SL ETS Commissioning issue

[IC_Systems]

Hello,

I download the ETS Individual address/ Application via SL.

I have some devices that support KNX Secure, but deactivated. devices like the new spacelogic DALI, Theben thepixa.

SL was in version less than 2.6.0 and in that time ETS Downloads without any issue 

After I upgrade the SL to V2.6.0 the ETS download application start to fail only for the deactivated secure devices.

I tried with the discontinued product InsideControl and its commission without issue.

is there any sittings/limitation when using SL with V2.6.0 and higher, and how to overcome this issue?

I stuck at V2.6.0 because I don't have VPN and I need the remote commission via port 3671.

[domotiqa]

Schneider choose to give a product with less and less possibility, far away from the roadmap given to us (we should have cloud, energy manager, alert, homekit and remote programming).

Despite, they :

- disable the remote port programming also if we use IP filtering

- disable the possibility to upload the alert package (no signature)

- disable the possibility to downgrade the firmware since 2.8

- protect by password the backup so useless with donwgrad firmware

Really disapointing

YOU CAN T DISABLE FEATURE IF YOU DON'T GIVE ALTERNATIV

[domotiqa]

I also open a ticket for this: #93902685

But they told me never have this issue.

I again have it on a new customer building...

What is strange, is that once I program it with usb localy, then I could program it again with SL

[PetrMares]

Hello,

let me quickly comment: 

- disable the remote port programming also if we use IP filtering

Remote programming, commissioning need to have a Wireguard support in linux kernel. This should be available by end of this year and after this dependency is solved we can continue with this activity

- disable the possibility to upload the alert package (no signature)

It is possible to install applications without signature but not lmup patch files. Application can be created by 3rd party but patch always by SE and signed by us.

- disable the possibility to downgrade the firmware since 2.8

Firmware downgrade is not supported since beginning. I know it allows you to install, but nevertheless not tested and therefore not supported. See the warning message in upgrade firmware window.

- protect by password the backup so useless with downgrade firmware

When the downgrade is not supported why it should be possible to restore on lower firmwares without this functionality implemented? You can make backup of project in older fimrwares and upload to 2.8.0 where password is not strictly requested.

Energy management as a part of new Wiser KNX app is now under fieldtest and will be part of next App release beginning of next year.

in general, signing of firmware, patches, encryption of backups etc. are requirements coming from cybersecurity department. The is not debate we implement or not. it is given.

[domotiqa]

Let's be in the fact:

HOMELYNK:

- no homekit support

- still always need to send email with MAC adress to link, unlink account.... W don't have time to spend with this king of bug. Most solution have QRcode, scan, create account and go

You really should inspirate from THINKA

SPACELYNK:

- alert module not supported / updated

- push notification -> none

- cloud connection with multiple site for customer -> no solution

- energy module -> promised in the roadmap we had 3 years ago

- bacnet client bugged (some product take a while to be discovered, to be linked... sometimes everythink disapear, we are limited with the datapoint... and you disable the bacnet script possibility not compatible if they are the app and the library both)

BOTH

No remote programmation, no VPN...

Shneider looks like going far from the original product and start to lock it  more and more (sorry your security division is zero, ip filtering was working I had a script and there is zero Security issue)

They should have work for next firmware and when ready deploy it.

You forget that it's me and other integrator that are on the field and have to find more and more solution always and always.

For me it start to be more and more difficult to deploy the solution. We should have more and more easy process, and it's the opposit.

[domotiqa]

When you say:

When the downgrade is not supported why it should be possible to restore on lower firmwares without this functionality implemented? You can make backup of project in older fimrwares and upload to 2.8.0 where password is not strictly requested.

We see that Schneider is far away from the reality with KNX:

I should stop to program remotly with 3671 port (secured by IP filtering and script on 2.6 firmware), because SE told me it's not secure. I should spend hour on my car to go to every customer I had remote support. Is it what you hare saying ?

So what I told you is SE low the function of SL&HL and not add function. It's from 2 years at least know (We didn't care about the new app we had mosaic, we didn't care about the revox, somfy... app).

On almost all Building project:

- energy module

- alert with individual ack, priority, categories and push or email.... but ctitical is better with push

- remote feature (lots of customer don't allow vpn or nat port): cloud and programming

[PetrMares]

Hi,

remote configuration is now on hold because of missing support in linux kernel. Means when delivered (not from us) we can continue, but right now we are blocked. Concept is done and we will work on this. There is a controller and knx access in scope.

Energy module means what exactly? For residential there will be energy flows, insights ... in the App. When we speak about commercial segment the persona here is facility manager so you mean multisite energy monitoring? "Alert manager" is also for mid, big building in a sense of cloud service/s.

[domotiqa]

remote configuration is now on hold because of missing support in linux kernel. Means when delivered (not from us) we can continue, but right now we are blocked. Concept is done and we will work on this. There is a controller and knx access in scope.

-> Not the integrator problem. When there a is a function, you can't stop it without other solution. One day SE wake up about security and disable feature. WHY DON't USE THE IP FILTERING FUNCTION THAT WAS WORKING ON 2-6 and add maybe watchdog like I do with script ??? At least the time another solution is found.

Energy module means what exactly? For residential there will be energy flows, insights ... in the App.

-> Energy module with modbus support, category, sum of category, PIE chart.... don't you see what DOGATE do for example?

When we speak about commercial segment the persona here is facility manager so you mean multisite energy monitoring?

"Alert manager" is also for mid, big building

-> no no and no all building also small, use defaut lkie LOW VOLTAGE on powertag, device not responding, IP ping, temperature too low, CO2 treshold too high, SERVER computer temperature overflow....

in a sense of cloud service/s.

-> cloud is usefull for project where we can't have nat openport, and also if you want to manage multi building or agency. Also to program remotly

Homelynk start to be more and more useless, due to the fact that rich people have Apple device and homekit. They don't want anymore proprietary  software. No installation, easy to setup...

Spacelynk would be the best Supervision with all these addon feature. But since more than 2 year, the product don't evolve more. The worst is that you disable feature

[PetrMares]

"Energy module" as you have described will be part of next Wiser KNX App release. All the categorization of energy equipment's, charts, history data etc. 

Now enriching the Wiser KNX App in order to add automations where for end user we allow add conditions and trigger actions. Push notification is shown when action is triggered. It is classical concept If-When-Then. 

[domotiqa]

you speak only about the residential app. I explain you about Spacelynk and Building customer.

Still a gap, sad SE don't follow integrator point of view.

[Erwin-vd-Zwart]

I don;t fully agree on that statement...

Schneider Electric has a great solution for the building segment, called EcoStuxure Building Operation, the problem is that the spaceLYnk has so much technology onboard that it can be used as substitute for this segment but that is not what it is designed for, the spaceLYnk is used to bridge KNX to a BMS system and not to replace a BMS..

If you need to manage a building you need to use the appropiate solution for that and that is a BMS if you ask me..

Just my 50 ct.. (:

BR,

Erwin 

[domotiqa]

Totally disagree.

There is a market from 0 to 5000M2 that is very low evaluate with plenty of project..

Ecostructure (I have the certification too) is not design for this, based on old fashion way to program and need computer (powerfull), based on Windows (such a pain) and so need maintenance...

But all of SE information are showing us where SE put theyr effort (Ecostructure is the main goal) vs strategy like ABB where everything are on KNX. The KNX branch are very the poor part of SE since 4 year in France at least (no more Ecoexpert support...).

Product like Spacelynk lost functionnality and are far away from the roadmap we used to have 5 year ago. You can't imagine the number of time I discuss that with each SE person I met. And I told that but I'm working with SE only since year know.

Sad.

[Erwin-vd-Zwart]

Well, i think you need to talk with your account manager about EBO..

The Building Operation solution is not based on a Windows PC but just like an spaceLYnk on a hardware server that can be scaled up to 250 servers under a ES and yes that runs on windows but as single pane of glass of all AS-P's in the system.

A single AS-P (Linux HW device like SL) can cover a small building, has a webbased user interface and there you have all the functionality you are missing in the spaceLYnk like event and alert management, event based trending, high level of user management and so on.

This is normally used as the center core of a small building and extended with KNX through a spaceLYnk and now the new LSS100300 BMS Gateway.   

Again my 50 ct...

BR,

Erwin

[domotiqa]

No like I explain I'm already certify as EBO expert.

You are speaking about the AServer. Which can't be compare at all vs Spacelynk in term of ergonomy, and possibility of design, speed, open api communication, and KNX port, remote programmation, iphone application, DB access, script to change everything generate page....

Did you ever develop once with EBO ? Start to buy a new computer only for its IDE.

It's where you made an error, small project can't afford this AS + LSS100300 and it's far away than what I could developp whith Spacelynk (try the iot connector on EBO vs 5min dev on SL).

But once again, none answer about all promised in the past, about the disabling function, update after update. Don't understand this point view and always try to explain that our Work as integrator is not important.

As explain, KNX integrator are the last priority of SE

[Erwin-vd-Zwart]

Yes i have developed for both EBO and KNX as i’m a System Architect at Schneider Electric with in-depth knowledge of all our building solutions especially KNX, Wiser/SL, power metering and EBO with all it’s features.

So i‘m very well known with the pro’s and cons of both systems as well as the design scope where the products are best used and advise and support our EcoXpert partners on all of these systems .

This is why I can say that EBO is not needed in residential segment, that is where the Wiser for KNX is positioned and for small buildings an AS-P positioned and is is even better then a spaceLYnk when KNX is not in the scope.

When KNX is in the scope of any building the best solution is to use EBO  combined with a spaceLYnk (when 1 KNX interface is needed) and with some bigger installations you should use the KNX BMS Gateway LSS100300 to avoid a single point of failure.

Also when using EBO’s connected room solution you can mix it with KNX by the LSS100300 or the Modbus to KNX interface. 

There is also an mobile app called Engage for EBO to control light and blinds by the occupants and ther are several interfaces like and REST from script and in our latest release we have the MQTT interface to make a 5 minute IoT integration to Azure or any other platform.

There is a build in reporting interface, external storage and much more…

So a remark that EBO does not fit the need of a small building is far from accurate as it is fully designed for that application.

As you already mentioned the real pain point is the investment on the hardware and this d

is a matter of costs and the desire of a robust system with tons of functions but not willing to invest in a BMS is where all goes wrong..

The price of a BMS is indeed a little bit higher, and the main reason is software development costs, these are (understandable) included in the product price, but the upside is that you get a full packed product with all features needed for that type of application.

The price of a spaceLYnk is indeed 25% lower then an AS-P but this product is not designed to use as an BMS and therefore missing some function you find in his “big brother”

In my opinion you get a great device with ton’s of functionality when selecting a spaceLYnk but sometimes you need to select a heavier and more costly solution.

It’s not a matter that Schneider has no focus on KNX (i know they have full focus) but it’s more that it makes no sense to develop 2 controllers for the same task, and that brings us back to the painpoint,

You need to select the correct product for the task, and for buildings that out catalog point you to EBO. Not because of prizing but of fitting the needs it’s developed for.

So my 50 cent are not changed.…

BR,

Erwin

[domotiqa]

It's your point of view but not mine and most integrator.

SE choose to use EBO and Bacnet for "big" building, only because they use to have EBO from Hvac solution.

In my opinion you get a great device with ton’s of functionality when selecting a spaceLYnk but sometimes you need to select a heavier and more costly solution.

-> Heavier.... If SE spents more Money on SL, it would be far better than EBO. The actual processor and memory inside are ridiculous and it's still powerfull enough to handle lots of my segment project (I have project with more than 1500 knx devices, 20 0000m2 size with all function inside and touchscreen everywhere in class room and function hard to have nativly in EBO).

You can't compare the design you could do with SL and EBO. Depend what Customer your focuse on. I use SL for the Manager not for the technician. It's how I work

It’s not a matter that Schneider has no focus on KNX (i know they have full focus)

-> Ok so what I'm feeling with SE since 5 year doesn't count. All the discution, travel, meeeting with SE I used to do are fake?

The Ecoexpert program work well and our contract signed are honored. Our KNX legal referee still exist. YA shame the difference of energy and money spend on EBO vs KNX...

but it’s more that it makes no sense to develop 2 controllers for the same task, and that brings us back to the painpoint,

-> Yes, for me EBO has no sens anymore, old fashion way to develop. Most project could be replaced by a SL, except big one because of lack of power, memory and some functionnality (or do like in EBO where they put plenty of AS linked by IP....in a bacnet protocol...) so every module is a Spacelynk... far away from the concept of KNX open

You need to select the correct product for the task, and for buildings that out catalog point you to EBO. Not because of prizing but of fitting the needs it’s developed for.

-> it's just a different way of thinking the building, Depend of lots of parameter, but KNX is the best for me, open, standard. SE think KNX are not for big market. Let me smile, in fact by putting IP AS they think it's better solution than a KNX reliable Bus, vs old Bacnet TP solution. Compare the way of thinking a Building in EBO and in KNX are a non sens for me. I never would have it on my own building vs having full KNX with Bus everywhere to put each product I would like in the futur.

Once again, we are on this forum for the KNX and the lack of function we need, the function disabled...

You tried to explain us that it's not big deal. Come on pour project, do our job every day.

Start to be painfull to be listen and respected. The last year is the worst with SL and Hl in term of lost of time on our customer. You know integrator are speaking about these problem each other. SL could be the killer product in this huge middle market, more and more in France since the Building owner have obligation (count and control)

[IC_Systems]

Thank you all for this discussion.

I am working with SE products 7 years ago, and I am very interested in the SL functionalities and capabilities.

but the market and the other competitors also keep developing, and we want the SL to still on the top and SE keep improving it.

the most drawback in the SL right now and  might make the Firmware upgrade effort beyond 2.6.0 useless without supporting remote programming; this limitation should be solved very soon.

While regarding the main topic of this subject, does any one face this issue and how could be solved?

[Erwin-vd-Zwart]

@IC_Systems 

In my opinion you MUST upgrade to a higher version as 2.6.0 as opening 3671 to the internet without any protection layer is a serious cybersecurity threat and also the reason why our cybersecurity process has moved us to closing this port from direct internet access (only public IP addresses), but it can still be used from behind a VPN solution.

This is not done to be anoying to our customers but because we have a lot of know cases (not only SE) where exposing your KNX installation direct to the internet has caused serious damage to the customers with open ports all over the world.

We know for example that on multiple sites the hardware is deleted over port 3671 and the BCU password is changed so the integrator cannot even reprogram the devices and needs to replace all hardware. This is a standard ETS functionality that cannot even be called a hack and can be done on hardware from any manufacturer / brand and causes serious issues for the end-users. 

So in my opinion staying on 2.6.0 and approach the installation without any protected layer (like VPN) over an open port is the same thing as parking your car in the middle of Amsterdam with the keys in it, and when it's stolen (there is a high risk this will happen) we whished we had done it differently.

I would advise to put a VPN enabled router in the installation and upgrade to 2.8.0 and use a VPN client to connect to the site for remote programming, this is the only safe way to do such a task.

There are also nice cloud VPN solutions on the market like IXON, those solutions supply a VPN router (with or without 4G) and a lifetime cloud subscription for around the 500,- euro, with this type of solutions you have multisite management with fast and most important SAFE connections to do your remote commisioning for your customers.

BR,

Erwin 

[IC_Systems]

Thanks @Erwin-vd-Zwart 

I agree with you in the security prospective, so we started to switch to VPN in our old projects, but we are waiting for the SE solution as the logic machine using zero tire with free of charge and no need for a special router supporting VPN.

Do you have any suggestions about the application download issue?

[domotiqa]

I agree woth you erwin,

It could be a searious security issue.

But on the 2.6.2 the oustide lan access was blocked. But with a script you could authorise one IP source adress. Which was great (it would be possible to add in the settings a textbox for that). Then I have a scheduled script that "watchdog " the ip activation and disable it everynight too. The security issue is so very very low, and only know integrator was informed about this script. so the 3671 wasn't basiicly exposed.

Second point about the customer access (not programming). For the VPN, I think that Spacelynk is cool to use by the end user customer, not only technician (because you can implement 3D view, personnalisation view...). If you ask him to first connect to VPN, then connect a link, then put user/password, you loose him before.

For the BCU password, it's possible to use script to disable the programming functionnality (like this product: L&J-ts4fxps, but by software with eibd backend).

[PetrMares]

Hello,

We are looking on your issue. I have been able to commission our MTN6500-0103 knx ip router using w4k with fw 2.8.0 and as well another knx device (push button by feller which is data secure so with deactivated secure commissioning).

I have started with fw 2.5.1 where it works and finally upgrade to 2.8.0 which seem ok as well.

Update:

KNX DALI gw has been tested  as well and passed so in general work, but if you still face issues than would be best to contact our L3 support directly to take look on your specific setup.

 

[IC_Systems]

hello @PetrMares 

Thank you for your effort.

I face this issue when I upgrade to Version 2.6.0. Did you test on this Version?

Also If you could give me the contact details for the L3 Support.

[domotiqa]

In my case, it's only at the first download I had problem on different building with Spacelogic ON/OFF master. After first download with USB interface, no more problem to program with SL&HL. I had new problem with a dimming spacelogic too recently.

[PetrMares · Accepted solution]

Hi,

I have checked the commissioning process on 2.6.0 and indeed not possible to commission the device. "the device does not respond in appropriate time" error message. Then updated to 2.6.1 where it is fixed.

L3 will contact you if anything more needed, but probably now it is clear where the problem is/was.