4
Converged Plantwide Ethernet (CPwE)
December 2016
Document Reference Number: ENET-WP011B-JA-P
•IP
1(IIoT)
• Converged Plantwide Ethernet (CPwE)
(OT) (IT)
CPwE
•Stratix® 5950 Stratix 5100
/Stratix 5700 Stratix 5400
Stratix 5410
•(OT) (IT)
( )
Converged Plantwide Ethernet (CPwE)ENET-WP011B-JA-P
Converged Plantwide Ethernet (CPwE)
(IACS)( ) IACS (OT)
(IT) Converged Plantwide Ethernet (CPwE)(IP)
(IIoT)
IACS IACS
IACS IACS
(IFW) IACS
IACS OT IACS
( ) (OEM)
OT IT
OTOEM IT
Deploying Industrial Firewalls within a CPwE Architecture (CPwE) Design and Implementation Guide (DIG)
Deploying Industrial Firewalls within a Converged Plantwide Ethernet Architecture ()
CVD (Cisco and Rockwell Automation Validated Design) IACS
CPwE CVD
1
Converged Plantwide Ethernet (CPwE)
CPwE IACS
CPwE( 1) IACS
1 CPwE
CPwE ODVA Common Industrial Protocol (CIP™)IIoT( ) EtherNet/IP™
EtherNet/IP URL odva.orghttp://www.odva.org/Technology-Standards/EtherNet-IP/Overview
IACS IACS
( ) IACS
CPwE ( 2) IEC-62443 ( ISA-99)
(IACS) NIST 800-82 (ICS)
IES IESIES
DAPWAP DAPWAP
IES IES
IES
IES IES
IES
IES
IES IES
IES
DAPWAP
IES
IES
IES
IES
IES
IES
3765
88
(WAN) –
• ERP - • Web• -
(AD)(AAA)
• - DNS DHCPC•
•• AV••
• FactoryTalk
• — DNS AD
DHCP (AAA)•
DMZ/
• /•• ACL IPS IDS• VPN•
4 5
(IDMZ)
0 3(
)
/
0 2
3 – ( )
WGB WGB
LWAPLWAP
SSID5GHz
/ - 0 2 – Flex Link
LAN ( )
/ - 0 2 –
(REP)LAN ( )
LWAP
I/O
SSID2.4GHz
Stratix 5000/80002
HMI
/ - 0 2/ /
Autonomous LAN ( )
AP
WGB I/O
HMI I/O
SSID5GHz
/
0 2
LAN
(WLC)
2Converged Plantwide Ethernet (CPwE)
ENET-WP011B-JA-P
Converged Plantwide Ethernet (CPwE)
IACS IACS
IACSIACS
IACS
CPwE ( 2)
• ( ) — IACS ( )( )
( ) IACS( ) IACS
(AAA)
• IT ( ) — (OS )
( ) LAN
• IT ( ) — ( ) (AD)
(IDMZ)
2 CPwE
–
IES IES
IES
IESIES
DAPWAP
IFW
3765
89
DMZ/
4 5
(IDMZ)
•• AV••
0 3
3 –
FactoryTalk
2 –
1 – 0 –
IT
( IT)
IT
IACS••••
VLAN
DMZ
• /•
• ACL IPS IDS• VPN•
•••
••
MCC
WGB
I/O
LWAP
SSID 2.4GHz
LAN (WLAN)•
– SSID–
SSID–
SSID• AEL WPA2• Autonomous WLAN
–– 802.1X - (EAP-FAST)
• WLAN– 802.1X - (EAP-TLS)– CAPWAP DTLSSSID
2.4GHz
LAN (WLC)(AD)
(ISE)
FactoryTalk
FireSIGHT Management CenterCisco Security Manager
(RAS)
OS
(AAA)
I/O
3Converged Plantwide Ethernet (CPwE)
ENET-WP011B-JA-P
Converged Plantwide Ethernet (CPwE)
IACS & & &
IACS IIoT(
)1 IP IACS
Deploying Industrial Firewalls within a CPwE Architecture (CPwE) DIG EtherNet/IP™
IACS
CPwE IFW CVD
•
–
–
–
–
– (Cisco Adaptive Security Appliance)
– (Cisco FireSIGHT® Management System) Common Industrial Protocol (CIP )
(DPI)
– (IFW)
– Stratix® 5950
– Cisco Industrial Security Appliance 3000
• ( 3)
– / /
– /
–
– /
•
–
– (Command Line Interface CLI)Adaptive Security Device Manager
–
– Cisco FireSIGHT Management Center Cisco Security Manager
–
4Converged Plantwide Ethernet (CPwE)
ENET-WP011B-JA-P
Converged Plantwide Ethernet (CPwE)
3
CPwECVD (Cisco Validated Design)
(OT) (IT) CPwE
CPwE
Deploying Industrial Firewalls within a Converged Plantwide Ethernet Architecture ()
Design and Implementation Guide (DIG)(IACS)
DIGCPwE
IACS
CPwE URL
•
– http://www.rockwellautomation.com/global/products-technologies/network-technology/architectures.page?
•
– http://www.cisco.com/c/en/us/solutions/enterprise/design-zone-manufacturing/landing_ettf.html
IES
IESIES
IES
IESIES
IES
IESIES
IES
IESIES
IESIESIES
IES
IFW
IFW
IFW
IFW
IFW
IFW
IFW
(IDMZ)
0 3(
)FireSIGHT Management Center
Cisco Security Manager
IES IES
HMI
/ 0 2
( )
5Converged Plantwide Ethernet (CPwE)
ENET-WP011B-JA-P
Converged Plantwide Ethernet (CPwE)
IFW FirePOWER™ FireSIGHT Management Center 6.0
Firepower Management Center CIPIFW FirePOWER
URL Cisco Firepower Compatibility Guidehttp://www.cisco.com/c/en/us/td/docs/security/firepower/compatibility/firepower-compatibility.html
www.cisco.com http://newsroom.cisco.com Cisco Systems, Inc.
Cisco Systems International BV
www.cisco.com
Cisco Systems, Inc. Cisco Systems (USA) Pte. Ltd. Cisco Systems International BV
200 Fax Web (www.cisco.com/go/offices)
Cisco Cisco Ciscowww.cisco.com/go/trademarks
(1110R)
( )
www.rockwellautomation.com
Rockwell Automation1201 South Second Street Milwaukee, WI 53204-2496 USA
(1) 414 382 2000Fax (1) 414 382 4444
Rockwell AutomationLevel 14, Core F, Cyberport 3 100 Cyberport Road, Hong Kong
(852) 2887 4788Fax (852) 2508 1846
/ / Rockwell AutomationNV, Pegasus Park, De Kleetlaan 12a 1831 Diegem, Belgium
(32) 2 663 0600Fax (32) 2 663 0640
Allen-Bradley FactoryTalk Rockwell Automation Rockwell Software Stratix Rockwell Automation, Inc.Rockwell Automation
EtherNet/IP CIP ODVA
© 2016 Cisco Systems, Inc. and Rockwell Automation, Inc. and all rights reserved. Publication ENET-WP011B-JA-P December 2016
6Converged Plantwide Ethernet (CPwE)
ENET-WP011B-JA-P
