Building Automation Knowledge Base

Issue Procedures and processes to secure I/A Series Niagara 4 Systems Product Line TAC IA Series Environment  I/A Series Niagara 4 Systems Cause Users accessing system without permission Potential damage done by malicious entry to the system Resolution The attached document describes how to implement security best practices in an I/A Series Niagara 4 system.  While it is impossible to make any system completely impenetrable, there are many ways to build up a system that is more resistant to attacks. In particular, this document describes how you can help make an I/A Series Niagara 4 system more secure by carefully configuring and using: Passwords System Passphrase Platform Account Management Station Account Management Role and Permission Management Authentication TLS and Certificate Management Module Installation Additional Settings External Factors Please note that while all of these steps should be taken to protect your I/A Series Niagara 4 system, they do not constitute a magic formula. Many factors affecting security and vulnerabilities in one area can affect security in another; it doesn’t mean much to configure a system expertly if your JACE is left physically unsecured where anyone can access it. Note: Schneider Electric strongly recommends upgrading to the latest I/A Series N4 version maintenance build that implements numerous security updates.  Before updating any system, make sure to review the build-included documentation to understand the behavioral impacts of the security enhancements and JACE hardware platforms supported. Download the Niagara 4 Hardening Guide_2023 for more details.

Issue Using a VPN with I/A Series Niagara Systems Product Line TAC IA Series Environment I/A Series Systems Cause A VPN's purpose is to provide a secure and reliable private connection between computer networks over an existing public network, typically the Internet. Resolution What is a VPN? "Virtual Private Network" or VPN is a mechanism to extend a private network across a public network such as the Internet. A VPN creates a point-to-point connection or "tunnel" across the Internet between two computers. The tunnel encrypts the data between VPN endpoints, preventing data from being deciphered without the required encryption keys. Why use a VPN? VPN provides an additional layer of security to your Niagara system without compromising your ability to access Niagara. A VPN can help protect your Niagara system from Internet-based attacks by requiring an additional layer of authentication to access Niagara resources. It can prevent automated Internet port scan tools from detecting the Niagara system. How can I set up a VPN? The following document describes how to use an Internet Security Gateway to provide VPN access to your ENC/JACE.  Click on the link to download Using a VPN with Niagara Systems for more details. In addition, the document describes setting up a VPN using a ZyWALL gateway.  The ZyWALL USG-20 unified security gateway (from ZyXEL) is a cost-effective device that you can add to an existing installation to provide VPN server capability. IMPORTANT NOTE: The information in this document is based on the assumption that the only IP devices on the network are Niagara devices. If Niagara devices share a network with other devices (such as a corporate LAN), DO NOT follow the approach described in the following pages. Instead, work with the customer’s IT department to determine the best method to protect both the Niagara and corporate systems while providing required access to the Niagara systems. In any scenario, if the VPN is installed or configured improperly, you can expose devices to the public Internet. If you are unsure about how to best configure and test your configuration, please consult an IT expert. Frequently Asked Questions I already use SSL, do I still need to use a VPN? The use of a VPN is still recommended as an additional layer of security. Attacks can come from both inside and outside of your network. Once I set up a VPN, do I still need to use SSL? Yes. The VPN only provides encryption between the VPN endpoints – the VPN client and server. Traffic from the VPN endpoint to and from the Niagara Station is not encrypted unless SSL is used. I’m running AX 3.6 or earlier without SSL support – should I still install a VPN? Yes. The VPN still helps protect against Internet-based attacks on your system. Do I still need a firewall? Yes. You should set up firewall rules to restrict Internet access to the VPN server port only. You should also consider setting up rules with the VPN server to restrict VPN access to only the required IP addresses and ports. For example, there may be non-Niagara devices on the LAN, but the VPN should be configured to only allow access to the Niagara systems. Additionally, you should only allow access to required Niagara services. Will a VPN affect LAN access to ENC/JACEs? No. LAN access to the Niagara devices remains the same as always. VPN only affects the ability to reach Niagara devices from external networks such as the Internet. If I use a VPN, will Niagara HTTP, Fox, and Platform tunneling work? Tunneling works normally over a VPN. You will need to update IP address assignments. What is the impact of VPN on Niagara Networking? Niagara Networking between systems on the LAN still functions the same whether or not there is a VPN installed. When I connect to a VPN, do I lose all other network connectivity? While your VPN client is connected to the remote VPN network, your Workbench (client) PC will have a new "Default Gateway" to allow you to make connections to stations on the VPN network. Typically, this happens without your knowledge and is mostly transparent. The change is undone after disconnecting from the VPN, and re-done when you reconnect. However (while you are connected to the VPN network) if your Workbench (client) PC tries to connect to sites on the [public] Internet or any other network through any router, you will find that you cannot reach those sites. If you must be able to reach those sites while connected to the VPN network, you will need to add static routes (temporary or permanent) to your Workbench PC’s TCP/IP configuration. The setting of those routes is beyond the scope of this document because they are specific to your PC’s network, your VPN network, and any other networks you try to reach. It is possible (but unlikely) that you cannot resolve these routing issues. This may happen if one or more of these networks have overlapping addresses. Consult with a TCP/IP expert if necessary. Likewise, if you use L2TP, PPOE, PPTP, or PPP for any part of your underlying network connection, the VPN client will probably conflict with it. Specifically, Windows only allows one connection of these four protocol types to be active at any given time. What is the impact on Single Sign On? You will need to define the SSO Domain and the hosts of the SSO Domain in your Workbench PC’s "hosts" file or default DNS server. The DNS server of the VPN will not be able to provide name services without changing your Workbench PC’s TCP/IP configuration. I use Dynamic DNS, can I still use a dynamic DNS provider with VPN? Yes. You will need to register the IP address of the VPN gateway and firewall with the DDNS provider. What is the impact of VPN on my system performance? Impact on performance should be minimal. It does take a little longer to set up the connection. References: Microsoft TechNet VPN Overview 

Issue MNB-1000 BACnet MS/TP communications do not auto-baud (synchronize). Product Line TAC IA Series Environment I/A Series MNB-1000 Firmware 1.2 and above Cause I/A Series MNB controllers with firmware 1.2 and above support baud rate synchronization (auto-baud) for BACnet MS/TP communications. This auto-baud feature is available if the device is configured for BACnet MS/TP communications only.  If the MNB-1000 BACnet Ethernet (or BACnet IP) communications are enabled, even though this is not being used in normal operation, it will cause the auto-baud to be disabled. Resolution 1. Disable the BACnet Ethernet (or BACnet IP) communications on the MNB-1000. Use a compatible RS-232 to RS-485 converter or the Roam IA to access the MNB-1000 via BACnet MS/TP communications. 2. Set the baud rate of the MNB-1000 MS/TP port to a fixed speed that matches the configured baud rate of the RS-485 port of the Jace. - Connect to the MNB-1000 using the WorkPlace Commissioning Tool. - Go to the MNB-1000 device properties, MS/TP tab, and set the baud rate of the MNB-1000 MS/TP port. See the example below.

Issue Opened the Individuals Editor, and nothing is listed in there. The Individual list editor is blank Product Line TAC INET Environment All versions of I/Net Seven Cause The Option Selection was used and not reverted back to the original setting that allows all individuals to show in this Editor. Resolution Open the Individuals Editor by selecting Edit>Access>Individuals. If there is more than one Tenant, select a valid Tenant.  Avoid selecting the All Tenant option. Select the Options button at the bottom of the Editor. In the Display field, from the drop-down, select Individual. In the options for all the fields, ensure it has an asterisk (*) and not a name or anything else. Click on the OK button, and now all the individuals for that Tenant will be displayed.

Warning Potential for Data Loss: The steps detailed in the resolution of this article may result in a loss of critical data if not performed properly. Before beginning these steps, make sure all important data is backed up in the event of data loss. If you are unsure or unfamiliar with any complex steps detailed in this article, please contact Product Support Services for assistance. Issue How does one get a clean database for the Enterprise Server or Enterprise Central? Product Line EcoStruxure Building Operation Environment Building Operation Enterprise Server Building Operation Enterprise Central Cause Need for clean database either for testing or start from scratch.  Resolution Stop Enterprise Server or Enterprise Central using Software Administrator Go to the location of your database using Windows Explorer. In EBO V3.2 or higher, software administrator has a shortcut button for the databse folder. For this example it is C:/ProgramData/Schneider Electric EcoStruxure/Building Operation 2.0/Enterprise Server/db Delete the following folders if (some might not exist): Configuration, Historical, Persistent, System, UDT Start Enteprise Server or Enterprise Central using Software Administrator, the system will create a new folders and files as needed. Note: Restoring a different database over the current database does not require the clean database state. Using the backup and restore procedure allows you to switch databases.

Issue Users may want to know how to perform the online activation of an embedded license  Product Line EcoStruxure Building Operation Environment Building Operation Automation Server Premium (AS-P) Building Operation Automation Server Bundled (AS-B) Cause From Building Operation 2022, the Automation Server (Classic/Secure boot AS-B or AS-P) and features like Smart Drivers, SNMP notifications, Personalized dashboards, TimescaleDB, MQTT Publish/Subscribe, Modbus, Serial MS/TP, ES Connection, Server I/O, Field Devices, SAML Authentication, Zoning, and BACnet IP require a license. Customers need to know how to activate their embedded licenses to enable these features. Resolution This video will demonstrate how to Find the list of supported features by each activation ID. Activate an embedded license on an Automation Server Verify the embedded license status via the Device Administrator, Workstation, and the Flexnet operation license portal. Notes Check each activation ID's supported features using the part number or license description through the Features and Licensed Products Table.  The Flexnet operation license portal is a public FlexNet Login (flexnetoperations.com) accessible from anywhere with an Internet connection.  The Automation Server and the PC running the Device Administrator must have outbound connectivity to the license activation server over the Internet. Check the resolution section of this article Could not establish contact with License Server using SmartX Server - Communities to verify if the Automation Server has access to the Flexnet license activation server. For troubleshooting, refer to Embedded license activation fails. Web helps:  Assigning Licenses and Activating Licenses Online. An Embedded DEMO license is available for temporary use during project engineering and installation until you know each device's specific licensing needs. Please visit How to activate a demo license on an Automation Server at EBO 2022. If the Automation Server does not have access to the Flexnet license activation server (no Internet connection), you can perform the steps in the following article Offline activation of embedded licenses.  Please take note that starting from Building Operation 2023 version 5.0.3 and higher, Automation Servers are no longer required to be connected to the Internet. The Device Administrator can access the internet and manage communication and license activation for the 'offline' Automation Servers.   A shorter version of the Online Activation of Embedded Licenses for Automation Servers-Digital Job Book (nampss.com). is available on the NAM PSS site. (Note: Registration for access to this site may be required.)  

Issue Unable to send emails using Google's SMTP Server Product Line EcoStruxure Security Expert Environment Security Expert Server Security Expert Controllers (SP-C-WEB, SP-C) Google SMTP Server Cause SMTP server settings in Controller and/or Google account settings are incorrect. Resolution When configuring the Email SMTP settings under Global | Global settings confirm that the correct SMTP server address and settings are used: SMTP Mail Server: smtp.googlemail.com SMTP Port: 25 Use SSL: Enabled SMTP login: <your Google account> SMTP password: <the app password created in section below> Email SMTP settings Google has removed the "less secure app access" ability and replaced it with "app passwords" where you create a unique 16-digit passcode for each individual app requiring access. See details on how to Sign in with app passwords. To use app passwords Google requires the account to be setup for 2-Step Verification. If you do not see the App passwords item under your Google accounts Security section you can also find this by typing "app passwords" in the "Search Google Account" search bar at the top of the window, select the first item "App passwords". App passwords In App passwords press Select app and choose Other (Custom name). Add a descriptive name for the app and click GENERATE. Copy the resulting 16-digit passcode as this will be the passcode used for the SMTP server credentials. Add App password Ensure Firewall settings are not blocking access to the mail server, especially if the McAfee firewall is being used. If there is a Firewall try temporarily disabling this to test.

Issue ODBC used with EcoStruxure Building Operation Product Line EcoStruxure Building Operation Environment Building Operation Enterprise Server Building Operation Automation Server Building Operation Automation Server Premium Building Operation Automation Server Bundled Building Operation Edge Server - Standard Cause ODBC (Open Database Connectivity), a standard C programming language middleware API. is used to access database management systems (DBMS). Resolution ODBC is not supported with the current or previous releases of EcoStruxure Building Operation.

Issue How can I insert the points name or path into the alarm text? Product Line EcoStruxure Building Operation Environment Building Operation Enterprise Central Building Operation Enterprise Server Building Operation Automation Server Premium Building Operation Automation Server Bundled Building Operation Edge Server Building Operation WorkStation Cause Require dynamic text insertion in the alarm text. Resolution The following substitution codes exist for alarm messages: All SBO/EBO versions:  @(F) – The path of the monitored variable.  @(O) – The monitored object name.  @(P) – The monitored variable. In addition to the above, Version 1.2 also includes: @(V) - Displays the value of the monitored variable at the time of the state change. e.g. If you create an alarm that is monitoring a temperature object named Room1Temp and write an alarm message that says: “The point @(O) is too hot.” When the alarm is triggered it will display: “The point Room1Temp is too hot.” Refer to: Alarm Messages  

Issue Is it possible to set/change the time for a time schedule in TAC Vista from a OPC client? Product Information TAC Vista Environment Vista Server Vista OPC Server Cause  In the OPC standard supported by TAC Vista time schedules are not included Resolution No it is not possible to set/change the time for a time schedule in TAC Vista from a OPC client?

Issue Extended LonTalk is supported In Vista 5.1.5 but it doesn't work, it is possible to read but not write to the device. Error message when writing: "Local network management failure" Product Line TAC Vista Environment Vista Server Cause When adding a Extended LonTalk device in to TAC Vista, TAC Vista will see in the xif file that this is a Extended LonTalk device and set a Extended LonTalk device flag for that device. It is possible to see the flag if hold down shift+Ctrl and click in properties for the lon device, it is called "EXTENDEDLONTALK".  If the xif file is imported to a TAC Vista with a version earlier than Vista 5.1.5 the Extended LonTalk will not work. Resolution Make sure the "EXTENDEDLONTALK" flag for the lon device is set, if not import the xif file again in Vista 5.1.5.  

Issue Nothing happens when starting the OGC editor Product Line TAC Vista Environment Vista Server Vista Workstation Cause The issue is with data execution prevention (DEP) not allowing the tacdraw application to run.  Resolution If DEP is not required on your system follow these steps: Go to Control Panel > System > Advanced > Performance Settings > Data Execution Prevention Choose "Turn on DEP for essential Windows programs and services only" Reboot the computer and the editor should launch like normal.  If DEP is required on your system follow these steps: Go to Control Panel > System > Advanced > Performance Settings > Data Execution Prevention Choose "Turn on DEP for all programs and services except those I select" Then click the add button and navigate to: For Vista 5.1.4 and up: C:\Program Files\Schneider Electric\TAC Vista 5.1.4 and choose the tacdraw.exe file. For Vista 5.1.3 and prior: C:\Program Files\TAC\TAC Vista 5.1.X and choose the tacdraw.exe file. Reboot the computer and the editor should launch like normal.  

Issue Error "Not enough space in RTI device"   Product Line TAC Vista Environment Aladdin Privilege Administrator 2.01 Vista IV Licensing Cause Memory in PSU is corrupt. Resolution Run Dongleutil, a dongle reset utility software. This utility resets the memory in the PSU that is connected to the PC. You need to install the license file again after this operation. This problem is usually seen when Inhouse PSU is used. In TAC Vista version 4.10 and later, it’s no longer necessary to install the engineering file when Inhouse PSU is in use. Just connect the PSU to the PC, and everything should work fine.

Issue TGML numeric presentations rounded to integers with no decimals displayed. Product Line TAC Vista Environment Vista Workstation Vista Server   Cause Depending on the component being used to display the numeric data, it may be as simple as a property not set to display decimals. It may also be due to presentation values. Resolution If using the default Numeric Presentation from the provided Snippets library, change the property in TAC Graphics Editor for 'Decimals' to the number of decimals to be presented i.e. 4 decimals = .0001, 2 decimals = .01, etc. If not using this Snippet, check to see if getPresentationValue() is being used in a script, or if the binding itself has the Format attribute set to Presentation instead of None. Presentation value will inherit all formatting from the Vista database and not from the TGML source file.

Issue There was a problem with the SQL server and the logs and events were queued in the $Queues folder.  The SQL problem is resolved but the $Queues folder has grown so much that it can't be opened to check. Is there a way of checking if Vista has restarted logging to SQL? Product Line TAC Vista Environment TAC Vista Server Microsoft SQL Server Cause When a problem occurs with the SQL server, the log values and events are saved in the $Queues folder in the TAC Vista database, so that no information is lost. As long as there is no connection to SQL, the logs and events will be queued in $Queues. Once a connection to SQL is re-established, Vista will start logging all the values in the $Queues folder, gradually emptying the folders, although this may take some time if the SQL server has been down for a while. Resolution Query the SQL database and check for logs with today's date. Download & install Microsoft SQL management studio (2005 or 2008 depending on which version of SQL is being used) Query the trend log table for logs using the following query: Start SQL management studio and log in to the TACVISTA sql instance. Click on New Query and type in the following query: use taclogdata go select * from TrendLogValue where LogTime > '2011-11-03 00:00:00.000' Note: if you have a custom configured SQL database change taclogdata to your database name. -Change the date to today's date and execute the query. If the query doesn't return any matches, change the date to an earlier date and repeat.   -Keep going until the date when contact with SQL was lost. If no matches are returned, check that the service TAC DSS writer is running. If it is then it maybe that the Vista is till trying to clear the backlog. Try again later.

Issue Summary view for Forced Value on I/O Product Line EcoStruxure Building Operation Environment Building Operation Enterprise Server Building Operation Enterprise Central Building Operation Automation Server Building Operation Automation Server Premium Building Operation Automation Server Bundled Cause Automation Server or any of connected devices can potentially have many points or values. Need to discover which ones are in Forced state. Examples: A Digital Output with default value: Digital Output with Forced value and ON: Digital Output with Forced value and OFF: Resolution You can search for forced values using the search function in WorkStation. Enabling In device option will enable finding forced values on devices hosted under EBO, as SpaceLogic and EasyLogic devices, MP and RP controllers, IP-IO modules and RP-IO modules. For more information, see Searching for Forced Values . You can also view the search in WebStation:   In EBO 2023 or later, You can search for forced values in WebStation using Diagnostics. For more information, see Displaying a List of Forced Values in WebStation .  

Issue When an attempt is made to activate a License, the following error is displayed, and the license is not activated.   Product Line EcoStruxure Building Operation Environment Building Operation License Administrator Cause In this case the Entitlement was inactivated due to a double registration made by mistake by the Orders Dept.  Resolution Used the second active Entitlement ID to activate the license.   For more information, refer to WebHelp articles 6367 and 7440.

Issue How many Modbus TCP Clients can be connected to Vista via an Xenta 913? Product Information TAC Vista Environment Vista 5.1.X Xenta 913 5.1.X or later Xenta 511 5.1.5 or later Xenta 701 5.1.5 or later Xenta 711 5.1.5 or later Xenta 721 5.1.5 or later Xenta 731 5.1.5 or later Cause When planning a system it's important to know how many devices are required. Resolution A maximum of 40 Modbus TCP clients are supported when communicating via a Xenta 913, Xenta 511 or Xenta 700. Each TCP Client may have up to 100 Modbus devices (see page 4 in the datasheet).  

Issue What new features are planned for inclusion in future product releases? Product Line Andover Continuum, EcoStruxure Building Operation, Field Devices, Satchwell BAS & Sigma, Satchwell MicroNet, TAC IA Series, TAC INET, TAC Vista, EcoStruxure Access Expert, EcoStruxure Security Expert Environment All product ranges Cause Information required on future Product Marketing plans. Resolution This document is no longer published on the Download Center by Product Management. For further information on the future product planning please contact the Product Manager for the specific product in your region. Americas: Americas.EcoStruxureBuilding@schneider-electric.com EMEA: EMEA.EcoStruxureBuilding@schneider-electric.com Asia Pacific & India: AsiaPac.EcoStruxureBuilding@schneider-electric.com

Issue What is the maximum binding count per graphic when polling OPC tags? Product Line TAC Vista   Environment Vista Server Vista OPC Server Cause There is no limit to the number of OPC tags, but performance may be affected when a large number of binding are used. Resolution The load on the Vista server should be considered. E.g. datatypes and the update period: Does an outside air temperature tag need to be updated every 10 seconds or is 10 minutes maybe more appropriate? Can binary signals be combined into a single register?