Configuration
4.16 Security
CP 1243-8 IRC
114
Operating Instructions, 02/2018, C79000-G8976-C385-03
3.
In the global security settings, double-click on the entry "VPN groups" > "Assign module
to a VPN group".
4.
Assign the security modules between which VPN tunnels will be established to the VPN
group.
Note
Current date and current time on the CP for VPN connections
Normally, to establish a VPN connection and the associated recognition of the certificates to
be exchanged, the current date and the current time are required on both stations.
The establishment of a VPN connection to an engineering station or an ST7cc/sc PC runs as
follows along with the time of day synchronization of the CP:
On the engineering station or the ST7cc/sc PC, you want the CP to establish a VPN
connection. The VPN connection is established even if the CP does not yet have the current
time. Otherwise the certificates used are evaluated as valid and the secure communication
will work.
Following connection establishment, the CP synchronizes its time of day with the PC
because the ST7cc/sc PC is the time master if telecontrol communication is enabled.
Configure the properties of the VPN group
1.
Double-click on the newly created VPN group.
Result: The properties of the VPN group are displayed in the "Properties" > "General" tab
of the Inspector window under "Authentication".
2.
You configure the pre-shared key or the certificate under the properties of the VPN group.
These properties define the default settings of the VPN group that you can change at any
time.
Note
Specifying the VPN properties of the CPs
You specify the VPN properties of the CPs in the "Security" > "Firewall" > "VPN" parameter
group of the relevant module.
Result
You have created a VPN tunnel. The firewalls of the CPs are activated automatically.
The "Activate firewall" check box is selected automatically when you assign the security
module to a VPN group. You cannot deselect the check box.
Download the configuration to all modules that belong to the VPN group.
