Easergy T300 Firewall

[Windsor]

Hi,

I have a T300 configuration that configures a T300 to be a Modbus master to a series of P3 relays over TCP. The T300 is turn is a DNP3 slave to a PSO 2020 system over TCP.

I am trying to decide how to configure a white list for the T300 firewall for the WAN interface. Does the white list only control incoming connections to the T300 (in which case I guess I only need to include the IP addresses for the PSO servers) or does it filter all incoming packets (in which case I guess I need to include the P3 relay IP addresses in the white list as well)?

[AndreMelo]

Hi @Windsor 

As you said it is a WAN interface configuration, which means the rules will be applied to every packet arriving at the WAN physical interface. 

The option you have is to connect the P3 into the LAN interface as following:

 

However, I cannot answer it without giving you this advice:  Please avoid using Modbus as much as possible. the T300 and the P· have better protocols (Protocols with time-stamp as a minimum) to do this integration.

You could use DNP3.0 or IEC61850-MMS for the downstream communication with P3.

Best Regards

[jean-luc_batard]

Dear all

Please always avoid to add any miscellaneous device on the so called LAN interface used as an internal backplane between modules

I know it is not perfect, but better use WAN port Eth1 for this purpose

Then you are both right, will require to enter the P3 IP@ in the WAN whitelist

BR