Industrial Connectivity

The industrial connectivity daemon (icond) and Industrial Connectivity service are available for FortiGate Rugged models equipped with a serial RS-232 (DB9/RJ45) interface to:

• Receive data in IEC 60870-5-101 serial protocol and convert it to IEC 60870-5-104 TCP/IP. See Sample configuration to convert IEC 60870-5-101 serial to IEC 60870-5-104 TCP/IP transport .

• Receive data in Modbus serial (RTU/ASCII) protocol and convert it to Modbus TCP. See Sample configuration to convert Modbus serial to Modbus TCP.

You can allow Industrial Connectivity access to an interface in the GUI and CLI.

To enable Industrial Connectivity for an interface in the GUI:

1. Go to Network > Interfaces.

2. Click Create New > Interface, or double-click an interface to open in for editing.

3. Set Role to Undefined or WAN

   Only internal and WAN interfaces support Industrial Connectivity administrative access.

4. In the Administrative Access section, select Industrial Connectivity.

   

5. Set the remaining options as desired, and click OK.

To enable Industrial Connectivity for an interface in the CLI:

config system interface
    edit <name>
        set allowaccess icond
        ...
    next
end

set allowaccess icond

Specify what types of management protocols can access the interface: icond: Industrial Connectivity service access to proxy traffic between serial port and TCP/IP.

Use the config system icond command to configure the Industrial Connectivity service provided by the Industrial Connectivity daemon (icond).

Sample configuration to convert IEC 60870-5-101 serial to IEC 60870-5-104 TCP/IP transport

After the Industrial Connectivity service is enabled and configured for an interface, supported FortiGate Rugged devices can receive data from Supervisory Control and Data Acquisition (SCADA) systems in serial format and convert it to TCP/IP formats.

In the following topology, PC1 uses the IEC 60870-5-101 (shortened to IEC-101) protocol to transmit data from SCADA systems to FortiGate Rugged, where the data is converted to the IEC 60870-5-104 (shortened to IEC-104) protocol, and sent to PC2.

The data is converted as follows:

• FortiGate Rugged transmits data over TCP port 502.

• Protocols IEC 60870-5-101 and IEC 60870-5-104 are both used to transmit the data.

  While IEC-101 is based on a serial transmission of data (for example, using RS-232 and FSK-based modems), IEC-104 is packet oriented and based on TCP/IP transmission.

To enable Industrial Connectivity for an interface in the CLI:

config system interface
    edit "internal1"
        set vdom "root"
        set ip 10.1.100.60 255.255.255.0
        set allowaccess ping https ssh http telnet icond
        set type physical
        set snmp-index 3
    next
end

To configure the Industrial Connectivity service in the CLI:

1. Configure the Industrial Connectivity service

   config system icond
       set status enable
       set type iec101-104
       set tty-device "serial0"
   end

2. Get the default status:

   get system icond
   status              : enable
   type                : iec101-104
   tty-device          : serial0
   tty-baudrate        : 9600
   tty-parity          : even
   tty-databits        : 8  
   tty-stopbits        : 1
   tty-flowcontrol     : none
   iec101-mode         : unbalanced
   iec101-laddr-size   : 1
   iec101-laddr-local  : 1
   iec101-laddr-remote : 2
   iec101-use-ack-char : disable
   iec101-keepalive    : enable
   iec101-t0           : 500
   iec101-trp          : 2500
   iec104-t1           : 15
   iec104-t2           : 10
   iec104-t3           : 20
   iec104-k            : 12
   iec104-w            : 8

Sample configuration to convert Modbus serial to Modbus TCP

After the Industrial Connectivity service is enabled and configured for an interface, supported FortiGate Rugged devices can receive data from Modbus networks in serial format and convert it to TCP.

In the following topology, the Modbus controller uses Modbus serial to transmit data to FortiGate Rugged, where the data is converted to the Modbus TCP, and sent to the Modbus Remote Terminal Unit (RTU).

To enable Industrial Connectivity for an interface in the CLI:

config system interface
    edit "internal1"
        set vdom "root"
        set ip 10.1.100.60 255.255.255.0
        set allowaccess ping https http telnet icond
        set type physical
        set description "link to modbus server"
        set snmp-index 3
    next
end

To configure the Industrial Connectivity service in the CLI:

1. Configure the Industrial Connectivity service

   config system icond
       set status enable
       set type modbus-serial-tcp
       set tty-device "serial0"
   end

2. Get the default status:

   get system icond
   status              : enable
   type                : modbus-serial-tcp
   tty-device          : serial0
   tty-baudrate        : 9600
   tty-parity          : even
   tty-databits        : 8
   tty-stopbits        : 1
   tty-flowcontrol     : none
   modbus-serial-mode  : RTU/ASCII
   modbus-serial-addr  : 1
   modbus-serial-timeout-resp: 500
   modbus-tcp-unit-id  : 255