Ion9000 communication failure after security updates

[Oz_Ba]

Hi,

I am having trouble reading data from Ion9000 device after client's IT department performed security policy updates.

PME 2020 is running with only one device connected directly using ethernet. It is Ion9000. 

Measurements from other 100+ devices are loaded into PME's SQL using ETL and this part is just fine.

Management console shows failure status for Ion9000 as you can see from the image attached.

No modifications to PME were made. 

Valid license is applied for high-end device.

I have had similar issue earlier and I managed to solve this by removing Ion9000 device from PME and then following steps described in this article:  Could not write to Event log pipeline in Alarm Service." after upgrading to PME 2020 | Schneider Ele... Then, I added Ion9000 again with new name and it worked.

Ion9000 is available through network using web browser or IonSetup v3.2 tool.

I also recorded data traffic on port 7700 between PME's and Io9000's IP address.

I am sure this has to be related to user account suspension and changes IT guys made after certain cyber-attacks.

Any suggestion is appreciated.

[Charles_Murison]

Hello @Oz_Ba ,

The failure state is somewhat generic of a message and not much to go on for troubleshooting. It could be that some services were started in incorrect order or it could be that the port to the meter is blocked or could mean something between ION components are failing (DCOM). First step would be to stop all ION services (not just automatic ones). There are 2 services that are not automatic but start when ION Network Router service is started. If either of these services are started before ION Network Router service this can cause problems within PME.

If restarting the services do not help, likely you will want to work with Tech support to start a case and troubleshoot.

Regards,

Charles

[Oz_Ba]

@Charles_Murison 

Thank you for your reply.

I am aware of ION services startup order, I tried restarting services in regular order many times. It did not give results.

I am able to use Ion Setup tool with no issues, I can read Realtime data, setup parameters, etc. That means ports are not blocked, right?

I also noticed that there is traffic present an port 7700 all the time. Looks like communication services are reading data from ION9000 but something is stuck between services.

I will definitely have to talk to tech support.

Regards,

[Charles_Murison]

Hello @Oz_Ba 

If ION Setup is able to talk to the device, that does indicates that ports are not blocked. Would need to understand what traffic PME is sending to confirm if this a concern or not. Very likely tech support is your best option moving forward.

Regards,

Charles

[Oz_Ba · Accepted solution]

Hi,

This was a cyersecurity issue.

Looks like new AI-based security solution (which I am not going to specify) blocked execution of siteserver.exe. 

I was confused by the fact that SiteServer service reported no issues.

@Charles_Murison thaks for your replies.