Zdalna komunikacja sieciowa - zagadnienia sieciowe

Remote communication
Understanding communication networks
Jörg Brasas

Transmission modes
Communication basics

Point-to-point vs. multipoint
Communication basics

Standardized as IEEE 802.3x
Max. 100m between two devices
Transmission speed 10/100/1000MBit/s
Tree-Topology with active
point-to-point connections
Twisted pair cable with RJ-45 connector
Ethernet

 4 The Application layer
defines TCP/IP application protocols. All higher
network protocols are situated here e.g.: HTTP,
DNS, DHCP, RDP…
 3 Transport Layer
Manages packets between different networks.
All devices get an IP to be distinguished from
each other. TCP, UDP are on this Layer 3.
 2 Internet Layer
Layer 2 are the MAC addresses. Information is
divided into packets, senders and receivers are
defined, so first basic transmission within a
subnet can start here.
 1 Network Access Layer
Layer 1 stands for the cable and power.
The TCP/IP four layer model

 IP addresses have to be unique in each network segment
 To address network participants
Device IP192.168.1.254/24
 To divide network into different subnets
Network IP 192.168.1.0/24
 Not allowed: the first and the last IP of a network are
.0 is the description of the network
.255 is always used for broadcasts.
Subnet
IP
IP (Internet Protocol IPv4) Layer 3

 Subnet masks
 Example:
192.168.10.0/24 defines a subnet that ranges from 192.168.10.1 to
192.168.10.254. The IP „.0“ and „.255“ are reserved
 Example:
192.168.10.0/30 defines a subnet that ranges from 192.168.10.1 to 192.168.10.2
offering space for 2 IP devices.
“.0” is the subnet ID and the broadcast IP now is 192.168.10.3
 Check http://www.subnet-calculator.com/
IP (Internet Protocol IPv4) Layer 3
CIDR notation Dot. Decimal Number of available: host IPs No. subnets
/16 255.255.0.0 65534 -
/24 255.255.255.0 254 1
/25 255.255.255.128 126 2
/26 255.255.255.192 62 4
/28 255.255.255.240 14 14
/30 255.255.255.252 2 128

 Private IP ranges
 DHCP Fallback network
 Local Network
 Own PC loopback address 127.0.0.1
IP special subnets
10.0.0.0 / 8 10.0.0.0 to 10.255.255.255 Network for private use
169.254.0.0 / 16 169.254.0.0 to 169.254.255.255 DHCP Fallback IP range
127.0.0.0 / 8 172.0.0.0 to 172.255.255.255 Local Network

Connects two different networks
Knows all IP addresses in his subnet
Is Default Gateway
Router
Router
212.118.95.204 192.168.10.1
Internal / local area Network (LAN)
192.168.10.0/24
External Network

Router inside the local network (LAN)
Router
Office production network Machine network
192.168.10.0/24 192.168.20.0/28
Internet
Router
Firewall mGuard
WAN IP: 192.168.10.254
LAN IP: 192.168.20.1

Direct communication inside a subnet but
Communication outside the own subnet
using a Default Gateway
Routers handle all traffic from inside subnet to
outside subnets and vice versa.
Default Gateway

Designed to block unauthorized access while permitting
authorized communications based on user-defined rules
Firewall
Internet
LAN WAN
Incoming
Outgoing

Firewall
Stateful Packet Inspection (SPI)
Connection Tracking
Table
Internet
LAN WAN
Request from
Port 1065
Request to
Port 1065
Reply from
Port 1065
Reply to
Port 1065

TCP (Transmission Control Protocol) Layer 4
establishes a connection on a specific port between
sender and receiver
receiver needs to acknowledge each received package
UDP (User Datagram Protocol) Layer 4
connectionless protocol; no proof if packets have been
transmitted successfully. UDP is much faster than TCP
Examples: Voice-over-IP, Video, Web radio
TCP and UDP Protocols

Ports allow different network applications running on the
same device to distinguish the traffic
Ports for incoming connections are opened by a server
which listens then for incoming connections
Ports
Server
10.10.1.254
84.58.39.58 : Port 21 10.10.1.11 file transfer
84.58.39.58 : Port 25 10.10.1.11 Email send
84.58.39.58 : Port 110 10.10.1.11 Email receive
10.10.1.11
Router
Internet IP
84.58.39.58

Port 53 UDP
DNS Server offers a large library of IP addresses and their
expression as regular web side
DNS uses a specific-to-general naming scheme for domain
names
The root domain
is . (“dot”)
DNS (Domain Name Services)

Port 67,68, UDP
A DHCP client connected to the network it immediately
starts sending UPD broadcast (.255) packets
The DHCP server will answer by giving the device an IP
DHCP (Dynamic Host Configuration Protocol)
1 2
43

NAT is modifying IP address information in IPv4 headers
while in transit across a traffic routing device
Hide an entire (private) IP address space behind
a single (public) internet IP address
 NAT provides a one-to-one translation of IP addresses to
interconnect two IP networks that have incompatible
addressing
Network address translation (NAT)

Applications for NAT
Production floor network
10.10.0.0 / 16
Internet
Machine #1
172.16.1.0 / 24
Machine #2
172.16.1.0 / 24
Machine #3
172.16.1.0 / 24

1:1 NAT
Internet
Machine #1
172.16.1.0 / 24
Machine #2
172.16.1.0 / 24
Machine #3
172.16.1.0 / 24
Network operator
10.10.0.0 / 16
10.10.1.0 /24
10.10.2.0/24
10.10.3.0/24

Portforwarding is like a hole in a wall
Is a direct link to a single device
It is limited to max. one internal IP for
each port.
Traffic from the outside addressing
the outside IP is directly transferred
to the configured IP behind the NAT
router.
Note:
There are no Firewall rules which
could secure a forwarded port.
Portforwarding on a NAT-Router

Port Forwarding
Router
External IP
81.7.12.96
Internal net
10.10.1.0/24
10.10.1.13
10.10.1.11
HTTP Web Server
201.87.11.2
Router configuration (Port Forwarding):
From IP: 201.87.11.2 on Port: 80 Forward to IP: 10.10.1.13 on Port: 80
From IP: 201.87.11.2 on Port: 125 Forward to IP: 10.10.1.15 on Port: 125
Request Web http://81.7.12.96: 80 -> Web Server
Request Email smtp://81.7.12.96:125-> Mail Server
Remark: Always assign the external router IP
and not the internal devices IP!
10.10.1.15
SMTP Mail Server
Port forwardings allow single or all network particiants to reach a specific device behind a
NAT directly on one or more specific ports. Port forwardings allow direct connection between
devices.
Port: 80
Port: 125
DMZ

DMZ – Lower security area within corporate networks
Demilitarized zone (DMZ)
Internet LAN (Office) LAN (Production)
Firewall Firewall
DMZ
Router
Server
Intranet / LAN

Private computer network in an additional software layer
on top of existing public network
IPSec
A protocol suite for securing
Internet Protocol (IP) communications
by authenticating and
encrypting each IP packet
Virtual Private Network (VPN)

Virtual Private Network (VPN)
Internet
Machine
Manufacturer Operator Network
Encryption Decryption
Encrypted Data

OPC VPN connection
Secure
Unsecure
Secure VPN
connection
Secure remote communication

mGuard firewall secures VPN connections
protects both communicating parties if one of them is attacked
OPC VPN connection
Secure
mGuard firewall secures VPN connections

I: ISAKMP SA (key exchange)
II: IPsec SA (data exchange)
 Phase I (ISAKMP SA or IKE SA key exchnage)
- Authentication of VPN gateways
- Negotiating of encryption code to secure phase II
 Phase II (IPsec SA: data exchange)
- IPsec connection parameters
VPN communication phases
Internet

Authentication with X.509 certificates
Asymmetric
Encryption with
a pair of keys
(private and public key)
VPN communication

Certificates
… to authenticate the VPN endpoints

… with XCA
http://xca.sourceforge.net
Creating a certificate

VPN Remote access
Internet
3G network
Service team 19“ FL MGUARD

Connection test with ping to check whether a network device
is reachable or not
Type „ping“ followed by the IP or host name of the device
Tools: ping

Tools: tracert
More detailed connection testing with tracert;
tracert allows to see which gateways were passed.
So the last working gateway can be easily determined.

Tools: ipconfig
Network Adapter
Information
with IPConfig
Ipconfig /all shows
detailed information
on the network
adapters of a PC

Remote service with VPN
Machine
Service
1. Configure mGuards
2. Create a Certificate
3. VPN-Connection configuration
3a. Central
3b. Machine
How can I maintenace
the machine?
Machine

Mobile networks: … no wires!

GSM
Global System for
Mobile Communications
1. Voice (primary)
2. Data (secondary)
CSD = Circuit Switching Data
UMTS/HSPA+
Universal Mobile
Telecommunications System/
High Speed Packet Access
Packet Data Network
GPRS/EDGE
General Packet Radio Service/
Enhanced Data Rates for GSM Evolution
Packet Data Network
1G 2G 2.5G 3G 4G
1986 1991 GPRS 2000 UMTS 2000 2010
EDGE 2006 HSPA 2008
History LTE
Long
Term
Evolution

Lte = Long term evolution for UMTS
4th generation mobile network
of 3GPP (3rd Generation Partnership Project)
Successor of
UMTS/HSDPA+
All IP network
Worldwide available
Lte

2G GSM/GPRS/EDGE 3G UMTS/HSPA 4G LTE
T-Mobile
Stand 03/2014

2G 3G 4G
vodafone
Stand 03/2014

Worldwide available
Check at http://maps.mobileworldlive.com

Poland
http://maps.mobileworldlive.com/network.php?cid=30&cname=Poland

Consumer Technology
Mobile Communication

SMS Short message service
Mobile Data Communication
Short message
service center

IP Communication
GPRS/EDGE and UMTS/HSPA+

… must start in the mobile network

Access Point APN
Private APN
Public Web APN

Application examples
Water supply
Water cleaning
Transportation
Process industry
Building automation
Decentralized power generation
Energy distribution

As a service for the end customer
Easy installation only if required
Reliable remote Ethernet access
Designed for international use
Mobile remote access via VPN
Internet
Mobile network
Service team
internal
FL MGUARD DELTA2

Temporary remote access to control
systems of door drives

VPN on demand
Remote access
via IPSec VPN tunnel
Complete solution:
mGuard Blade and
mobile router
Remote access for customer
Internet
3G network
End customer
Service team 19“ FL MGUARD

Remote access to solar inverters

Secure communication via VPN
Secure remote link to Ethernet networks
Live video as an option
International use
Internet
3G network

Secure communication via VPN
Secure communiaction solution
Private network inside the mobile network
High bandwidth
Private APN
Public Web APN

Zdalna komunikacja sieciowa - zagadnienia sieciowe

More Related Content

What's hot (20)

Similar to Zdalna komunikacja sieciowa - zagadnienia sieciowe (20)

Recently uploaded (20)

Zdalna komunikacja sieciowa - zagadnienia sieciowe