PLC Lockdown - ANSL Login

Ask Questions B&R Software & Runtime
, ,
1

Hi Community!

With cyber security being such a hot topic at the moment, I was wondering if anyone has a method for locking down a PLC so it can be connected/ downloaded to, even with an older project version for example. This topic has come about based on the risk of past employees having access to machines.

Versions:

AS4.12

AS6

I’ve seen the ANSL login extension, has anyone had good/ bad experiences with this.

We use ANSL communication between different machines within a production line, I was wondering how this would effect that communications if we lock it down.

Using AsANSLClientStart

Thanks

Shaun

2

Hi @whyleys,

I personally know some customers using it and additionally have tested it by myself some time ago - I’m not aware of issues with these functions, so I interpret it as “good experience” :wink: But: I’ve no experience using it with AsANSL for inter-controller communication, just used it for Automation Studio online so far.

Sure, some things are important to know:

  • how is the User Role system working (ANSL “authentication only” uses a role)
  • how is TLS working in Automation Runtime (ANSL encryption + authentication uses TLS)
  • right now, it’s just about encryption + authentication, so there’s no functionality yet now available for “read only” versus “read write” (I think there’s something in preparation also, but to be honest I’m not exactly know / sure about).

So you can use TLS for encryption + certificate authentication, or role based authentication by username + password, or both in combination.

About TLS, I wrote a post some time ago describing how it works in detail (for Automation Studio online), and what needs to be considered:

For role-based access, it’s more ore less just “a few configuration clicks”:

About AsANSL: as mentioned, I don’t have any practical experiences.
But from the online help, it looks like that both possibilities are supported by AsANSL also via associated parameters inside the configuration object on the ANSL client side. The’re some differences between AS4 and AS6, as AS6 has some additional possibilities regarding the certificate handling.

Best regards!