The Configuration Management and Hardening Guide of
Moxa’s NPort 5000 Series
Moxa Technical Support Teamsupport@moxa.com

Contents
1.

Introduction.................................................................................... 2

2.

General System Information ........................................................... 3

2.1.

Basic Information About the Device ............................................................ 3

2.2.

Deployment of the Device ......................................................................... 4

3.

Configuration and Hardening Information ...................................... 5

3.1.

TCP/UDP Port Status ................................................................................. 6

3.2.

Account Management ..............................................................................103.3.

Accessible IP List .....................................................................................123.4.

Logging and Auditing ...............................................................................134.

Patching/Upgrades ....................................................................... 15

4.1.

Patch Management Plan ...........................................................................15

4.2.

Firmware Upgrades .................................................................................15

5.

Security Information and Vulnerability Feedback ......................... 17Copyright © 2022 Moxa Inc.
About Moxa

Released on Jan 03, 2022

Moxa is a leading provider of edge connectivity, industrial computing, and network infrastructure
solutions for enabling connectivity for the Industrial Internet of Things (IIoT). With over 30 years ofindustry experience, Moxa has connected more than 71 million devices worldwide and has a
distribution and service network that reaches customers in more than 80 countries. Moxa delivers
lasting business value by empowering industries with reliable networks and sincere service.
Information about Moxa’s solutions is available at www.moxa.com.

How to Contact Moxa
Tel:
Fax:

1-714-528-6777
1-714-528-6778Moxa Tech Note

The Configuration Management and Hardening
Guide of Moxa’s NPort 5000 Series

1. Introduction
This document provides guidelines on how to configure and secure the NPort 5000 Series. Youshould consider the recommended steps in this document as best practices for security inmost applications. It is highly recommended that you review and test the configurations
thoroughly before implementing them in your production system to ensure that yourapplication is not negatively impacted.

Copyright © 2022 Moxa Inc.

Page 2 of 17

Moxa Tech Note

The Configuration Management and HardeningGuide of Moxa’s NPort 5000 Series

2. General System InformationBasic Information About theDevice
ModelFunction

Operating System

Firmware Version

NPort 5000A Series

General purpose

Moxa Operating System

Version 1.6

NPort 5110

General purpose

Moxa Operating System

Version 2.10

NPort 5130/5150

General purpose

Moxa Operating System

Version 3.9

NPort 5200 Series

General purpose

Moxa Operating System

Version 2.12

NPort 5400 Series

General purpose

Moxa Operating System

Version 3.14

NPort 5600-DT Series

General purpose

Moxa Operating System

Version 2.8

NPort 5600-DTL Series

General purpose

Moxa Operating System

Version 1.6

NPort 5600-DT Series

General purpose

Moxa Operating System

Version 2.8

NPort 5600-DTL Series

Entry level

Moxa Operating System

Version 1.6

NPort 5600 Series

Rackmount

Moxa Operating System

Version 3.10

NPort 5000AI-M12 Series

RailwayMoxa Operating System

Version 1.5

NPort IA5000 Series

Industrial automation

Moxa Operating System

Version 1.7

NPort IA5000A Series

Industrial automation

Moxa Operating System

Version 1.7

The NPort 5000 Series is a device server specifically designed to allow industrial
devices to be directly accessible from the network. Thus, legacy devices can betransformed into Ethernet devices, which then can be monitored and controlled fromany network location or even the Internet. Different configurations and features areavailable for specific applications, such as protocol conversion, Real COM drivers, andTCP operation modes, to name a few. It uses TLS protocols to transmit encrypted serial
data over Ethernet.
Moxa Operating System (MOS) is an embedded proprietary operating system, which isonly executed in Moxa edge devices. Because the MOS operating system is not freely
available, the chances of malware attacks are significantly reduced.

Copyright © 2022 Moxa Inc.

Page 3 of 17

Moxa Tech NoteThe Configuration Management and Hardening
Guide of Moxa’s NPort 5000 Series

2.2. Deployment of the Device
You should deploy the NPort 5000 Series
behind a security firewall network thathas sufficient security features in placeand ensure that networks are safe frominternal and external threats.
Make sure that the physical protection of
the MGate devices and/or the systemmeets the security needs of yourapplication. Depending on theenvironment and the threat situation, theform of protection can vary significantly.

Copyright © 2022 Moxa Inc.

Page 4 of 17

Moxa Tech NoteThe Configuration Management and Hardening
Guide of Moxa’s NPort 5000 Series

3. Configuration and Hardening Information
For security reasons, account and password protection is enabled by default, so you must
provide the correct account and password to unlock the device before entering the web
console of the gateway.
The default account and password are admin and moxa (both in lowercase letters),
respectively. Once you are successfully logged in, a pop-up notification will appear to remind
you to change the password in order to ensure a higher level of security.

Copyright © 2022 Moxa Inc.

Page 5 of 17

Moxa Tech NoteThe Configuration Management and Hardening
Guide of Moxa’s NPort 5000 Series

3.1. TCP/UDP Port Status
Refer to the table below for all the ports, protocols, and services that are used tocommunicate between the NPort 5000 Series and other devices.
Service Name
Moxa CommandOption

Default
Settings

Type

Port Number

Remark & Description

TCP

14900, 4900

For Moxa utility

UDP

4800

communication

Enable/Disable

Enable

DNS_wins

EnableEnableUDP53, 137, 949

SNMP agent

Enable/Disable

Enable

UDP

161

SNMP handling routine

HTTP server

Enable/Disable

DisableTCP

80

Web console

HTTPS server

Enable/Disable

EnableTCP

443

Secured web console

Telnet server

Enable/Disable

DisableTCP23

Telnet console(DSCI)

Processing DNS and WINS(Client) data

DHCP client needs to
DHCP client

Enable/Disable

EnableUDP68

acquire the system IP
address from the server
Synchronize the time
settings with the timeserver

SNTP

Enable/Disable

DisableUDP

Random PortThis function is notavailable for the5100/5100A/5200/5200A Series.

Remote System
Log

Operation Mode

Enable/Disable

OptionDisableDefault
Settings

UDP

Random Port

Send the event log to theremote log serverType Port Number

Remark &Description

950+ (Serial port No. Real COM Mode

Enable/Disable

EnableTCP1)
966+ (Serial port No. 1)

RFC2217 Mode

Enable/Disable

DisableTCP

User-defined (default:Only available in

4000+Serial port No.)

certain models

User-defined (default:
TCP Server Mode

Enable/Disable

DisableTCP

4000+Serial port No.)
User-defined (default:
966+Serial port No.)

Copyright © 2022 Moxa Inc.

Page 6 of 17

Moxa Tech Note

The Configuration Management and Hardening
Guide of Moxa’s NPort 5000 Series
Default

Operation Mode

OptionUDP Mode

Enable/Disable

DisableUDP

Enable/Disable

DisableTCP

Enable/Disable

DisableTCP

Enable/Disable

DisableTCP

Enable/Disable

DisableTCP

Enable/Disable

DisableN/APair ConnectionMaster Mode
Pair Connection
Slave Mode
Ethernet Modem
Mode
Reverse Telnet
Mode
Disabled ModeSettings

Type Port Number

Remark &Description

User-defined (default:4000+Serial port No.)
User-defined (default:

Only available in

4000+Serial port No.)

certain models

User-defined (default:Only available in

4000+Serial port No.)

certain models

User-defined (default:4000+Serial port No.)
User-defined (default:4000+Serial port No.)N/A

For security reasons, you should consider disabling unused services. After initial setup,
use services with stronger security for data communication. Refer to the table below forthe suggested settings.
Service Name
Moxa Command(DSCI)

SuggestedSettings
DisableTypePort Number Security Remark

TCP

14900, 4900

Disable service that is not commonly

UDP

4800

used

DNS_wins

EnableUDP53, 137, 949

SNMPDisableUDP

161

HTTP Server

DisableTCP

80

HTTPS Server

EnableTCP

443

Telnet Server

DisableTCP

23

DHCP Client

DisableUDP

67, 68SNTP Client

DisableUDP

Random Port

EnableUDP

Random Port

Remote System
Log

Copyright © 2022 Moxa Inc.

A necessary service to get IP; cannot bedisabled
Suggest to manage NPort via HTTPS
consoleDisable the service for HTTP from plain
text transmission
Encrypted data channel with trusted
certificate for NPort configuration
Disable service that is not commonly
used
Suggest to assign a system IP in staticmanner
Suggest to use the SNTP server for
secure time synchronization
Suggest to have a system log server tostore all the logs from all the devices inthe network

Page 7 of 17

Moxa Tech Note

The Configuration Management and Hardening
Guide of Moxa’s NPort 5000 Series

For the console services
HTTP

DisableHTTPS

EnableTelnetDisableMoxa Command

DisableTo enable or disable these services, log in to the HTTP/HTTPS console and select BasicSettings  Console Settings.

For the SNMP agent service, log in to the HTTP/HTTPS console and selectAdministration  SNMP Agent,. select Disable for the SNMP, and select Disable foragent service.

Copyright © 2022 Moxa Inc.

Page 8 of 17

Moxa Tech Note

The Configuration Management and Hardening
Guide of Moxa’s NPort 5000 Series

To disable the SNTP service server, log in to the HTTP/HTTPS/SSH/Telnet console and select BasicSettings, and keep the Time server setting empty. This will disable the SNTP service. Then, keep
the Time server empty as Disable for the SNTP Server.

For the remote system log server, it depends on your network architecture. We recommend yournetwork administrator to have a Log Server to receive the log messages from the device. In thiscase, log in to the HTTP/HTTPS/SSH/Telnet console, select Remote Log Server, and input the IP
address of the Log Server in the SYSLOG server field. If your network doesn't have one, keep it
empty (disable Remote System Log Server).

For the operation mode services, it depends on how you bring your serial device tothe Ethernet network. For example, if your host PC uses a legacy software to open aCOM port to communicate with the serial device, then the NPort will enable the RealCOM mode for this application. If you don't want the NPort to provide such a
service, log in to the HTTP/HTTPS/SSH/Telnet console, select Serial PortSettings-> Port # -> Operation Modes, and then select Disable.

For each instruction above, click the Submit button to save your changes, and thenrestart the NPort 5000 Series so the new settings will take effect.

Copyright © 2022 Moxa Inc.

Page 9 of 17

Moxa Tech NoteThe Configuration Management and Hardening
Guide of Moxa’s NPort 5000 Series

3.2. Account Management•

Through the administration account, admin, log in to NPort 5000 Series and performconfiguration settings. To change the default password (moxa), please log in to theHTTP/HTTPS/Telnet console and select Administration  Account Management
 User Account. Click on the ‘admin’ account row, and select ‘Edit’ in the toptoolbar. Input the old password in the Password field and the new password inConfirm Password field (at least 4 characters) to change the password. Ascreenshot of the GUI for the web console is shown below.

•To add new general users, please log in to the HTTP/HTTPS/Telnet console andselect Administration  Account Management  User Account. Click Add in
the top toolbar, then input the Account Name, Password, Confirm Password to add anew user. A snapshot of the GUI for the web console is shown below.

Here, we can also Delete users.
Please note that click Save/Restart is performed after any modification.

Copyright © 2022 Moxa Inc.

Page 10 of 17

Moxa Tech Note

Note:

The Configuration Management and Hardening
Guide of Moxa’s NPort 5000 Series

It is suggested to manage the NPort 5000 Series in another “administration level” accountinstead of using the default “admin” account, as it is commonly used by embedded
systems. Once the new administration level account has been created, it is suggested thatthe original “admin” account be monitored for security reasons to avoid a brute-force
attack.

•Considering all security levels, the login password policy and failure lockout can beconfigured. To configure it, please log in to the HTTP/HTTPS console and selectAdministration  Account Management  Password & Login Policy. Not only
can the Account Password Policy be configured, but the Account Login Failure
Lockout can be further enabled to increase the security level of the accountmanagement.
It is suggested to set the password policy at a higher complexity. For example, set
the Password minimum length at 16, enable all password complexity strength
checks, and enable the Password lifetime checking mechanism. Also, to avoid abrute-force attack, it’s suggested to enable the Account login failure lockout
feature. A screenshot of the GUI for the web console is shown below.

Copyright © 2022 Moxa Inc.

Page 11 of 17

Moxa Tech Note•

The Configuration Management and Hardening
Guide of Moxa’s NPort 5000 Series

For some system security requirements, an approved warning banner needs to be
displayed to all users attempting to access the device. In addition to the warningbanner, please log in to the HTTP/HTTPS console and select Administration Account Management  Notification Message. Users can type in the warning
message in the Login Message field at all access points.

3.3. Accessible IP List•

The NPort 5000 Series has a feature that can add or block remote host IP addresses
to prevent unauthorized access. That is, if a host’s IP address is in the accessible IPtable, then the host will be allowed to access the NPort 5000 series. To configure it,
please log in to the HTTP/HTTPS console and select Accessible IP List.

You may add a specific address or range of addresses by using a combination of an IP
address and a netmask as follows:

Copyright © 2022 Moxa Inc.

Page 12 of 17

Moxa Tech Note

The Configuration Management and Hardening
Guide of Moxa’s NPort 5000 Series

To allow access to a specific IP address: Enter the IP address in the corresponding
field; enter 255.255.255.255 for the netmask.
To allow access to hosts on a specific subnet: For both the IP address andnetmask, use 0 for the last digit (e.g., “192.168.1.0” and “255.255.255.0”).
To allow access to all IP addresses: Make sure that the Enable checkbox for theAccessible IP List is not checked.
Additional configuration examples are shown in the following table:
Desired IP Range

IP Address Field

Netmask Field

Any hostDisable

Enable192.168.1.120

192.168.1.120

255.255.255.255

192.168.1.1 to 192.168.1.254

192.168.1.0

255.255.255.0

192.168.1.1 to 192.168.255.254

192.168.0.0

255.255.0.0

192.168.1.1 to 192.168.1.126

192.168.1.0

255.255.255.128

192.168.1.129 to 192.168.1.254

192.168.1.128

255.255.255.128

Ensure the communication peer is listed in the Accessible IP List for entering the web
Warning

console.

3.4. Logging and Auditing•Please refer to table below for all the events that will be recorded by the NPort 5000
SeriesEvent Group

Summary

SystemSystem cold start, System warm start

Network

DHCP/BOOTP gets IP/renew, NTP connect failed, IP conflict, Network link
down
Login failed, IP changed, Password changed, Firmware upgraded, Certificate

Configuration

imported, Configuration imported or exported, Configuration changed, Clear
event logged

OpMode•Connect, Disconnect

To configure this setting, log in to the HTTP/HTTPS console and select System Log
Settings. Then, enable the Local Log for recording on the NPort 5000 device and/or
Remote Log for keeping the records on a server about the network. It is suggested
to enable the system log settings to record all important system events in order tomonitor any security issue with the device status. A screenshot of the GUI for theweb console is shown below.

Copyright © 2022 Moxa Inc.

Page 13 of 17

Moxa Tech Note•

The Configuration Management and Hardening
Guide of Moxa’s NPort 5000 Series

To review the above events, log in to HTTP/HTTPS console, select Monitor System Log. A screenshot of the GUI for the web console is shown below.

Copyright © 2022 Moxa Inc.

Page 14 of 17

Moxa Tech Note

The Configuration Management and Hardening
Guide of Moxa’s NPort 5000 Series

4. Patching/Upgrades
4.1. Patch Management Plan
With regard to patch management, Moxa in general releases version enhancement withthorough release notes annually. If any security vulnerability issue is identified, Moxa
will release a beta fix within 30 days .

4.2. Firmware Upgrades
The process of firmware and/or software upgrade is instructed as below.
•We will release the latest firmware and software along with its released notes on our
official website. The links listed below are for specified items for the NPort 5000
Series.
NPort Series
5100A

5100

5200A

5200

5400

5600

5600-DT

5600-DTL

IA5000A

IA5000

5000AI-M12

Copyright © 2022 Moxa Inc.

URL
https://www.moxa.com/en/products/industrial-edge-connectivity/serialdevice-servers/general-device-servers/nport-5100a-series#resources
https://www.moxa.com/en/products/industrial-edge-connectivity/serialdevice-servers/general-device-servers/nport-5100-series#resources
https://www.moxa.com/en/products/industrial-edge-connectivity/serialdevice-servers/general-device-servers/nport-5200a-series#resources
https://www.moxa.com/en/products/industrial-edge-connectivity/serialdevice-servers/general-device-servers/nport-5200-series#resources
https://www.moxa.com/en/products/industrial-edge-connectivity/serialdevice-servers/general-device-servers/nport-5400-series#resources
https://www.moxa.com/en/products/industrial-edge-connectivity/serialdevice-servers/general-device-servers/nport-5600-series#resources
https://www.moxa.com/en/products/industrial-edge-connectivity/serialdevice-servers/general-device-servers/nport-5600-dt-series#resources
https://www.moxa.com/en/products/industrial-edge-connectivity/serialdevice-servers/general-device-servers/nport-5600-dtl-series#resources
https://www.moxa.com/en/products/industrial-edge-connectivity/serialdevice-servers/industrial-device-servers/nport-ia5000a-series#resources
https://www.moxa.com/en/products/industrial-edge-connectivity/serialdevice-servers/industrial-device-servers/nport-ia5000-series#resources
https://www.moxa.com/en/products/industrial-edge-connectivity/serialdevice-servers/general-device-servers/nport-5000ai-m12-series#resources

Page 15 of 17

Moxa Tech Note•

The Configuration Management and Hardening
Guide of Moxa’s NPort 5000 Series

Moxa’s website provides the SHA-512 hash value for you to double-check if thefirmware is identical to the one on the website.

•When a user wants to upgrade the firmware of the NPort 5000 Series, please
download the firmware from the website first. Then log in to HTTP/HTTPS console
and select Upgrade Firmware. Click the Choose File button to select the proper
firmware and click Submit to upgrade the firmware.

•If a user wants to upgrade the firmware of the NPort 6000 Series with multiple
units , please download the utility Device Search Utility (DSU) or MXconfig for a GUI
interface, or the Moxa CLI Configuration Tool for a CLI interface to preform the mass
deployment.

Copyright © 2022 Moxa Inc.

Page 16 of 17

Moxa Tech Note

The Configuration Management and Hardening
Guide of Moxa’s NPort 5000 Series

5. Security Information and Vulnerability Feedback
As the adoption of the Industrial IoT (IIoT) continues to grow rapidly, security has become
one of the top priorities. The Moxa Cyber Security Response Team (CSRT) is taking a proactive
approach to protect our products from security vulnerabilities and help our customers better
manage security risks.
Please follow the updated Moxa security information from the link below:
https://www.moxa.com/en/support/product-support/security-advisory

Copyright © 2022 Moxa Inc.

Page 17 of 17