Hi,
as I was asked a few times about TLS secured Automation Studio Online connection with Automation Studio 4, I decided to create a short walkthrough here.
All of the information below is also available in the Automation Help, but I thought it makes sense to bring together the infos dedicated to ANSL TLS in one place, and shrink them to the minimum needed.
This guide is not intended to explain in detail all steps and functionality behind, and also not about reaching a maximum of security!
It’s just about:
- how to setup ANSL online connection secured with TLS
- how to come online again after this changes
Prepare a SSL configuration
In Configuration View, under “AccessAndSecurity → TransportLayerSecurity”, create a configuration of type “Common SSL configuration” that you want to use with ANSL TLS (you should already have the certificate and key you need to create a SSL configuration. If not, you can create self-signed certificates also with Automation Studio).
Setup ANSL for using TLS
In “Physical View → ‘CPU’ → Properties”, choose “secure (over SSL/TLS)” under “Online parameters → Protocol”, and select at “SSL configuration” the SSL configuration you’ve prepared.
Please mention, that ANSL TLS uses a different TCP port (see “SSL port number”, default 11179).
As you want to secure the online connection, you should also deactivate INA online access. So in “ETH” interface configuration of the PLC, set “INA Parameters → Activate online communication” to “off” (this has to be done / checked for all ETH interfaces of the PLC).
Additionally, check if “ANSL parameters → Activate online communication” is set to “on” at those ETH interfaces you want to use for online communication.
Transfer configuration changes to PLC
Now transfer the porject to the PLC.
Please mention that you will loose the online communication after transfer because of a reboot of the PLC, and the communication will not re-establish automatically after the PLC restart, because we’ve changed the PLC online settings!
So after the transfer has finished and the message “target is being rebooted…” appears, you can use the “Cancel” button.
Setup the new online connection
Go to “Online → settings” and please first make sure, that you see the columns “Extra CPU settings” and “SSL/TLS Config file” in the “Ethernet” tab of the online settings.
To make this columns visible, you can right-click on the column header, and choose “Columns >”.
Now, use “Add TCP connection” to get a new connection entry that we can adapt, or change a existing connection entry.
In column “SSL/TLS Config file”, use the “…” Button to open a file dialog, where you have to select your SSL configuration that you’ve configured for use with ANSL.
You find this file of type “*.sslcfg” in the your project path under “Physical → Name of Configuration → Name of PLC → TransportLayerSecurity”
In the column “Extra CPU settings”, change the number that is set in the “/PT=” parameter to “11179” (which is the default port number used with ANSL TSL as you’ve seen above; of course you have to use the number that you’ve configured).
DONE!
Save the changes, activate your changed online setting, and voila: you should be online again, and now secured by TLS.
Only the ones who have access to the SSL configuration from this project (including the certificate and key) can now still connect via Automation Studio (or other online tools like PVI, Runtime Utility Center).
That’s all, best regards!
Alex
Im sure B&R Community user will like this nice summary