Cybersecurity Suite
RTU Firewall

VCL Products > Cybersecurity Suite > RTU Firewall IEC -104, MODBUS
UNMS Supported
RTU Firewall - Front
RTU Firewall - Back
RTU Firewall - Front
RTU Firewall - Back


3D View Mechanical Drawing (PDF)

VCL-2243: RTU Firewall IEC -104, MODBUS TCP/IP

Get Data Sheet

VCL-2243 is a high-security, high-reliability, ruggedized, failsafe, transparent RTU firewall that is designed to be installed between the RTU and the SCADA server without having to reconfigure any element of the network. The VCL-2243 firewall supports IEC 60870-5-104 (IEC 104) and MODBUS TCP/IP protocol options with extremely advanced features that may be installed to secure and protect RTUs (Remote Terminal Units) in critical infrastructure such as substations, smart grid distribution systems, oil and gas infrastructure, and railway signaling networks from being compromised, attacked, or accessed by hostile elements.

Protocol Supported:

IEC 60870-5-104:
10/100BaseT ETH Port MODBUS TCP/IP:
10/100BaseT ETH Port

Versions and Technology Deployment:

  • High-Security, High-Reliability, Ruggedized RTU Firewall.
  • Failsafe—Never itself becomes a point of failure, even in a power-down condition.
  • Transparent Firewall—No modification required in the existing network.
  • Does not add any measurable latency. The latency added under full load conditions is less than 1ms.
  • Installed in substations to protect RTUs from network-side intrusion and hostile access.
  • MAC-based lock. Allows users to lock to specified MAC addresses of known network devices in the utility network, such as SCADA servers, network management devices, computers, etc. The RTU shall only accept or transmit data to known network devices in the MAC whitelist.
  • IP address-based lock. Allows lock to user-specified IP address. The RTU shall only accept or transmit data to known network devices in the IP address whitelist.
  • Port-based lock. Allows transmission only on user-selected ports. Blocks communication and access on all other ports.
  • Deep Packet Inspection. Allows only SCADA (-104/MODBUS TCP/IP) packets to pass through. Blocks all other packets.
  • Comprehensive logging of all -104/MODBUS TCP/IP packets. Fingerprints and logs all unauthorized traffic and access attempts.
  • Timekeeping: Fetches time from NTP Server to maintain millisecond accuracy.

Applications:

  • Utilities: Electric generation, transmission, and distribution.
  • May be installed to firewall RTU terminals and server(s) located in Load Dispatch Centres/SCADA management centres and rail traffic control.
  • Smart Grid Distribution Systems.
  • Oil & gas production, pipelines.
  • Railway Signalling Infrastructure: Rail Traffic Control Room(s).
  • All distributed data networks consisting of a central server and multiple edge locations.

Firewall—Features and Capabilities:

  • Protocols supported:
    • IEC 60870-5-104 (IEC 104)
    • MODBUS TCP/IP
  • Lock to user-specified MAC addresses.
  • Lock to user-specified IP address.
  • Allows transmission of only 104 MODBUS TCP/IP packets.
  • Port-based lock. Allows transmission only on user-selected ports. Blocks access on all other ports.
  • Deep Packet Inspection. Allows only SCADA (-104 / MODBUS TCP/IP) packets to pass through. Blocks all other packets.
  • Per-frame/packet authentication
  • Firewall
    • Port (Soft) based
    • MAC-based
    • IP address-based
    • IP domain-based
  • Whitelist and blacklist options
    • Whitelist exception allowed and blocks all other traffic by default (system default mode)
    • Blacklist exception blocked and allows all other traffic.
  • Seamless scalability
  • Infrastructure neutral: maybe used with SDH, IP/MPLS, or MPLS-TP networks
  • Transparent to network and applications
  • Easy installation and management

Monitoring and Access Control:

  • Password Strength Monitor
  • Device Management and Alarm Monitoring
  • Command Line Interface—Telnet, SSH
  • SNMPv2 Alarm Monitoring
  • Alarm condition detection and reporting (traps and SNMP alarm table)
  • Syslog

Firewall and Security:

  • Secure Boot
  • Firewall Security:
    • Inclusion Policy—Access Control based upon White-List IP addresses, MAC addresses, and IP domain
    • Exclusion Policy—Access Control Based on Blacklist
  • Resistance to Denial of Service (DoS) Attack
  • Encrypted Firmware Updates
  • Non-volatile access log with the capability to "fingerprint" all successful log-in attempts and keep a log of the IP and MAC addresses of all successful logins.
  • SNMP trap generation, along with LED and external alarm indication
  • Password protection with password strength monitor
  • RADIUS Password Authentication
  • SSH (Secure Access Control) with encrypted password protection

Interfaces—Terminal:

  • Total Number of Ethernet Interfaces: 2
    • One 10/100 RJ45 equipment interface for the local (trusted) RTU side
    • One 10/100 RJ45 network interface to the WAN (untrusted) network side
  • Auto MDI/X (straight or crossover Ethernet cable correction)
  • Management interfaces:
    • Ethernet, RS-232, RS-485, USB

CE Compliances:

  • Immunity as per EN 60255-26
  • Low-voltage directive as per EN 60255-27

Other Regulatory Compliances:

  • RoHS
  • Meets CE requirements
  • Complies with FCC Part 68 and EMC FCC Part 15

Application Diagram:


RTU Modbus Firewall
Mechanical Drawing (PDF)

UNMS (Unified Network Management System)

  • Secure (supports TLS/SSL for encrypting connections between devices)
  • Permission-based security
  • Uses Software Defined Perimeter (SDP); the username/password login is replaced with Single-Packet Authorization (SPA) and the receiving device cannot be seen by hackers. This introduces an additional layer of security and is beneficial with or without SSL/TLS.
  • Guaranteed message delivery (no data loss or duplication of data)
Read more