DeltaV Distributed Control System Product Data Sheet November 2015 DeltaV™ Controller Firewall Provides an additional level of economical cyber-protection to your DeltaV™ controllers. Easy, out-of-the-box protection, in a plug-and- play solution. Layered implementation that can be added to your system at any time. Purpose-built, fully supported DeltaV security solution. Introduction Network firewalls are used to limit communications traffic between networks so that only permitted messages and a defined level of traffic are allowed to pass between the networks. The DeltaVTM Controller Firewall is a hardware device that is installed within a DeltaV network between the controllers and workstations. The DeltaV Controller Firewall provides an additional layer of cybersecurity protection that can be installed within the DeltaV Control network. It functions to provide additional protection for controllers installed on the secure side of the firewall against message flooding and denialof-service attacks originating from the workstation side of the firewall. Benefits Even more protection. If your security risk assessment determines that additional protection is required to prevent automated cyber-attacks on your system, the controller firewall can be economically installed on your system to mitigate these threats. Easy to deploy. The firewall is pre-configured to match the required DeltaV communication rules. Simply install the hardware, hook up the network cables and the protection is in place—right out of the box. The DeltaV™ Controller Firewall provides additional security protection from for your DeltaV controllers. Security layer can be added at any time. The controller firewall can be installed during your initial system implementation or at any later time when you decide you need additional protection for your controllers. It is highly recommended to be installed in Electronic Marshalling based systems. Meet customer cybersecurity requirements for AchillesTM certifications. The controller firewall is part of the solution to provide Achilles Certified DeltaV controllers for customers who require this optional security certification for their controllers. (On DeltaV v12 and newer systems the DeltaV Controller Firewall is no longer required for Achilles certifications). The DeltaV controller firewall is a fully supported solution. The firewall is “purpose-built” and is specifically configured and tested to function in a DeltaV network. It is set up to serve the very specific purpose of protecting a DeltaV controller from cyber-attacks and to provide an A

DeltaV Controller Firewall implementation of the DeltaV controller. As a fully supported DeltaV product the Controller Firewall is available only from Emerson Process Management. Product Description The DeltaV Controller Firewall is a 24-volt DIN rail-mounted hardware firewall specifically configured to be installed in a DeltaV system and support DeltaV communications protocols. The firewall is set up so that the factory default configuration will allow DeltaV communications and deny any other communications not specifically required for the DeltaV controllers to communicate bi-directionally...

DeltaV Controller Firewall The controller firewall is also available in a special version that provides additional configuration protection for DeltaV SIS Logic Solvers. This version of the firewall will block the “SIS Unlock” message generated by the ProfessionalPLUS Station from reaching the Logic Solver. Unlocking the Logic Solver can be done by from the front panel pushbutton by using a specific button sequence, by using the discrete input on the front panel of the firewall or by physically bypassing the firewall so the unlock message can reach the Logic Solver. The front panel button unlock...

DeltaV Controller Firewall DeltaV Controller Firewall Smart Switch Control Network Ethernet Inside Box = Secure Area | One typical installation example of the controller firewall in a DeltaV network. (Redundant networks not show for simplicity) Optional Solution The controller firewall is an optional solution and would be installed only when your risk assessment determines that this extra layer of protection is warranted. The firewall should be deployed only if the risk assessment of the control system determines that the controllers cannot be adequately protected from denial-of-service attacks...

DeltaV Controller Firewall Installation Information To provide the greatest protection, the DeltaV Controller Firewall is mounted on a DIN rail in close proximity to the controllers. Depending on the geographical distribution of the controllers, the firewall can be deployed in a 1:1 configuration to protect a single controller or in conjunction with a DIN mounted network switch to provide a 1:N configuration (N<=8). Note that the installation shown above is the only architecture supported for this firewall. For redundant controllers, the firewall can support up to 8 redundant pairs of controllers...

DeltaV Controller Firewall Fiber Optic 100BASE-FX Ports Wave Length System Attenuation Example for FO line length** Fiber Attenuation ** Including 3 dB system reserve when compliance with the fiber data is observed. Digital Input and Relay Output Relay Output Switching current max. 1 A, SELV Signal Contact Switching voltage max. 60 V DC, SELV Relevant for North America: max. 30 V DC, Class 2, resistive load Digital Input (SIS-IPD only) Used for remotely by-passing the SIS protection function to allow unlocking the SIS Logic solver. This function is disabled by default in the SIS-IPD. Maximum...

DeltaV Controller Firewall November 2015 Power requirements Operating Voltage Model Number Maximum Power Consumption Power Output Service Diagnostics LED’s (power, link status, device status, USB device status), signaling contact (24 V DC / 1 A), log file. Command Line Interface (CLI), web interface, auto configuration adapter (ACA11). Configuration is not required to install and use the firewall and SIS-IPD out of the box. Configuration is only required for custom configurations required by users. Other Services Services supported - NTP, serial, HTTPS, SSH, SNMP V1/V2/V3. Redundancy Redundancy...