Post on 24-Oct-2015
description
INTERFACE
UM EN PSI-MODEM-GSM/ETHOrder No.: 2910855
User manual
GPRS/EDGE modem with Ethernet interface
Designation:
Revision:
Order No.:
This user manual is valid for:
INTERFACE
103965_en_00 PHOENIX CONTACT
09/2009
GPRS/EDGE modem with Ethernet interface
UM EN PSI-MODEM-GSM/ETH
00
2910855
Designation Version Order No.
PSI-MODEM-GSM/ETH 2313355
User Manual
PSI-MODEM-GSM/ETH
Please observe the following notes
In order to ensure the safe use of the product described, you have to read and understand
this manual. The following notes provide information on how to use this manual.
User group of this manual
The use of products described in this manual is oriented exclusively to
– qualified electricians or persons instructed by them, who are familiar with applicable
standards and other regulations regarding electrical engineering and, in particular, the
relevant safety concepts.
– qualified application programmers and software engineers, who are familiar with the
safety concepts of automation technology and applicable standards.
Phoenix Contact accepts no liability for erroneous handling or damage to products from
Phoenix Contact or third-party products resulting from disregard of information contained in
this manual.
Explanation of symbols used and signal words
The following types of messages provide information about possible property damage and
general information concerning proper operation and ease-of-use.
This is the safety alert symbol. It is used to alert you to potential personal injury
hazards. Obey all safety messages that follow this symbol to avoid possible
injury or death.
DANGER
This indicates a hazardous situation which, if not avoided, will result in death or serious
injury.
WARNING
This indicates a hazardous situation which, if not avoided, could result in death or serious
injury.
CAUTION
This indicates a hazardous situation which, if not avoided, could result in minor or
moderate injury.
NOTE
This symbol and the accompanying text alerts the reader to a situation which may cause
damage or malfunction to the device, either hardware or software, or surrounding
property.
This symbol and the accompanying text provides additional information to the reader. It is
also used as a reference to other sources of information (manuals, data sheets, literature)
on the subject matter, product, etc.
PHOENIX CONTACT 103965_en_00
PSI-MODEM-GSM/ETH
General terms and conditions of use for technical documentation
Phoenix Contact reserves the right to alter, correct, and/or improve the technical
documentation and the products described in the technical documentation at its own
discretion and without giving prior notice, insofar as this is reasonable for the user. The
same applies to any technical changes that serve the purpose of technical progress.
The receipt of technical documentation (in particular data sheets, installation instructions,
manuals, etc.) does not constitute any further duty on the part of Phoenix Contact to furnish
information on alterations to products and/or technical documentation. Any other
agreement shall only apply if expressly confirmed in writing by Phoenix Contact. Please
note that the supplied documentation is product-specific documentation only and that you
are responsible for checking the suitability and intended use of the products in your specific
application, in particular with regard to observing the applicable standards and regulations.
Although Phoenix Contact makes every effort to ensure that the information content is
accurate, up-to-date, and state-of-the-art, technical inaccuracies and/or printing errors in
the information cannot be ruled out. Phoenix Contact does not offer any guarantees as to
the reliability, accuracy or completeness of the information. All information made available
in the technical data is supplied without any accompanying guarantee, whether expressly
mentioned, implied or tacitly assumed. This information does not include any guarantees
regarding quality, does not describe any fair marketable quality, and does not make any
claims as to quality guarantees or guarantees regarding the suitability for a special purpose.
Phoenix Contact accepts no liability or responsibility for errors or omissions in the content
of the technical documentation (in particular data sheets, installation instructions, manuals,
etc.).
The aforementioned limitations of liability and exemptions from liability do not apply, in so
far as liability must be assumed, e.g., according to product liability law, in cases of
premeditation, gross negligence, on account of loss of life, physical injury or damage to
health or on account of the violation of important contractual obligations. Claims for
damages for the violation of important contractual obligations are, however, limited to
contract-typical, predictable damages, provided there is no premeditation or gross
negligence, or that liability is assumed on account of loss of life, physical injury or damage
to health. This ruling does not imply a change in the burden of proof to the detriment of the
user.
103965_en_00 PHOENIX CONTACT
PSI-MODEM-GSM/ETH
Statement of legal authority
This manual, including all illustrations contained herein, is copyright protected. Use of this
manual by any third party is forbidden. Reproduction, translation, and public disclosure, as
well as electronic and photographic archiving or alteration requires the express written
consent of Phoenix Contact. Violators are liable for damages.
Phoenix Contact reserves all rights in the case of patent award or listing of a registered
design, in as far as this concerns software of Phoenix Contact that meets the criteria of
technicity or has technical relevance. Third-party products are always named without
reference to patent rights. The existence of such rights shall not be excluded.
Windows 3.x, Windows 95, Windows 98, Windows NT, Windows 2000, Windows XP, and
Windows Vista are trademarks of the Microsoft Corporation.
All other product names used are trademarks of the respective organizations.
How to contact us
Internet Up-to-date information on Phoenix Contact products and our Terms and Conditions can be
found on the Internet at:
www.phoenixcontact.com.
Make sure you always use the latest documentation.
It can be downloaded at:
www.phoenixcontact.net/download.
Subsidiaries If there are any problems that cannot be solved using the documentation, please contact
your Phoenix Contact subsidiary.
Subsidiary contact information is available at www.phoenixcontact.com.
Published by .
Should you have any suggestions or recommendations for improvement of the contents and
layout of our manuals, please send your comments to
tecdoc@phoenixcontact.com.
PHOENIX CONTACT GmbH & Co. KG
Flachsmarktstraße 8
32825 Blomberg
Germany
Phone +49 - (0) 52 35 - 3-00
Fax +49 - (0) 52 35 - 3-4 12 00
PHOENIX CONTACT
P.O. Box 4100
Harrisburg, PA 17111-0100
USA
Phone +1-717-944-1300
PHOENIX CONTACT 103965_en_00
103965_en_00 PHOENIX CONTACT i
Table of contents
1 Description of the GSM modem...............................................................................................1-1
1.1 Description .........................................................................................................1-1
1.2 Ordering data .....................................................................................................1-2
1.3 Technical data ....................................................................................................1-2
2 Hardware installation ...............................................................................................................2-1
2.1 Housing dimensions ...........................................................................................2-1
2.2 Mounting the module on a DIN rail .....................................................................2-1
2.3 Description of the connections and LEDs...........................................................2-2
2.4 Establishing connections....................................................................................2-3
2.4.1 Safety notes ......................................................................................2-3
2.4.2 Connecting Ethernet networks ............................................................2-4
2.4.3 Connecting the antenna ......................................................................2-5
2.4.4 Inserting the SIM card .........................................................................2-6
2.4.5 Connecting the supply voltage ............................................................2-7
2.4.6 Connecting switching inputs and outputs ............................................2-8
2.5 Resetting the modem (reset) ..............................................................................2-9
3 Configuration via WBM ............................................................................................................3-1
3.1 Connection requirements ...................................................................................3-1
3.2 Starting web-based management (WBM) ..........................................................3-1
3.3 Device Information (View device status).............................................................3-3
3.3.1 Hardware ............................................................................................3-3
3.3.2 Status ..................................................................................................3-4
3.4 Local Network (Set up local network) .................................................................3-6
3.4.1 IP Configuration (Set up connection) ..................................................3-6
3.5 Wireless Network (Mobile phone settings) .........................................................3-7
3.5.1 GSM ...................................................................................................3-7
3.5.2 GPRS/EDGE .......................................................................................3-9
3.5.3 PING .................................................................................................3-10
3.5.4 Remote Configuration (Remote maintenance) ..................................3-11
3.6 Network Security (Security settings).................................................................3-12
3.6.1 Firewall (Definition of firewall rules) ...................................................3-12
3.6.2 NAT Table (Addressing table setup) .................................................3-15
3.7 VPN ..................................................................................................................3-16
3.7.1 IPsec Connections (IPsec connection setup) ....................................3-17
3.7.2 IPsec Certificates (Certificate upload) ...............................................3-22
3.7.3 IPsec Status (Status of the VPN connection) ....................................3-24
3.8 System .............................................................................................................3-25
3.8.1 User (Password modification) ...........................................................3-25
3.8.2 Additional AT commands ..................................................................3-26
3.8.3 RTC (Time and date setup) ...............................................................3-27
3.8.4 Reboot (Modem restart) ....................................................................3-29
3.8.5 Firmware Update ..............................................................................3-30
3.9 CIDR (Classless Inter-Domain Routing) ...........................................................3-31
PSI-MODEM-GSM/ETH
4 Creating certificates .................................................................................................................4-1
4.1 Installing XCA.....................................................................................................4-1
4.2 Creating a database ...........................................................................................4-1
4.3 Creating a CA certificate.....................................................................................4-3
4.4 Creating machine certificates .............................................................................4-7
4.4.1 Creating templates ..............................................................................4-7
4.4.2 Creating machine certificates based on a template ...........................4-11
4.4.3 Exporting machine certificates ..........................................................4-14
5 Application examples for secure VPN connections..................................................................5-1
5.1 Modem-to-modem connection via GPRS/EDGE ................................................5-1
5.1.1 Setting up modem 1 ............................................................................5-1
5.1.2 Setting up modem 2 ............................................................................5-4
5.2 Connection from a modem to a control center via GPRS/EDGE
and the Internet ..................................................................................................5-5
5.2.1 Loading certificates on the modem .....................................................5-5
5.2.2 Loading certificates on the FL MGUARD RS VPN ..............................5-8
5.2.3 Setting a packet filter on the FL MGUARD RS VPN ..........................5-10
5.2.4 Setting up the VPN connection in mGuard ........................................5-10
5.2.5 Checking the status of the VPN connection in mGuard .....................5-13
ii PHOENIX CONTACT 103965_en_00
Description of the GSM modem
1 Description of the GSM modem
1.1 Description
The PSI-MODEM-GSM/ETH GSM modem is a high-performance modem for industrial
Ethernet networks, which can be used to transmit sensitive data securely via GSM
networks. The integrated firewall and the VPN support (Virtual Private Network) protect your
application against unauthorized access.
Remote stations can be integrated into an IP network via a GPRS/EDGE connection or by
dialing the phone number. The quad band technology means that the modem can be used
globally in all 850, 900, 1800, and 1900 MHz GSM networks.
No matter where your system or controller is located – the process data is available at any
location via a secure VPN connection.
For reliable and safe communication, the focus is on EMC, electrical isolation, and surge
protection.
In addition, the GPRS/EDGE service and GSM network quality are monitored. If necessary,
a corresponding message is sent or the GSM connection is reestablished.
Features
– Quad band (850 MHz/900 MHz/1800 MHz/1900 MHz)
– GPRS (General Packet Radio Service) and EDGE (Enhanced Data Rates for GSM
Evolution)
– Integrated TCP/IP stack
– Virtual permanent line for connecting networks via GPRS
– Integrated firewall
– VPN support
– Wide supply voltage range of 10 V DC to 30 V DC
– Temperature range of -25°C to +60°C
– High-quality electrical isolation (VCC // Ethernet)
– Integrated surge protection
– Easy configuration via web-based management (WBM)
103965_en_00 PHOENIX CONTACT 1-1
PSI-MODEM-GSM/ETH
1.2 Ordering data
1.3 Technical data
Modem
Description Type Order No. Pcs./Pkt.
Quad band modem for GPRS/EDGE and GSM with Ethernet interface,
firewall, VPN support, and alarm inputs and outputs
PSI-MODEM-GSM/ETH 2313355 1
Accessories
Description Type Order No. Pcs./Pkt.
GSM quad band antenna with omnidirectional characteristics PSI-GSM-QB-ANT 2313155 1
Antenna cable with SMA circular connector
Degree of protection
Dimensions
2 m
IP65
76 mm x 20 mm
GSM stub antenna for installation directly on the device, angled antenna
connector (90°, SMA circular connector)
PSI-GSM-STUB-ANT 2313342 1
System power supply unit,
primary-switched
Input voltage range
Nominal output voltage
Nominal output current
45 Hz ... 65 Hz
85 V AC ... 264 V AC
24 V DC ±1%
1.5 A
MINI-SYS-PS-100-240AC/24DC/1.5 2866983 1
DIN rail connector (3 required) ME 17,5 TBUS 1,5/ 5-ST-3,81 GN 2709561 1
Power supply
Supply voltage 10 V DC ... 30 V DC
Via COMBICON plug-in screw terminal block
24 V DC ±5% (alternative or redundant, via backplane bus contact and system
power supply)
Frequency DC
Current consumption
Nominal current consumption
Standby current consumption
< 360 mA at 24 V
< 90 mA at 24 V
LED indicator VCC (green LED)
Steady light: Operation
Ethernet interface
Connection method RJ45 female connector, shielded
Transmission speed 10/100 Mbps
Transmission length 100 m (twisted pair, shielded)
Supported protocols TCP/IP, UDP, TFTP, HTTP, MODBUS TCP, PPP, PROFINET, EtherNet IP,
CHAP
Secondary protocols ARP, DHCP, BOOTP, SNMP, RIP, RARP
LED indicator/data indicator TD (yellow LED), GSM data to modem (dynamic)
RD (green LED), GSM data from modem (dynamic)
LED indicator/control signal indicator ACT (yellow LED), Ethernet data transmission
LINK (green LED), Ethernet link established
Function
Management Web-based management, SNMP
1-2 PHOENIX CONTACT 103965_en_00
Description of the GSM modem
GSM/GPRS
Frequencies 850 MHz, 900 MHz, 1800 MHz, 1900 MHz (EGSM)
Transmission power 2 W at 850 MHz and 900 MHz
1 W at 1800 MHz and 1900 MHz
SIM interface 1.8 V and 3 V SIM card
GPRS compatibility GPRS Class 12, Class B
Coding scheme: CS1 ... CS4
EDGE EDGE (EGPRS) multislot Class 10
Network function 4 time slots for receiving data
4 time slots for transmitting data,
maximum of 5 simultaneous time slots
The PIN code is saved in the modem. After a voltage interrupt, the modem
automatically redials into the network and automatically logs into the GPRS
network.
Integrated TCP/IP stack, firewall, and VPN support, automatic connection
establishment.
Command set compatibility AT standard command set and extended
V.250 basic command set
Antenna connection 50 Ω impedance SMA female antenna connector
LED SIM (red LED)
– Steady light: No SIM card present
– Flashing: No PIN code entered
– OFF: SIM card present and PIN code entered
NET (yellow LED)
– Steady light: Very good network reception
– Flashing: Good network reception
– Flashing quickly: Moderate network reception
– OFF: No network reception
Startup diagnostics Selftest, visualization via LEDs
(controller, RAM, EPROM, GSM engine, antenna, EEPROM)
Network test Network bargraph in web-based management
General data
Ambient temperature range (operation) -25°C ... +60°C
Housing
Material
Dimensions (H x W x D)
ME 35 with 5-pos. bus contact and ground contact
PA 6.6-FR, V0, green
99 mm x 35 mm x 120 mm
Weight of device 237 g
Functional earth ground Housing contact with DIN rail
Degree of protection IP20
Separate ground levels Supply // Ethernet (TP) // antenna
Vibration resistance According to DIN EN 60068-2-6
5g, 1.5 h each in x, y, and z direction
Shock test
Operation
Storage
According to DIN EN 60068-2-27
15g, 11 ms, half-sine shock pulse
30g, 11 ms, half-sine shock pulse
Free fall According to IEC 60068-2-32 from a height of 1 m (without packaging)
Test voltage 1.5 kV AC, 50 Hz, 1 min. between all ground levels according to
DIN EN 61010-1/VDE 0411-1 and DIN EN 60950
CE conformance According to R&TTE Directive 1999/5/EC
103965_en_00 PHOENIX CONTACT 1-3
PSI-MODEM-GSM/ETH
Electromagnetic compatibility
Noise immunity according to EN 61000-6-2
Electrostatic discharge (ESD) EN 61000-4-2 Criterion B
8 kV air discharge
6 kV contact discharge
Electromagnetic HF field
Amplitude modulation
Pulse modulation
EN 61000-4-3 Criterion A
10 V/m
10 V/m
Fast transients (burst)
Signal
Power supply
EN 61000-4-4
Criterion A
1 kV/5 kHz
Criterion A
1 kV/5 kHz
Criterion B
2 kV/ 5 kHz
Surge current load (surge)
Signal
Power supply
EN 61000-4-5 Criterion B
1 kV
2 kV
Conducted interference EN 61000-4-6 Criterion A
10 V
Noise emission EN 55011 Class A
CE conformance according to R&TTE Directive 1999/5/EC
EMC
Noise immunity
(electromagnetic compatibility)
EN 61000-6-2 Generic standard for the industrial
sector
Safety
Protection of personnel with regard to electrical safety EN 60950
Health
Limitation of exposure of the population to electromagnetic fields EC Gazette 1999/519/EC EC Council recommendation of
July 12, 1999
Radio
Effective use of the frequency spectrum and prevention of radio interference DIN EN 301511
1-4 PHOENIX CONTACT 103965_en_00
Hardware installation
2 Hardware installation
2.1 Housing dimensions
Figure 2-1 Housing dimensions (in mm)
2.2 Mounting the module on a DIN rail
• Mount the modem on a 35 mm EN DIN rail (see Figure 2-2).
Figure 2-2 Mounting
NOTE:
Only mount and remove the modem when the power supply is disconnected.
NOTE:
The DIN rail must be connected to PE to ensure safe operation.
103965A001
120 35
99
PSI-MODEM-GSM/ETH
Ord.-No. 23 13 355
LAN
VCC
RD
TD
ALR
NET
DCD
SIM
AA
VPN
ACT
LNK
ANT
102678A002
103965_en_00 PHOENIX CONTACT 2-1
PSI-MODEM-GSM/ETH
2.3 Description of the connections and LEDs
Connection terminal blocks
1 Connection terminal blocks (COMBICON): 24 V power supply, 0 V power supply
2 6 switching inputs, digital
3 4 switching outputs, digital
Connectors
4 SMA female antenna connector
5 RJ45, Ethernet interface (TP port)
LEDs
VCC (Green) Steady light if supply voltage is present
RD (Yellow) Receive data with reference to the GSM connection
TD (Green) Transmit data with reference to the GSM connection
ALR (Red) Steady light if alarm message was sent successfully
Flashes when alarm message is being sent
Flashes quickly if alarm message could not be sent
OFF if no alarm is present
NET (Yellow) Steady light for very good network reception
Flashes for good network reception
Flashes quickly for moderate network reception
OFF if there is no network reception or reception is very poor
SIM (Red) No SIM card; flashes if no PIN code has been entered
AA (Yellow) Automatic answer, flashes during selective call acceptance
VPN (Green) VPN tunnel active
ACT (Yellow) Ethernet data transmission
LINK (Green) Ethernet link established
Beneath the cover
6 SIM card holder
Reset button
31 2
4
6
PSI-MODEM-GSM/ETH
Ord.-No. 23 13 355
LAN
VCC
RD
TD
ALR
NET
DCD
SIM
AA
VPN
ACT
LNK
ANT
5
2-2 PHOENIX CONTACT 103965_en_00
Hardware installation
2.4 Establishing connections
2.4.1 Safety notes
WARNING: Electrical connection may only be carried out by qualified personnel
Only qualified personnel may connect the power, start up, and operate this device.
According to the safety instructions in this text, qualified personnel are persons who are
authorized to start up, to ground, and to mark devices, systems, and equipment according
to the standards of safety technology. In addition, these persons must be familiar with all
warning instructions and maintenance measures in this text.
Disregarding this warning may result in damage to equipment and/or serious personal
injury.
WARNING: SELV operation
The PSI-MODEM-GSM/ETH is designed exclusively for SELV operation according to
IEC 60950/EN 60950/VDE 0805.
WARNING:
The modem must only be connected to devices, which meet the requirements of
EN 60950 ("Safety of Information Technology Devices").
WARNING: Disconnect the device power supply before replacing the SIM card.
The device only supports 1.8 and 3 V SIM cards. For older SIM cards, please contact your
GSM service provider.
103965_en_00 PHOENIX CONTACT 2-3
PSI-MODEM-GSM/ETH
2.4.2 Connecting Ethernet networks
The PSI-MODEM-GSM/ETH has an Ethernet interface on the front in RJ45 format, to which
only twisted pair cables with an impedance of 100 Ω can be connected.
• Push the Ethernet cable with the crimped RJ45 connector into the LAN interface until it
engages with a click.
Please observe the keying of the connector.
Figure 2-3 RJ45 interface
The RD and TD LEDs indicate the status of the Ethernet connection.
WARNING:
The modem must only be connected to devices, which meet the requirements of
EN 60950 ("Safety of Information Technology Devices").
NOTE:
Only use shielded twisted pair cables and corresponding shielded RJ45 connectors.
Table 2-1 Meaning of the terminal designations
Designation Meaning
TD (transmit data) Transmit data (refers to PC, PLC, etc.)
RD (receive data) Receive data (refers to PC, PLC, etc.)
RD (Yellow) Receive data with reference to the GSM connection
TD (Green) Transmit data with reference to the GSM connection
� � � � �
� � � � �
� � � � �
� � � �
� � � �
� � � � �
� � � � �
� � � �
� � �
� � �
� � �
� � �
� � � �
� � � �
� � � �
� � � �
� � � �
2-4 PHOENIX CONTACT 103965_en_00
Hardware installation
2.4.3 Connecting the antenna
Figure 2-4 Antenna connection with SMA connector
• Connect a suitable antenna to the antenna connection.
• If the "NET" LED indicates good (flashing) or very good reception (steady light), secure
the antenna.
Installing the antenna
• Select an antenna position with a good wireless network signal. The "NET" LED can be
used to determine the receive quality.
• When using the PSI-GSM-900/1800-ANT antenna (Order No. 2708902), drill a hole
measuring 16.5 mm in diameter in the top of the control cabinet.
• Secure the antenna using the washer and nut provided:
Figure 2-5 PSI-GSM-900/1800-ANT antenna installation
NOTE: Please observe the following during installation:
– The antenna has a diameter of 76 mm and is 21 mm high.
– The cable is 2 meters long.
VCC
RD
TD
ALR
NET
DCD
SIM
AA
VPN
ACT
LNK
ANTPSI-M
OD
EM-G
SM/E
TH
Ord
.-No. 23
13355
102678A005
103965_en_00 PHOENIX CONTACT 2-5
PSI-MODEM-GSM/ETH
2.4.4 Inserting the SIM card
Figure 2-6 Opening the housing
Opening the housing Open the housing to access the SIM card holder inside.
• Using a screwdriver, lever off the LAN connection cover.
Inserting the SIM card Your GSM service provider will have supplied you with a SIM card where all the important
data for your connection is stored.
• If you have been supplied with a SIM card in credit card format, simply detach the small
section of the card and remove any excess plastic from the edges.
• With the contact surface facing the PCB, slide the SIM card into the holder. The angled
corner should point upward (see Figure 2-6).
PIN code The SIM card can be protected with a 4 or 5-digit PIN code.
When selecting the SIM card, please note that a packet data connection (GPRS or EDGE)
is required for the core functions (VPN router).
WARNING: Disconnect the device power supply before replacing the SIM card.
The device only supports 1.8 and 3 V SIM cards. For older SIM cards, please contact your
GSM service provider.
NOTE: Electrostatic discharge
The module contains components that can be damaged or destroyed by electrostatic
discharge. When handling this module, observe the necessary safety precautions against
electrostatic discharge (ESD) according to EN 61340-5-1 and EN 61340-5-2.
ALAN
NETDCDSIM
AA
VPN
ACTLNK
LAN
NETDCDSIM
AA
VPN
ACTLNK
C
B
7174B012
It is recommended that you enter the PIN code as described in "User (Password
modification)" on page 3-25.
2-6 PHOENIX CONTACT 103965_en_00
Hardware installation
2.4.5 Connecting the supply voltage
The supply voltage must be between 10 V DC and 30 V DC.
• Connect the 24 V supply voltage to the "24V" and "0V" terminal points on the plug-in
screw terminal block.
As soon as the "VCC" LED lights up, the modem is ready.
Figure 2-7 Connecting the supply voltage
WARNING: The PSI-MODEM-GSM/ETH is designed exclusively for SELV operation
according to IEC 60950/EN 60950/VDE 0805.
O1
O2
24V
0V
I1I2
O3
O4
I3
I4
I5I6
I3 I4 I5 I6
O1 O224V 0V I1 I2
O3 O4
24 V 0 V
103965_en_00 PHOENIX CONTACT 2-7
PSI-MODEM-GSM/ETH
2.4.6 Connecting switching inputs and outputs
Figure 2-8 Wiring the inputs
• Connect the switching inputs and outputs to the relevant plug-in screw terminal blocks.
– 10 ... 30 V DC can be connected to the floating switching inputs (IN1 ... IN6).
– The short-circuit-proof switching outputs (O1 ... O4) are designed for a maximum
of 50 mA at 10 ... 30 V DC.
• The 0 V potential of the switching inputs and outputs must be connected to the "0 V"
terminal block of the power supply connection.
NOTE: The switching outputs are only enabled in software release 1.xx or later.
They are not available in earlier versions.
I3 I4 I5 I6
O1 O224V 0V I1 I2
O3 O4
-+
2-8 PHOENIX CONTACT 103965_en_00
Hardware installation
2.5 Resetting the modem (reset)
The modem has a concealed reset button, which is used to reset the modem IP address to
the setting default upon delivery.
• Disconnect the Ethernet cable from the LAN connection on the modem.
Opening the housing Open the housing to access the reset button inside.
Figure 2-9 Opening the housing
• Using a screwdriver, lever off the LAN connection cover.
• Press and hold down the reset button (1).
Reconnect the Ethernet cable and hold down the reset button for a further 5 seconds.
The IP address is reset to the setting default upon delivery.
The modem can be accessed via 192.168.0.1.
ALAN
NETDCDSIM
AA
VPN
ACTLNK
LAN
NETDCDSIM
AA
VPN
ACTLNK
B
103965a003
1
103965_en_00 PHOENIX CONTACT 2-9
Configuration via WBM
3 Configuration via WBM
3.1 Connection requirements
– The PSI-MODEM-GSM/ETH modem must be connected to the power supply.
– The computer that is to be used for configuration must be connected to the LAN female
connector on the modem.
– A 27
– browser (e.g., Mozilla Firefox, Microsoft Internet Explorer or Apple Safari) must be
installed on the configuration computer.
3.2 Starting web-based management (WBM)
The PSI-MODEM-GSM/ETH is configured via web-based management (WBM).
• Establish an Ethernet connection from the PSI-MODEM-GSM/ETH to a PC by means
of an Internet connection.
• Open a browser on the PC.
• Set the IP address of your PC to the network of the modem.
• Enter the IP address 192.168.0.1 in the address field of your browser.
The following page opens in the browser.
Figure 3-1 Login window
This page protects the area in WBM where modem settings are modified.
A user name and password are required in order to log in.
103965_en_00 PHOENIX CONTACT 3-1
PSI-MODEM-GSM/ETH
• The user name is "admin" and the password is "admin".
There are two user levels:
– user: Read-only access to the "Device Information" menu item.
– admin: Full access to all areas.
To configure the modem, make the desired settings on the individual pages of the modem
user interface.
For security reasons, we recommend you change the password during initial
configuration (see "User (Password modification)" on page 3-25).
3-2 PHOENIX CONTACT 103965_en_00
Configuration via WBM
3.3 Device Information (View device status)
This area can be accessed without logging in and displays information about the hardware
and status of the modem.
3.3.1 Hardware
Device Information >> Hardware
Hardware Address Address of the manufacturer
Internet Internet address of the manufacturer
Type Order designation of the modem
Order-No. Order number of the modem
Serial Number Serial number of the modem
Hardware Hardware version of the modem
Firmware Version Firmware version of the modem
Operating System Operating system version
Web Based
Management
Version of web-based management
MAC Address The MAC address enables the unique identification of an
Ethernet device in a computer network.
IMEI The IMEI (International Mobile Station Equipment Identity) is a
15-digit serial number, which can be used to clearly identify
each GSM or UMTS termination device.
103965_en_00 PHOENIX CONTACT 3-3
PSI-MODEM-GSM/ETH
3.3.2 Status
Current status information about the GSM network and the network connections is
displayed here.
3.3.2.1 GSM
Device Information >> Status >> GSM
GSM Status Provider Provider name
Networkstatus Status of the mobile phone network
Registered home: Logged into the provider's home network
Roaming: Dial-in into an external mobile phone network
Waiting for PIN: Enter PIN
Wrong PIN: Incorrect PIN entered
No SIM Card: Insert SIM card
Power off: GSM module has not been started yet
Signal Level Signal strength as a dBm value and bar
Signal Quality Signal quality as a % value and bar
Packet Data GPRS offline/online: GPRS is a GSM service, which
provides packet-based wireless access for mobile GSM
users.
EDGE offline/online: EDGE is a further development of the
GPRS data service and has a higher data transmission rate.
3-4 PHOENIX CONTACT 103965_en_00
Configuration via WBM
3.3.2.2 Network Connections (Network settings)
The "Network Connections" pages displays network information about the local Ethernet
interface and the GSM and GPRS/EDGE interface.
Device Information >> Status >> Network Connections
Network Connections
Wireless Network Link TCP/IP connected/not connected: TCP/IP is connected/is
not connected.
VPN connected/not connected/idle: VPN is connected/is
not connected/is idle.
PPP connected/not connected: PPP is connected/is not
connected. PPP is a standard protocol that Internet providers
use for customer dial-in.
IP Address IP address assigned by the provider
Netmask Subnet mask assigned by the provider
DNS Server IP address of the DNS server
Sec. DNS Server IP address of the alternative DNS server
Local Network Link The local Ethernet is connected (connected)/is not
connected (not connected).
IP Address Current Ethernet IP address
Netmask Subnet mask of the local Ethernet network
103965_en_00 PHOENIX CONTACT 3-5
PSI-MODEM-GSM/ETH
3.4 Local Network (Set up local network)
3.4.1 IP Configuration (Set up connection)
The connection from the modem to the local Ethernet computer can be set up here.
The IP configuration can also be modified here. The IP address, subnet mask, and the type
of address assignment can be set.
Local Network >> IP Configuration
IP Configuration
Current Addresses IP Address Current IP address of the computer that is connected to the
LAN interface of the modem.
The IP address can be reset (see "Resetting the modem
(reset)" on page 2-9).
Subnet Mask The subnet mask for the current IP address.
Type of the IP address
assignment
Static (default): The IP address is assigned permanently
(fixed IP).
DHCP: When the modem is started, the IP address and the
subnet mask are assigned dynamically by a DHCP server.
Enter addresses in dotted decimal notation. I.e.,
four decimal integers in the range from 0 to 255
separated by dots, for example: 130.94.122.195.
3-6 PHOENIX CONTACT 103965_en_00
Configuration via WBM
3.5 Wireless Network (Mobile phone settings)
Remote stations can be integrated into an IP network via a GSM or GPRS/EDGE
connection. The connection can be configured here.
3.5.1 GSM
Wireless Network >> GSM
GSM Setup Country Select the country in which the modem is dialing into the GSM
network. This setting limits the selection under Provider.
PIN In the PIN field, enter the PIN for the SIM card. The PIN cannot
be read back, it can only be overwritten.
Frequency In the Frequency field, the frequency range in which the
modem is to operate can be selected using the checkboxes.
Roaming If Roaming is activated (default), a specific provider can be
selected from the "Provider" pull-down menu.
Enable: The modem can also dial-in via external networks. If
Auto is set under Provider, the strongest provider is selected.
Depending on your contract, this can incur additional costs.
Alternatively, you can specify a provider.
Disable: Roaming is deactivated and only the provider's
home network is used. If this network is unavailable, the
modem cannot establish an Internet connection.
103965_en_00 PHOENIX CONTACT 3-7
PSI-MODEM-GSM/ETH
Provider Select a provider via which the modem is to establish the
Internet connection.
The country selected under Country limits the list of
providers.
Auto: The modem automatically selects the provider.
Wireless Network >> GSM (continued)
3-8 PHOENIX CONTACT 103965_en_00
Configuration via WBM
3.5.2 GPRS/EDGE
Wireless Network >> GPRS/EDGE
Packet Data Setup Packet Data Disable: The GPRS/EDGE connection is deactivated.
Enable: Enable access to GPRS/EDGE.
If GPRS/EDGE is activated, there is only a virtual permanent
connection to the partner. This wireless area is not used until
data is actually transmitted. This is why GPRS services are
usually invoiced based on the volume of data rather than the
connection time.
Username User name for GPRS/EDGE access
The user name and password can be obtained from your
provider.
Password Password for GPRS/EDGE access
APN The APN can be obtained from your provider.
APN (Access Point Name) is the name of a terminal point in a
GPRS network, which enables access to an external packet
data network.
The APN defines the access point at which a connection can
be established for the mobile termination device. At the same
time, the APN specifies which network is to be used to
establish a connection.
Manual DNS Disable: Deactivate manual DNS setting. The DNS settings
are received automatically from the provider.
Enable: Enable manual DNS setting.
DNS Server IP address of the primary DNS server in the mobile phone network
Sec. DNS Server IP address of the alternative DNS server in the mobile phone
network
103965_en_00 PHOENIX CONTACT 3-9
PSI-MODEM-GSM/ETH
3.5.3 PING
This option can be used to influence behavior on receipt of ICMP packets, which are sent
from the external GPRS network to the modem.
A ping can be used to check whether a device in an IP network can be accessed. This can
be useful during startup. During normal operation, responding to external ping requests
results in data traffic and thus associated costs, if applicable.
Wireless Network >> PING
Ping ICMP external Disable: If a ping request is sent from the external GPRS
network to the modem, it is ignored.
Enable: If a ping request is sent from the external GPRS
network to the modem, it is sent back. It is thus possible to test
whether the modem can be accessed.
3-10 PHOENIX CONTACT 103965_en_00
Configuration via WBM
3.5.4 Remote Configuration (Remote maintenance)
This option can be used to specify whether the modem may be configured via the mobile
phone network or the external network using WBM.
Wireless Network >> Remote Configuration
Remote Configuration Web based
Management external
Disable: External configuration via WBM is not possible. Set
this option if you can configure and maintain the modem locally.
Enable: The modem can be configured externally via WBM.
Remote maintenance of the modem is thus possible.
103965_en_00 PHOENIX CONTACT 3-11
PSI-MODEM-GSM/ETH
3.6 Network Security (Security settings)
3.6.1 Firewall (Definition of firewall rules)
The GSM modem includes a Stateful Packet Inspection Firewall.
The connection data of an active connection is recorded in a database (connection tracking).
Rules can thus only be defined for one direction. This means that data from the other
direction of the relevant connection, and only this data, is automatically allowed through.
The firewall can be enabled and disabled. It can be deactivated for startup, for example, by
disabling the packet filter ("Packet Filter" set to "Disable").
If multiple firewall rules are defined, these are queried starting from the top of the list of
entries until an appropriate rule is found. This rule is then applied.
If the list of rules contains further subsequent rules that could also apply, these rules are
ignored.
Network Security >> Firewall
Firewall Lists the firewall rules that have been set up. They apply for incoming data connections
that have been initiated externally.
3-12 PHOENIX CONTACT 103965_en_00
Configuration via WBM
Packet Filter Disable: A packet filter is not used. The subsequent rules are
not applied.
Enable: The data is packed in data packets by the
transmitting host in a network and sent. Each packet that
passes through the packet filter is checked. Using the data
present in each packet, such as the sender and recipient
addresses, the packet filter decides what to do with this packet
based on filter rules. An impermissible packet, which may not
pass through the filter, is either discarded (Drop) or sent back
to the sender with a remark that access was not permitted
(Reject).
Incoming Traffic Protocol TCP, UDP, ICMP, all
From IP/To IP 0.0.0.0/0 means all IP addresses. To specify an address area,
use CIDR format (see "CIDR (Classless Inter-Domain
Routing)" on page 3-31).
From Port/To Port (Only evaluated for TCP and UDP protocols.)
– any refers to any port.
– startport:endport (e.g., 110:120) refers to a port area.
Action Accept: The data packets may pass through.
Reject: The data packets are sent back, which means that the
sender is informed of their rejection.
Drop: The data packets may not pass through. They are
discarded, which means that the sender is not informed of
their whereabouts.
Log For each individual firewall rule you can specify whether the
event is to be logged if the rule is applied.
– Log set to Yes (event is logged)
– Log set to No (default setting)
New The "New" button adds a new firewall rule below the last rule.
The "Delete" button deletes the relevant rule from the table.
The arrows can be used to move the rule up/down a row.
Network Security >> Firewall
103965_en_00 PHOENIX CONTACT 3-13
PSI-MODEM-GSM/ETH
Outgoing Traffic Lists the firewall rules that have been set up. They apply for outgoing data connections
that have been initiated internally in order to communicate with a remote partner.
Default setting: A rule is defined by default that permits all outgoing connections.
Protocol TCP, UDP, ICMP, all
From IP/To IP 0.0.0.0/0 means all IP addresses. To specify an address area,
use CIDR format (see "CIDR (Classless Inter-Domain
Routing)" on page 3-31).
From Port/To Port (Only evaluated for TCP and UDP protocols.)
– any refers to any port.
– startport:endport (e.g.,110:120) refers to a port area.
Action Accept: The data packets may pass through.
Reject: The data packets are sent back, which means that the
sender is informed of their rejection.
Drop: The data packets may not pass through. They are
discarded, which means that the sender is not informed of
their whereabouts.
Log For each individual firewall rule you can specify whether the
event is to be logged if the rule is applied.
– Log set to Yes (event is logged)
– Log set to No (default setting)
New The "New" button adds a new firewall rule below the last rule.
The "Delete" button deletes the relevant rule from the table.
The arrows can be used to move the rule up/down a row.
Network Security >> Firewall
If no rule is defined, all outgoing connections are prohibited (excluding VPN).
3-14 PHOENIX CONTACT 103965_en_00
Configuration via WBM
3.6.2 NAT Table (Addressing table setup)
Lists the rules defined for NAT (Network Address Translation).
The GSM modem has one IP address, which can be used to access the modem externally.
For incoming data packets, the device can convert the specified sender IP addresses to
internal addresses, a technique referred to as NAT (Network Address Translation). Using
the port number, the data packets can be redirected to ports of internal IP addresses.
Network Security >> NAT Table
Protocol TCP, UDP, ICMP
From Port/To Port (Only evaluated for TCP and UDP protocols.)
– any refers to any port.
– startport:endport (e.g.,110:120) refers to a port area.
To IP 0.0.0.0/0 means all IP addresses. To specify an address area,
use CIDR format (see "CIDR (Classless Inter-Domain
Routing)" on page 3-31).
Log For each individual rule you can specify whether the event is
to be logged if the rule is applied.
– Log set to Yes (event is logged)
– Log set to No (default setting)
New The "New" button adds a new rule below the last rule.
The "Delete" button deletes the relevant rule from the table.
The arrows can be used to move the rule up/down a row.
103965_en_00 PHOENIX CONTACT 3-15
PSI-MODEM-GSM/ETH
3.7 VPN
Requirements for a VPN connection
A general requirement for a VPN connection is that the IP addresses of the VPN partner are
known and can be accessed.
– In order to successfully establish an IPsec connection, the VPN partner must support
IPsec with the following configuration:
– Authentication via X.509 certificates
– ESP
– Diffie-Hellman group 2 or 5
– 3DES or AES encryption
– MD5 or SHA-1 hash algorithms
– Tunnel mode
– Quick mode
– Main mode
– SA lifetime (1 second to 24 hours)
– If the partner is a computer running Windows 2000, the Microsoft Windows 2000 High
Encryption Pack or at least Service Pack 2 must be installed.
3-16 PHOENIX CONTACT 103965_en_00
Configuration via WBM
3.7.1 IPsec Connections (IPsec connection setup)
IPsec (Internet Protocol Security) is a security protocol that is used for communication via
IP networks.
VPN >> IPsec >> Connections
IPsec Connections Enable Specifies whether the defined VPN connection should be
active (Yes) or not (No).
Name Assign a descriptive name to each VPN connection. The
connection can be freely named and renamed.
Settings Click on Edit to specify the settings for IPsec (see page 3-18).
IKE The Internet Key Exchange protocol provides automatic key
management for IPsec.
For two end points to create a secure connection, a key
exchange procedure is required. With automatic key
configuration, session keys are negotiated automatically via
certificates.
Click on Edit to specify the settings for IKE (see page 3-20).
103965_en_00 PHOENIX CONTACT 3-17
PSI-MODEM-GSM/ETH
3.7.1.1 Settings >> Edit
VPN >> IPsec >> Connections >> Settings >> Edit
IPsec Connection Settings Name The name of the VPN connection entered under IPsec
Connections.
VPN Specifies whether the defined VPN connection should be
active (Enable) or not (Disable).
Remote Host IP address or URL of the partner to which (or from which) the
tunnel will be created.
The Remote Host setting is only used if Initiate has been
selected under Remote Connection, i.e., the modem
establishes the connection.
If Remote Connection is set to Accept, the value "%any" is
set internally for Remote Host in order to wait for a
connection.
Authentication X.509 Remote Certificate authentication method.
With the X.509 certificate option, each VPN device has a
private key and a public key in the form of an X.509 certificate,
which contains additional information about the certificate's
owner and the certification authority (CA).
The procedure for creating an X.509 certificate is
described under Section 4, "Creating
certificates".
3-18 PHOENIX CONTACT 103965_en_00
Configuration via WBM
Remote Certificate Specifies which certificate the modem shows to the VPN
partner (partner certificate, .pem).
The certificate can be selected from the selection list.
The selection list contains the certificates that have been
loaded on the modem (see "IPsec Certificates (Certificate
upload)" on page 3-22).
Local Certificate Specifies the certificate the modem uses to authenticate the
VPN partner (machine certificate, PKCS#12)
The certificate can be selected from the selection list.
The selection list contains the certificates that have been
loaded on the modem (see "IPsec Certificates (Certificate
upload)" on page 3-22).
Remote ID Default: Empty field
The Remote ID can be used to specify the name the modem
uses to identify itself to the partner. It must match the data in
the modem certificate. If the field is left empty, the data from
the certificate is used.
Valid values:
– Empty, i.e., no entry (default). The "Subject" entry
(previously "Distinguished Name") in the certificate is
then used.
– The "Subject" entry in the certificate.
One of the Subject Alternative Names, if they are listed in the
certificate. If the certificate contains Subject Alternative
Names, these are specified under "Valid values:". These can
include IP addresses, host names with "@" prefix or e-mail
addresses.
Local ID Default: Empty field
The Local ID can be used to specify the name the modem
uses to identify itself to the partner.
For additional explanation see Remote ID.
Address Remote
Network
IP address/subnet mask of the remote network to which the
VPN connection is to be established.
Address Local
Network
IP address/subnet mask of the local network.
Here, specify the address of the network or computer, which
is connected locally to the modem.
Remote Connection Here you can specify from which side the connection can be
established.
The VPN connection is started by the modem (Initiate) or
initiated by the partner (Accept).
VPN >> IPsec >> Connections >> Settings >> Edit
103965_en_00 PHOENIX CONTACT 3-19
PSI-MODEM-GSM/ETH
3.7.1.2 IKE >> Edit
VPN >> IPsec >> Connections >> IKE >> Edit
IPsec - Internet Key
Exchange Settings
Name The name of the VPN connection entered under IPsec
Connections.
Phase 1 ISAKMP SA
Key exchange
ISAKMP SA
Encryption
Encryption algorithm
(Internet Security Association and Key Management Protocol
(ISAKMP) is a protocol for creating Security Associations (SA)
and exchanging keys on the Internet.)
3DES is the most commonly used method and is therefore set
by default.
The following generally applies: The more bits an encryption
algorithm has (specified by the appended number), the more
secure it is. The relatively new AES-256 method is therefore
the most secure, however it is not used that widely yet.
The longer the key, the more time-consuming the encryption
procedure.
ISAKMP SA Hash Leave this set to all. It then will not make a difference whether
the partner is operating with MD5 or SHA-1.
ISAKMP SA Lifetime
(sec.)
The keys of an IPsec connection are renewed at defined
intervals in order to increase the difficulty of an attack on an
IPsec connection.
ISAKMP SA lifetime:
Lifetime in seconds of the keys agreed for the ISAKMP SA.
Default setting: 3600 seconds (1 hour).
The maximum permitted lifetime is 86,400 seconds (24 hours).
3-20 PHOENIX CONTACT 103965_en_00
Configuration via WBM
Phase 2 IPsec SA
Data exchange
In contrast to Phase 1 ISAKMP SA (key exchange), the
procedure for data exchange is defined here. It does not
necessarily have to differ from the procedure defined for key
exchange.
IPsec SA Encryption See ISAKMP SA Encryption
IPsec SA Hash See ISAKMP SA Encryption
IPsec SA Lifetime
(sec.)
Lifetime in seconds of the keys agreed for IPsec SA.
Default setting: 28,800 seconds (8 hours). The maximum
lifetime is 86,400 seconds (24 hours).
DH/PFS Group Key exchange procedure (defined in RFC 3526 – More
Modular Exponential (MODP) Diffie-Hellman groups for
Internet Key Exchange (IKE)).
Perfect Forward Secrecy (PFS): Method for providing
increased security during data transmission. With IPsec, the
keys for data exchange are renewed at defined intervals. With
PFS, new random numbers are negotiated with the partner,
instead of being derived from previously agreed random
numbers.
5/modp1536 – 2/modp1024
The following generally applies: The more bits an encryption
algorithm has (specified by the appended number), the more
secure it is. The longer the key, the more time-consuming the
encryption procedure.
Dead Peer Detection If the partner supports the Dead Peer Detection (DPD)
protocol, the relevant partners can detect whether or not the
IPsec connection is still valid and whether it needs to be
established again.
Behavior in the event that the IPsec connection is aborted:
– Off: No Dead Peer Detection
– Hold: Hold the IPsec connection
– Clear: Release the IPsec connection
– Restart: Restart the IPsec connection
DPD Delay (sec.) Delay until the next request for a sign of life
Period of time in seconds after which DPD Keep Alive
requests should be sent. These requests test whether the
partner is still available.
Default setting: 30 seconds.
DPD Timeout (sec.) Period of time in seconds after which the connection to the
partner should be declared dead, if there has been no
response to the Keep Alive requests.
Default setting: 120 seconds.
VPN >> IPsec >> Connections >> IKE >> Edit
103965_en_00 PHOENIX CONTACT 3-21
PSI-MODEM-GSM/ETH
3.7.2 IPsec Certificates (Certificate upload)
A certificate that is loaded on the modem is used to authenticate the modem at the partner.
The certificate acts as an ID card for the modem, which it shows to the relevant partner.
There are various certificate types.
– Remote or partner certificates contain the public key used to decode the encrypted
data.
– Own or machine certificates contain the private key used to encrypt the data. The
private key is kept private. A PKCS#12 file is therefore protected by a password.
– The CA certificate or root certificate is the "mother of all certificates used". It is used to
check the validity of the certificates.
By importing a PKCS#12 file, the modem is provided with a private key and the
corresponding certificate. Multiple PKCS#12 files can be loaded on the modem, enabling
the modem to show the desired self-signed or a CA-signed machine certificate to the
partner for various connections.
To use a certificate that is installed here, the certificate must be assigned under VPN >>
IPsec >> Connections >> Settings >> Edit.
Click "Apply" to load the certificate onto the modem.
The procedure for creating an X.509 certificate is described under Section 4, "Creating
certificates".
3-22 PHOENIX CONTACT 103965_en_00
Configuration via WBM
VPN >> IPsec >> Certificates
Certificates Load Remote
Certificate (.cer .crt)
Here you can upload certificates, which the modem can use
for authentication with the VPN partner.
Upload
Import the certificate. Click on "Browse" to select the
certificate that is to be imported.
Under VPN >> IPsec >> Connections >> Settings >> Edit,
one of the certificates listed under Remote Certificate or
Local Certificate can be assigned to each VPN connection.
Load Own PKCS#12
Certificate (.p12)
Upload
Import the certificate you have received from your provider.
The file must be in PKCS#12 format. Click on "Browse" to
select the certificate that is to be imported.
Under VPN >> IPsec >> Connections >> Settings >> Edit,
one of the certificates listed under Remote Certificate or
Local Certificate can be assigned to each VPN connection.
Password
In the Password field, enter the password used to protect the
private key of the PKCS#12 file. The password is assigned
when the key is exported.
Remote Certificates Overview of the imported .cer/.crt certificates.
Click on "Delete" to delete a certificate.
Own Certificates Overview of the imported PKCS#12 certificates.
Click on "Delete" to delete a certificate.
The symbols indicate whether a CA certificate, a machine
certificate or a private key was found in the PKCS#12 file
(green = present).
The procedure for creating an X.509 certificate is
described under Section 4, "Creating certificates".
103965_en_00 PHOENIX CONTACT 3-23
PSI-MODEM-GSM/ETH
3.7.3 IPsec Status (Status of the VPN connection)
VPN >> IPsec >> Status
Status Active IPsec
Connection
Status of the active VPN connection.
3-24 PHOENIX CONTACT 103965_en_00
Configuration via WBM
3.8 System
3.8.1 User (Password modification)
System >> User
User Setup Admin Unrestricted access to all areas.
Old password: Old password
New password: New password
Retype new password: Enter new password again
User Restricted access (read-only)
Default: user
Old password: Old password
New password: New password
Retype new password: Enter new password again
103965_en_00 PHOENIX CONTACT 3-25
PSI-MODEM-GSM/ETH
3.8.2 Additional AT commands
The AT command set is used to configure and parameterize modems.
The "AT Commands" option is intended for use during servicing in order to access the
GSM engine. It has no significance for normal use.
3-26 PHOENIX CONTACT 103965_en_00
Configuration via WBM
3.8.3 RTC (Time and date setup)
System >> RTC
Real Time Clock (RTC) New Time Here you can set the time, if no NTP server has been set up
(see below) or the NTP server cannot be reached.
NTP Synchronisation As soon as NTP Synchronisation is set to Enable, the GSM
modem references the date and time from a time server and
synchronizes with it.
Initial time synchronization can take up to 15 minutes. During
this time, the GSM modem continuously compares the time
data of the external time server and that of its own "clock" so
that this can be adjusted as accurately as possible. Only then
can the GSM modem act as the NTP server for the devices
connected to its LAN interface and provide the system time.
Timezone Select the time zone.
NTP Server NTP (Network Time Protocol)
The GSM modem can act as the NTP server for computers
that are connected to its LAN port. In this case, the devices
should be configured so that the local address of the GSM
modem is specified as the NTP server address.
So that the GSM modem can act as the NTP server, it must
reference the current date and the current time from an NTP
server (time server). To do this, the address of an NTP server
must be specified. In addition, NTP Synchronisation must be
set to Enable.
103965_en_00 PHOENIX CONTACT 3-27
PSI-MODEM-GSM/ETH
Daylight saving time Disable: Daylight saving is not taken into consideration.
Enable: Daylight saving is taken into consideration.
Time Server for Local
Network
Time Server Enable: The GSM modem acts as the time server in the local
network. The devices in the local network do not reference the
time via the Internet. Costs can thus be reduced.
Disable: The GSM modem does not act as the time server for
the local network.
System >> RTC
3-28 PHOENIX CONTACT 103965_en_00
Configuration via WBM
3.8.4 Reboot (Modem restart)
System >> Reboot
Reboot Reboot NOW! Click on Reboot NOW! to trigger a modem restart.
Any active data transmissions will be aborted.
Daily reboot Disable: No regular reboot.
Enable: A reboot is performed daily at the time set below.
Following a reboot the modem must log into the mobile phone
network again. The provider resets the data connection and
calculates charges. Regular rebooting provides protection
against the provider aborting and reestablishing the
connection at an unforeseeable point in time.
Time Time specified in Hours:Minutes:Seconds.
Please do not trigger a reboot while data
transmission is active.
103965_en_00 PHOENIX CONTACT 3-29
PSI-MODEM-GSM/ETH
3.8.5 Firmware Update
System >> Firmware Update
Firmware Update GSM
Engine
Updates can be installed for the firmware for the GSM
connection, the modem firmware, and web-based
management.
Updates ensure that you can benefit from enhanced functions
and product updates.
Updates can be downloaded at:
www.phoenixcontact.net/download.
To install updates:
• Click on "Browse" and select the file that contains the
update.
• Then click "Apply".
Firmware Update Modem
Update Web Based
Management
3-30 PHOENIX CONTACT 103965_en_00
Configuration via WBM
3.9 CIDR (Classless Inter-Domain Routing)
IP subnet masks and CIDR are methods of notation, which combine several IP addresses
to create a single address area. An area comprising consecutive addresses is handled like
a network.
To specify an area of IP addresses for the GSM modem, e.g., when configuring the firewall,
it may be necessary to specify the address area in CIDR format. In the table below, the left-
hand column shows the IP subnet mask, while the right-hand column shows the
corresponding CIDR format.
IP subnet maskBinary CIDR
255.255.255.255 11111111 11111111 11111111 11111111 32255.255.255.254 11111111 11111111 11111111 11111110 31255.255.255.252 11111111 11111111 11111111 11111100 30255.255.255.248 11111111 11111111 11111111 11111000 29255.255.255.240 11111111 11111111 11111111 11110000 28255.255.255.224 11111111 11111111 11111111 11100000 27255.255.255.192 11111111 11111111 11111111 11000000 26255.255.255.128 11111111 11111111 11111111 10000000 25
255.255.255.0 11111111 11111111 11111111 00000000 24255.255.254.0 11111111 11111111 11111110 00000000 23255.255.252.0 11111111 11111111 11111100 00000000 22255.255.248.0 11111111 11111111 11111000 00000000 21255.255.240.0 11111111 11111111 11110000 00000000 20255.255.224.0 11111111 11111111 11100000 00000000 19255.255.192.0 11111111 11111111 11000000 00000000 18255.255.128.0 11111111 11111111 10000000 00000000 17
255.255.0.0 11111111 11111111 00000000 00000000 16255.254.0.0 11111111 11111110 00000000 00000000 15255.252.0.0 11111111 11111100 00000000 00000000 14255.248.0.0 11111111 11111000 00000000 00000000 13255.240.0.0 11111111 11110000 00000000 00000000 12255.224.0.0 11111111 11100000 00000000 00000000 11255.192.0.0 11111111 11000000 00000000 00000000 10255.128.0.0 11111111 10000000 00000000 00000000 9
255.0.0.0 11111111 00000000 00000000 00000000 8254.0.0.0 11111110 00000000 00000000 00000000 7252.0.0.0 11111100 00000000 00000000 00000000 6248.0.0.0 11111000 00000000 00000000 00000000 5240.0.0.0 11110000 00000000 00000000 00000000 4224.0.0.0 11100000 00000000 00000000 00000000 3192.0.0.0 11000000 00000000 00000000 00000000 2128.0.0.0 10000000 00000000 00000000 00000000 1
0.0.0.0 00000000 00000000 00000000 00000000 0Example: 192.168.1.0/255.255.255.0 corresponds in CIDR format to: 192.168.1.0/24
103965_en_00 PHOENIX CONTACT 3-31
Creating certificates
4 Creating certificates
Certificates are required for a secure VPN connection.
Certificates can be acquired from certification authorities or you can create them using the
appropriate software. For example, X.509 certificates are created using Version 0.6.4 of the
XCA program. The XCA program can be downloaded at http://xca.sourceforge.net.
4.1 Installing XCA
• Start the setup_xca-0.6.4.exe setup file and follow the on-screen instructions of the
setup program.
4.2 Creating a database
These instructions for creating self-signed certificates are based on Version 0.6.4 of the
XCA program.
• Once installed, start the XCA program.
Figure 4-1 XCA Version 0.6.4 (1)
• Create a new database via the "File… New DataBase" menu item.
103965_en_00 PHOENIX CONTACT 4-1
PSI-MODEM-GSM/ETH
Figure 4-2 XCA Version 0.6.4 (2)
• Assign a password to encrypt the database.
• Select the "File... Options" menu item.
Figure 4-3 XCA Version 0.6.4 (3)
• Change the hash algorithm from SHA 256 to SHA 1.
4-2 PHOENIX CONTACT 103965_en_00
Creating certificates
4.3 Creating a CA certificate
First you must create a certification authority (CA) certificate.
This root certificate acts as an entity that certifies and authenticates the signing of all
certificates that are derived from it and thus guarantees the authenticity of the certificate that
is in circulation.
• Switch to the "Certificate" tab and click on "New Certificate".
Figure 4-4 XCA Version 0.6.4 (4)
In the program window shown, there is already a preset self-signed certificate with the
signature algorithm SHA-1.
103965_en_00 PHOENIX CONTACT 4-3
PSI-MODEM-GSM/ETH
• Switch to the "Subject" tab.
Figure 4-5 XCA Version 0.6.4 (5)
• Here, enter the information about the owner of the root certificate.
• Click on "Generate a new key".
Figure 4-6 XCA Version 0.6.4 (6)
• Do not change the default key size and type.
• Specify a name.
4-4 PHOENIX CONTACT 103965_en_00
Creating certificates
• Switch to the "Extensions" tab.
Figure 4-7 XCA Version 0.6.4 (7)
The period of validity of the certificate is specified on the "Extensions" tab. The root
certificate should have a longer period of validity than the machine certificates that are to be
created later.
In this example, the period of validity is set to 10 years. The certificate type is already set to
"Certification Authority" by default.
• Activate all the options as shown in Figure 4-7.
103965_en_00 PHOENIX CONTACT 4-5
PSI-MODEM-GSM/ETH
• Switch to the "Key Usage" tab.
Figure 4-8 XCA Version 0.6.4 (8)
• Select the "Certificate Sign" and "CRL Sign" options and click "OK" to complete root
certificate creation.
This certificate has been successfully created.
• A new root certificate is now listed in the overview, from which further machine
certificates can be derived.
Figure 4-9 XCA Version 0.6.4 (9)
4-6 PHOENIX CONTACT 103965_en_00
Creating certificates
4.4 Creating machine certificates
4.4.1 Creating templates
The further creation of machine certificates can be simplified by using templates.
• Switch to the "Templates" tab.
Figure 4-10 XCA Version 0.6.4 (10)
• Click on "New template" to create a terminal certificate.
• In the "Preset Template values" prompt that appears, select "Nothing".
On the "Subject" tab, specify the settings for the certificates that are to be created later.
103965_en_00 PHOENIX CONTACT 4-7
PSI-MODEM-GSM/ETH
• The following window appears. Stay on the "Subject" tab.
Figure 4-11 XCA Version 0.6.4 (11)
Two names appear in angular brackets ("Internal name" and "Common name").
The names in the angular brackets are simply placeholders, as the actual names are
assigned to the certificates. When using the template, the names are set individually.
4-8 PHOENIX CONTACT 103965_en_00
Creating certificates
• Switch to the "Extensions" tab.
Figure 4-12 XCA Version 0.6.4 (12)
• Change the certificate type to "End Entity", as the template is to be used for machine
certificates.
365 days should be specified as the period of validity of the certificates to be created. After
the resulting end date, the certificates can no longer be used.
103965_en_00 PHOENIX CONTACT 4-9
PSI-MODEM-GSM/ETH
• Switch to the "Key Usage" tab.
Figure 4-13 XCA Version 0.6.4 (13)
• Select the "Digital Signature", "Data Encipherment", and "Key Agreement" options and
click "OK" to create the template.
The template can now be used to create certificates signed with the root certificate.
4-10 PHOENIX CONTACT 103965_en_00
Creating certificates
4.4.2 Creating machine certificates based on a template
A template can be used to create certificates signed with the root certificate.
• Switch to the "Certificate" tab and click on "New Certificate".
Figure 4-14 XCA Version 0.6.4 (14)
• On the "Source" tab, specify the root certificate that is to be used for signing.
• In addition, you can select a template that has been created and read it in by clicking
"Apply".
103965_en_00 PHOENIX CONTACT 4-11
PSI-MODEM-GSM/ETH
• Switch to the "Subject" tab.
Figure 4-15 XCA Version 0.6.4 (15)
• Here, enter the information about the owner of the machine certificate.
When entering information on this tab, please note that the certificates must differ at
least with regard to their name ("Internal name" and "Common name").
For example, the equipment identification of the machine or PSI-MODEM-GSM/ETH
modem can be used as the name here.
• Click on "Generate a new key".
Figure 4-16 XCA Version 0.6.4 (16)
• Do not change the default key size, type, and name.
4-12 PHOENIX CONTACT 103965_en_00
Creating certificates
In the previous steps, a self-signed certificate was created as a CA certificate.
A machine certificate has now been created, which has been signed by the CA.
Figure 4-17 XCA Version 0.6.4 (17)
The machine certificate must be exported so that it can be used on the modem.
103965_en_00 PHOENIX CONTACT 4-13
PSI-MODEM-GSM/ETH
4.4.3 Exporting machine certificates
• Select the relevant certificate from the list and click on "Export".
The entire certificate including the private key must be in PKCS#12 format and can then be
uploaded to the relevant component as a machine certificate.
Figure 4-18 XCA Version 0.6.4 (18)
• The partner certificate should also be exported.
This is stored in PEM format without the private key.
Figure 4-19 XCA Version 0.6.4 (19)
4-14 PHOENIX CONTACT 103965_en_00
Application examples for secure VPN connections
5 Application examples for secure VPN connections
5.1 Modem-to-modem connection via GPRS/EDGE
A modem-to-modem connection can be used, for example, to securely connect two system
parts via the mobile phone network.
At least one of the modems must have a fixed IP address and modem-to-modem
communication must take place in the mobile phone network. Should you have any
questions, please contact your provider.
Before you begin
Check the installation locations of the modems to ensure that there is sufficient network
coverage available there from your provider. Data connections can only be established if
this is the case.
Creating certificates X.509 certificates are required for each modem to ensure a secure VPN connection. These
certificates can be acquired from certification authorities or you can create them using the
appropriate software (see Section 4, "Creating certificates").
5.1.1 Setting up modem 1
• Start by setting up the modem that is to establish the VPN connection.
Loading certificates
• Log into web-based management as the administrator.
• Open "VPN… IPsec… Certificates".
First load the partner certificate (Remote Certificate).
• To do this, click on "Browse" and select the corresponding *.crt certificate file.
• Click "Apply" to load the certificate file.
103965_en_00 PHOENIX CONTACT 5-1
PSI-MODEM-GSM/ETH
Next load the machine certificate (Own PKCS#12 Certificate).
• To do this, click on "Browse" and select the corresponding *.p12 certificate file.
• Click "Apply" to load the certificate file.
The loaded certificates are shown at the bottom of the screen:
5-2 PHOENIX CONTACT 103965_en_00
Application examples for secure VPN connections
Setting up the VPN connection on the modem
• Open "VPN… IPsec… Connections".
• Assign a name to the IPsec VPN connection and confirm with "Apply".
• In the Settings column, click on "Edit" to set the connection options.
• Under Remote Host, enter the public IP address of the partner.
• Now select the partner certificate (Remote Certificate) and the machine certificate
(Local Certificate).
• Under Address Remote Network, enter the IP address/subnet mask of the remote
network to which the VPN connection is to be established. Use CIDR format (see
page 3-31).
• Under Address Local Network, enter the IP address/subnet mask of the local
network. Use CIDR format (see page 3-31).
• For the modem that is to establish the VPN connection, select "Initiate" under Remote
Connection.
103965_en_00 PHOENIX CONTACT 5-3
PSI-MODEM-GSM/ETH
• Then switch to "VPN… IPsec… Connections".
• In the IKE column, click on "Edit" to set the IKE options.
• Change ISAKMP SA Encryption and IPsec SA Encryption to "AES-128".
• To ensure that the VPN connection is reestablished in the event of a connection abort,
activate the "Restart" option under Dead Peer Detection.
5.1.2 Setting up modem 2
• Repeat VPN connection setup for the second modem.
• For the modem that is to accept the VPN connection, select "Accept" under Remote
Connection.
NOTE: Please note that the Remote Certificate and Local Certificate and the remote and
local network are now swapped round.
5-4 PHOENIX CONTACT 103965_en_00
Application examples for secure VPN connections
5.2 Connection from a modem to a control center via
GPRS/EDGE and the Internet
A connection from a modem to a control center can be used, for example, to securely
connect substations or systems to the control center via the Internet using a broadband
Internet connection (DSL).
The broadband Internet connection in the control center must have a fixed IP address. A
fixed URL, which points to an IP address via DynDNS for example, is also supported. A
suitable VPN router for the broadband Internet connection in the control center would be the
FL MGUARD RS VPN (Order No. 2989611), for example.
Before you begin
Check the installation location of the modem to ensure that there is sufficient network
coverage available from your provider. Data connections can only be established if this is
the case.
Creating certificates X.509 certificates are required for each modem to ensure a secure VPN connection. These
certificates can be acquired from certification authorities or you can create them using the
appropriate software (see Section 4, "Creating certificates").
5.2.1 Loading certificates on the modem
• Log into web-based management as the administrator.
• Open "VPN… IPsec… Certificates".
First load the partner certificate (Remote Certificate).
• To do this, click on "Browse" and select the corresponding *.crt certificate file.
• Click "Apply" to load the certificate file.
Next load the machine certificate (Own PKCS#12 Certificate).
• To do this, click on "Browse" and select the corresponding *.p12 certificate file.
• Click "Apply" to load the certificate file.
103965_en_00 PHOENIX CONTACT 5-5
PSI-MODEM-GSM/ETH
The loaded certificates are shown at the bottom of the screen:
Setting up the VPN connection on the modem
• Open "VPN… IPsec… Connections".
• Assign a name to the IPsec VPN connection and confirm with "Apply".
5-6 PHOENIX CONTACT 103965_en_00
Application examples for secure VPN connections
• In the Settings column, click on "Edit" to set the connection options.
• Under Remote Host, enter the public IP address of the broadband Internet connection
in the control center.
• Now select the partner certificate (Remote Certificate) and the machine certificate
(Local Certificate).
• Under Address Remote Network, enter the IP address/subnet mask of the remote
network to which the VPN connection is to be established. Use CIDR format (see
page 3-31).
• Under Address Local Network, enter the IP address/subnet mask of the local
network. Use CIDR format (see page 3-31).
The modem must establish the VPN connection.
• Select "Initiate" under Remote Connection.
• Then switch to "VPN… IPsec… Connections".
103965_en_00 PHOENIX CONTACT 5-7
PSI-MODEM-GSM/ETH
• In the IKE column, click on "Edit" to set the IKE options.
• Change ISAKMP SA Encryption and IPsec SA Encryption to "AES-128".
• To ensure that the VPN connection is reestablished in the event of a connection abort,
activate the "Restart" option under Dead Peer Detection.
5.2.2 Loading certificates on the FL MGUARD RS VPN
• Log into web-based management for the FL MGUARD RS VPN as the administrator.
• Here, open "Authentication… Certificates".
• First load the machine certificate (Own PKCS#12 Certificate).
5-8 PHOENIX CONTACT 103965_en_00
Application examples for secure VPN connections
• Switch to the "Machine Certificates" tab.
• Click on "Browse" and select the corresponding *.p12 certificate file.
• In the Password field, enter the password used to protect the private key of the
PKCS#12 file.
• Click on "Import".
Once imported, the loaded certificate appears under Certificate.
• Remember to save the imported certificate by clicking on "Apply".
• Next load the partner certificate (Remote Certificate).
• Switch to the "Remote Certificates" tab.
• To do this, click on "Browse" and select the corresponding *.crt certificate file.
• Click on "Import".
Once imported, the loaded certificate appears under Certificate.
• Remember to save the imported certificate by clicking on "Apply".
103965_en_00 PHOENIX CONTACT 5-9
PSI-MODEM-GSM/ETH
5.2.3 Setting a packet filter on the FL MGUARD RS VPN
• Open "Network Security… Packet Filter".
• In the Incoming rules and the Outgoing rules tabs, under Protocol set "All" From IP
"0.0.0.0/0" To IP "0.0.0.0/0".
• Under Action set "Accept".
• Click "Apply" to save the changes.
5.2.4 Setting up the VPN connection in mGuard
• Open "VPN… IPsec VPN… Connections".
• Insert a new row and assign a name for the IPsec VPN connection.
• Click on "Edit" to set the connection options.
We recommend that communication is not restricted in the packet filter only when starting
up the VPN connection.
For normal operation, set the packet filter so that only your application's data traffic is
permitted.
5-10 PHOENIX CONTACT 103965_en_00
Application examples for secure VPN connections
• On the "General" tab, under Transport and Tunnel Settings select "Tunnel" as the
Type.
• Enter the network addresses of the Local and Remote networks.
• Switch to the "Authentication" tab.
• Select the previously imported machine certificate as the Local X.509 Certificate.
• Load the partner certificate (Remote Certificate). To do this, click on "Browse" and
select the corresponding *.crt certificate file.
• Click on "Upload" to load the certificate file.
103965_en_00 PHOENIX CONTACT 5-11
PSI-MODEM-GSM/ETH
• Switch to the "IKE Options" tab.
• Under ISAKMP SA (Key Exchange), change the Encryption Algorithm to "AES-128".
• Under IPsec SA (Data Exchange), change the Encryption Algorithm to "AES-128".
• Click "Apply" to save the changes.
5-12 PHOENIX CONTACT 103965_en_00
Application examples for secure VPN connections
5.2.5 Checking the status of the VPN connection in mGuard
• Check the status of the VPN connection.
• Open "VPN… IPsec VPN… IPSec Status".
The names of the VPN connections are listed on the left, while their current status is
indicated on the right.
Buttons
– To update the displayed data, click on Update.
– If you want to release and then restart a connection, click on the corresponding Restart
button.
– If you want to reconfigure a connection, click on the corresponding Edit button.
Connection, ISAKAMP Status, IPsec Status
In the event of problems, it is recommended that you check the VPN logs of the partner to
which the connection was established. This is because detailed error messages are not
forwarded to the initiating computer for security reasons.
GATEWAY GATEWAY indicates the IP addresses of the communicating VPN gateways.
TRAFFIC TRAFFIC refers to the computers and networks that communicate via the VPN gateways.
ID Refers to the subject of an X.509 certificate.
ISAKMP Status ISAKMP Status (Internet Security Association and Key Management Protocol) is set to
"established" if both VPN gateways involved have established a channel for key
exchange. In this case, they have been able to contact one another and all entries up to
and including "ISAKMP SA" on the connection configuration page are correct.
IPsec Status IPsec Status is set to "established" if IPsec encryption is activated for communication. In
this case, all the data under "IPsec SA" and "Tunnel Settings" is correct.
If displayed: This means that:
ISAKMP SA established,
IPsec State: WAITING
Authentication was successful, but the other parameters do not match. Does the
connection type (Tunnel, Transport) correspond?
If Tunnel is selected, do the network areas correspond on both sides?
IPsec State: IPsec SA
established
The VPN connection is established successfully and can be used. However, if this is not
possible, the VPN gateway is causing problems for the partner. In this case, deactivate
and reactivate the connection to reestablish the connection.
103965_en_00 PHOENIX CONTACT 5-13