MAC address of the connection.

Destination IP Address

The destination IP address of the connection.

Destination Port

If the protocol is TCP/UDP, it indicates the destination port.
If the protocol is ICMP, it indicates the ICMP code.

VLAN ID

The VLAN ID of the connection.

Ethernet TypeThe Ethernet type of the connection.

IP Protocol NameThe IP protocol name of the connection.

L7 Protocol Name

The layer 7 protocol name of the connection. The term
layer 7 refers to the one defined in the OSI (Open Systems
Interconnection) model.

Cmd / Fun No.

The command or the function number that triggered thelog.

Extra Information

Extra information provided with the log.

ActionThe action performed based on the policy settings.

Count

The number of detected network packets.

Viewing File Filter Logs
The file filter logs refer to logs detected by the [File Filter] feature. ‘File filter’ is advanced
configurations when you configure the [Policy Enforcement] settings.

Procedure
1.

Go to [Logs] > [File Filter Logs]
The following table describes the log table.
Field

Description

Time

The time the log entry was created.

Rule Name

The name of the policy enforcement rule set and thematched policy rule that was used to generate the log.

Profile Name

The name of the file filter profile that was used togenerate the log.

Direction

Interface Direction

Interface

The physical port interface which receives the packet.

Source MAC Address

The source MAC address of the packet.

Source IP Address

The source IP address of the packet.

Source Port

If the protocol is TCP/UDP, it indicates the source port.

Destination MAC
address

The destination MAC address of the packet.

Destination IP Address

The destination IP address of the packet.

Destination Port

If the protocol is TCP/UDP, it indicates the destination
port.

VLAN ID

The VLAN ID of the packet.

ProtocolThe layer 7 protocol name of the connection. The term
layer 7 refers to the one defined in the OSI (Open
Systems Interconnection) model.

Extra Information

Extra information provided with the file filter log.

ActionThe action performed based on the policy settings.

103Viewing Suspicious Object Logs
The suspicious object logs are included logs detected by the [Suspicious Objects] feature.

Procedure
1.

Go to [Logs] > [Suspicious Object Logs].
The following table describes the log table.
Field

Description

Time

The time the log entry was created.

ID

The hash ID of the matched suspicious object.

Type

The suspicious object type, which is node type or link type.

SourceThe source of suspicious object

Risk Level

The threat level of suspicious object

Expiration TimeThe Expiration Time of suspicious object. When the expiration
time reaches, the suspicious object will be deleted.

Direction

Interface direction

Interface

The physical port interface which receives the suspicious
objectSource MAC Address

The source MAC address of the connection.

Source IP Address

The source IP address of the connection.

Source PortThe source port of the connection.

Destination MAC
address

The destination MAC address of the connection.

Destination IP Address

The destination IP address of the connection.

Destination PortThe destination port of the connection.

VLAN ID

The VLAN ID of the connection.

Ethernet TypeThe Ethernet type of the connection.

IP Protocol NameThe IP protocol name of the connection.

ActionThe action performed based on the suspicious object settings.

Count

The number of detected suspicious object within thedetection threshold.

Viewing Asset Detection Logs
The asset detection logs cover the system status changes of the managed assets.

Procedure
1.

Go to [Logs] > [Assets Detection Logs].
The following table describes the log table.
Field

Description

Time

The time the log entry was created.

Event TypeThe log event description.

Interface

The network interface which receives the asset
information.

Asset MAC Address

The MAC address of the asset.

Asset IP Address

The source IP address of the asset.

104

Viewing System Logs
You can view details about system events on the device.

Procedure
1.

Go to [Logs] > [System Logs].
The following table describes the log table.
Field

Description

Time

The time the log entry was created.

Severity

The severity level of the logs.

Message

The log event description.

Viewing Audit Logs
You can view details about user access, configuration changes, and other events that occurred whenusing the device.

Procedure
1.

Go to [Logs] > [Audit Logs].
The following table describes the log table.
Field

Description

Time

The time the log entry was created.

User ID

The user account used to execute the task.

Client IP

The IP address of the host used to access the
management console.

Severity

The severity level of the logs.

Message

The log event description.

Note:

To view the audit logs, please log in with the default “audit” account.

105

Chapter 13

The Administration Tab
This chapter describes the available administrative settings for EdgeFire™ device.

Account Management
Note:

Log onto the management console using the default administrator account (“admin”) to
access the Account Management tab.

This system uses role-based administration to grant and control access to the management console.
Use this feature to assign specific management console privileges to the accounts and present themwith only the tools and permissions necessary to perform specific tasks. Each account is assigned a
specific role. A role defines the level of access to the management console. Users log on to the
management console using custom user accounts.
The following table outlines the tasks available on the [Account Management] tab.

Task

Description

Add Account(s)Click Add to create a new user account.
For more information, see Adding a User Account on
page107.

Delete Existing Account(s)Select the existing user account(s) and click Delete.

Edit Existing Account(s)Click the name of a preexisting user account to view or
modify the current account settings.

User RolesThe following table describes the permissions matrix for user roles.
User Roles
Sub-TabAdmin

Operator

Visitor

Auditor

View

Yes

Yes

Yes

Yes

All operations

Yes

Yes

Yes

Yes

View

Yes

Yes

Yes

No

All operations

Yes

Yes

Yes

No

View

Yes

Yes

No

No

All operations

Yes

No

No

No

View

Yes

Yes

No

No

All operations

Yes

Yes

No

No

View

Yes

Yes

No

No

All operations

Yes

Yes

No

No

View

Yes

Yes

No

No

All operations

Yes

Yes

No

No

Logs (notincludingaudit logs)

View

Yes

Yes

Yes

No

Audit Log

View

No

No

No

Yes

Administration

View

Yes

No

No

No

SystemVisibility
DeviceObject Profiles
Security
Pattern

Action106

All operations

Yes

No

No

No

Built-in User Accounts
The following table lists the built-in user accounts for the device.
Built-in Account ID

Default Password

User Role

admin

Admin

txone

auditor

Auditor

txone

Note:

The built-in user accounts cannot be deleted from the device.

Note:

When you first set up the device, ensure that the passwords of the built-in accounts arechanged.

Adding a User AccountWhen you log on using the administrator account (“admin”), you can create new user accounts toaccess the system.

Procedure
1.
2.

Go to [Administration] > [Account Management].
Click [Add].
The Add User Account screen will appear.

3.

Configure the account settings.
Field

4.

Description

ID

Type the user ID to log on to the management console.

Name

Type the name of the user for this account.

Role

Select a user role for this account.
For more information, see User Roles on page106.

Authentication
SourceType the authentication source for this account.

Local Password

Type the account password.

Confirm Local
password

Type the account password again to confirm.

Description

Add a description for this accountClick [Confirm].

Changing Your Password
Procedure
1.

On the management console banner, click your account name.

2.

Type your new password in [Local Password] field.

3.

Retype your new password in [Confirm Local Password] field.

4.

Click [Confirm].

107

Configuring Password Policy Settings
EdgeFire™ provides the following password policy settings to enhance web console access security:▪

Password complexity settingsSpecify password complexity settings to enforce strong passwords. For example, you canspecify users to create strong passwords that must contain a combination of both uppercase
and lowercase letters, numbers, and symbols, and are at least eight characters in length.

Note:

When strong passwords are required and a user submits a new password, and thepassword policy determines whether the password meets your company's establishedrequirements. Strict password policies may sometimes increase costs to an organization
when users select passwords that are too difficult to remember. Users call the help desk
when they forget their passwords, or keep passwords in easily accessible locations andincrease their vulnerability to threats. When establishing a password policy, balance
your need for strong security against the need to make the policy easy for users tofollow.

Procedure
1.
2.

Go to [Administration] > [Account Management].
Click the [Password Policy] tab.
The [Password Policy] window will appear.

3.

Select one or more options that meet your required password policy.

4.

Click Save.

Auth Service
Use the [Auth Service] tab to configure the TACACS+ of the device.

Configuring TACACS+
Procedure
1.

Go to [Administration] > [Auth Services].

108

2.

In the [TACACS] pane, configure the Primary and Secondary TACACS+ Servers for thedevice.

3.

Enable Primary TACACS+ and configure settings.
•

Configure the server address.

•

Configure the server port (Default port: 49).

•

Configure the shared secret key (MAX: 64 characters).

•

Select the authentication type from the list as follows:•

Enable Secondary TACACS+ Server if you need.

109System Management
Use the [System Management] tab to do the following:▪

Configure the host name and location information of the device.

▪

Choose the protocols and ports that can be used to manage the device.

▪

Configure the IP addresses that are allowed to manage the device.

Configuring Device Name and Device Location Information
Procedure
1.

Go to [Administration] > [System Management].

2.

In the [System Settings] pane, provide the host name and location information for thedevice.

Configuring Management Method and Access Control List
Configuring Management Protocols and Ports
Procedure
1.
2.

Go to [Administration] > [System Management].
In the [Management Method] pane:•

Select the protocols that are allowed to be used.

•

Input the port numbers for the protocols.

Note:

The HTTP and HTTPS protocols are used for connecting to the web management console.
The SSH and Telnet protocols are used for connecting via the CLI commands.

110Configuring Access Control List from Management Clients
Procedure
3.

Go to [Administration] > [System Management].

4.

In the [Management Method] pane, use the toggle to enable or disable access control fromthe management clients.

5.

List the IP addresses that are allowed to manage the device.

6.

Check if pinging the management interface are allowed.

The Sync Settings Tab
EdgeFire™ can be managed by a TXOne ODC (Operational Technology Defense Console). Use thistab to register the EdgeFire™ to a TXOne ODC.

Enabling Management by ODCProcedure
1.

Go to [Administration] > [Sync Settings].
•

Use the toggle to enable management by ODC.

•

Input the IP address of the ODC server.

111

Action for Master Rule and Profile
Procedure
1.

Go to [Administration] > [Sync Settings].

2.

Click the [Master Rule & Profile] button to delete Object Profiles and Policy Enforcement rules
synced from ODC

Configuring Syslog Settings
The system maintains Syslog events that provide summaries of security and system events. Common
Event Format (CEF) syslog messages are used in EdgeFire™.
Configure the Syslog settings to enable the system to send the Syslog to a Syslog server.

Procedure
1.

Go to [Administration] > [Syslog].

2.

Select [Send logs to a syslog server] to set the system to send logs to a syslog server.

3.

Configure the following settings.

112

FieldDescription

Server address

Type the IP address of the syslog server.

Port

Type the port number.

ProtocolSelect the protocol for the communication.

Facility level

Select a facility level to determine the source and priorityof the logs.

Severity level

Select a syslog severity level.
The ODC system only sends logs with the selected
severity level or higher to the syslog servers.
For more information, see Syslog Severity Level Mapping
Table on page 114.

4.

Select the types of logs to send.

5.

Click [Save].

113

Syslog Severity Levels
The syslog severity level specifies the type of messages to be sent to the syslog server.

Level

Severity0

Emergency

1

CriticalDescription
Complete system failure▪

Take immediate action.
Primary system failure▪

Take immediate action.
2

Alert

Urgent failure▪

Take immediate action.
3

Error

Non-urgent failure▪

Resolve issues quickly.
4Warning

Error pending▪

Take action to avoid errors.
5

Notice6

Informational

7

Debug

Unusual events▪

Immediate action is not required.
Normal operational messages useful forreporting, measuring throughput, andother purposes▪

No action is required.
Useful information when debugging theapplication.

▪

Setting the debug level cangenerate a large amount ofsyslog traffic in a busy network.
Use with caution.

Note:

Syslog Severity Level Mapping Table
The following table summarizes the logs of Policy Enforcement/Protocol Filter/Cyber Security and theirequivalent Syslog severity levels.

PolicyEnforcement/ Protocol
Filter Action

Cyber Security
Severity Level

Syslog Severity Level

0 - Emergency
Critical

1 - AlertHigh

2 - Critical
3 - Error

DenyMedium

4 - Warning
5 - NoticeAllow

6 - Information
7 - Debug114Configuring System Time
Network Time Protocol (NTP) synchronizes computer system clocks across the Internet. Configure NTP
settings to synchronize the system clock with an NTP server, or manually set the system time.

Procedure
1.

Go to [Administration] > [System Time].

2.

Under System Time Settings, select one of the following:▪

▪

Synchronize system time with an NTP servera.

Specify the domain name or IP address of the NTP server.

b.

Click [Synchronize Now].

Set system time manuallya.

Click the calendar to select the date and time.

b.

Set the hour, minute, and second.

c.

Click [Apply].

3.

From the Time Zone drop-down list, select the time zone.

4.

Click [Save].

The SNMP Tab
The Simple Network Management Protocol is a protocol used for exchanging management information
between Edge series devices. EdgeFire™ supports SNMP v1/v2c and more secure v3, as well as SNMP
traps.

Procedure
1.

Go to [Administration] > [SNMP]

2.

Click [Enable] to enable SNMP functionality.

3.

Under General settings, you can change the SNMP port. The default setting is Port 161.

115

4.

You can click the “Download MIB file” link to download the EdgeFire™’s MIB file.

Configuring SNMP v1/v2c
Procedure
1.

Go to [Administration] > [SNMP]

2.

Click [Add] to create SNMP v1/v2c settings.

•

a. Enter Community name.

•b. Add a Trusted Address list. There are two supported types: Single IP and IP Subnet.

•

c. Click [OK] to create a new SNMP v1/v2c community.

Configuring SNMP v3
Procedure
1.

Go to [Administration] > [SNMP]

2.

Click [Add] to create SNMP v3 settings.

116

3.

Enter USM user.

4.

Under [Security Method], select from the following options:

5.

•a. No authentication or privacy.

•

b. Authenticated – this includes SHA and MD5. You can select the appropriate
authentication protocol and enter an authentication key.

•c. Authenticated with Privacy – this also includes SHA and MD5, and you can selectappropriate authentication and privacy protocols.

Click [OK] to create an SNMPv3 USM User.

Configuring SNMP Trap Receivers
Procedure
1.

Go to [Administration] > [SNMP]

2.

Click the [Trap Receivers] tab.

3.

Click [Add] to create a new Trap Receiver.
•

Use the toggle of [Status] to enable a Trap Receiver.

•Enter [Name] for a Trap Receiver.

•

Add [Description] if necessary.

•

Select SNMP version: SNMP v1 or SNMP v2c•

Enter [Server Address].

•

Enter [Server Port]. The default server port is 162.

•

Select message type: “Trap” or “informRequest”.

•

Enter [Trap Community]. The default name is PUBLIC.

117

•

Set [Trap Retry Times] to an amount of retries, ranging from 1-10 times.

•

Select what will trigger an Event Notification from the list as follows:

The Back Up / Restore Tab
Export settings from the management console to back up the configuration of your EdgeFire™. If asystem failure occurs, you can restore the settings by importing the configuration file that you
previously backed up.
We recommend the following:▪

Backing up the current configuration before each import operation.

▪

Performing the operation when the EdgeFire™ is idle. Importing and exporting configuration
settings affects the performance of EdgeFire™.

118

Backing Up a Configuration
Procedure
1.

Go to [Administration] > [Back Up / Restore].
The [Back Up / Restore] tab will appear.

2.

Click the [Back Up] button.
A configuration backup file will automatically be saved in your computer.

Restoring a Configuration
Follow the steps to restore the configurations of the EdgeFire™.

Procedure
1.

Go to [Administration] > [Back Up / Restore].

2.

Under the [Restore Configuration] section, click the [Select File] button, and proceed toimport the file.

All services will restart. It can take some time to restart services after applying imported settings andrules.

The Firmware Management Tab
Use the [Firmware Management] tab to:▪

View the firmware information of the device▪

Upgrade the firmware of the device▪

Boot into standby partition and firmware

Viewing Device Firmware Information
Procedure
1.

Go to [Administration] > [Firmware Management].

2.

The [Firmware Management] pane lists the two partitions available. It shows the [Partition#], [Partition Name], [Partition Status], [Firmware Version] and [Firmware Build Date].

119Note: All Edge Series devices can have up to two firmwares installed. Each firmware is installedin its own separate partition. At any given point in time, one partition will have the status[Running], which indicates the currently running and active firmware. The other partition will
have the status [Standby] which indicates an alternative or standby partition.

Updating Firmware
Procedure
1.

Go to [Administration] > [Firmware Management].

Note: During a firmware upgrade, firmware will always be installed to the [Standby] partition.
As such, the firmware upgrade button is only available in the [Standby] partition row.

2.

Click on the Upgrade Firmware button to install it to the [Standby] partition.

3.

In the [Update Firmware] pane provide the location of the firmware and click [Upload] toinstall the firmware to the [Standby Partition].

4.

After successfully installing required firmware to [Standby] partition, click on the [Reboot and
Apply Firmware] button as shown in the next section.

Note:

Various versions of the firmware can be downloaded at the Trend Micro Download
Center at https://www.trendmicro.com/en_us/business/products/downloads.html

120Rebooting and Applying Firmware
To boot into an upgraded firmware or to revert to a previous firmware, a user may need to boot into
the [Standby] partition and load the firmware from it.

Procedure
1.

Go to [Administration] > [Firmware Management].

2.

Click on the [Reboot and Apply Firmware] button that is available in the [Standby] partition
row

3.

Click [OK] to proceed with rebooting into the [Standby] partition and making it the [Running]partition.

Reboot System
Use the [Reboot System] tab to reboot the system.

Procedure
1.

Go to [Administration] > [Reboot System]

2.

In the [Reboot System] pane, click [Reboot] to reboot the system.

121

Chapter 13

Supported USB Devices
This chapter describes the use of supported USB devices with the EdgeFire™ device for extended or
supporting functionality.
To ensure optimal operation, only the below list of USB devices is currently supported. This list may
be updated from time to time. Please visit TrendMicro’s support page for a more updated list.
#

Model

DeviceType

1

MOXA Backup Configurator (ABC-02 Series)
Model: ABC-02-USB-T

USB Disk
Drive

2

Innodisk Industrial USB 2.0 16GB(USB Drive 2SE)

USB Disk
Drive

3

Apacer industrial USB disk 16GB (AH355)

USB Disk
Drive

Supported actions via USB Disk
1.

On-demand configuration for disk backup

2.

Load pattern from disk

3.

Load configuration from disk

4.

Load firmware from disk

Given that this feature allows anyone with a supported USB disk device to perform various
operation via USB, the physical security of the EdgeFire™ device must be considered carefully.
Only supported USB disk devices may be used for this feature.

To perform any of these actions:
2.

Plug the supported USB disk device into the EdgeFire™ device’s USB port.

2.

Upon successful detection of the USB disk device, the “IPS/IDS” LED will change to a steadygreen. The system log can also be checked to confirm that a supported USB disk device was
detected when inserted. This state is referred to as the “Default Action” state.

122

Note:

If an unsupported USB device is plugged in, it will simply be ignored and no further
action will be taken.

The functionality of the reset button will also change until the USB device is unplugged. The
reset button will at this time not serve the as the reboot/factory reset button. It will instead
serve as a button to cycle through a set of possible actions that may be taken when a USB
device is plugged in.

The user can use the reset button to cycle through a set of possible actions. The LEDs will
indicate which action is currently selected. Each quick press of the Reset button will toggle
through the next possible action.

Possible Actions to Toggle ThroughLED

COLOUR/STATE

State/Action

Default State – USB Plugged in

IPS/IDS LED

Amber – Steady

Load/Restore Pattern

IPS/IDS LED

Green – Blinking (1/sec)

Load/Restore Configuration

MGMT LED

Green – Blinking (1/sec)

Load/Restore Firmware

IPS/IDS & MGMT LED

Green – Blinking (1/sec)

Backup Configuration

3.

After selecting an action, it must be confirmed by pressing the Reset button for more than 3
seconds. (a long, steady press).

Note:
3.

The action must be confirmed within 10 seconds. If the action is not confirmed within 10
seconds, the LEDs will be return to their default state.

While an action is being attempted, if there is a USB disk data transfer, the following LEDs
will indicate it as shown here and then return to previous state after data transfer iscomplete.

Data Transfer Indication

LED

COLOUR/STATE123

IPS/IDS LED

4.

Amber – Blinking (Once every 0.5 sec)

If any error occurs when action is being attempted, the following LEDs will show it like so:

Error Indication (on any
error while action was
being processed)

Note:

LED

COLOUR/STATE

FAULT LED

Red – Steady

The error can only be cleared if: (1) the reset button is pressed once more (LEDs returnto default state with no action selected) or (2) the USB disk is unplugged.

5.

Relevant system logs can be checked to verify whether the action was completed successfully
or failed. If an action is successful, LEDs will be restored to their default state when the USB
disk device was first plugged in and no action was selected.

6.

The USB disk device may be unplugged, after which LEDs will return to their state prior to
the USB disk device being plugged in (USB/F LED off), and a log will be available in systemlogs.

On-demand Configuration backup
4.

In the “Default Action” state, on-demand configuration backup to disk can be performed byholding down the reset button for > 10 seconds. During file transfer the USB LED may blink.
However, since configuration files are usually not be very large, this process may finish
quickly.

5.

This action will save the current running configuration to the disk under thepath“/TXone/config/xxxxxx.acf”.

6.

After saving the config, if successful, the USB app will return to the “Default Action” state. If
any error occurs, the FAULT LED will turn red.

The system logs will also reflect whether the action was successful or not.

Load Pattern from Disk
A DPI pattern file may be easily and quickly loaded from a USB disk device. This functionality
allows for a floor operator to update the pattern file on the physical floor of the ICS environment
without the need of a client computer to log into the device.

1.

Save the pattern file in a USB disk device under path “/TXone/pattern/”. Assuming apattern file has the name pattern.acf, its file path on the USB disk device would be“/TXone/pattern/pattern.acf”.

Note:

Saving pattern files under other paths or incorrect folder names will cause the file to not
be detected during the pattern load process. Folder names are case-insensitive.
If multiple pattern files exist in the folder, the newest will be used.

2.

Plug in the USB disk. Enter the “Default Action” state.

124

3.

In the default action state, give the reset button one short press to toggle it to its “LoadPattern” action state.

4.

When in its “Load Pattern” action state, the “IPS/IDS” LED will change to blinking green.

Blinking

5.

The “Load Pattern” action must now be confirmed by holding down the reset button for morethan 3 seconds.

6.

After confirmation, the selected action will be attempted. If successful, the USB app will
return to the “Default Action” state. If any errors occur, the FAULT LED will turn red.

7.

The system logs will also reflect whether the action was successful or not.

Load Configuration from Disk
A configuration file may be easily and quickly loaded via a USB disk device. This functionality
allows for a floor operator to update/restore the configuration on the physical floor of the ICS
environment without the need of a client computer to log into the device.

8.

Save the pattern file in a USB disk device under path “/TXone/config/”. Assuming apattern file has the name pattern.acf, its file path on the USB disk device would be“/TXone/config/config.acf”.

Note:

Saving config files under other paths or incorrect folder names will cause the file to not
be detected during the pattern load process. Folder names are case-insensitive.
If multiple config files exist in the folder, the newest will be selected in subsequent steps

9.

Plug in the USB disk. Enter the “Default Action” state.

10. In the default action state, give the reset button one short press to toggle it to its “LoadConfig” action state.
11. When in its “Load Config” action state, the “MGMT” LED will change to blinking green.

Blinking

12. The “Load Config” action must now be confirmed by holding down the reset button for morethan 3 seconds.
13. After confirming, the action will be attempted. If successful, the USB app will return to the“Default Action” state. If any error occurs, the FAULT LED will turn red.
14. The system logs will also reflect whether the action was successful or not.

125

Load Firmware from Disk
Device firmware may be easily and quickly upgraded via a USB disk device. This functionality
allows for a floor operator to upgrade/change the firmware of a device on the physical floor of the
ICS environment without the need of a client computer to log into the device.

15. Save the pattern file in a USB disk device under path “/TXone/firmware/”. Assuming apattern file has the name pattern.acf, its file path on the USB disk device would be“/TXone/firmware/firmware.acf”.

Note:

Saving firmware files under other paths or incorrect folder names will cause the file tonot be detected during the firmware load process. Folder names are case-insensitive.
If multiple firmware files exist in the folder, the newest will be selected in subsequent
steps

16. Plug in the USB disk. Enter the “Default Action” state.
7.

In the default action state, give the reset button three short presses to toggle to the “LoadFirmware” action state.

8.

When in “Load Firmware” action state, the “MGMT” and “IPS/IDS” LEDs will change toblinking green.

Blinking
Blinking

9.

The “Load Firmware” action must now be confirmed by holding down the reset button for
more than 3 seconds.

10. After confirming, the action will be attempted. If successful, the USB app will return to the“Default Action” state. If any error occurs, the FAULT LED will turn red.
11. The system logs will also reflect whether the action was successful or not.

Note:

Latest versions of the firmware files can be downloaded from the Trend Micro Download
Center at https://www.trendmicro.com/en_us/business/products/downloads.html

126Appendix A

Terms and Acronyms
The following table lists the terms and acronyms used in this document.
Term/Acronym

Definition

ALG

Application Layer Gateway

CEF

Comment Event Format

CIDR

Classless Inter-Domain Routing

DPI

Deep Packet Inspection

EWS

Engineering Workstation

HMI

Human-Machine Interface

ICS

Industrial Control System

IT

Information Technology

NAT

Network Address Translation

ODC

Operational Technology Defense Console

OT

Operational Technology

OT Defense
ConsoleOperational Technology Defense Console

PLC

Programmable Logic Controller

SCADA

Supervisory Control and Data Acquisition

127