IBH Link UA:Startup operations: Difference between revisions

From IBHsoftec Wiki English
Jump to navigation Jump to search
Created page with "== Mounting and Connection == The '''IBH Link UA''' is designed for DIN rail mount: 600px 64px '''ATTENTION!''' ..."
 
Link to centralized GDS certificate management added
 
(4 intermediate revisions by 2 users not shown)
Line 9: Line 9:
'''ATTENTION!'''
'''ATTENTION!'''


'''The IBH Link UA requires a 12 - 36V DC power supply. Higher voltages may destroy the device. Pay attention to polarity.'''
'''Use only supply voltage from 12V to 36V to operate the device. Higher voltage may destroy the device.'''


[[Image:IBH_Link_UA_24V.png|200px]]
[[Image:IBH_Link_UA_24V.png|200px]]
Line 23: Line 23:
== Configuration of the IP addresses ==
== Configuration of the IP addresses ==


The administration can be made with a recent web browser over the Ethernet port 1 by using the host name http://'''ibhlinkua_<serial number>''' (f.i. http://'''ibhlinkua_0001180''')
The administration can be made with a recent web browser over the Ethernet port 1 by using the host name http://'''ibhlinkua_<serial number>''' (f.i. http://'''ibhlinkua_001180''')


or over the ports 2-4 by entering the default IP Address '''192.168.1.14'''
or over the ports 2-4 by entering the default IP Address '''192.168.1.14'''
Line 99: Line 99:
== Security ==
== Security ==


OPC UA defines different Security Levels:
OPC UA can protect communication through authentication, message signing, encryption and application certificates.


[[Image:IBH_Link_UA_Security.png|880px]]
[[Image:IBH_Link_UA_Security.png|880px]]


There are different levels of encryption '''None, Basic128Rsa15''' and '''Basic256'''
=== Message Security Modes ===
 
{|


{| class="wikitable"
! Mode
! Protection
|-
|-
 
| <code>None</code>
| '''None''' || No encryption
| Messages are neither signed nor encrypted.
 
|-
|-
 
| <code>Sign</code>
| '''Basic128Rsa15''' || 128 Bit encryption
| Messages are signed so that manipulation can be detected.
 
|-
|-
 
| <code>SignAndEncrypt</code>
| '''Basic256''' || 256 Bit encryption
| Messages are signed and encrypted.
 
|}
|}


The IBH Link UA supports the level '''Sign''', '''Sign and Encrypt''' and '''Sign + Sign and Encrypt'''
For normal operation, use <code>SignAndEncrypt</code> whenever all communication partners support it.


{|
=== Security Policies ===


{| class="wikitable"
! Security policy
! Notes
|-
|-
 
| <code>Basic128Rsa15</code>
| '''Sign''' || The messages contain signed certificates
| Legacy policy; not recommended for new installations.
 
|-
| <code>Basic256</code>
| Older policy for compatibility with existing clients.
|-
| <code>Basic256Sha256</code>
| Modern policy using SHA-256.
|-
|-
 
| <code>Aes128_Sha256_RsaOaep</code>
| '''Sign and Encrypt''' || The messages contain signed certificates and are encrypted
| Modern AES-based policy.
 
|-
|-
 
| <code>Aes256_Sha256_RsaPss</code>
| '''Sign + Sign and Encrypt''' || The messages may contain only signed certificates, or can be signed and are encrypted as well
| Strong modern AES-based policy.
 
|}
|}


<br />
Prefer the strongest policy supported by every client. Enable <code>None</code> or legacy policies only when required for compatibility and protect such connections through network segmentation and firewall rules.
 
<br />
 
<br />


== Certificates ==
== Certificates ==
Line 184: Line 184:


[[Image:IBHLink_UA_OPC_Client.png|1085px]]
[[Image:IBHLink_UA_OPC_Client.png|1085px]]
<br />
<br />
<br />
For centralized management, automatic renewal and distribution of certificates and trust lists, the IBH Link UA can be connected to a [[IBH Link UA:GDS|Global Discovery Service (GDS)]].
==Historical Data==
While OPC Data Access allows the access to data in real time, supports OPC Historical Access, also called OPC HDA access, access to already stored data. From simple data logging systems to complex SCADA systems historical data can be queried on standardized manner. The activation of the Historical data is easily performed using the web browser.
[[Image:IBH_Link_UA_HDA_Web_Eng.PNG|1240px]]
[[Image:IBH_Link_UA_HDA.png|1146px]]


<br />
<br />

Latest revision as of 12:48, 5 August 2026

Mounting and Connection

The IBH Link UA is designed for DIN rail mount:

ATTENTION!

Use only supply voltage from 12V to 36V to operate the device. Higher voltage may destroy the device.

Power supply: 24VDC / 0,2A




Configuration of the IP addresses

The administration can be made with a recent web browser over the Ethernet port 1 by using the host name http://ibhlinkua_<serial number> (f.i. http://ibhlinkua_001180)

or over the ports 2-4 by entering the default IP Address 192.168.1.14

No other tools are required.

Default IP Address configuration:

Level Port Address
Management level Port 1 Host name: ibhlinkua_<serial number>
Control level Port 2 - 4 192.168.1.14

Default Login:

admin

admin

Network: Management Level

Network configuration for Port 1 (Management level respectively Supervision Level):

Network: Control Level

Network configuration for Port 2 - 4 (Control Level respectively Machine Level):

From both levels the Endpoint URL can be copied:

The Endpoint URL is provided by the IBH Link UA and is the destination URL for the OPC Client.

In our sample, the UA Expert diagnostic client from Unified Automation is shown:



Time Settings

Before creating certificates, the clock of the IBH Link UA must be set with the correct date and time!




Security

OPC UA can protect communication through authentication, message signing, encryption and application certificates.

Message Security Modes

Mode Protection
None Messages are neither signed nor encrypted.
Sign Messages are signed so that manipulation can be detected.
SignAndEncrypt Messages are signed and encrypted.

For normal operation, use SignAndEncrypt whenever all communication partners support it.

Security Policies

Security policy Notes
Basic128Rsa15 Legacy policy; not recommended for new installations.
Basic256 Older policy for compatibility with existing clients.
Basic256Sha256 Modern policy using SHA-256.
Aes128_Sha256_RsaOaep Modern AES-based policy.
Aes256_Sha256_RsaPss Strong modern AES-based policy.

Prefer the strongest policy supported by every client. Enable None or legacy policies only when required for compatibility and protect such connections through network segmentation and firewall rules.

Certificates

Before creating certificates, the time of the IBH Link UA must be set

Exchange of Certificates is another important security level of OPC UA.

A communication is only possible, if both Server and Client have a valid certificate assigned by the respective partners.

After setting the time of the IBH Link UA, a new server certificate can be created:

To get the best reliability of the Server Certificate, all fields need to be completed in detail:

If an existing Server Certificate shall be used with the IBH Link UA, it can be uploaded via the button <Upload Server Certificate>.

Make the IBH Link UA Server Certificate visible for the Client:

OPC UA clients usually detect server certificates automatically, when the first connection is established

or they offer other options for the handling of certificates.

Make the Client Certificate visible for the IBH Link UA Server:

After the client has accepted the server certificate, it will send the client certificate.

Whether new certificates are existing, can be checked using the Refresh button or the key <F5>:

Once the certificate is trusted, the communication with the Client can be established:





For centralized management, automatic renewal and distribution of certificates and trust lists, the IBH Link UA can be connected to a Global Discovery Service (GDS).

Historical Data

While OPC Data Access allows the access to data in real time, supports OPC Historical Access, also called OPC HDA access, access to already stored data. From simple data logging systems to complex SCADA systems historical data can be queried on standardized manner. The activation of the Historical data is easily performed using the web browser.




System

System information like the temperature of the IBH Link UA can be found here:

Retrieved from "https://wiki.ibhsoftec.com/en/index.php?title=IBH_Link_UA:Startup_operations&oldid=2325"