Commissioning the Com'X 200

sesa72458 · ‎2014-09-09

Hi,

I've recently sold a couple of Com'X200 to a customer that traditionally used the EGX100 to pull out metering information to go into their on-site SCADA system.

I found the Com'X200 almost impossible to commission on-site because I can't ping the device. Their SCADA/Network engineer would not accept the device because of this, even though the SCADA was communicating correctly through the gateway.

His reason was that without ping he is unable to quickly check whether or not the device is alive or not, he's just a bit old-school I guess.

I tried to explain the extra security features, etc, however he wasn't interested in these as their SCADA system is physically separated from external networks. He suggested that we should include an option or options to disable the security features for those that have no need for these.

Has anyone else had any issues commissioning the Com'X200? What have you done to get around some of the difficulties in working with the additional security features?

Any suggestions for product modifications?

Regards,

Steven Yan

LaurentCoene · ‎2014-09-15

Hi Steven,

It's true that the device is a lot more secure and for good reasons since now it can be connected on a GPRS network (so in other words directly on the internet).

Personally, I've stopped pinging the device as I used to do, and instead, I do all the commissioning using the wifi dongle. It's so much faster as you don't have to worry about IPs, etc.... So I guess that rather than trying to commission the Com'X200 like you used to commission an EGX100, you could train the customer/SI to use the new commissioning way! Plus you can do it from an iPad which is way cooler! 🙂

We did get similar remarks, but all cleared out once you show them and explain.

As you will see more connected devices and the internet of things is getting more widespread, these security settings are more and more important. You can read about so many hacking stories, we are really doing that to secure the customer.

Having said that, we could have the option to turn ping on and remind the customer that it should be kept off for security purpose.

sesa72458 · ‎2014-09-15

Hi Laurent,

I appreciate the response and I agree that if a device is connected to the external internet the security settings are necessary.

The problem wasn't that the unit wasn't commissioned properly, it was that our scope of works ended at the gateway and when the SCADA engineer took over, he was on the other end of a large site and he simply wanted to be able to ping the new device to ensure that it was alive.

I demonstrated using ION Setup that the unit was working correctly as a gateway, but he just wouldn't accept it.

I think having the option to turn it ON or OFF or possibly turning it ON for 15 minutes (or whatever time) and it auto turns OFF would be very helpful for these situations.

Regards,

Steven Yan

sesa77557 · ‎2014-09-16

I think having the option to turn it ON or OFF or possibly turning it ON for 15 minutes (or whatever time) and it auto turns OFF would be very helpful for these situations.

I fully agree with Steven!

We have received this kind of complaint also from some italian Customers.

When do you think it will be available this option?

Thanks,

Roberto

LaurentCoene · ‎2014-09-17

All good comments. : any plan on the future roadmap?

sesa168100 · ‎2014-09-21

Guys,

After reading all the comments in this thread, I am trying to add few thoughts from my side.

I feel Security can never be an optional feature in our products. It's our conscious decision to provide it & our customers must understand it.

If we provide opening in the door by disabling Security features then It can be exploited as well as a vulnerability against us!

Regarding the issue of how to check If the device is alive or not, we use the DPWS feature provided by the Com'X 200. This is useful feature that let's you see the device in your Network page in Windows 7.

As more & more Schneider IP devices have started to incorporate this, I think this should be our preferred way to find the device on the network.

Please find the attached screenshot of our network.

We have moved on from Ping & I think our customer also should..

Feel free to correct me, If this can not work at any customer site!

Thanks,

Darshan.

sesa72458 · ‎2014-09-22

Hi Darshan,

I find it strange that the Com'X200 has disabled ping but the Industry BU's M580 which is Achilles L2 certified while the Com'X200 is only L1 certified; allows Ping to the device.

If it is a security issue, then I'm sure it would be disabled for the M580 also.

I also don't understand how it is a vulnerability against us when the device is installed on a customer's site on their intranet which is segregated from the internet, if whomever is hacking them can get through their firewall, our little gateway will be the least of their worries. This is valid if the Com'X200 is connected directly to the internet via it's 3G modem, however for every 1 enquiry about the 3G functionality I get, I'll get 10 where it's not.

Regards,

Steven Yan

Adrian_Dicea · ‎2014-09-22

if he's old-school send my best wishes and this suggestion: nmap or telnet

sesa168100 · ‎2014-09-22

Hi Steven,

Thanks to point out the M580 case. It's indeed a great example with options like Unlock Security & Enforce Security where it enables / disables the FTP, HTTP & Achilles L2 Protection. Similar analogy can be useful in Com'X 200 when It's used as either a Gateway or Energy Server. I agree It could be handy to have Ping enabled when Com'X 200 is used as a Gateway but when It's working as Energy Server & talking to our cloud applications then we can dictate our terms of disabling Ping requests.

With M580 customers, one can assume that they may have firewalls & secured network infrastructure but for Com'X 200, which is targeted for Low & Medium size buildings; It may not be the case always. I am not an expert in Cybersecurity topics but what I know is It's best to fix things at Application level (Which is in our scope) than to rely on Network level security(Which is in customer's scope). Responsibility will always come back to us If our product gets hacked, may it be on secured or unsecured network!

Hacking techniques have also evolved over the time & ICMP is no more used just for Denial Of Service / Flooding / Ping Of Death attacks.Hackers can do lot many things with ICMP. You can explore further on topics like ICMP Tunneling, ICMP Backdoor trojans, Project Loki etc.

Hence It's best to keep the ICMP door locked, which we seldom need for a normal operation!

Best Regards,

Darshan.

arjanbijker · ‎2014-09-23

I agree with Steven that ICMP should be enabled/disabled according to the customer needs. I have stopped selling comx200 due to enormous frustations from the start.

Security was only one of them. The device is slow as well an can take up to 15minutes to reboot. Not good for commission engineers.

I dont understand all this FUSS about security. I am an Cisco Certified engineer and normally IT security is done at Firewall / switch level, not device level. Almost every cisco engineer today still uses ICMP to test connectivity.

We must remember the COMX is only a gateway / logger, nobody could have a reason to "hack" it. There is nothing to hack 🙂

Honestly, this FUSS about security drives me mad......

Regards

Anonymous user · ‎2014-09-29

Hi ,

I thought I would share my experience with COM'x200 and some of the feedback to improve on.

I have been recently trying to commission a COM'x200 and we had a hard time to get it working.

1. GPRS signal strength - It would be great to have a higher gain antenna with a longer cable length then 5 meter, as in some instances the device would be installed in switchboard rooms/car parks and locations where signal strength is very low and you would need to extend the antenna to areas with better signal

2.GPRS Modem - The modem is very hard to work with, its difficult to firstly open the modem to insert the SIM card (especially someone with thick/fat fingers! is going to be huge task). Two of the modem were spoilt in this process. One of the modems the antenna came off from the pcb board and the other one just stopped working (I am thinking possibly due to static charges by touching the circuity while opening it up ). It would be really helpful to have a slot to insert the SIM card rather then having to open it up.

3.GPRS modem detection - If you unhook the modem and hook it back, COMX'200 does not detect the modem. The device requires another reboot another 10 minutes gone.

4.Antenna - It is really difficult to remove or change the antenna once you have your modem slotted.The little wrench helps but just not enough space to work with, I would rather not have that curved plastic thingy near the antenna which gives more space to remove or change the antenna if required.

5. COM'x 200 is very slow to reboot, a lot of time is wasted if you need to change the settings or to restart the COM'x 200 for whatever reason.

Regards

Anonymous user · ‎2014-10-02

Hello every body

I totally understand your issues.

About the ping

I can just explain that the Com'X 200 was originaly designed as an internet gateway (collect data on a LAN and push it to an internet server)

Due to the fact that =S= application on the net are not yet available, many people use it as an "intranet" gateway, where the cybersecurity issue

are not so relevant.

==> We will add an option to reply to ICMP protocol

About the GPRS modem

The main target of this GPRS modem was for "RSP", where we provide a SIM card already in place. We will not rework this GPRS modem, but

==> We will add to the catalog a 3G / USB modem (with external access for SIM card) that would avoid all the problems about the Sim Card, and the antenna plug

About boot time

Sorry, the Com'X 200 architecture is based on OSGi. This help us a lot in the dynamism of the application. Many configuration changes are taken into account directly without requiring to restart the application. Unhappily this has a cost especially on embedded firmware where ressources are constraint

==> We can not expect significant improvements in the coming months

Regards

Jef