郝思曼交换机及EthernetIP白皮书

Hirschmann. Simply a good Connection.
EtherNet/IP Control Systems with Hirschmann Network Devices
White Paper
Rev. 1.0

Contents
EtherNet/IP Control Systems with Hirschmann Network Devices
1 2 2.1
Introduction Basics Switch Functionality Criteria IGMP Snooping Auto negotiation Virtual Local Area Networks (VLANs) EtherNet/IP Network Design Criteria Network Topology Switches versus Hubs and Media Converters Twisted Pair Wiring Fiber-optic Solutions
4 4 4 4 5 5 5 5 5 6 6 6 6 7
2.1.1 2.1.2 2.1.3 2.2 2.2.1 2.2.2 2.2.3 2.2.4 3 3.1 3.2
EtherNet/IP Networks Isolated Network Connected and Integrated Network
EtherNet/IP Control Systems with Hirschmann Network Devices White Paper Rev. 1.0 2 / 24

4 4.1 4.2 4.3 4.4 4.5 4.6 4.7 4.8 4.9
EtherNet/IP with Hirschmann Network Devices Isolated Network High Reliability - Single Ring High Reliability - Multiple Rings Security - Remote Maintenance via Service Port Security - Remote Maintenance via Phone Line Security - Remote Maintenance via Internet Security - Separation of Production Cells Security - Coupling of Locations Identical Network Segments Wireless – Single Remote Location Wireless – Multiple Remote Locations Wireless - Mobile Devices Wireless - Connection without Radio Line of Sight
8 8 9 10 11 12 13 14 15 16 17 18 19 20 21 21 21 21 22
4.10 4.11 4.12 4.13 5 5.1 5.2 5.3 6
Managing Hirschmann Switches EtherNet/IP Network Management Software Web-based Management Product Description
EtherNet/IP Control Systems with Hirschmann Network Devices White Paper Rev. 1.0 3 / 24

EtherNet/IP Control Systems with Hirschmann Network Devices
1 Introduction
Rockwell Automation has a strategic 3 party alliance with Hirschmann for network devices. This white paper describes the use of Hirschmann equipment in an EtherNet/IP network. EtherNet/IP is Rockwell Automation’s industrial plant floor network and part of the NetLinx architecture. EtherNet/IP utilizes standard Ethernet TCP/IP including media, protocols, etc. and the Common Industrial Protocol (CIP) on top. Controllers, personal computers, operator interfaces, drives, remote I/Os and other devices can be interconnected via this network to exchange control and configuration data.
rd
2 Basics
2.1 Switch Functionality Criteria
Rockwell Automation requires and/or recommends several features available in switches for EtherNet/IP networks. The most important features are explained in the following chapters.
2.1.1
IGMP Snooping
The EtherNet/IP communication differentiates between explicit and implicit messages. While explicit messages are used for device configuration and diagnostics, implicit messages are used for I/O control data. Much of EtherNet/IP implicit messaging uses IP multicasts to distribute I/O control data. By default, an unmanaged layer 2 switch treats multicast packets in the same way as broadcast packets. In this case multicast packets are re-transmitted to all ports except the port they were received on. Therefore network traffic increases significantly. Switches that support IGMP snooping learn which ports have devices connected that are part of a particular multicast group and only forward the multicast packets to the ports that are part of the multicast group. Consequently IGMP snooping reduces network traffic. Some layer 2 switches that support IGMP snooping require a router in the network. The router sends out IGMP polls in order to learn what devices are participating in which multicast groups. If the control system is a stand-alone network without the presence of a router, the switches deployed in those networks need to EtherNet/IP Control Systems with Hirschmann Network Devices White Paper Rev. 1.0 4 / 24

support IGMP snooping and IGMP polls. Hirschmann managed layer 2 switches support IGMP polls by activating the "Querier" function on the switch. Therefore Hirschmann switches can be used in any network without a router present.
2.1.2
Auto negotiation
The recommended speed for EtherNet/IP is 100 Mbps. Auto negotiation and auto sensing let devices select the most optimal way to communicate without configuring the duplex operation and speed of the individual ports. If a manually configured device, or a device not supporting auto negotiation and auto sensing, is connected to an auto negotiation device, a mismatch can occur that results in serious communication problems. Most 10 Mbps devices do not support auto negotiation and not all 100 Mbps devices support auto negotiation either. Full duplex operation is recommended on switch-to-switch connections. Half-duplex operation is required on some controller-to-switch and field device-to-switch connections.
2.1.3
Virtual Local Area Networks (VLANs)
VLANs can be used to split a local area network into two or more isolated networks without the traffic from one network burdening another. If a network design supports two VLANs for instance, broadcast traffic and IP multicast traffic from VLAN 1 will not reach VLAN 2 and vice versa.
2.2
EtherNet/IP Network Design Criteria
2.2.1
Network Topology
An EtherNet/IP control system can be based on a star, ring, tree or line topology or any combination of these topologies. The most common architecture of an EtherNet/IP network is a star topology.
2.2.2
Switches versus Hubs and Media Converters
Hubs and media converters usually support a single baud rate and half duplex operation only. Operating with these parameters places limitations on network length. When designing a network with these devices, a detailed calculation has to be made because all design criteria of a half duplex system apply to this network. In contrast to hubs and media converters, a switch supports multiple baud rates and duplex operation. A switch can transmit incoming data packets out of several ports simultaneously in full duplex operation and with different speeds if necessary. This makes designing a network much easier and considerably increases the data throughput. EtherNet/IP Control Systems with Hirschmann Network Devices White Paper Rev. 1.0 5 / 24

2.2.3
Twisted Pair Wiring
EtherNet/IP recommends the use of Cat. 5e cables for the 10/100Base-T(X) connections. In these applications the maximum cable length is 100m (330ft). For longer distances the use of fiber-optic solutions is required. 2.2.4 Fiber-optic Solutions
Fiber-optic cables have to be used where the distances are longer than 100m (330ft). Fiber-optic cables should also be used where electromagnetic interference is expected and between buildings for ground isolation and noise immunity. When designing a fiber-optic link, it is important to choose devices that all operate with the same fiber-optic standard (wave length, multi/single mode fiber, etc.).
3 EtherNet/IP Networks
An EtherNet/IP control system can be based on an isolated network, a connected network or an integrated network consisting of hundreds of nodes with connectivity to an enterprise network and the Internet. The most common design of an EtherNet/IP network is a simplex, non redundant network. To increase the communication reliability, the network can be designed as a ring topology.
3.1
Isolated Network
An isolated network is a local area network (LAN) that provides communication between a controller, remote I/Os and other field devices with no connectivity to an office environment or the Internet.
Controller
Operator Inteface
PC
Switch
I/O‘s
Drives
Figure 3-1: Example of an EtherNet/IP control system as a stand-alone network
EtherNet/IP Control Systems with Hirschmann Network Devices White Paper Rev. 1.0 6 / 24

3.2
Connected and Integrated Network
An EtherNet/IP connected network is a local area network (LAN) that provides communication between controllers, drives, remote I/Os and other devices such as servers and workstations. If the EtherNet/IP control system is part of the plant-wide LAN with connectivity to the enterprise network and/or Internet, it is called an integrated network. In this case, a router should be used to minimize network traffic between the EtherNet/IP control network and the office environment. For security reasons the EtherNet/IP control network must be protected from the office environment and the Internet through the use of firewalls, gateways, routers and/or security software. Depending on the size of the control network firewalls can also be used to isolate production cells to increase the network security.
Switch
Router
Switch
Figure 3-2: Example of an EtherNet/IP network as a part of a plant-wide LAN
EtherNet/IP Control Systems with Hirschmann Network Devices White Paper Rev. 1.0 7 / 24

4 EtherNet/IP with Hirschmann Network Devices
4.1
Isolated Network
An example of an EtherNet/IP control system as an isolated network is shown in the following figure.
3
3
3
1
Hirschmann Switches - MICE - Rail - OCTOPUS
2 3
Hirschmann Switches - SPIDER 3TX
4
3
4
3
4
3
Figure 4-1: EtherNet/IP control system as an isolated network
Notes for figure 4-1 1 2 3 4 Switch with IGMP snooping and Querier function enabled Switch with 3 ports to build a secure line topology 100 m (max.) Cat. 5e twisted pair straight through cable 100 m (max.) Cat. 5e twisted pair crossover cable (recommended for switch-to-switch connections)
To prevent duplex mismatch, check each port's speed and mode settings and configure the interconnected ports correctly.
EtherNet/IP Control Systems with Hirschmann Network Devices White Paper Rev. 1.0 8 / 24

4.2
High Reliability - Single Ring
The following figure shows how easy it is to increase the reliability of an isolated network. Using switches which support self-healing ring technology such as HiPER-Ring; one additional cable is added to the network (stand-by link).
4
4
4
1 5,6 3,5,6
2 5,6
Hirschmann Switches - MICE - Rail - OCTOPUS
2
4 4 4 4 4
Figure 4-2: Ring topology Notes for figure 4-2 1 2 3 4 5 6 Switch acting as a redundancy manager (RM) monitoring the ring Switch supporting HiPER-Ring technology but not acting as an RM Stand-by link, becomes active whenever a link between the switches fails 100 m (max.) Cat. 5e twisted pair straight-through cable 100 m (max.) Cat. 5e twisted pair crossover cable (recommended for switch-to-switch connections). Up to 4 km full duplex multimode fiber or up to 30 km full duplex single mode fiber. The connector type on both ends of the fiber is determined by the choice of switch and media module.
To prevent duplex mismatch, check each port's speed and mode settings and configure the interconnected ports correctly.
EtherNet/IP Control Systems with Hirschmann Network Devices White Paper Rev. 1.0 9 / 24

4.3
High Reliability - Multiple Rings
The following figure shows how easy it is to increase the reliability of a more complex network. Rings built using switches which support self-healing ring technology such as HiPER-Ring are redundantly connected for maximum availability.
5
5
2 6,7
Switch Series - MACH - MICE - Rail
6,7 1
6,7 3
5
6,7
Switch Series - MICE - Rail - OCTOPUS
4,6,7 4,6,7 2
2
4,6,7 1
6,7 3
6,7 3
4,6,7 1
6,7 5 5 5 5
6,7 5 5
Figure 4-3: Multiple rings
Notes for figure 4-3 1 2 3 4 5 6 7 Switch supporting HiPER-Ring technology and acting as a redundancy manager (RM) Switch supporting HiPER-Ring technology Switch supporting HiPER-Ring technology with redundant coupling enabled Stand-by link, becomes active whenever a link between the switches fails 100 m (max.) Cat. 5e twisted pair straight-through cable 100 m (max.) Cat. 5e twisted pair crossover cable (recommended for switch-to-switch connections). Up to 4 km full duplex multimode fiber or up to 30 km full duplex single mode fiber. The connector type on both ends of the fiber is determined by the choice of switch and media module.
EtherNet/IP Control Systems with Hirschmann Network Devices White Paper Rev. 1.0 10 / 24

4.4
Security - Remote Maintenance via Service Port
Some applications require a secure service port for initial configuration or access by third party employees. These applications can be realized with the Hirschmann EAGLE firewall. An example of an EtherNet/IP control system with a secured service port within a factory network is shown in the following figure.
a), b), c) 3 3 Hirschmann Switch - MICE - Rail - OCTOPUS 4 2 1
3, 5 3 3 3 3 3
Hirschmann Firewall - EAGLE
Shop Floor
Service Department
Figure 4-4: Secure remote maintenance via service port Notes for figure 4-4 a) b) c) 1. 2. 3. 4. 5. Select a transparency mode of the EAGLE. Configure the EAGLE as a DHCP server, to provide an IP address to a device connected to the non trusted port. Establish firewall rules for controlled access based on the IP addresses provided by the DHCP server. Non trusted port of the EAGLE Trusted port of the EAGLE 100 m (max.) Cat. 5e twisted pair straight-through cable 100 m (max.) Cat. 5e twisted pair crossover cable (recommended) Up to 4 km full duplex multimode fiber or up to 30 km full duplex single mode fiber
EtherNet/IP Control Systems with Hirschmann Network Devices White Paper Rev. 1.0 11 / 24

4.5
Security - Remote Maintenance via Phone Line
An example of an EtherNet/IP control system with a secure remote access over a phone line is shown in the following figure.
3
3
Hirschmann Switch - MICE - Rail - OCTOPUS 2
a), b), c)
1
3, 4 3 3
Hirschmann Firewall - EAGLE
Modem Phone Line
3 3 3
Figure 4-5: Secure remote maintenance access via phone line Notes for figure 4-5 a) Select the network mode PPPoE or PPTP. b) Configure the EAGLE as a DHCP server, to provide an IP address to a device connected to the non trusted port. c) Establish firewall rules for controlled access based on the IP addresses provided by the DHCP server. 1. 2. 3. 4. Serial port of the EAGLE (non trusted) Trusted port of the EAGLE 100 m (max.) Cat. 5e twisted pair straight-through cable Up to 4 km full duplex multimode fiber or up to 30 km full duplex single mode fiber
EtherNet/IP Control Systems with Hirschmann Network Devices White Paper Rev. 1.0 12 / 24

4.6
Security - Remote Maintenance via Internet
An example of EtherNet/IP control system with a secure remote access is shown in the following figure. In this example the data transmission over the non secure network is encrypted, and authentication at both ends of the tunnel is required.
3
3
a) Hirschmann Switch - MICE - Rail - OCTOPUS
Unsecure Network 2 1
Internet
3, 4 3 3 Hirschmann Firewall - EAGLE 3
3 3
Figure 4-6: Secure remote maintenance access via Internet and VPN tunnel Notes for figure 4-6 a) Use the EAGLE as a VPN Router. 1. Non trusted port of the EAGLE 2. Trusted port of the EAGLE 3. 100 m (max.) Cat. 5e twisted pair straight-through cable 4. Up to 4 km full duplex multimode fiber or up to 30 km full duplex single mode fiber
EtherNet/IP Control Systems with Hirschmann Network Devices White Paper Rev. 1.0 13 / 24

4.7
Security - Separation of Production Cells
An example of a secure separation of production cells with EtherNet/IP control systems is shown in the following figure.
Hirschmann Switch - MACH - MICE - LION
1 2
a)
1 a) 2 Hirschmann Switch - MICE - Rail - OCTOPUS
Hirschmann Firewall - EAGLE
Production Cell 1
Production Cell 2
Figure 4-7: Secure separation of production cells Notes for figure 4-7 a) If the EAGLE firewall will be used in a layer 2 network select the mode "Multi Client Transparency". Establish firewall rules for controlled access between the industrial backbone and production cells or between production cells.
1. Non trusted port of the EAGLE 2. Trusted port of the EAGLE
EtherNet/IP Control Systems with Hirschmann Network Devices White Paper Rev. 1.0 14 / 24

4.8
Security - Coupling of Locations
An example of a secure connection between EtherNet/IP control systems via a non secure network is shown in the following figure. A non secure network could be the Internet or a wireless connection. In this example the data transmission over the non secure network is encrypted, and authentication at both ends of the tunnel is required.
3
3
Hirschmann Switch - MICE - Rail 2 - OCTOPUS
a) 1 Unsecure Network 1
a) 2
3, 4 3 3 3 3
3, 4 Hirschmann Firewall - EAGLE 3
3
Figure 4-8: Secure coupling of remote locations via a non secure network and VPN tunnel
Notes for figure 4-8 a) Firewall in "Router Mode" The EAGLE needs to be configured as the default gateway on the secured port of the connected devices. Establish firewall rules for controlled access between the two locations. 1. Non trusted port of the EAGLE 2. Trusted port of the EAGLE 3. 100 m (max.) Cat. 5e twisted pair straight-through cable 4. Up to 4 km full duplex multimode fiber or up to 30 km full duplex single mode fiber
EtherNet/IP Control Systems with Hirschmann Network Devices White Paper Rev. 1.0 15 / 24

4.9
Identical Network Segments
In some applications it is appropriate to configure machines identically, to facilitate device replacement. This technique requires the use of duplicate IP addresses. In order to allow machines with duplicate IP addresses to co-exist on one network, the device connecting these machines needs to support a mechanism of masquerading IP addresses. The Hirschmann EAGLE is capable of performing this function as it supports 1:1 NAT (Network Address Translation). An example of identical network segments is shown in the following figure.
IP 149.218.3.10/24
Hirschmann Switch - MACH - MICE - LION
Plant Network
149.218.1.10/24 1 2 a)
149.218.2.10/24 1 a) Hirschmann Firewall - EAGLE 2 Hirschmann Switch - MICE - Rai - OCTOPUS
192.166.1.10/24
192.166.1.10/24
Machine 1
Machine 2
Figure 4-9: Network segments using identical IP addresses Notes for figure 4-9 a. Firewall in Router Mode supporting 1:1 NAT In this case, the trusted port of the EAGLE needs to be configured as the default gateway on the connected devices. 1. Non trusted port of the EAGLE 2. Trusted port of the EAGLE EtherNet/IP Control Systems with Hirschmann Network Devices White Paper Rev. 1.0 16 / 24

4.10 Wireless – Single Remote Location
An example of an EtherNet/IP control system with a single remote location connected via a wireless link is shown in the following figure.
3
3 Hirschmann Switch - MICE - Rail - OCTOPUS
1
2
3 3 Hirschmann - BAT 3 3 3 3 3 Hirschmann - BAT
Figure 4-10: Wireless – single remote location Notes for figure 4-10 1 2 Or 1 2 3 Access Point configured as a Bridge (master unit) Access Point configured as a Bridge (slave unit) 100 m (max.) Cat. 5e twisted pair straight-through cable Access Point configured as an Access Point Access Point configured as an Access Client
EtherNet/IP Control Systems with Hirschmann Network Devices White Paper Rev. 1.0 17 / 24

4.11 Wireless – Multiple Remote Locations
An example of an EtherNet/IP control system with multiple remote locations connected via wireless links is shown in the following figure.
3
3
Hirschmann Switch - MICE - Rail - OCTOPUS 1 3
2 3
3
Hirschmann - BAT 3 3 3 3 3
2
3
3
Figure 4-11: Wireless – multiple remote locations
Notes for figure 4-11 1 2 3 Access Point configured as a Bridge (master unit) Access Point configured as a Bridge (slave unit) 100 m (max.) Cat. 5e twisted pair straight-through cable
EtherNet/IP Control Systems with Hirschmann Network Devices White Paper Rev. 1.0 18 / 24

4.12 Wireless - Mobile Devices
An example of an EtherNet/IP control system including a mobile device and two wireless zones is shown in the following figure.
Zone 1
Zone 2
Mobile device
1
Hirschmann access point - BAT series 2 Hirschmann switch - MICE series - Rail series 3,4
1
2
2
2
2
2
2
2
2
Figure 4-12: Wireless - mobile devices Notes for figure 4-12 1 2 3 4 Access Point configured as an Access Point 100 m (max.) Cat. 5e twisted pair straight-through cable 100 m (max.) Cat. 5e twisted pair crossover cable (recommended) Full duplex multimode fiber or single mode fiber, cable length depends on size of wireless zones
EtherNet/IP Control Systems with Hirschmann Network Devices White Paper Rev. 1.0 19 / 24

4.13 Wireless - Connection without Radio Line of Sight
An example of a wireless connection of two EtherNet/IP systems without direct radio line of sight is shown in the following figure.
2
1
4
3
3
Hirschmann Switch - MICE - Rail - OCTOPUS
Hirschmann - BAT
3 3 3 3 3 3 3 1 2
Figure 4-13: Wireless - connection without radio line of sight Notes for figure 4-13 1 2 3 4 Access Point configured as a Bridge (master unit) Access Point configured as a Bridge (slave unit) 100 m (max.) Cat. 5e twisted pair straight-through cable 100 m (max.) Cat. 5e twisted pair crossover cable (recommended)
EtherNet/IP Control Systems with Hirschmann Network Devices White Paper Rev. 1.0 20 / 24