Wonderware多网络构架指南以及涉及常用端口

1、SummaryThisarticlediscussesthefundamentalcomponentsofamulti-networkarchitecturesupportingaWonderwarebasedenvironment.Italsoprovidesanillustrationofaworkingexampleofhowamulti-networkcouldbeimplementedtosupportaWonderwareenvironment.Thisarticleinnowayadvocatesthatthisistheonlywaytoimplementamultinetwo

2、rkarchitecture,itisprovidedtoshowafundamentalexampleofhowatypicalmulti-networkarchitectureislaidout.OverviewTherearemanywaystoimplementanetworkarchitecturebutregardlessoftheimplementation,amulti-networkenvironmentwillutilizesomeformofnetworkswitches,routers,andpossiblyfirewallstoprotectthebackendsys

3、tems.SwitchesareusedtoconcentratetheEthernetconnectionscomingfromnodessuchasPCs,PLCs,andPrinterstoasinglepoint.Routersareusedtoroutepacketsofdatatonetworkaddressdestinationsdesignatedinthepackets,similartohowtheUSPostalServiceroutesmailtohomesindifferentneighborhoodsbasedontheaddress.Firewallshelpto

4、protectthenetworkfromunwantednetworktrafficandintrusion.Multi-networkarchitecturesareoftenlaidoutinsegmentscalledsubnetsorsubdividednetworks.Subnetscanbesegregatedbasedonarea,function,systems,orevensecurity.Forexampleinanindustrialcontrolsenvironment,therecouldbeanycombinationofsupervisory,PLC,admin

5、istrativeorbusinessnetworks.Eachnetworktypewouldrepresentasegmentintheoverallnetwork.Asmentionedearlier,inordertoconnectthesenetworksegmentstogether,arouterisusedtojoinallthenetworksegmentstoasinglepoint.Ingeneral,arouterisconfiguredtoconnecttoeachnetworkviaaninterfaceportthatwillconnectdirectlytoan

6、etworksegmentsswitch.Eachinterfaceportontherouterisconfiguredtobethegatewayforanetworksegment.AproperlyconfiguredrouterknowsabouttheothernetworksandhowtoroutepacketsbetweenthenetworkstotheirdestinationsWhentherouterhasbeenconnectedtoallofthenetworksegments,theneachrouterinterfaceisconfiguredtobeagat

7、ewaywiththeappropriateIPAddressofthatnetworksegment,i.e.,192.168.3.1meansthattherouterisconfiguredtobethegatewayof192.168.3.0network.Therouteristraditionallydesignatedtobethefirstnodeonaparticularnetwork,henceitisgiven.1asitslastoctetinitsIPAddress,butthisisnotarule.Oncesystemsoneachnetworksegmentca

8、nsuccessfullypassdatapacketsbetweenthenetworks(usuallybypingingorusingsomeothermeansoftestingfunctionality),afirewallcanthenbeputinplacetofurtherrestricttheinformationflowtowhatisessentialfornormaldaytodayoperations.Carefulconsiderationshouldbeobservedastowhereandhowmanyfirewallsshouldbeplacedinthen

9、etworkarchitecture,whattypeofsecuritymodelwillbefollowed,andwhatportswillneedtobeopenedorclosedfornormalnetworkoperationsandsecurity.BelowaresomecommonportsforaWonderwarebasednetworkthatshouldbeleftopened:ForHistorianandApplicationServers1.445/tcp-Fileandprintersharing2.1434/udp-SQLServerBrowser3.1433/tcp-SQLTCP4.135/tcp-DCOM5.80/tcp-InformationServerWebPortalForWonderwareDAServers102DASSIDirect502DASMBTCP2221,2222,2223DASABTCP5413SuiteLi