Fortinet Document Library

Version:

Version:


Table of Contents

Administration Guide

Download PDF
Copy Link

Detecting IEC 61850 MMS protocol in IPS

IEC 61850 is a SCADA protocol whose services are mapped to a number of protocols, including MMS services. MMS/ICCP detection is supported in IPS. The purpose of the MMS dissectors is to identify every IEC 61850 service to distinguish different MMS/ICCP messages. IPS engine 6.0.12 and later support MMS dissectors.

The following scenarios are also supported:

  • Multiple MMS PDUs are transferred in one TCP payload, and the IPS engine identifies individuals.
  • An MMS message is split over multiple TCP segments, where MMS runs over COTP segments.
  • ICCP/TASE.2 that also uses MMS transport (ISO transport over TCP for ICCP) is detected.

Industrial signatures must be enabled in the global IPS settings to receive MMS/ICCP signatures. By default, industrial signatures are excluded.

config ips global
    set exclude-signatures none
end

Below are some industrial signatures for MMS/ICCP messages that can be detected by the IPS engine. This is not an exhaustive list.

  • MMS_GetNameList.Request
  • MMS_GetNamedVariableListAttributes.Request
  • MMS_GetVariableAccessAttributes.Request
  • MMS_Identify.Request
  • MMS_Initiate.Request
  • MMS_Read.Request
  • MMS_Reset.Request
  • ICCP_Transfer.Reporting
  • ICCP_Create.Dataset
  • ICCP_Abort
  • ICCP_Start.Transfer.DSTransferSet
  • ICCP_Get.Dataset.Element.Values
  • ICCP_Get.Next.DSTransfer.Set.Value
  • ICCP_Delete.Dataset
  • ICCP_Start.Transfer.IMTransferSet

Diagnose command

The COTP dissector adds support for identifying every MMS PDU, and let the IPS engine separate them, like the Modbus and IEC-104 services for example.

# diagnose ips debug enable all
# diagnose debug enable
[284@78]ips_l7_dsct_processor: serial=8142 create: cotp                
[284@78]ips_l7_dsct_processor: serial=8142 create: iec104
[284@78]ips_l7_dsct_processor: serial=8142 create: modbus

Log samples

MMS dissectors can be triggered, and MMS/ICCP signatures can be monitored and logged.

Log samples:
date=2020-03-26 time=15:51:10 logid="1059028704" type="utm" subtype="app-ctrl" eventtype="signature" level="information" vd="vd1" eventtime=1585263070836106492 tz="-0700" appid=43699 srcip=10.1.100.242 dstip=172.16.200.106 srcport=50963 dstport=102 srcintf="port13" srcintfrole="undefined" dstintf="port14" dstintfrole="undefined" proto=6 service="tcp/26112" direction="outgoing" policyid=1 sessionid=2711 applist="test" action="pass" appcat="Industrial" app="MMS_Read.Request" incidentserialno=376610508 msg="Industrial: MMS_Read.Request," apprisk="elevated"
date=2020-03-26 time=16:15:45 logid="1059028704" type="utm" subtype="app-ctrl" eventtype="signature" level="information" vd="vd1" eventtime=1585091746264983273 tz="-0700" appid=44684 srcip=10.1.100.242 dstip=172.16.200.106 srcport=41665 dstport=102 srcintf="port13" srcintfrole="undefined" dstintf="port14" dstintfrole="undefined" proto=6 service="tcp/26112" direction="incoming" policyid=1 sessionid=194463 applist="test" action="pass" appcat="Industrial" app="ICCP_Transfer.Reporting" incidentserialno=762763993 msg="Industrial: ICCP_Transfer.Reporting," apprisk="elevated"

Detecting IEC 61850 MMS protocol in IPS

IEC 61850 is a SCADA protocol whose services are mapped to a number of protocols, including MMS services. MMS/ICCP detection is supported in IPS. The purpose of the MMS dissectors is to identify every IEC 61850 service to distinguish different MMS/ICCP messages. IPS engine 6.0.12 and later support MMS dissectors.

The following scenarios are also supported:

  • Multiple MMS PDUs are transferred in one TCP payload, and the IPS engine identifies individuals.
  • An MMS message is split over multiple TCP segments, where MMS runs over COTP segments.
  • ICCP/TASE.2 that also uses MMS transport (ISO transport over TCP for ICCP) is detected.

Industrial signatures must be enabled in the global IPS settings to receive MMS/ICCP signatures. By default, industrial signatures are excluded.

config ips global
    set exclude-signatures none
end

Below are some industrial signatures for MMS/ICCP messages that can be detected by the IPS engine. This is not an exhaustive list.

  • MMS_GetNameList.Request
  • MMS_GetNamedVariableListAttributes.Request
  • MMS_GetVariableAccessAttributes.Request
  • MMS_Identify.Request
  • MMS_Initiate.Request
  • MMS_Read.Request
  • MMS_Reset.Request
  • ICCP_Transfer.Reporting
  • ICCP_Create.Dataset
  • ICCP_Abort
  • ICCP_Start.Transfer.DSTransferSet
  • ICCP_Get.Dataset.Element.Values
  • ICCP_Get.Next.DSTransfer.Set.Value
  • ICCP_Delete.Dataset
  • ICCP_Start.Transfer.IMTransferSet

Diagnose command

The COTP dissector adds support for identifying every MMS PDU, and let the IPS engine separate them, like the Modbus and IEC-104 services for example.

# diagnose ips debug enable all
# diagnose debug enable
[284@78]ips_l7_dsct_processor: serial=8142 create: cotp                
[284@78]ips_l7_dsct_processor: serial=8142 create: iec104
[284@78]ips_l7_dsct_processor: serial=8142 create: modbus

Log samples

MMS dissectors can be triggered, and MMS/ICCP signatures can be monitored and logged.

Log samples:
date=2020-03-26 time=15:51:10 logid="1059028704" type="utm" subtype="app-ctrl" eventtype="signature" level="information" vd="vd1" eventtime=1585263070836106492 tz="-0700" appid=43699 srcip=10.1.100.242 dstip=172.16.200.106 srcport=50963 dstport=102 srcintf="port13" srcintfrole="undefined" dstintf="port14" dstintfrole="undefined" proto=6 service="tcp/26112" direction="outgoing" policyid=1 sessionid=2711 applist="test" action="pass" appcat="Industrial" app="MMS_Read.Request" incidentserialno=376610508 msg="Industrial: MMS_Read.Request," apprisk="elevated"
date=2020-03-26 time=16:15:45 logid="1059028704" type="utm" subtype="app-ctrl" eventtype="signature" level="information" vd="vd1" eventtime=1585091746264983273 tz="-0700" appid=44684 srcip=10.1.100.242 dstip=172.16.200.106 srcport=41665 dstport=102 srcintf="port13" srcintfrole="undefined" dstintf="port14" dstintfrole="undefined" proto=6 service="tcp/26112" direction="incoming" policyid=1 sessionid=194463 applist="test" action="pass" appcat="Industrial" app="ICCP_Transfer.Reporting" incidentserialno=762763993 msg="Industrial: ICCP_Transfer.Reporting," apprisk="elevated"