Remote programing via port 3671

[IC_Systems]

Hello 

I read  this statemen in the forum : 1 external IP address that is allowed to connect via 3671.

does this will be implemented, and is there a time line

@Erwin-vd-Zwart 

[PetrMares]

Hello,

The remote programing via 3671 from external public IP addresses is not enabled. We had a plan to provide an option how to explicitly define one IP address and allow it, but this has not been confirmed by Cybersecurity team.

[IC_Systems]

aha so its cancelled.

is there any secure ways in the plan?

its a very useful tool 

[PetrMares]

Yes. we see the same usefulness and evaluating options. This can be done most likely over VPN tunnel using cloud infrastructure. Nevertheless this is a part of bigger story we would like to improve.

[domotiqa]

what about Zerrotier solution integration ?

[PetrMares]

Zerotier is 3rd party IoT platform. I know this would be possible, but from cybersecurity we have got pushback.

We have to use ideally SE infrastructure.

[IC_Systems]

Thanks @PetrMares 

Cybersecurity is very important

I hope to see some thing soon 🙂

Last Thing: Which is the last FM that support Remote Programming VAI 3671.

Also is it possible and safe to downgrade FM

[domotiqa]

yes Petr !

A little VPN connection to Schnedier cloud, a remote adress like: 5641s3d54f35sd1f3651f3sd1fsdf.remoteschndeider.fr that is disable after 1 hour and that we can enable through the cloud access and over. 😁

[domotiqa]

any news about remote programming and push notification ?

[domotiqa]

Please make the script for remote programing  working again in the last firmware.

It authorize only one IP to connect. There is no security issue, and you stop all solution except VPN that in certain case is not possible.

So you stop all solution but give no other solution (knx ip secure programing, cloud remote programming like zerrotier package from openrb....)

[PetrMares]

Hello,

unfortunately this is not possible.

The proposal of solution for remote configuration over cloud is now under evaluation considered as prioritized feature.

[domotiqa]

Hi Petr,

why not possible ?

What security issue to authorize specific IP or at least through IP secure or both?

But we need quick solution. Imagine our old customer which we are using remote support (but don't authorize to add other device like VPN).

We use on demand open port, we use schedule script to disable it at 00h00, and authorize only our IP. I'm from IT, and there is very few issue with this solution...

[PetrMares]

Hello,

Schneider Electric has implemented a cybersecurity policy which each offer must follow. A security statement on the KNXnetIP attacks can be found here: https://download.schneider-electric.com/files?p_Doc_Ref=SESB-2021-313-01

I am not sure if you are aware about KNX position paper. If not you can found it here : https://www.knx.org/wAssets/docs/downloads/Marketing/Flyers/KNX-Secure-Position-Paper/KNX-Secure-Pos...

Until a secure commissioning over cloud will be available there is still the possibility to add i.e. a Mikrotik router and use it as VPN connection to the customers network.

Regards

Petr

[domotiqa]

I can see two option that a re secure

- IP secure could be forced from outside LAN for Spacelynk

- Ip filtering is a good solution

Can you explain the problem with these two option.

I'm coming from IT and can not see any problem on it.

The position from Schneider is not the right one.

You say there is a problem, so we blocked everything! without solution. It's totally  against your programer and there is no short time solution (not until 2023). So it's not possible for professionel like us. Finaly, once again we need to find solution by us.

The way Schneider is acting with KNX is desolation. You go to the webpage of Spacelynk it says the product will stop in 2027 (big in orange). The ecoexpert program is dead (no news, no contract, two years of developpement money no news...). The people who care of KNX in our area are not reaffected.

Sad time for programer who care about our relation and defend SE to be threat like this. Remember, we are working every day with the customer. We are in first line.

See this forum, I put lots of post, and no answer. Or always it will come. But when in two years...

I have econfigure bug post: no news

I have alarm module for spacelynk used in the past: no news

I have remote access: no solution (it exist zerrotier plugin withe openrb, tailscale, there is ngrok, wiregard...ise remote, jung remote, thinka, gira x1, 1home...)

Homekit support: lets wait matter (there is abb, thinka, 1home...)

Push Notification: just homelynk no spacelynk

Great, don't know why using this forum, only to have wait or no answer.

[PetrMares]

The date 2027 as a discontinuation for the product has been marked by somebody accidentally and only on French local SE website. It has been fixed yesterday once we have been informed about this bug, Not true.

Alarm Application cannot be hosted on our marketplace, but you will receive ipk which can be installed on your own.

The team around controller is working on evolution of the offer in different directions. New Wiser KNX App, Zigbee integration and new KNX BMS gateway. 

Beside this we are considering to have KNX remote commissioning  option prioritized, but there are steps, enablers needs to be taken first on platform and aligned with overall strategy and roadmap. 

 

[IC_Systems]

Hello @PetrMares 

Could You give us a teaser when these things will be available.

Also regarding the IOT with sim-on, any news and teasers.

We absolutely respect your effort, but SE should be/still within the firsts top:)

[PetrMares · Accepted solution]

Hello,

I can say that new KNX BMS IP gateway is in final phase where performing external fieldtest. You may saw last KNX journal where new products, sw have been communicated. If not here you go:

https://www.knx.org/knx-en/for-professionals/newsroom/en/news/KNX-Journal-2022-now-available/

Similarly for Zigbee and new Wiser KNX App. 

I would suggest you to contact front office in your country as the offer availability may differ. Country front office is also responsible for communication towards you, partners, system integrators regarding new products. If they are not sure about details they can always contact me or responsible colleague as Zigbee, new App is not under mine responsibility, but  nevertheless due to same platform very close.

KNX IoT Keynote Event has been streaming  5th April, not too focused on technical aspects:

https://www.youtube.com/watch?v=lP-T7cYe6qg

in parallel we have joined a webinar together with our cloud architect and man behind IoT for W4K, spaceLYnk. I see still not on youtube. This will be uploaded later.

Up to now is available an application note?

https://download.schneider-electric.com/files?p_Doc_Ref=AN002_109&p_enDocType=Application+solutions&...

News about Simlab are up to date on their website: https://simlabinc.com/

or here: https://www.knx-iotech.org/portfolio_page/sim-on-digital-property-experience/

Regards

[domotiqa]

Hi Petr,

Alarm Application cannot be hosted on our marketplace, but you will receive ipk which can be installed on your own.

Was not true. In the past the app was in the marketplace. What you mean is that SE gave the option, then remove it. And worst of that, it mean no more improvment on this really important missing featured for any Supervision in buildings. All our opponent in BEMS have this featured. I don't see any new building with Automation that don't ask for it in the publis procurement contract.

The lack of feature are: notification push, category of alarm and checkbox in the object tab to be abble to fight with Dogate ABB for example.

The team around controller is working on evolution of the offer in different directions. New Wiser KNX App, Zigbee integration and new KNX BMS gateway. 

Ok but once again, the Spacelynk already have this feature (the new bacnet client still little bug like long time refresh, or loose variable). So it mean that once again we are focused on Ecostructure to bring knx to Ecostructure. However, most of building between 200 and 5000m2, don't need such big/heavy solution. The spacelynk is a much better easy solution.

Beside this we are considering to have KNX remote commissioning  option prioritized, but there are steps, enablers needs to be taken first on platform and aligned with overall strategy and roadmap. 

Ok SE can still take time to create theyr own offer, but between this gap, a solution should be available (zerrotier, only once IP allowed in spacelynk...)