GE Multilin D400 Instruction Manual page 144

144
Network interfaces can operate in one of two modes:
• Internal
The Internal mode permits traffic from known protocols and should only be enabled
on interfaces connected to known devices only. The Internal mode is the default mode
for Net1 and would typically be used when the interface is connected to the
substation LAN.
• External
The External mode offers a stricter set of rules and is the default mode for all
interfaces except Net 1. The External mode would typically be used when the interface
is connected to a WAN.
By default, the firewall allows outbound traffic on internal interfaces and blocks all
outbound traffic except outbound SSH on external interfaces. If you want the firewall to
allow outbound traffic for a particular protocol on an external interface you must create a
"custom" rule. See section: "Add/Edit/Remove Custom Rules" on page 145.
By default, the firewall blocks inbound traffic on both internal and external interfaces. The
D400 automatically generates rules allowing inbound traffic on internal interfaces for all
configured services. If you want the firewall to allow inbound traffic on an external
interface, you may modify the associated "generated" rule to allow the traffic on ALL
interfaces rather than only the "Internal" interface. See section: "Add/Edit/Remove Custom
Rules" on page 145.
Table 34: Service traffic through the firewall
Service Name
Modbus/TCP Server (Inbound)
DNP/UDP Server (Inbound)
DNP/TCP Server (Inbound)
DNP/TCP Client (Inbound)
DNP/UDP Client (Inbound)
IEC 60870-5-104 Server (Inbound)
Terminal Server (Inbound)
DCA Pass-Through (Inbound)
Secure Connection Relay (Inbound)
Secure DCA Pass-Through (Inbound) SSL/TLS Enabled
Secure Terminal Server (Inbound)
SNMP Client (Inbound)
LogicLinx Executor (Inbound)
HTTP (Inbound)
HTTPS (Inbound)
DHCP Client (Inbound)
Telnet Server (Inbound)
FTP Client/Server (Active & Passive,
Inbound)
SSH/SFTP/SCP Server (Inbound)
TFTP Client (Inbound)
NTP Client (Inbound)
NTP Server (Inbound)
SSH/SFTP/SCP (Outbound)
All other services (Outbound)
GE INFORMATION
CHAPTER 12: USING THE D400 LOCAL CONFIGURATION UTILITY
Notes
Dual Endpoint Enabled
SSL/TLS Disabled
SSL/TLS Disabled
SSL/TLS Enabled
When enabled in d400cfg
When enabled in d400cfg,
see note below
When enabled in d400cfg
When enabled in d400cfg
When enabled in d400cfg
When enabled in d400cfg,
see note below
When enabled in d400cfg
When enabled in d400cfg
When enabled in d400cfg
When enabled in d400cfg
Don't Care
D400 SUBSTATION GATEWAY INSTRUCTION MANUAL
External Mode Internal Mode
Deny Allow
Deny Allow
Deny Allow
Deny Allow
Deny Allow
Deny Allow
Deny Allow
Deny Allow
Allow Allow
Allow Allow
Allow Allow
Deny Allow
Deny Allow
Deny Allow
Deny Allow
Deny Allow
Deny Allow
Deny Allow
Deny Allow
Deny Allow
Deny Allow
Deny Allow
Allow Allow
Deny Allow