GeoSCADA Mobile vs Virtual ViewX

[Howard1]

Quick question on the relationship between GeoSCADA mobile and Virtual ViewX...

• Has anyone tried connecting to VVX host from HTML5 browser on iOS/Android mobile device, how well does it work?  How usable is it?
• From Schneider point of view - is the intention that using browser on mobile device will replace the GeoSCADA mobile app?

[Higginbotham]

I have tested using the Virtual ViewX from an iPhone and found it to be super frustrating to the point of being unusable. When viewing a regular webpage from the iPhone you are able to zoom in the screen and move it around with ease, but the Virtual ViewX does not function like a webpage at all. If you zoom in with two fingers the text on the screen becomes blurry and unreadable. You can use a one finger zoom that actually zooms in the ViewX but you cant move the screen side to side. 

From a computer Virtual ViewX looks and feels just like being in ViewX. This could be useful if you have two people needing access to the server at the same time. 

[BevanWeiss]

If you have access to a Windows RDS installation in that same environment, it would be worth trying to use the Microsoft RDP application with the RemoteApp capability to 'present' ViewX onto the iPhone.

I've been using this with an iPad for a while now, and it works really quite well.  I'm not sure that I'd want to be designing mimics on such a device, or even doing much object configuration.  But for an operator interface, I think it's suitable.

[sbeadle]

Hi Howard.

Virtual ViewX is much more suited to larger screens. We are still developing the App, and it has recently been given more capability such as Method execution and Search. There's also simpler deployment for Administrators - users don't have to read out a long Device ID to register a device.

We are adding some UI shortcuts for Virtual ViewX, watch out for them in release notes for Geo SCADA 2019 and 2020.

Steve

[Rich-C]

Hello Stephen,

I am a Rep out of Michigan.  I have been working on a solution to get the mobile app working externally, as I found out the mobile app does not come with built in tools to access Geo Scada externally. 

Do we have any solution/suggestions to make mobile app reachable to Geo Scada from outside the network? 

Thanks, 

[BevanWeiss]

Hi @Rich-C ,

When you say 'working externally', what do you mean exactly?

I assume that you are referring to a security model where the end user has their SCADA environment somewhat isolated from the outside world through firewalls or other network segregation.

There are a number of different ways of achieving a connected network however.  I'd list them from my most preferred to least preferred.

1. Use an IPsec or similar VPN tunnel to get the end device into the secure environment.  I've recently been using Wireguard in my personal environments, and it's amazingly easy to configure in small volume.  I haven't looked into Enterprise-wide capabilities for it, but it seems like a great option for VPN connections.
2. Provision field devices with SIM cards having APNs which terminate within the secure environment.  This was quite popular in Australia a few years ago.  The issue is around getting secure access back out of that APN to normal services people like to use on their mobile devices (i.e. unsecure internet, corporate email etc).
3. Punch holes in the firewalls so that network traffic from 'the internet' can access the secure services required.  I consider this pretty risky without additional mitigating controls, like proxy servers, DMZs etc.

Network security is a common concern, and there are lots of best practises out there for how to provide services between secured and unsecured networks.  Ultimately it's really something that needs to feed into the business risk management systems, and would eventually pop out as a cyber security risk with associated controls in place to minimise the risk as far as the business is interested in minimising.

I wouldn't recommend implementing a special access system just for the GeoSCADA Mobile service, since then it will have maintenance and support challenges.  Best to provision it in accordance with existing cyber security measures, or implement organisation-wide measures which support this service in addition to others.

[Rich-C]

Hi Bevan,

Thank you for all the info. I was thinking using the mobile app and login in that way.

Lets say I'm on the road and want to check Geo Scada I would pull up the app on my phone and login.

Now, I have it set up in an office environment where I login to the app and see my values and all is working fine but only because I am logged in the same network. 

My understanding is that the mobile app only work while I'm still in the same network as Geo Scada Mobile server. 

I guess my questions would be:

Does the Geo Scada mobile app have the capabilities to be set up for a user to log in from anywhere outside the office? 

[BevanWeiss]

The Geo SCADA Mobile App uses IP / TCP communication.

If you have an IP / TCP connection from whatever location you are in back to the Geo SCADA Expert Mobile server then it will work.

This is not a limitation of the Geo SCADA Mobile App.  It is a limitation of your network configuration.

[sbeadle]

Hi Howard,

the Mobile solution (and the VVX solution) are encouraged to be separate web server host machines. It is good practice to place these servers in a separate network segment, often termed a DMZ, where firewalls each side control traffic. The mobile device traffic and the Geo SCADA traffic the other side would often be configured through different network ports, further improving the separation (although this is not mandatory).

Another point about the Mobile solution is that the TCP/IP connections between Geo SCADA servers and the Mobile server are outbound from Geo SCADA, and separated by another server task, which reduces the attack surface if someone hacks the Mobile server. This architecture makes it possible to put the Mobile server's traffic on the public web, although best security practice would add a VPN as an additional layer of protection.

Kind regards

Steve

[Rich-C]

Hello Bevan,

So after all configurations and settings. Ports open and forwarded. I get the following error: The remote server responded but Geo SCADA Mobile Server functionality was missing. Contact your administrator.

Do you have any suggestions??

Also, what port does Geo SCADA mobile server use for external access??

Thank you. 

[BevanWeiss]

When people say 'Ports open and forwarded.' without actually detailing which ports (and protocols) they have opened, then I have suspicions that they got the wrong ports.

So how did you determine which ports to forward, and how did you test that they were indeed forwarded?

If you are forwarding the ports, then you will likely run into issues with IP addresses / hostnames not matching the certificate values.  If you have the companion configured to require secure connections this would likely be a problem.

On the Mobile server you could look in the logs which are at:

c:\ProgramData\Schneider Electric\ClearSCADA\Logs (unless you've configured them somewhere else)

You've confirmed that the Mobile Server works locally right?

It really would be a better idea to use a VPN for this.  It makes the various ports / certificate problems just go away.

[sbeadle]

This article may help:

https://community.se.com/t5/Geo-SCADA-Knowledge-Base/Common-Issues-in-ClearSCADA-Mobile/ba-p/278232