Emerson Exchange 365

• Not Answered

Recommended practice for connecting DeltaV Server to Internet?

Hello,

We have a requirement on site that to give access to remote client via ProPlus (DeltaV Live screen, view only). So what is recommended practice to connect it to internet?

• There must be a firewall? (If yes, please recommend a model)
• Can we connect directly ProPlus to internet (temporarily until firewall is not available)? 
• Is there any network adapter settings such that ProPlus always disables WiFi adapter? If so, How to enable it?

Thanks!

Let us build success,

Zohaib Jahan

• ProPlus
• firewall
• DeltaV Live
• DeltaV

Zohaib Jahan

• 7 Dec 2022 12:50 PM
• Cancel

5 Replies

• Andre Dicaire

  

  • 7 Dec 2022 6:54 PM

  This is a huge Cybersecurity risk. You should consult with a professional.
  
  If you have Wifi on the Pro Plus, it must be a Laptop. Wrkstations and servers supported for DeltaV do not come with such options.
  
  A laptop will be running Windows 10, and as such does not support additional RD sessions. A remote connection would take over the local session. That is, the local screen would not be usable when a remote session is active. It will be one or the other.
  
  You should have a secure connection to the Internet, such as a VPN that prevents unauthorized access. Typically, internet access should land first on an RD Gateway or Jump Server that can validate the connection and user. From there the connection to the DeltaV ProPlus or other computer would be done through a Firewall.
  
  Cutting these corners exposes the Pro Plus and if this is a production facility, you should not be directly connected to the internet.
  
  Windows 10 makes it easy to RDP to other computers. But just because you can, doesn't mean you should. Unsecure access to the ProPlus is not something that should be allowed. Generally, Remote access to the DeltaV system should go through an RD server and not the Pro Plus. And you should have end point protection in place like Anti Virus.
  
  If you do connect, I hope you are not posting next on how to recover your Pro Plus from a cyber attack.

  Andre Dicaire

  • Cancel
• Randy Pratt

  

  • 7 Dec 2022 7:07 PM

  In reply to Andre Dicaire:

  If you direct connect, web crawlers such as Shodan (https://www.shodan.io) and several others (one run by the Chinese government) will find it within a week. As Andre noted, don't do it.

  • Cancel
• Bryce Elliott

  

  • 8 Dec 2022 4:53 PM

  Emerson has a Smart Firewall. Start there. I recommend looking at the documentation for it and the DeltaV Security Manual (should be available with your Guardian login) for how to set it up. Your controls folks, your corporate IT, and your Operations folks should all be part of this discussion.
  
  The only time I directly connect a DeltaV machine to the Internet is when I need to do something like get Microsoft Office licensed. I hook it up for the 2-3 minutes it takes me to complete the process, and then I unhook it. Leaving a ProPlus hooked to the Internet is begging for trouble.
  
  At most of the client sites I support, I have a minimum of 2 logins to get to the DeltaV; its typically 3, and in 1 case 4. I have to log into their network (VPN), then I have to log into a machine (sometimes virtual; sometimes physical) that is on the corporate network side of the firewall. Then I have to log into the DeltaV machine that is on the other side of the Firewall. The firewall has only a few holes poked in it. It is a bit of a pain, but it isn't nearly as painful as when I had to rebuild a ProPlus and a Historian at a client site where they left themselves open (against our recommendation).

  - Bryce H. Elliott, P.E.

  • Cancel
• Zohaib Jahan

  

  • 10 Dec 2022 1:22 PM

  In reply to Andre Dicaire:

  Thanks for the value feedback.
  We'll check with Emerson support for RD Server or alternative for remote client access.

  Let us build success,

  Zohaib Jahan

  • Cancel
• Zohaib Jahan

  

  • 10 Dec 2022 1:22 PM

  In reply to Andre Dicaire:

  Thanks for the value feedback.
  We'll check with Emerson support for RD Server or alternative for remote client access.

  Let us build success,

  Zohaib Jahan

  • Cancel