CROSSBOW_v5.4_Client_ConfigurationManual
CROSSBOW_v5.4_Client_ConfigurationManual
Configuration Manual
SIMATIC NET
Device Management
https://www.siemens.com/ruggedcom
Preface
Introduction 1
RUGGEDCOM CROSSBOW
Installation and Upgrade 2
SIMATIC NET
Setup and Configuration 3
Device Management Managing Regions,
RUGGEDCOM CROSSBOW v5.4 Facilities, Devices and
Gateways 4
Client
Configuration Manual
Managing CAMs 5
Managing Generated Audit
Logs 6
Managing Reports 7
Troubleshooting 8
Reference 9
06/2023
C79000-G8976-1573-01
Legal information
Warning notice system
This manual contains notices you have to observe in order to ensure your personal safety, as well as to prevent
damage to property. The notices referring to your personal safety are highlighted in the manual by a safety
alert symbol, notices referring only to property damage have no safety alert symbol. These notices shown
below are graded according to the degree of danger.
DANGER
indicates that death or severe personal injury will result if proper precautions are not taken.
WARNING
indicates that death or severe personal injury may result if proper precautions are not taken.
CAUTION
indicates that minor personal injury can result if proper precautions are not taken.
NOTICE
indicates that property damage can result if proper precautions are not taken.
If more than one degree of danger is present, the warning notice representing the highest degree of danger
will be used. A notice warning of injury to persons with a safety alert symbol may also include a warning
relating to property damage.
Qualified personnel
The product/system described in this documentation may be operated only by personnel qualified for the
specific task in accordance with the relevant documentation, in particular its warning notices and safety
instructions. Qualified personnel are those who, based on their training and experience, are capable of
identifying risks and avoiding potential hazards when working with these products/systems.
Proper use of Siemens products
Note the following:
WARNING
Siemens products may only be used for the applications described in the catalog and in the relevant
technical documentation. If products and components from other manufacturers are used, these must be
recommended or approved by Siemens. Proper transport, storage, installation, assembly, commissioning,
operation and maintenance are required to ensure that the products operate safely and without any
problems. The permissible ambient conditions must be complied with. The information in the relevant
documentation must be observed.
Trademarks
All names identified by ® are registered trademarks of Siemens Canada Ltd.. The remaining trademarks in this
publication may be trademarks whose use by third parties for their own purposes could violate the rights of
the owner.
Disclaimer of liability
We have reviewed the contents of this publication to ensure consistency with the hardware and software
described. Since variance cannot be precluded entirely, we cannot guarantee full consistency. However, the
information in this publication is reviewed regularly and any necessary corrections are included in subsequent
editions.
Preface ........................................................................................................................................... xi
Security information ............................................................................................................... xi
Firmware/software support model ......................................................................................... xii
Supplementary Documentation .............................................................................................. xii
Accessing documentation ...................................................................................................... xii
Registered trademarks ........................................................................................................... xii
Warranty ............................................................................................................................... xiii
Training ................................................................................................................................ xiii
Customer support ................................................................................................................. xiii
Contacting Siemens .............................................................................................................. xiv
1 Introduction ........................................................................................................................... 1
1.1 Security Recommendations ................................................................................... 1
1.2 System Requirements ............................................................................................ 4
1.3 RUGGEDCOM CROSSBOW Tools ............................................................................. 4
2 RUGGEDCOM CROSSBOW Installation and Upgrade ............................................................. 7
2.1 Installing the RUGGEDCOM CROSSBOW Client ........................................................ 7
2.1.1 Installing CROSSBOW Client ................................................................................... 7
2.2 Determining the Current Software Version ............................................................ 8
3 Setup and Configuration ..................................................................................................... 11
3.1 Basic Setup ......................................................................................................... 11
3.2 Launching RUGGEDCOM CROSSBOW Client .......................................................... 12
3.3 Configuring the Virtual Serial Port for a CROSSBOW Client .................................... 16
3.4 Managing Server Connections ............................................................................. 17
3.4.1 Multiple Client Connections ................................................................................. 18
3.4.2 Connecting/Disconnecting a Client from the Server .............................................. 18
3.4.3 Reconnecting to the Last Server Connection ........................................................ 18
3.4.4 Clearing the Most Recently Used Servers List ....................................................... 20
3.4.5 Configuring the Client Login Timeout .................................................................. 20
3.4.6 Enabling/Disabling TLS 1.2 Connections for RUGGEDCOM CROSSBOW Client ......... 22
3.5 Managing Users, Groups and Authentication ....................................................... 23
3.5.1 Broadcasting a Message to All Users .................................................................... 23
3.5.2 Disconnecting All Users ....................................................................................... 25
3.5.3 Managing User Profiles ........................................................................................ 25
3.5.3.1 Adding a User Profile .......................................................................................... 26
3.5.3.2 Configuring a User Profile ................................................................................... 29
3.5.3.3 Deleting a User Profile ......................................................................................... 30
3.5.3.4 Changing a User's Password ................................................................................ 31
3.5.4 Managing User Groups ........................................................................................ 33
3.5.4.1 Adding a User Group ........................................................................................... 33
Note
Along with the Client application and ADM, RUGGEDCOM CROSSBOW consists of a
primary server (SAM-P), optional local server(s) (SAM-L), and companion tools such
as the Station Access Controller (SAC) and Background Logger. For more information
about managing the server(s) and companion tools, refer to the "RUGGEDCOM
CROSSBOW Server Configuration Manual".
Security information
Siemens provides products and solutions with industrial security functions that
support the secure operation of plants, systems, machines and networks.
In order to protect plants, systems, machines and networks against cyber threats, it
is necessary to implement – and continuously maintain – a holistic, state-of-the-art
industrial security concept. Siemens’ products and solutions constitute one element
of such a concept.
Customers are responsible for preventing unauthorized access to their plants,
systems, machines and networks. Such systems, machines and components should
only be connected to an enterprise network or the internet if and to the extent
such a connection is necessary and only when appropriate security measures (e.g.
firewalls and/or network segmentation) are in place.
For additional information on industrial security measures that may be implemented,
please visit https://www.siemens.com/industrialsecurity.
Siemens’ products and solutions undergo continuous development to make them
more secure. Siemens strongly recommends that product updates are applied as
soon as they are available and that the latest product versions are used. Use of
product versions that are no longer supported, and failure to apply the latest updates
may increase customer’s exposure to cyber threats.
To stay informed about product updates, subscribe to the Siemens Industrial Security
RSS Feed under https://www.siemens.com/cert.
Supplementary Documentation
Other documents that may be of interest include:
• "RUGGEDCOM CROSSBOW v5.4 Server Configuration Manual". Contains
information about managing the RUGGEDCOM CROSSBOW primary server (SAM-
P), optional local server(s) (SAM-L), and companion tools such as the Station
Access Controller (SAC) and Background Logger.
• "RUGGEDCOM CROSSBOW v5.4 Companion Reference Manual". Contains
information specific to device types and products that support RUGGEDCOM
CROSSBOW.
• "RUGGEDCOM CROSSBOW v5.4 Scripting Reference Manual"
• "RUGGEDCOM CROSSBOW v5.4 Device Type Definition Tool (DTDT) for
CROSSBOW Configuration Manual"
• "RUGGEDCOM CROSSBOW v5.4 Executables and Ports". Contains a list of
executable files and ports, and their default state.
• "Application Description: Deploying RUGGEDCOM CROSSBOW as an Intermediate
Remote Access Solution"
• "FAQ – How to Troubleshoot Connection Issues"
Accessing documentation
The latest user documentation for RUGGEDCOM CROSSBOW v5.4 is available upon
request. To request or inquire about a user document, contact Siemens Customer
Support.
Registered trademarks
The following and possibly other names not identified by the registered trademark
sign ® are registered trademarks of Siemens Canada Ltd.:
• RUGGEDCOM
• ROS
• RCDP
• Discovery Protocol
Other designations in this manual might be trademarks whose use by third parties
for their own purposes would infringe the rights of the owner.
Warranty
Refer to the License Agreement for the applicable warranty terms and conditions, if
any.
For warranty details, visit https://www.siemens.com or contact a Siemens customer
service representative.
Training
Siemens offers a wide range of educational services ranging from in-house training
of standard courses on networking, Ethernet switches and routers, to on-site
customized courses tailored to the customer's needs, experience and application.
Siemens' Educational Services team thrives on providing our customers with the
essential practical skills to make sure users have the right knowledge and expertise
to understand the various technologies associated with critical communications
network infrastructure technologies.
Siemens' unique mix of IT/Telecommunications expertise combined with domain
knowledge in the utility, transportation and industrial markets, allows Siemens to
provide training specific to the customer's application.
For more information about training services and course availability, visit https://
www.siemens.com or contact a Siemens Sales representative.
Customer support
Customer support is available 24 hours, 7 days a week for all Siemens customers.
For technical support or general information, contact Siemens Customer Support
through any of the following methods:
Online
Visit http://www.siemens.com/automation/support-request to submit a Support Request
(SR) or check on the status of an existing SR.
Telephone
Call a local hotline center to submit a Support Request (SR). To locate a local hotline center,
visit https://w3.siemens.com/aspa_app/?lang=en.
Mobile app
Install the Industry Online Support app by Siemens AG on any Android, Apple iOS or
Windows mobile device and be able to:
• Access Siemens' extensive library of support documentation, including FAQs and
manuals
• Submit SRs or check on the status of an existing SR
• Contact a local Siemens representative from Sales, Technical Support, Training, etc.
• Ask questions or share knowledge with fellow Siemens customers and the support
community
Contacting Siemens
Address Siemens Canada Ltd.
Digital Industries
Process Automation
300 Applewood Crescent
Concord, Ontario
Canada, L4K 5C7
Telephone Toll-free: 1 888 264 0006
Tel: +1 905 856 5288
Fax: +1 905 856 1995
E-Mail [email protected]
Web https://www.siemens.com
Authentication
• Make sure database encryption is enabled. For added security, Siemens
recommends using certificate-based encryption. If certificate-based encryption
is used, make sure the encryption certificate is different than the one used for
the RUGGEDCOM CROSSBOW server. If password-based encryption is used, make
sure to use registry protection.
For more information about encrypting passwords, refer to the "RUGGEDCOM
CROSSBOW Server Configuration Manual".
For more information about registry protection, refer to the "RUGGEDCOM
CROSSBOW Server Configuration Manual".
• Replace the default passwords for all user accounts and processes (where
applicable) before RUGGEDCOM CROSSBOW is deployed.
• Use strong passwords. Avoid weak passwords such as password1, 123456789,
abcdefgh, etc.
• Make sure passwords are protected and not shared with unauthorized personnel.
• Passwords should not be re-used across different user names and systems, or
after they expire.
• Record passwords in a safe, secure, off-line location for future retrieval should
they be misplaced. This includes the Device Password reports that can be
generated by RUGGEDCOM CROSSBOW.
• Restrict access to the RUGGEDCOM CROSSBOW server and database to only
trusted personnel.
• Do not save credentials in RUGGEDCOM CROSSBOW-adjacent applications (e.g.
Microsoft SQL Server Management Studio).
Physical/Remote Access
• Restrict physical access to the RUGGEDCOM CROSSBOW server to only trusted
personnel. A person with malicious intent in possession of removable media
(e.g. USB, external hard drive, etc.) could extract critical information, such as
certificates, keys, etc., or reprogram the server.
• Make sure operators are trained to use RUGGEDCOM CROSSBOW and have the
required set of permissions to perform their duties.
• Do not expose the RUGGEDCOM CROSSBOW server – specifically, ports 21000,
21005 and 21008 – to the Internet. For more information about network
configuration, refer to the "RUGGEDCOM CROSSBOW Server Configuration
Manual".
• Make sure unwanted commands are not issued to devices via RUGGEDCOM
CROSSBOW. While RUGGEDCOM CROSSBOW is designed to block commands
(as specified by the administrators), a determined user may still be able to
circumvent security surrounding a specific command. It is recommended
(and the responsibility of the user) to review the event logs regularly for any
such activity. If necessary, RUGGEDCOM CROSSBOW can also be configured to
generate audit logs for device connections, which detail all transactions between
users and devices.
• Generated reports may contain sensitive information, such as IP addresses and
credentials. The user generating these reports is responsible for the proper
storage and distribution of this material.
• Dependent on the company's Public Key Infrastructure (PKI), use Transport Layer
Security (TLS) 1.3 connections and make sure all TLS/SSL certificates are signed
using a Secure Hash Algorithm. TLS 1.3 is enabled by default in RUGGEDCOM
CROSSBOW v5.4.
Communication
• All communications with the RUGGEDCOM CROSSBOW server, client
workstations, and IEDs should be contained within the security perimeter.
Hardware/Software
• Make sure the latest versions of all RUGGEDCOM CROSSBOW utilities are installed
on the RUGGEDCOM CROSSBOW server and individual client workstations,
including all security-related patches. For the latest information on security
patches for Siemens products, visit the ProductCERT Security Advisories website
[http://www.industry.siemens.com/topics/global/en/industrial-security/news-
alerts/Pages/alerts.aspx] or the ProductCERT Security Advisories website [https://
new.siemens.com/global/en/products/services/cert.html#SecurityPublications].
Updates to Siemens Product Security Advisories can be obtained by subscribing
to the RSS feed on the Siemens ProductCERT Security Advisories website, or by
following @ProductCert on Twitter.
• Make sure installed RUGGEDCOM CROSSBOW components contain an MD5 that
matches the MD5 specified in the document "RUGGEDCOM CROSSBOW v5.4
Executables and Ports".
• Only enable the services that will be used by RUGGEDCOM CROSSBOW utilities,
including physical ports. Unused physical ports could potentially be used to gain
access to the network behind the device.
• Use redundant RUGGEDCOM CROSSBOW setups whenever possible to increase
availability of all services and to backup the configuration.
• Make sure robust Server Class hardware is used when installing RUGGEDCOM
CROSSBOW on custom hardware not provided by Siemens.
• Make sure systems on which RUGGEDCOM CROSSBOW is installed are protected
from malware by using virus scanners, applying the latest Windows updates and
other industry best practices as appropriate.
• Make sure all centralized security components that interact with RUGGEDCOM
CROSSBOW (e.g. servers for Active Directory/RADIUS/RSA, external logging
servers, mail servers, etc.) are continuously secured and maintained according to
industry best practices.
Policy
• Periodically audit all workstations that access the RUGGEDCOM CROSSBOW
Server to make sure they comply with these recommendations and/or any
internal security policies.
• Make sure to follow the security recommendations outlined in this Configuration
Manual and configure the environment according to defense in depth best
practices.
• Review the user documentation for other Siemens products used in coordination
with RUGGEDCOM CROSSBOW for further security recommendations.
Decommissioning
• When RUGGEDCOM CROSSBOW is no longer in use, delete the RUGGEDCOM
CROSSBOW database and uninstall all instances of Server and Client applications,
including any related tools such as SAM-Ls, ADMs, etc.
For more information about related tools, refer to "RUGGEDCOM CROSSBOW
Tools" (Page 4).
Note
Responsiveness of the RUGGEDCOM CROSSBOW Client and Servers (SAM-P, SAM-
L, and SAC) can vary depending on a number of factors, including the capacity of
the host hardware, the capacity of the network infrastructure, the number of active
automated activities, the number of connected users, and the size of the overall
system.
Consider employing industry best practices, such as limiting the number of
connected users and scheduling automated activities during off hours, to optimize
Client responsiveness and overall system performance.
Tool Description
forwards communications through the RUGGEDCOM CROSSBOW
Server to a remote device using one of a variety of communications
mechanisms.
Note
A Virtual Port, or VPort, is an internal software component that
behaves like an actual hardware serial port. A Virtual Port is named
using the same convention as a real serial port, such as COM3. The
port number is configurable.
Tool Description
For more information about the DTDT, refer to the "RUGGEDCOM
CROSSBOW v5.4 Device Type Definition Tool (DTDT) for CROSSBOW
Configuration Manual".
RUGGEDCOM CROSSBOW RUGGEDCOM CROSSBOW Background Logger can optionally be
Background Logger run in the background of the RUGGEDCOM CROSSBOW server. It
captures internal log messages to assist in debugging and analyzing
field issues.
For more information about the Background Logger, refer to the
"RUGGEDCOM CROSSBOW Server Configuration Manual".
NOTICE
RUGGEDCOM CROSSBOW works with various third-party applications. Make sure
to consult the documentation for these applications for any requirements needed
to work with RUGGEDCOM CROSSBOW. Additionally, make sure to keep these
applications up-to-date, as outdated software can impact performance and security.
NOTICE
Make sure the installation materials provided by Siemens are digitally signed with
the Siemens AG certificate and contain MD5s that match those in the RUGGEDCOM
CROSSBOW v5.4 Release Notes.
Note
If planning to connect to devices/gateways using their real IP addresses (as opposed
to their localhost addresses), do not install RUGGEDCOM CROSSBOW Client on a
workstation running RUGGEDCOM CROSSBOW SAC or any form of server.
Note
To silently install the RUGGEDCOM CROSSBOW client instead, unzip the contents
of the compressed Zip file to a temporary directory, open a command prompt
window, and type:
cd { path } [ "CrossBow Client.msi" | "CrossBow Client
x64.msi" ] /quiet
5. Open the compressed Zip file and double-click CrossBow Client x64.msi (64-
bit). The CrossBow Client Setup installation wizard appears.
6. Follow the on-screen instructions to install the RUGGEDCOM CROSSBOW Client
application. A reboot may be required.
7. Launch RUGGEDCOM CROSSBOW Client, but do not connect to the RUGGEDCOM
CROSSBOW server.
8. Select the trusted Certificate Authority (CA). For more information, refer to
"Selecting a Trusted CA for a RUGGEDCOM CROSSBOW Client" (Page 57).
9. Verify the appropriate CA certificate is installed. For more information,
refer to "Verifying/Installing the RUGGEDCOM CROSSBOW Client CA
Certificate" (Page 56).
10. Configure which virtual serial communication port will be used by the
application for remote serial connections. For more information, refer to
"Configuring the Virtual Serial Port for a CROSSBOW Client" (Page 16).
Note
For information about setting up the RUGGEDCOM CROSSBOW Server(s) and Station
Access Controller (SAC), refer to the "RUGGEDCOM CROSSBOW Server Configuration
Manual".
Note
Each user authentication method has a unique way of handling multiple failed
login attempts. For Basic authentication, if a user enters their password incorrectly
several times (the actual number of times is defined within RUGGEDCOM CROSSBOW
Server), their profile will be locked until until an administrator unlocks it.
For Active Directory authentication, the lockout policies (if any) are defined by the
Active Directory server are respected.
For RSA SecurID authentication, the lockout policies (if any) are defined by the RSA
Authentication Manager are respected. Typically, when a user enters their password
incorrectly several times, the RSA server will put them in Next Tokencode Mode. In
this mode, when the user does provide the correct PIN and tokencode, the server
requests a second tokencode for verification.
Note
Images and steps may differ depending on the version of Windows being used. For
assistance, contact Siemens Customer Support.
3 4
Note
RUGGEDCOM CROSSBOW stores past successful server connections in a drop-
down window for quick selection. To configure RUGGEDCOM CROSSBOW to
automatically reconnect to the last known server, refer to "Reconnecting to the
Last Server Connection" (Page 18).
Note
The restricted use banner is required by North American Electric Reliability
Corporation (NERC) Critical Information Protection (CIP) standards. For more
information about customizing the message in the banner, refer to the
"RUGGEDCOM CROSSBOW Server Configuration Manual".
1 2
1 Cancel Button
2 Proceed Button
Figure 3.2 Restricted Use Banner (Example)
1 3
1 Yes Button
2 Check Box
3 No Button
Figure 3.3 Service Certificate Warning
Note
Click the check box to prevent this warning from appearing in the future.
Note
The RSA SecurID login process may vary depending on certain conditions. For
example, the first time a user uses their RSA SecurID token, they will likely be in
New PIN Mode (a PIN number has not been assigned to them yet), and they will
be required to create a PIN. This depends on the configuration of the RSA server.
RUGGEDCOM CROSSBOW will prompt the user for the information required by
the RSA server.
3 4
3 4
Note
The following characters are not permitted in passwords and will be ignored if
defined in the password rules:
• single quote (')
• semi-colon (;)
• pipe (|)
4. Enter a user name and password/passcode, then click OK. Once RUGGEDCOM
CROSSBOW Client has initialized, the RUGGEDCOM CROSSBOW Client window
appears.
Note
The port number must exceed the number of physical COM ports on the client's
workstation.
Note
When the client is installed on the same machine as the RUGGEDCOM CROSSBOW
Server, make sure the selected COM Port does not overlap with the range of ports
specified in the COM Pool Configuration.
For more information about the COM Pool Configuration, refer to the "RUGGEDCOM
CROSSBOW Server Configuration Manual".
To configure the virtual serial port for RUGGEDCOM CROSSBOW Client, do the
following:
1. Launch RUGGEDCOM CROSSBOW Client, but do not connect to the RUGGEDCOM
CROSSBOW server.
2. On the toolbar, click File, then click Preferences. The Preferences dialog box
appears.
1 OK Button
2 Cancel Button
3 Virtual Serial Port Box
Figure 3.7 Preferences Dialog Box
Note
Only one Client version earlier than RUGGEDCOM CROSSBOW v5.0 may be installed
on a given machine. All RUGGEDCOM CROSSBOW Client versions v5.0 or later may be
installed on the same machine.
Note
Each version of RUGGEDCOM CROSSBOW Client can only connect to the
corresponding version of the RUGGEDCOM CROSSBOW Server. For example, a v4.7.4
Client cannot connect to a v5.2.0 Server.
Connecting
1. In RUGGEDCOM CROSSBOW Client, click File on the toolbar, then click Connect
to Server.
2. Log in to the application. For more information about the log in process, refer to
"Launching RUGGEDCOM CROSSBOW Client" (Page 12).
Disconnecting
• In RUGGEDCOM CROSSBOW Client, click File on the toolbar, then click
Disconnect from Server. RUGGEDCOM CROSSBOW Client is disconnected from
the server.
1 OK Button
2 Cancel Button
3 Auto Connect to Last Server Check Box
Figure 3.8 Preferences Dialog Box
Note
Before performing this action, make sure no users are connected to RUGGEDCOM
CROSSBOW.
1 OK Button
2 Cancel Button
3 Client Login Timeout Box
Figure 3.9 Preferences Dialog Box
1 OK Button
2 Cancel Button
3 Allow TLS 1.2 Connection Check Box
Figure 3.10 Preferences Dialog Box
3. Select Allow TLS 1.2 Connection to enable TLS 1.2 connections, or clear the
check box to disable TLS 1.2 connections.
4. Repeat step 1 (Page 22) and step 2 (Page 22) for all other RUGGEDCOM
CROSSBOW client workstations.
Note
If Active Directory is in use, some interface controls in RUGGEDCOM CROSSBOW
Client for managing users and user groups are disabled.
2 3
1 Connected Users
2 Broadcast Message Button
3 Disconnect All Users Button
Figure 3.11 Connected Users Screen
1 4
1 To Box
2 Text Box
3 Send Button
4 Cancel Button
Figure 3.12 Dialog Box
5. In the text box, type the message to broadcast to all users, then click Send.
NOTICE
Use this feature with care, as this will disconnect any connections other users have
to devices/gateways.
2 3
1 Connected Users
2 Broadcast Message Button
3 Disconnect All Users Button
Figure 3.13 Connected Users Screen
Note
Each user must be created under the user group to which they belong. However, the
same user profile can be created under multiple user groups if needed.
1 2
NOTICE
Before adding a user profile to an Administrative group, make sure the user is
not connected to RUGGEDCOM CROSSBOW.
3. On the User Groups pane, right-click the desired user group and then click Add
User. The User Properties dialog box appears.
8
1 9
2
3
4
5
6
7
1 Username Box
2 Full Name Box
3 Description Box
4 Email Box
5 Primary Phone Box
6 Secondary Phone Box
7 Status Box
8 OK Button
9 Cancel Button
Figure 3.15 User Properties Dialog Box
Username The user's user name for logging into RUGGEDCOM CROSSBOW
Client.
If the user name matches the name of another user profile, all other fields are
configured automatically and blocked from further modifications.
5. If the profile has been automatically configured, click OK. The user profile is
added to the user group. For information about further modifying the user
profile, refer to "Configuring a User Profile" (Page 29).
Otherwise, configure the following parameters:
Parameter Description
Description A description of the user, such as the users title, role, location,
etc. This parameter is optional.
1 3
4
2
5
1 OK Button
2 Cancel Button
3 New Box
4 Confirm New Box
Figure 3.16 Change CrossBow Password Dialog Box
NOTICE
A password should be created for each user profile, regardless of the level of
authentication in use (i.e. basic or strong). In strong authentication mode, this
password is considered the SAC Fallback password used to connect to a SAC
that has lost connectivity with the SAM-P.
NOTICE
Passwords must meet the criteria defined by the administrator. For more
information about defining rules for passwords, refer to "Configuring Password
Rules" (Page 253).
Note
Passwords are used for user access to the system if the RUGGEDCOM CROSSBOW
Server is set for basic authentication. When strong authentication is selected,
these passwords still exist and may be used in SAC fallback authentication.
Fallback authentication occurs when a user logs in locally to a Station Access
Controller at a facility and the SAC is unable to connect to a parent SAM-P to
proxy the user login. In this case, the SAC will authenticate the user based on
their basic authentication password.
Note
Passwords are pushed to the SAM-L, if applicable, when Basic with Global
Fallback authentication is used.
Note
Each instance of a user profile represents the same user. Modifications to a user
profile under one user group affect all other instances of the user profile.
1 2
3. On the Users pane, right-click the desired user profile, and then click Properties.
The User Properties dialog box appears.
7
1
2
3
4
5
2 Description Box
3 Email Box
4 Primary Phone Box
5 Secondary Phone Box
6 OK Button
7 Cancel Button
Figure 3.18 User Properties Dialog Box
Note
The Status parameter is only configurable when set to Locked, unless the user
has administrator rights.
Parameter Description
Description A description of the user, such as the users title, role, location,
etc. This parameter is optional.
1 2
NOTICE
Before deleting a user profile from an Administrative group, make sure the user
is not connected to RUGGEDCOM CROSSBOW.
3. In the User Groups pane, right-click the desired user profile, and then click
Delete. If the profile profile does not exist under any other user group, a
confirmation dialog box appears.
4. Click Yes.
NOTICE
Passwords must meet the criteria defined by the administrator. For more
information about defining rules for passwords, refer to "Configuring Password
Rules" (Page 253).
Note
Passwords are used for user access to the system if the CrossBow Server is set for
basic authentication. When strong authentication is selected, these passwords still
exist and may be used in SAC fallback authentication. Fallback authentication occurs
when a user logs in locally to a Station Access Controller at a facility and the SAC is
unable to connect to a parent SAM-P to proxy the user login. In this case, the SAC will
authenticate the user based on their basic authentication password.
Method 1: Administrators
To change the password for another user, do the following:
1. Access the RUGGEDCOM CROSSBOW client workstation, launch RUGGEDCOM
CROSSBOW Client, and login as a user with the necessary administrative
privileges.
2. On the toolbar, click System Administration, then click User Groups. The User
Groups dialog box appears.
1 2
3. On the Users pane, right-click the desired user profile and then click Change
CrossBow Password. The Change CrossBow Password dialog box appears.
Note
The Old box is unavailable to administrators.
1 3
4
2
5
Method 2: Users
To change the password for the current user, do the following:
1. Access the RUGGEDCOM CROSSBOW client workstation, launch RUGGEDCOM
CROSSBOW Client, and login as a user with the necessary administrative
privileges.
2. On the toolbar, click File, then click either Change CrossBow Password (basic
authentication) or CrossBow SAC Fallback (strong authentication). The Change
Password or CrossBow SAC Fallback dialog box appears.
1 3
4
2
5
2. On the toolbar, click System Administration and then click User Groups. The
User Groups dialog box appears.
1 2
3. Right-click in the User Groups pane and then click Add User Group. The User
Group Properties dialog box appears displaying the Access Privileges tab.
1
4
5
2
1 Name Box
2 Description Box
3 Tabs
4 OK Button
5 Cancel Button
Figure 3.24 Access Privileges Tab
4. Configure the level of access the user group has to specific device
groups. For more information, refer to "Assigning Device Group Access
Privileges" (Page 35).
5. Configure the type of information available per device group to users within the
user group. For more information, refer to "Assigning Device Group Information
Privileges" (Page 38).
6. Assign administrative privileges to the user group. For more information, refer to
"Assigning Administrative Privileges" (Page 40).
7. Assign special operation privileges to the user group. For more information,
refer to "Assigning Special Operation Privileges" (Page 42).
8. Assign CAM privileges to the user group. For more information, refer to
"Assigning CAM Privileges" (Page 43).
9. Click OK. The dialog box closes.
10. Click OK.
Note
All user groups subsequent to the default Admin administrator user group are
automatically granted user-level rights.
11. [Optional] Configure the new user group as the administrator user group. For
more information, refer to the "RUGGEDCOM CROSSBOW Server Configuration
Manual".
Note
The same access privileges can be controlled when configuring a user group. For
information about how to assign access privileges when configuring a user group,
refer to "Assigning Access Privileges to a User Group" (Page 225).
Note
Access privileges are granted by device interface, not by the device itself. Therefore,
users can be given access to some interfaces, but be blocked from others on the
same device. For example, in the case of a RUGGEDCOM ROX II device, one user
group representing operators can be granted access to the device's Web-based
interface, while another group representing administrators can be given access to
both the Web-based and SSH interfaces.
1 2
3. On the User Groups pane, right-click a user group, and then click Properties.
The User Group Properties dialog box appears.
4. Click the Access Privileges tab. The Access Privileges screen appears.
5
2 2
6 3
7 8
3
5. Select the device groups the user group will require access to and then configure
the following for each:
Parameter Description
Note
RUGGEDCOM CROSSBOW allows users to configure custom
device logins and login access sets.
For more information about device type logins, refer to
"Configuring a Device Type Login" (Page 257).
For more information about login access sets, refer to
"Managing Login Access Sets" (Page 163).
Note
The Show Credentials check box in the application properties must also be
enabled for the password to be presented.
For more information, refer to "Adding/Configuring an
Application" (Page 275).
Note
The same information privileges can be controlled when configuring a device group.
For information about how to assign information privileges when configuring a
device group, refer to "Assigning Access Privileges to a User Group" (Page 225).
Note
Access to device data is independent from the user group's access privileges.
Specifically, a user group may be unable to connect to devices within a specific
device group, but still have access to the device data.
1 2
3. On the User Groups pane, right-click a user group and then click Properties.
The User Group Properties dialog box appears.
4. Click the Information Privileges tab. The Information Privileges screen
appears.
2 3 4 5
1 Device Groups
2 Alerts Check Box
3 Status Check Box
4 Faults Check Box
5 File Access Level List
6 OK Button
7 Cancel Button
Figure 3.28 Information Privileges Screen
Parameter Description
Status When enabled (selected), the user group can view all status
messages generated by devices within the device group.
Faults When enabled (selected), the user group can view all fault
messages generated by devices within the device group.
1 2
3. On the User Groups pane, right-click a user group and then click Properties.
The User Group Properties dialog box appears.
5
2 3 4
6
1 7
1 User Groups
2 Applications Check Box
3 Server Logs Check Box
4 Audit Logs Check Box
5 OK Button
6 Cancel Button
7 Device Groups
Figure 3.30 Administrative Privileges Screen
NOTICE
Before changing permissions in an Administrative group, make sure none of the
users assigned to the group is connected to RUGGEDCOM CROSSBOW.
Note
The ability to perform special operations is independent from the user group's access
privileges. Specifically, users may be able to perform special operations on devices
within a device group, but still have no access to the devices themselves.
Note
Some device types within the individual device groups may not support all special
operations. If a device group contains such a device type, only the special operation
supported by the associated devices and gateways are available. For a list of special
operations and the device types that support them, refer to "Special Operations
Supported by Device Family/Type" (Page 357).
1 2
3. On the User Groups pane, right-click a user group and then click Properties.
The User Group Properties dialog box appears.
4. Click the Special Operation Privileges tab. The Special Operation Privileges
screen appears.
1 Device Groups
2 OK Button
3 Cancel Button
Figure 3.32 Special Operation Privileges Screen
Note
The Device Access column indicates the device groups for which the current
user group has access privileges.
Note
The All Device Groups device group applies to all device groups.
5. Select privileges for all special operations using the check boxes on the All Ops
row, or select privileges for individual device groups. For information about the
available special operations, refer to "Available Special Operations" (Page 339).
6. Click OK. The dialog box closes.
7. Click OK to save changes.
Note
The ability to use CAMs is independent from the user group's access privileges.
Specifically, users may be able to use a CAM on devices within a device group, but
still have no access to the devices themselves.
Note
Available CAMs are specific to each installation of RUGGEDCOM CROSSBOW. CAMs
shown in screen captures are examples only.
1 2
3. On the User Groups pane, right-click a user group and then click Properties.
The User Group Properties dialog box appears.
4. Click the CAMs Privileges tab. The CAM Privileges screen appears.
1 Device Groups
2 OK Button
3 Cancel Button
Figure 3.34 CAMs Privileges Screen
5. Select privileges for all device groups using the check boxes on the All Device
Groups row, or select privileges for individual device groups. Options include:
Note
The Device Access column indicates the device groups for which the user group
has access privileges.
Note
The All Device Groups device group applies to all device groups.
Parameter Description
All CAMs Grants access to all CAMs for the selected device group.
{ Individual CAMs } Grants access to a specific CAM for the selected device group.
Note
Only empty user groups can be deleted. Make sure all users have been deleted
from the user group before deleting the user group. For more information, refer to
"Deleting a User Profile" (Page 30).
1 2
2 User Pane
Figure 3.35 User Groups Dialog Box
3. Right-click in the User Groups pane and then click Delete. A confirmation dialog
box appears.
4. Click OK to save changes.
1 Available Profiles
Figure 3.36 Notifications Screen
3. Right-click anywhere, and then click Add Profile. The Notification Profile
Configuration dialog box appears.
1 2
4. In the Profile Name box, type the name of the e-mail notification profile.
5. Configure the conditions under which an e-mail notification will be generated.
For more information, refer to "Configuring Conditions" (Page 49).
6. Configure a template for the e-mail notification. For more information, refer to
"Creating an E-Mail Template" (Page 53).
7. Click OK. The dialog box closes.
8. Click OK to save changes.
1 Available Profiles
Figure 3.38 Notifications Screen
3. Right-click the desired e-mail notification profile, and then click either Enable or
Disable.
1 Available Profiles
Figure 3.39 Notifications Screen
3. Right-click the desired e-mail notification profile, and then click Delete. A
confirmation dialog box appears.
4. Click Yes.
Note
Only events recorded in the RUGGEDCOM CROSSBOW database and that can be
reported against in the System Activity report can be targeted. For more information
about the System Activity Report, refer to "Generating a Report" (Page 317).
1 Available Profiles
Figure 3.40 Notifications Screen
3. Right-click the desired e-mail notification profile, and then click Edit Profile. The
Notification Profile Configuration dialog box appears.
4 5
6 7 8
1 OK Button
2 Cancel Button
3 Conditions
4 Add Condition Button
5 Remove Condition Button
6 Send To Lists
7 Add Button
8 Remove Button
9 E-Mail Addresses
Figure 3.41 Notification Profile Configuration Dialog Box
1 2 3 4 5 6 7
3 Not List
4 Condition List
5 Value List
6 Closing Parenthesis List
7 Connector List
Figure 3.42 Condition
Password Change
Configuration
Change
CrossBow Status
Gauntlet Special
Operation
Gauntlet Port
Access
Gauntlet Basic
PGM
Gauntlet Aux Relay
Special Operation
External Syslog
Device Activity
File Activity
Alerts
Scheduler
Username Is {users} A notification is sent when the user
name matches the selected name.
Is In User Group {user groups} A notification is sent when the user
belongs to the specified user group.
1 Available Profiles
Figure 3.43 Notifications Screen
3. Right-click the desired e-mail notification profile, and then click Edit Profile. The
Notification Profile Configuration dialog box appears.
4. Click the Email Template tab. The Email Template screen appears.
1 OK Button
2 Cancel Button
3 Subject Line Box
4 Body Box
5 Importance List
Figure 3.44 Email Template Screen
5. Customize the subject line and message body as needed. The following
placeholder objects are available to automatically include information related to
the event:
• <affecteddevicegroup> – the name of the device group affected by the
event
• <affectedfilename> – the name of the file affected by the event
• <affectedfiletype> – the name of the file type affected by the event
• <affectedusergroup> – the name of the user group affected by the event
• <affectedusername> – the name of the user affected by the event
• <deviceid> – the unique ID of the device associated with the event
• <devicenamewithsub> – the name of the associated device and facility
• <duration> – the duration of the event in minutes (m)
• <endtime> – the time at which the event ended
• <eventtext> – the event description
• <eventtype> – the event type
• <logfile> – the name of the log file where the event is recorded
• <recordid> – the event's unique ID
• <server> – the name of the associated server
• <starttime> – the time at which the event occurred or started
6. In the Importance list, select the important tag to apply to the e-mail. Options
include High, Normal and Low.
7. Click OK to save changes.
NOTICE
CA certificates must meet the following requirements:
• Support both TLS/SSL client and TLS/SSL server functionality
• Use an RSA key size of at least 2048 bytes
NOTICE
Spaces are not permitted in CA certificate names.
NOTICE
TLS 1.3 connections between RUGGEDCOM CROSSBOW clients and servers are
enabled by default, requiring all TLS/SSL certificates be signed using a Secure Hash
Algorithm.
NOTICE
Some gateways/servers (e.g. Cooper Power Systems) require installing an additional
proprietary root CA to allow special operations in RUGGEDCOM CROSSBOW. Refer to
the manufacturer's instructions for details.
1 OK Button
2 Cancel Button
3 Install Certificates Button
Figure 3.45 Preferences Dialog Box
NOTICE
During the import process, make sure to select the Mark this key as
exportable option. This is required for TLS connections between the client and
server. If this option is not selected, connections between the client and server
cannot be made.
Note
For information about trusted CAs for the server, SAC and SAM-L, refer to the
"RUGGEDCOM CROSSBOW Server Configuration Manual".
2. On the toolbar, select File, then click Preferences. The Preferences dialog box
appears.
1 OK Button
2 Cancel Button
3 Choose Trusted Certificate Authorities Button
Figure 3.47 Preferences Dialog Box (RUGGEDCOM CROSSBOW Client)
1 OK Button
2 Cancel Button
3 Clear Stored Responses To Certificate Warnings Button
Figure 3.49 Preferences Dialog Box
3. Click Clear Stored Responses To Certificate Warnings. All stored responses are
immediately erased.
Note
A local SSH server is created by RUGGEDCOM CROSSBOW when proxying an SSH
connection to an end device. The public key of the chosen certificate will be used
when creating the local SSH server.
1 OK Button
2 Cancel Button
3 Choose Application Client Certificate Button
Figure 3.50 Preferences Dialog Box
Note
RUGGEDCOM CROSSBOW is configured by default to use its own auto-generated
self-signed certificate. However, users are encouraged to use their own
certificates whenever possible.
of the file can then be viewed as part of the fault records for the device, gateway,
facility or region.
Directories can be specified at the global level, as well as at the device/gateway level.
EFS can also be configured to import event files that have a specific file keyword.
Note
For information about viewing fault records for a device, gateway, facility or region,
refer to "Viewing Fault Records for a Device" (Page 192).
Note
Users must have read/write access for the directories targeted by the EFS.
2 3 4 5
1 Available CAMs
2 Report Button
3 Run Now Button
4 Properties Button
5 Enabled Check Box
Figure 3.52 CAMs Dialog Box (Example)
3. For the Data CAM, click Properties. The Properties for Data CAM dialog box
appears.
1 2
Note
RUGGEDCOM CROSSBOW only searches for files with a specific file keyword when
scanning the global directory. File keywords are ignored when scanning a directory
selected for a specific device/gateway.
1
2 3 4
1 Available CAMs
2 Run Now Button
3 Properties Button
4 Enabled Check Box
5 OK Button
6 Cancel Button
Figure 3.54 CAMs Screen
5. For the Data CAM, click Properties. The Properties for Data CAM dialog box
appears.
1 3
4
2
File Keyword The file keyword required for files associated with the device/
gateway.
Note
An alternate file difference viewer can be configured specifically for comparing
configuration files belonging to a specific device type. For more information about
configuring a custom configuration file difference viewer for a device type, refer to
"Configuring an Alternate Configuration File Difference Viewer" (Page 235).
1 2
1 Application Box
2 Browse Button
3 OK Button
4 Cancel Button
5 Arguments Box
Figure 3.56 Preferences Dialog Box
3. Type the name of the executable for the application – including the full network
path – in Application, or click the short browse button to select the file from the
network.
These tokens are replaced by the names of the files to be compared by the
application.
5. Click OK to save changes.
1 OK Button
2 Cancel Button
3 Password Font Options
4 Password Digit Color Options
Figure 3.57 Preferences Dialog Box
Note
Font selection is based on the available fonts installed on the user's operating
system. For more information about installing fonts, consult the user
instructions for the operating system.
3. Under Personalizations, select the desired font from the Password Font list
and/or the desired digit color from the Password Digit Color list.
Once selected, a sample appears showing how the password will be displayed.
4. Click OK to save changes.
2 3
1 Filtering Options
2 Regions/Facilities Pane
3 Devices/Gateways Pane
Figure 4.1 Field Layout Tab (Connectivity View)
Each region and facility can be expanded to display the sub-regions if applicable.
Gateways and/or end-devices assigned to a region or facility are displayed in the
Devices/Gateways pane.
The following representative icons are used:
Region
Facility
Station Access Controller (SAC), Secure Access Manager - Local (SAM-L) or Asset Discovery
and Management (ADM) Agent
Gauntlet
Gateway
Device
Note
For information about defining custom fields to enhance the filtering options for
the Group By view, refer to the "RUGGEDCOM CROSSBOW Server Configuration
Manual".
1 2
Standard Search
To search for items, do the following:
1. Access the RUGGEDCOM CROSSBOW client workstation, launch RUGGEDCOM
CROSSBOW Client, and login as a user with the necessary administrative
privileges.
2. In the Search field, start typing the desired search criteria. The list will auto-
populate as the criteria is recognized.
3. Select the desired search result from the list. The selection will appear in the
Devices/Gateways pane.
Advanced Search
The advanced search allows users to search by Region Name, Device Name, Facility
Name, and up to ten custom fields.
For more information about configuring custom fields, refer to the "RUGGEDCOM
CROSSBOW Server Configuration Manual".
To search for items using the advanced search function, do the following:
1. Access the RUGGEDCOM CROSSBOW client workstation, launch RUGGEDCOM
CROSSBOW Client, and login as a user with the necessary administrative
privileges.
2. Click the Advanced Search button. A menu will appear displaying the available
search criteria.
3. Narrow the search as required by clicking the desired text box(es) in the menu.
4. Select the desired search result from the list. The selection will appear in the
Devices/Gateways pane.
7
2
8
4 5 6 9
3
10
1 Filter Bar
2 Select Filters List
3 Active Alerts
4 Apply Button
5 Current Selection
6 Selected Filters
7 OK Button
8 Refresh Button
9 Auto Refresh Check Box
10 Pagination Bar
Figure 4.9 Filter Bar – Alerts (Example)
Note
When first logging in as a full administrative user after installing RUGGEDCOM
CROSSBOW, a single region named Global Region appears in the Connectivity view.
Each region is defined by first adding sub-regions (if required), then facilities,
gateways subordinate gateways, and finally end-devices. As each component is
added, they are added to the RUGGEDCOM CROSSBOW database.
3
1 4
2
1 Name Box
2 Description Box
3 OK Button
4 Cancel Button
Figure 4.10 Region Properties Dialog Box (Example)
3. Configure the identification properties (e.g. name, description, etc.) for the
region or facility. For more information, refer to "Configuring Identification
Properties" (Page 77).
4. [Optional] Enable CAMs for the region or facility. For more information, refer to
"Enabling/Disabling CAMs" (Page 303).
5. Click OK to save changes.
3
1
4
2
1 Name Box
2 Description Box
3 OK Button
4 Cancel Button
Figure 4.11 Identification Screen (Example)
Note
The list of active alerts is based on the information available at the time when the
associated CAM ran last. If the condition that generated the alert has been fixed in
the field, the alert will still be presented by RUGGEDCOM CROSSBOW until the CAM
runs again. For example, if the expected firmware version for a device is updated
in the Firmware Version CAM, the CAM must still run again to verify the new value
against the device's real value before the alert is cleared.
3. Click the Active Alerts button. The Alerts-Data For dialog box appears.
6
2
7 8
1 Filter Bar
2 Active Alerts
3 Hide Acknowledged Alerts Check Box
4 OK Button
5 Refresh Button
6 Auto Refresh Check Box
7 Acknowledge All Button
8 Acknowledge Button
Figure 4.13 Alerts-Data For Dialog Box – Alerts
4. [Optional] Select filters as required, and then click Apply. For more information
about filtering, refer to "Filtering Data" (Page 74)
The Alerts-Data For screen lists the active alerts in order of severity, by default.
The severity of the alert, the time the alert was raised, the associated facility, the
source (device), and a brief description of the alert are listed.
Alerts are color-coded based on their level of severity. By default, red alerts
are the highest severity (critical), followed by yellow (warning), then blue
(information). These colors can be customized via the main server. For more
information, refer to the "RUGGEDCOM CROSSBOW Server Configuration
Manual".
Note
The Active Alerts button flashes for five seconds whenever a new alert is raised.
Note
Select Hide Acknowledged Alerts to hide alerts as they are acknowledged.
Note
If an alert is acknowledged yet still active, the alert will not be re-raised if the
alerted condition reoccurs.
Note
Special actions are available for some alert types. In the case of configuration
mismatch alerts, right-clicking the alert and selecting Compare displays the
approved configuration and the current configuration in a file difference
viewer. For connectivity alerts, right-click the alert and select retry to attempt to
reestablish the connection.
Note
The list of active alerts is based on the information available at the time when the
associated CAM ran last. If the condition that generated the alert has been fixed in
the field, the alert will still be presented by RUGGEDCOM CROSSBOW until the CAM
runs again. For example, if the expected firmware version for a device is updated
in the Firmware Version CAM, the CAM must still run again to verify the new value
against the device's real value before the alert is cleared.
6
2
7 8
1 Filter Bar
2 Active Alerts
3 Hide Acknowledged Alerts Check Box
4 OK Button
5 Refresh Button
6 Auto Refresh Check Box
7 Acknowledge All Button
8 Acknowledge Button
Figure 4.14 Data For Dialog Box – Alerts
The Alerts screen lists the active alerts. It lists the severity of the alert, the
associated facility, the source (device), and a brief description of the alert.
Note
Select Hide Acknowledged Alerts to hide alerts as they are acknowledged.
Note
Special actions are available for some alert types. In the case of configuration
mismatch alerts, right-clicking the alert and selecting Compare displays the
approved configuration and the current configuration in a file difference
viewer. For connectivity alerts, right-click the alert and select retry to attempt to
reestablish the connection.
4. [Optional] Filter the data as required. For more information, refer to "Filtering
Data" (Page 74)
5. [Optional] Acknowledge alerts as required.
• To acknowledge a single alert, select the alert and click Acknowledge
• To acknowledge multiple alerts, select each alert while holding either Shift
(select alerts in sequence) or Ctrl (select specific alerts not in sequence),
then click Acknowledge
• To acknowledge all alerts, click Acknowledge All
6. Click OK when done.
Note
Only one SAC is permitted per facility.
1 2
1 Regions/Facilities Pane
2 Devices/Gateways Pane
Figure 4.16 Field Layout Screen
Note
Only one SAC is permitted per facility or gateway. If SAC is already associated
with a facility or gateway, the Add Station Access Controller option is
unavailable.
2. In the Devices/Gateway pane, right-click the associated gateway and click Add
Station Access Controller. The Station Access Controller Properties dialog box
appears.
5
1
6
2
1 Name Box
2 Description Box
3 Status List
4 Custom Fields
5 OK Button
6 Cancel Button
Figure 4.18 Identification Tab
5. [Optional] If custom fields are associated with the SAC, modify the values for
each if required.
If a custom field is not available, add it. For more information, refer to the
"RUGGEDCOM CROSSBOW Server Configuration Manual".
6. Click OK to save changes.
3. Once located, right-click the SAC and then click Properties. The Station Access
Controller Properties dialog box appears.
4. Click the Connection tab. The Connection screen appears.
6
1
7
2
1 IP Address Box
2 Common Name Box
3 Port Box
4 Platform List
5 Device Group
6 OK Button
7 Cancel Button
Figure 4.19 Connection Screen
Common Name The common name in the SAC certificate. This is required to
establish a Transport Layer Security (TLS) connection between
the SAM and SAC.
Port The port number for the SAC. The port number is always the
SAC's main server port number plus five. For example, if the
server port is 21000 (default), the authentication port used by
the SAC is 21005.
5. Select the impact level for the device from the BES Cyber System list.
6. Click OK to save changes.
1 2 3
1 Device Types
2 Devices/Gateways
Figure 4.21 Device Types Dialog Box
3. In the left pane, expand CrossBow Station Access Controller and then click
Station Access Controller. All configured SACs appear in the right pane.
Note
Selecting the Station Access Controller device type updates the database for all
SACs.
4. Right-click either the desired SAC or the CrossBow Station Access Controller
device type, point to Special Operations, and then click Push SAC Database.
The Scheduling Push SAC Database dialog box appears.
1 2
5
6
1 Description Box
2 OK Button
3 Cancel Button
4 Repetition Lists
5 Start Time Options
6 Start Time Box
Figure 4.22 Scheduling Push SAC Database Dialog Box
NOTICE
The global fall-back password must be set for the SAC. For more information
about setting the password, refer to "Changing Passwords for Devices/
Gateways" (Page 151).
1 2
7. Enter a valid reason for revealing the global password and then click OK. The
global password is displayed.
8. Click OK.
9. Once the recipient has completed their task with the SAC, reset the global
password using the Change Password special operation. For more information,
refer to "Performing Special Operations" (Page 268).
Note
On the RUGGEDCOM CROSSBOW server, the ADM credentials must be configured via
the External Database Integration Service (EDIS). For more information, refer to the
"RUGGEDCOM CROSSBOW Server Configuration Manual".
1 2
1 Regions/Facilities Pane
2 Devices/Gateways Pane
Figure 4.24 Field Layout Screen
Note
Only one ADM is permitted per facility or gateway. If an ADM is already
associated with a facility or gateway, the Add Asset Discovery & Management
Agent option is unavailable.
2. In the Devices/Gateway pane, right-click the associated gateway and click Add
Asset Discovery & Management Agent. The Asset Discovery & Management
Properties dialog box appears.
5
1
6
2
1 Name Box
2 Description Box
3 Status List
4 Custom Fields
5 OK Button
6 Cancel Button
Figure 4.26 Identification Tab
5. [Optional] If custom fields are associated with the ADM, modify the values for
each if required.
If a custom field is not available, add it. For more information, refer to the
"RUGGEDCOM CROSSBOW Server Configuration Manual".
6. Click OK to save changes.
8
1
9
2
3 4 5 6 7
10
1 IP Address Box
2 Device Group
3 Login Box
4 Username Box
5 Password Box
6 Set Button
7 Origin Box
8 OK Button
9 Cancel Button
10 Suggest Password Button
Figure 4.27 Connection Screen
NOTICE
For added security, make sure the credentials used by the ADM to log into
the EDIS database are different from the credentials used by the EDIS on the
RUGGEDCOM CROSSBOW server. The ADM should be limited to only have
access to the DevicesForCrossbow table. For information about sharing device
information and configuring the EDIS, refer to the "RUGGEDCOM CROSSBOW
Server Configuration Manual".
6. [Optional] Click the Suggest Password button. A dialog box appears containing
a randomly generated password suggestion that meets the password rules
defined for that device type. The password is displayed using the font and color
defined in the user's preferences. From this dialog, the user can choose to copy
the suggested password to the clipboard.
7. [Optional] To change the password, click the Set button, enter the new
password, then click Set again.
8. Click OK to save changes.
5. Select the impact level for the device from the BES Cyber System list.
6. Click OK to save changes.
1 2 3
1 Device Types
2 Devices/Gateways
Figure 4.29 Device Types Dialog Box
3. In the left pane, expand Crossbow Asset Discovery & Management and then
click Crossbow ADM Agent. All configured ADMs appear in the right pane.
Note
Selecting the Crossbow ADM Agent device type updates the database for all
ADMs.
4. Right-click either the desired ADM device type, point to Special Operations, and
then click Push to ADM Agent. The Scheduling Push to ADM Agent dialog box
appears.
1 2
4
5
1 Description Box
2 OK Button
3 Cancel Button
4 Repetition Lists
5 Start Time Options
6 Start Time Box
Figure 4.30 Scheduling Push to ADM Agent Dialog Box
3. Once located, right-click the ADM and then click Properties. The Asset
Discovery & Management Properties dialog box appears.
4. Click the Advanced tab. The Advanced Properties screen appears.
4 5
1 Properties
2 OK Button
3 Cancel Button
4 Value List
5 Set Button
Figure 4.31 Advanced Properties Screen (Example)
5. Review the available properties and their values. For more information, refer to
"Available Advanced Parameters" (Page 341).
6. For each property that needs to be modified, select the property, select an
alternate value from the Value list, then click Set.
7. Click OK to save changes.
Note
Only one SAM-L is permitted per facility.
Note
A SAM-L cannot be added if a SAC already exists in the facility.
3
1
4
2
1 Name Box
2 Description Box
3 OK Button
4 Cancel Button
Figure 4.32 Facility Properties Dialog Box (Example)
3. Configure the name and description for the facility. For more information, refer
to "Configuring Identification Properties" (Page 77).
4. In the Regions/Facility pane, select the facilty where the SAM-L will reside.
5. Right click a blank area in the Devices/Gateway pane, then click Add Secure
Access Manager - Local. The Secure Access Manager - Local Properties dialog
box appears.
6
1
7
2
8
9
3
10
4
11
1 Name Box
2 Description Box
3 Status List
4 Custom Fields List
5 Encryption Enabled Status Box
6 OK Button
7 Cancel Button
8 Password Status Box
9 Encryption Password Expiry Period List
10 Last Time Encryption Password Changed Box
11 Enable Update Preparation Check Box
Figure 4.34 Identification Tab
Encryption Password The time in days in which password encryption will expire on
Expiry Period the SAM-L. A value of 0 signifies the encryption password will
not expire.
Last Time Encryption Status parameter showing the number of days since password
Password Changed encryption was changed on the SAM-L.
Parameter Description
Enable Update Prepara Enables or disables update preparation mode. Enabling this
tion parameter allows a user to perform a certificate replacement
when a certificate has expired or is about to expire.
5. [Optional] If custom fields are associated with the SAM-L, modify the values for
each if required.
If a custom field is not available, add it. For more information, refer to the
"RUGGEDCOM CROSSBOW Server Configuration Manual".
6. Click OK to save changes.
5
1
7 6
2
8
3
1 IP Address Box
2 Common Name Box
3 Port Box
4 Device Group
5 OK Button
6 Cancel Button
7 Global SAM-L Sync Mode Box
8 Daily Sync Time Box
Figure 4.35 Connection Screen
Parameter Description
Common Name The common name in the SAM-L certificate. This is required to
establish a Transport Layer Security (TLS) connection between
the SAM-P and the SAM-L.
NOTICE
The common name in the SAM-L certificate must match the
common name in the SAM-P, as configured in the Certificate
Subject box in the SAM-P Primary Configuration tab.
For more information about selecting/installing the
RUGGEDCOM CROSSBOW server certificate, refer to the
"RUGGEDCOM CROSSBOW Server Configuration Manual".
Global SAM-L Sync Mode The mode used to sync the SAM-L with the SAM-P.
NOTICE
This parameter is active only when the SAMLSyncTimerMode
global advanced parameter is configured.
For more information about configuring global advanced
parameters, refer to the "RUGGEDCOM CROSSBOW Server
Configuration Manual".
Daily Sync Time The time of day selected to sync the SAM-L with the SAM-P,
based on a 24-hour clock.
5. Select the impact level for the device from the BES Cyber System list.
6. Click OK to save changes.
Note
A failed automatic sync operation is retried in decreasing frequency for 24 hours,
after which the operation is retried every 24 hrs.
Note
Sync timing is not automatically triggered by user actions, such as deleting a file.
However, a SAM-L can be synced manually on demand without impacting the
automatic sync timing.
For more information about manual syncing, refer to "Manually Synchronizing a
SAM-L" (Page 108).
The initial sync operation is a full sync from the SAM-P, pushing down all the required
data for the SAM-L. Subsequent syncs are partial syncs, where changed data from the
SAM-L is pushed to the SAM-P, then changed data is pushed from the SAM-P back to
the SAM-L.
The status of past and upcoming sync operations can be viewed in the client.
For more information about viewing the sync status, refer to "Viewing the Sync
Status of SAM-Ls" (Page 109).
2 3 4 5 6 7 8 9 10 11 12 13
1
14
Note
When Auto Refresh is selected, the form will auto-update every 60 seconds.
Note
SAM-L syncs are prioritized based on the time since the last attempted sync.
If two SAM-Ls have the same sync time, the SAM-L whose last sync attempt is
oldest will be processed first.
Operation Description
Last Attempted Sync Time The date and time a SAM-L sync was last
attempted.
Last Sync Type The type of the last sync. Options include
None, Partial or Full.
Delay Until Next Sync The calculated delay until the next sync based
on the SAMLSyncTimerDelay advanced
parameter.
Next Sync Type The type of the next sync. Options include
Partial or Full.
Failures Since Last Success The number of failures since the last successful
sync.
Status The sync status. Options include Pending,
Running, Success, or Failed.
Sync Now This operation performs a partial sync on
demand, which bumps the priority of the SAM-
L's next sync to the top of the queue.
Sync Recovery This operation performs a full recovery of
the SAM-L database. This should only be
used when the SAM-L database needs to be
recovered to a working state.
6
1
7
2
8
9
3
10
4
11
1 Name Box
2 Description Box
3 Status List
4 Custom Fields List
5 Encryption Enabled Status Box
6 OK Button
7 Cancel Button
8 Password Status Box
9 Encryption Password Expiry Period List
10 Last Time Encryption Password Changed Box
11 Enable Update Preparation Check Box
Figure 4.38 Identification Tab
4. Select the Enable Update Preparation check box to enable preparation mode.
When the update has been completed, disable update preparation by
deselecting the Enable Update Preparation check box.
Note
The following procedure describes how to add a device/gateway using RUGGEDCOM
CROSSBOW Client. Devices/gateways can also be added by directly to the
RUGGEDCOM CROSSBOW database via either the Bulk Importer tool or an external
database.
For more information about the Bulk Importer, refer to "Importing/Exporting Device/
Gateway Information" (Page 210).
For more information about the External Database Integration Service, refer to the
"RUGGEDCOM CROSSBOW Server Configuration Manual".
Note
To facilitate configuration when changing device types, RUGGEDCOM
CROSSBOW retains the interface's proxy ports and advanced parameters that are
common between the two device types. As some parameters can differ between
devices in a family, it is recommended to review all interfaces and advanced
parameters following a device type change.
3. Configure the identification properties (e.g. name, description, etc.) for the
device/gateway. For more information, refer to "Configuring Identification
Properties" (Page 126).
4. Configure the connection properties (e.g. host name, user names, passwords,
etc.) for the device/gateway. For more information, refer to "Configuring
Connection Properties" (Page 127).
5. Configure the interfaces available for the device/gateway. For more information,
refer to "Configuring Interfaces" (Page 129).
6. Enable or disable the applications available for the device/gateway. For more
information, refer to "Enabling/Disabling Applications" (Page 136).
7. Configure the NERC CIP properties for the device/gateway. For more
information, refer to "Configuring NERC CIP Properties" (Page 137).
8. Configure any advanced parameters associated with the device/gateway. For
more information, refer to "Configuring Advanced Properties" (Page 138).
9. Click OK to save changes.
NOTICE
All subordinate devices/gateways are deleted when a parent gateway is deleted.
NOTICE
When a gateway is copied or cut, the same applies to any subordinate devices/
gateways.
Note
The device/gateway must be assigned to a device group the user has permissions to
access, and at least one application must be enabled for the device/gateway before a
connection can be established.
Note
For information about assigning a device/gateway to a device group, refer to
"Configuring Interfaces" (Page 129)
Note
For information about enabling/disabling applications, "Enabling/Disabling
Applications" (Page 251).
Note
If connecting to a serial device, make sure a virtual serial port is configured first.
For more information, refer to "Configuring the Virtual Serial Port for a CROSSBOW
Client" (Page 16).
Note
Each user can open multiple, concurrent sessions to different devices/gateways using
the CrossBow Terminal Emulator and/or Web Browser application. In addition, at
least one additional session can be opened using any other application installed
Note
Devices/gateways the user previously connected with in the same RUGGEDCOM
CROSSBOW Client session are listed in the right pane of the Field Layout tab. If the
desired device/gateway is listed in this pane, consider reconnecting rather than
finding the device/gateway again. For more information, refer to "Reconnecting to a
Device/Gateway" (Page 118).
Note
If the target device does not have all passwords defined, a prompt will appear
confirming it is OK to proceed. For information about managing passwords,
refer to "Managing Device/Gateway Passwords" (Page 150).
Note
If a weak cipher is detected, a prompt will appear confirming it is OK to
proceed. SSH cipher suites are configurable for devices/gateways and device
types via their advanced parameters SSH EncryptionAlgorithms, SSH
HostKeyAlgorithms, SSH KeyExchangeAlgorithms, and SSH MACAlgorithms.
Note
For information about configuring advanced properties, refer to "Configuring
Advanced Properties" (Page 138).
Note
For information about the available advanced parameters for a device or
gateway, refer to the "Available Advanced Parameters" (Page 341).
1 Available Applications/Interfaces
2 Select Login Access Options
3 OK Button
4 Cancel Button
Figure 4.40 Application Selection Dialog Box
Note
When RUGGEDCOM CROSSBOW establishes a connection with a network proxy
device, a Proxy Daemon is typically launched from the RUGGEDCOM CROSSBOW
Client. The Proxy Daemon is a process that exists during the span of the
connection to the end-device. It proxies data between the application and the
end-device through RUGGEDCOM CROSSBOW. All data is transmitted through
the Transport Layer Security (TLS) tunnel created between the RUGGEDCOM
CROSSBOW Client and the RUGGEDCOM CROSSBOW server.
Note
By default, the type of port that will open on the client side will match the port
type of the target device. For example, if telnet is used, a network pork will open
on the client side.
Note
Only one instance of GE Enervista UR or GE Enervista URPlus can be used at a
time.
Note
Login access sets are enabled based on the user's access privileges.
5. Under Select login, select the login access set to use when connecting to the
device.
Note
Connections may not be successful if the target device is already at its maximum
number of connections. The SAM-P and SAM-L associated with the device do not
share infomation about when a user is connected to a given device.
7. Once connected, the device/gateway and the connection status appear in the
Device Connection History pane.
1 Active Connections
2 Disconnect Button
Figure 4.41 Device Connection History Pane
1 Dismiss Button
Figure 4.42 Dialog Box - Localhost and Port Required
1 Dismiss Button
Figure 4.43 Dialog Box - Actual IP Address and Port Required
Note
Each user can open multiple, concurrent sessions to different devices/gateways using
the CrossBow Terminal Emulator and/or Web Browser application. In addition, one
additional session can be opened using any other application installed on the client's
workstation.
1 Available Applications/Interfaces
2 Select Login Access Options
3 OK Button
4 Cancel Button
Figure 4.44 Application Selection Dialog Box
Note
When RUGGEDCOM CROSSBOW establishes a connection with a network proxy
device, a Proxy Daemon is typically launched from the RUGGEDCOM CROSSBOW
Client. The Proxy Daemon is a process that exists during the span of the
connection to the end-device. It proxies data between the application and the
end-device through RUGGEDCOM CROSSBOW. All data is transmitted through
the Transport Layer Security (TLS) tunnel created between the RUGGEDCOM
CROSSBOW Client and the RUGGEDCOM CROSSBOW server.
Note
Login access sets are enabled based on the user's access privileges.
3. Under Select login, select the login access set to use when connecting to the
device.
4. Click OK. RUGGEDCOM CROSSBOW attempts to connect to the device. Review
the Messages pane for details.
5. Once connected, the device/gateway and the connection status appear in the
Device Connection History pane.
1 Active Connections
2 Disconnect Button
Figure 4.45 Device Connection History Pane
1 Dismiss Button
Figure 4.46 Dialog Box – Localhost and Port Required
1 Dismiss Button
Figure 4.47 Dialog Box – Actual IP Address and Port Required
Note
Connections made via a network proxy can only be closed by disconnecting from
the device/gateway from RUGGEDCOM CROSSBOW Client.
1 Active Connections
2 Disconnect Button
Figure 4.48 Field Layout Tab – Disconnect
Note
The Discover Connected Devices special operation is only supported by select
gateways. For information about which gateways support this operation, refer to
"Special Operations Supported by Device Family/Type" (Page 357).
Note
Devices discovered via this special operation will automatically have their Mandatory
(Version 3) NERC CIP properties set to No and their BES Cyber System set to
Unassigned.
2. Search for the desired gateway. For more information, refer to "Locating
Devices/Gateways" (Page 111).
NOTICE
Unsupported characters will be ignored if defined in the password rules.
The following characters, including a blank space, are supported:
ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_!
@#&+$^[]-.`~%*()=\{}:""<>?,/ŠŒŽšœžŸÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖØÙÚÛÜÝ
Þßàáâãäåæçèéêëìíîïðñòóôõöøùúûüýþÿ
Note
Windows Firewall with Advanced Security must be enabled and configured on the
RUGGEDCOM CROSSBOW server. The VPN uses the Windows Firewall to create the
IPSec tunnel on the RUGGEDCOM CROSSBOW server side. For more information, refer
to the "RUGGEDCOM CROSSBOW Server Configuration Manual".
NOTICE
Security hazard – risk of unauthorized access and/or exploitation
Minimize the chances of a security event by adhering to the following guidelines:
• Make sure the IP address of the end-device is not accessible outside of a VPN
tunnel
• Use 2048 bit (or higher) Diffie-Hellman groups
• Use strong ciphers
• Keys used by the VPN connection must be 1024 bits (or higher) in length
• Disable all export cipher suites for VPN connections
Note
Once the VPN tunnel is established, additional connections to the device will not
create further VPNs. The VPN will stay connected until the last device is disconnected.
Note
For more information about how to configure IPSec on the end-device, refer to the
device's user documentation.
NOTICE
RUGGEDCOM ROX devices support IKEv1 for RUGGEDCOM CROSSBOW
connections. Make sure the ROX device is configured to use IKEv1.
For more information about configuring the gateway type, refer to "Configuring
Identification Properties" (Page 126).
7. Define the pre-shared key for the gateway. The key must match the secret key
defined previously in step 3 (Page 124).
For information about how to define the pre-shared key for a gateway, refer to
"Configuring Connection Properties" (Page 127).
8. Configure the following advanced parameters for the device or its device type in
RUGGEDCOM CROSSBOW:
Note
The parameter values must match those configured for the end-device.
For information about how to configure advanced parameters for a device or its
device type in RUGGEDCOM CROSSBOW, refer to either "Configuring Advanced
Properties" (Page 138) or "Configuring Advanced Properties" (Page 255).
For more information about these advanced parameters, refer to "Available
Advanced Parameters" (Page 341).
Note
For information about how to configure Gauntlet gateways, refer to "Configuring
Gauntlet Gateways" (Page 145).
1 10
2 11
4
3
6
5
8
1 Name Box
2 Display Name Box
3 Description Box
4 Gateway Type List
5 Serial Number Box
6 Firmware Box
7 Status List
8 MAC Address Box
9 OK Button
10 Cancel Button
11 Custom Fields
Figure 4.49 Identification Screen (Example)
NOTICE
Unsupported characters will be ignored.
The following characters, including a blank space, are supported:
ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_!
@#&+$^[]-.`~%*()=\{}:""<>?/ŠŒŽšœžŸÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖØ
ÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõöøùúûüýþÿ
NOTICE
This parameter is active only when the DisplayNameEnabled
global advanced parameter is set to True.
For more information about configuring global advanced
parameters, refer to the "RUGGEDCOM CROSSBOW Server
Configuration Manual".
5. [Optional] If custom fields are associated with the device/gateway, modify the
values for each if required.
If a custom field is not available, add it. For more information, refer to the
"RUGGEDCOM CROSSBOW Server Configuration Manual".
6. Click OK to save changes.
6
1
7
2 3 4 5
1 2 3 4
1 Login Box
2 Username Box
3 Password Box
4 Set Button
5 OK Button
6 Cancel Button
7 Suggest Password Button
Figure 4.51 Connection Dialog Box – Devices (Example)
Note
Some parameters are read-only, depending on the server being used.
Some parameters are not applicable to certain devices/gateways.
Pre-Shared Key The value of the pre-shared key used by the device/gateway.
This is required to establish an IPSec connection with an IPSec-
enabled RUGGEDCOM device. For more information about IPSec
connections, refer to "Establishing an IPSec Connection with
RUGGEDCOM Devices" (Page 123).
The password for the login. Click Set to set a new password.
7. [Optional] Click the Suggest Password button. A dialog box appears containing
a randomly generated password suggestion that meets the password rules
defined for that device type. The password is displayed using the font and color
defined in the user's preferences. From this dialog, the user can choose to copy
the suggested password to the clipboard.
8. Click OK to save changes.
9. If the device/gateway password was changed and a Station Access Controller
(SAC) belongs to the same facility, update the SAC database. For more
information, refer to "Updating the SAC Database" (Page 90).
3. Once located, right-click the device/gateway and then click Properties. The
Device Properties or Gateway Properties dialog box appears.
4. Click the Interfaces tab. The Interfaces screen appears.
2 3 4 5 6 7
1
1 Available Interfaces
2 Enable Check Box
3 Network Port
4 Gateway Port
5 Proxy Ports Box
6 Device Group List
7 Audit Level List
8 OK Button
9 Cancel Button
Figure 4.52 Interfaces Screen (Example)
Note
Interfaces must be enabled at the device type level before they
can be enabled at the device level.
Network Port The network port on the device/gateway used by the interface.
Gateway Port The gateway port used by the interface. This parameter is only
applicable to devices/gateways that are subordinate to a parent
gateway.
Parameter Description
Note the following syntax conventions:
• A simple integer port number (e.g. 80) indicates a TCP port.
• An integer prefixed with the letter U (e.g. U50000)
indicates a UDP port.
• An integer prefixed with the letter F (e.g. F21) activates
special handling for passive mode FTP protocol. When
logging in to a device via FTP, RUGGEDCOM CROSSBOW
will automatically provide the necessary authentication
credentials. If a specific FPT credential is available and
configured in RUGGEDCOM CROSSBOW, that credential
will be supplied. In other cases, the user's selected login
will be provided for FTP authentication. The FTP client and
server will negotiate additional ports between them during
a connection. With FTP handling activated, RUGGEDCOM
CROSSBOW will monitor the communications between the
FTP client and server, and open up additional proxy ports as
required.
• An integer prefixed with the letter T (e.g. T69) activates
special handling for passive mode TFTP protocol. The TFTP
client and server will negotiate additional ports between
them during a connection. With TFTP handling activated,
RUGGEDCOM CROSSBOW will monitor the communications
between the TFTP client and server, and open up additional
proxy ports as required.
• An integer prefixed with the letter M (e.g. M5433) indicates
a monitored TCP port. Monitored ports do not start listening
right away on the client side. Instead, the server creates
an initial monitoring connection from the server to the
specified port on the end device. When this monitoring
connection is successful, the listening port on the client
side is enabled for new incoming connections. The listening
port must support multiple incoming connections and must
not have an enabled inactivity timeout.
• More than one port can be specified, separated by spaces.
• A range of ports can be specified, separated by a dash (e.g.
200-210 for ports 200 through 210 inclusive). Up to 30
ports can be specified, including those prefixed with U, F,
T, and M . Dynamic ports (e.g D1:80) and redirected ports
(e.g. 3389:4389) are not supported by this syntax.
• A colon (:) between two port numbers instructs
RUGGEDCOM CROSSBOW to listen on the first port on
the client-side localhost proxy and target the second
port on the end-device. The first port is the local port
number and the second is the target port number (i.e.
localportnumber:targetportnumber).
A useful application of this convention is to avoid port
conflicts. For example, the Windows' Remote Desktop
Connection uses the Remote Desktop Protocol (RDP) over
TCP port 3389. Normally, port 3389 would simply be
specified as the TCP port to proxy. However, if the client's
workstation is accessible via Remote Desktop Connection,
port 3389 is already in use, preventing the localhost proxy
from opening that port. To workaround this conflict,
specify an arbitrary local port number (e.g. 4389:3389) or
Parameter Description
specify D1 (e.g. D1:3389) to have the client's workstation
dynamically choose the local port.
Another example is when an application may be trying
to connect on a fixed port, but intermediate devices are
installed between the RUGGEDCOM CROSSBOW Server
and the end device and have a form of port redirection
enabled. Example: A modem listening on port 446, but
redirecting requests to port 443. To accommodate this, the
user can configure 443:446 in the Proxy Ports field and the
client workstation will listen on port 443, but RUGGEDCOM
CROSSBOW will attempt to connect to port 446.
The D1 token is useful in this context for specifying the
proxy port for a secure Web connection. In this case, each
new web connection established will pick a free port for
the localhost proxy to listen on. The application definition
for the secure Web browser connection must then use the
token <D1> in its command line parameters (e.g. https://
localhost:<D1>) to tell the browser launched to target
the dynamically selected port for that connection. This
allows more than one browser connection to be active
simultaneously, each with its own dynamically chosen
localhost proxy port. If an application supports passing
multiple ports on the command line and dynamic ports
are required, additional dynamic ports can be added to the
same interface using tokens <D2:{port}>, <D3:{port}>, etc.,
where {port} is the desired dynamic port number. Note that
Web connections can only support 1 dynamic port.
Use of this syntax requires a client application that can
connect to an arbitrary port number, either through
the application's user interface or (preferably) through
command line parameters that can be passed to the
application when it is launched.
Note
Gateway ports can also be configured at the device type level. For more information,
refer to "Configuring Gateway Ports" (Page 243).
Note
Gateway ports for Novatech devices are not configurable via RUGGEDCOM
CROSSBOW.
1 Available Ports
2 OK Button
3 Cancel Button
Figure 4.53 Gateway Ports Screen
5. Confirm the port numbers associated with the device type, if applicable. If a
port number needs to be modified, double-click the port number and edit the
existing port number.
6. Click OK to save changes.
Note
The Enable or Disable Ports special operation is only supported by select devices/
gateways. For information about which devices/gateways support this operation,
refer to "Special Operations Supported by Device Family/Type" (Page 357).
Note
The Enable or Disable Ports special operation must be enabled via the User Group
Special Operation Privileges to be visible as a special parameter. For information
about assigning special operation privileges, refer to "Assigning Special Operation
Privileges" (Page 42).
1
4
2
6
3
7
1 Description Box
2 Repetition Lists
3 Start Time Options
4 OK Button
5 Cancel Button
6 Repetition Values
7 Start Time Box
Figure 4.54 Scheduling Enable or Disable Ports Dialog Box
5. Select the Files Export Enabled check box to enable the service, or deselect the
Files Export Enabled to disable the service.
6. Click OK to save changes.
Note
Applications can be enabled/disabled at the device type and device/gateway
levels. However, if an application is disabled at the device type level, it cannot
be enabled at the individual device/gateway level. Applications that have been
disabled at the device type level are unavailable/dimmed. For information about
how to enable an application at the device type level, refer to "Enabling/Disabling
Applications" (Page 251).
1 2
1 Available Applications
2 Available Interfaces
3 Pop Up Text Box
4 OK Button
5 Cancel Button
Figure 4.56 Applications Screen (Example)
5. Select the impact level for the device from the BES Cyber System list.
6. Click OK to save changes.
4 5
1 Properties
2 OK Button
3 Cancel Button
4 Value List
5 Set/Edit Button
Figure 4.58 Advanced Properties Screen (Example)
5. Review the available properties and their values. For more information, refer to
"Available Advanced Parameters" (Page 341).
6. For each property that needs to be modified, do one of the following:
a. Select the property, type or select an alternate value from the drop down
list, then click Set; or
b. Select the property, click Edit, then select an alternate value from the Edit
Special Parameter Default Value list.
7. Click OK to save changes.
Note
For information about how to configure other devices and gateways, refer to
"Configuring Standard Devices/Gateways" (Page 125).
Note
Nozomi Guardians are added to gateways or facilities in the same manner as
standard devices, with exceptions as described. Nozomi Guardians are listed
under their associated facilities, device groups and device types.
Note
To facilitate configuration when changing device types, RUGGEDCOM
CROSSBOW retains the interface's proxy ports and advanced parameters that are
common between the two device types. As some parameters can differ between
devices in a family, it is recommended to review all interfaces and advanced
parameters following a device type change.
3. Configure the identification properties (e.g. name, description, etc.) for the
Nozomi Guardian. For more information, refer to "Configuring Identification
Properties" (Page 141).
4. Configure the connection properties (e.g. host name, user names, passwords,
etc.) for the Nozomi Guardian. For more information, refer to "Configuring
Connection Properties" (Page 142).
5. Configure the interfaces available for the Nozomi Guardian. For more
information, refer to "Configuring Interfaces" (Page 129).
6. Enable or disable the applications available for the Nozomi Guardian. For more
information, refer to "Enabling/Disabling Applications" (Page 136).
7. Configure the NERC CIP properties for the Nozomi Guardian. For more
information, refer to "Configuring NERC CIP Properties" (Page 137).
8. Configure any advanced parameters associated with the Nozomi Guardian. For
more information, refer to "Configuring Advanced Properties" (Page 144).
9. Click OK to save changes.
6
1
7
2
1 Name Box
2 Display Name Box
3 Description Box
4 Status List
5 Custom Fields Box
6 OK Button
7 Cancel Button
Figure 4.60 Identification Screen (Example)
NOTICE
Unsupported characters will be ignored.
The following characters, including a blank space, are supported:
ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_!
@#&+$^[]-.`~%*()=\{}:""<>?/ŠŒŽšœžŸÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖØ
ÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõöøùúûüýþÿ
Display Name The name of the Nozomi Guardian to be displayed after the
device name.
NOTICE
This parameter is active only when the DisplayNameEnabled
global advanced parameter is set to True.
For more information about configuring global advanced
parameters, refer to the "RUGGEDCOM CROSSBOW Server
Configuration Manual".
5. [Optional] If custom fields are associated with the Nozomi Guardian, modify the
values for each if required.
If a custom field is not available, add it. For more information, refer to the
"RUGGEDCOM CROSSBOW Server Configuration Manual".
6. Click OK to save changes.
1 8
3 4 5 6
1 IP Address Box
2 Common Name Box
3 Login Column
4 Username Column
5 Password Column
6 Set Button
7 OK Button
8 Cancel Button
9 Suggest Password Button
Figure 4.61 Connection Dialog Box – Devices (Example)
Common Name The common name used by the Nozomi certificate for
communication with the SAM-P.
The password for the login. Click Set to set a new password.
7. [Optional] Click the Suggest Password button. A dialog box appears containing
a randomly generated password suggestion that meets the password rules
defined for that device type. The password is displayed using the font and color
defined in the user's preferences. From this dialog, the user can choose to copy
the suggested password to the clipboard.
8. Click OK to save changes.
4 5
1 Properties
2 OK Button
3 Cancel Button
4 Value List
5 Set Button
Figure 4.62 Advanced Properties Screen (Example)
5. Review the available properties and their values. For more information, refer to
"Available Advanced Parameters" (Page 341).
Note
Use the NozomiTypeFilter parameter to specify the device criteria (e.g. IED,
robot, computer, etc.) to be imported into RUGGEDCOM CROSSBOW.
6. For each property that needs to be modified, select the property, select an
alternate value from the Value list, then click Set.
7. Click OK to save changes.
Note
For information about how to configure other devices and gateways, refer to
"Configuring Standard Devices/Gateways" (Page 125).
1 7
3
2 8
5 4
1 Name Box
2 Description Box
3 Gauntlet Type List
4 Serial Number List
5 Status List
6 OK Button
7 Cancel Button
8 Custom Fields
Figure 4.63 Identification Screen
Parameter Description
Gauntlet Type The device type to which the Gauntlet gateway belongs.
5. [Optional] If custom fields are associated with the device/gateway, modify the
values for each if required.
If a custom field is not available, add it. For more information, refer to the
"RUGGEDCOM CROSSBOW Server Configuration Manual".
6. Click OK to save changes.
10
2 1 11
3 12
4 5
6
8
7
9
Note
Some of the parameters shown/listed are not available for certain devices/
gateways.
Phone Number The phone number at which to reach the Gauntlet gateway.
Basic Pass Data The basic password required to connect to the Gauntlet
gateway.
Lockout Interval The time in minutes (m) the Gauntlet gateway will block login
attempts.
Device Group The device type associated with the Gauntlet gateway.
2 3 4
1 Ports
2 Default Option
3 Secure Check Box
4 Transfer Code Box
5 OK Button
6 Cancel Button
Figure 4.65 Ports Screen
Note
The default port in a Gauntlet gateway is the one used if no transfer code is
detected. If the Gauntlet gateway is subordinate to another Gauntlet gateway,
the default port of the subordinate must be set to 1.
5. Select Default next to the chosen port number to make that port the default.
6. For each port that is to be secure, select Secure.
7. For each port, type the transfer code in Transfer Code.
8. Click OK to save changes.
5. Select the impact level for the device from the BES Cyber System list.
6. Click OK to save changes.
4 5
1 Properties
2 OK Button
3 Cancel Button
4 Value List
5 Set Button
Figure 4.67 Advanced Properties Screen
5. Review the available properties and their values. For more information, refer to
"Available Advanced Parameters" (Page 341).
6. For each property that needs to be modified, select the property, select an
alternate value from the Value list, then click Set.
7. Click OK to save changes.
NOTICE
New secure passkeys will be programmed where necessary during the operation.
• For more information about configuring the password for a standard device/
gateway, refer to "Configuring Connection Properties" (Page 127)
• For more information about configuring the password for a Gauntlet gateway,
refer to "Configuring Connection Properties" (Page 146)
Note
Passwords are changed using the Change Password special operation, which is
only supported by select devices/gateways. For information about which devices/
gateways support this operation, refer to "Special Operations Supported by Device
Family/Type" (Page 357).
Note
For Novatech Orion gateways only, RUGGEDCOM CROSSBOW will attempt to
verify the new password following a reboot of the gateway. To prevent erroneous
password verification errors, configure the RebootDelaySeconds special parameter
to control how long RUGGEDCOM CROSSBOW must wait for the gateway to complete
a reboot before attempting to verify its password.
1
5
2
7
3
8
4
9
10
1 Description Box
2 Repetition Lists
3 Start Time Options
4 Password To Change Options
5 OK Button
6 Cancel Button
7 Repetition Values
8 Date Box
9 Configure Custom Button
10 Password Type List
Figure 4.68 Scheduling Change Password Dialog Box
1 4
8. Select one or more user names for which to change the password.
9. [Optional] If desired, select Save Custome Password Set for future use Check
Box.
10. Click OK to close the dialog box.
Note
The following characters are not permitted in passwords and will be ignored if
defined in the password rules:
• single quote (')
• semi-colon (;)
• pipe (|)
12. Under Start Time (On Server), select Now or Specific Time. If Now is selected,
proceed to step 14 (Page 154).
13. Select a date and time at which the operation should occur.
14. Click OK to save changes. The operation will commence at the selected time.
For information about how to monitor scheduled operations, refer to "Viewing
Scheduled Operations and Log Reports" (Page 266).
NOTICE
Only devices/gateways for which the PasswordsKnownTo parameter is configured
will be included in this operation. For more information about this parameter, refer
to "Available Advanced Parameters" (Page 341).
Note
Passwords are synchronized using the Sync Managed Passwords special operation,
which is only supported by select devices/gateways. For information about which
devices/gateways support this operation, refer to "Special Operations Supported by
Device Family/Type" (Page 357).
1
4
2
6
3
7
1 Description Box
2 Repetition Lists
3 Start Time Options
4 OK Button
5 Cancel Button
6 Repetition Values
7 Start Time Box
Figure 4.70 Scheduling Sync Managed Passwords Dialog Box
The password set name, description and status (enabled or disabled) are
displayed.
3. Right-click the desired password change sets and then click either Enable or
Disable, as applicable. The Status column updates accordingly.
4. Click OK to save changes.
3. Right-click anywhere in the Password Change Sets pane and then click Add.
The Password Change Set Add dialog box appears.
1 5
2 6
1 Name Box
2 Description Box
3 Status Box
4 Password Change Set List
5 OK Button
6 Cancel Button
Figure 4.74 Password Change Set Add Dialog Box
5. In the password change set list, select the desired device type(s) to be associated
with the password set.
6. Click OK. The dialog box closes.
7. Click OK to save changes.
NOTICE
Built-in password sets cannot be deleted.
2 OK Button
Figure 4.75 Password Change Sets Dialog Box
3. On the Password Change Sets pane, right-click the desired password change
set, and then click Delete. A confirmation dialog box appears.
4. Click Yes.
5. Click OK to save changes.
Note
The three preconfigured password change sets Administrator, Engineer and
User cannot be edited, as they contain a set of default logins used internally by
RUGGEDCOM CROSSBOW.
3. On the Password Change Sets pane, right-click the desired password change
set, and then click Edit. The Password Change Sets Edit dialog box appears.
1 5
2 6
1 Name Box
2 Description Box
3 Status Box
4 Password Change Set List
5 OK Button
6 Cancel Button
Figure 4.77 Password Change Set Edit Dialog Box
5. In the password change set list, select the desired device type(s) to be associated
with the password set.
6. Click OK. The dialog box closes.
7. Click OK to save changes.
3. On the Password Change Sets pane, right-click the desired password change
set, and then click Copy. The Password Change Sets Edit dialog box appears.
1 5
2 6
1 Name Box
2 Description Box
3 Status Box
4 Password Change Set List
5 OK Button
6 Cancel Button
Figure 4.79 Password Change Set Edit Dialog Box
5. In the password change set list, select the desired device type(s) to be associated
with the password set.
6. Click OK. The dialog box closes.
7. Click OK to save changes.
Note
System administrators are responsible for adding custom device logins to their
custom login access sets, otherwise actions such as checking out passwords may not
function properly.
For more information about device type logins, refer to "Configuring a Device Type
Login" (Page 257).
The login access set name, description and status (enabled or disabled) are
displayed.
3. Right-click the desired login access set and then click either Enable or Disable,
as applicable. The Status column updates accordingly.
4. Click OK to save changes.
3. Right-click anywhere in the Login Access Sets pane and then click Add. The
Login Access Set Add dialog box appears.
1 5
2 6
1 Name Box
2 Description Box
3 Status Box
NOTICE
A login access set must be enabled before associating a user group with a
device type.
For more information about enabling login access sets, refer to "Enabling/
Disabling Login Access Sets" (Page 164).
5. In the login access set list, select the desired device type(s) to be associated with
the user group.
6. Click OK. The dialog box closes.
7. Click OK to save changes.
NOTICE
Built-in password sets cannot be deleted.
3. On the Login Access Sets pane, right-click the desired login access set, and then
click Delete. A confirmation dialog box appears.
4. Click Yes.
5. Click OK to save changes.
Note
The three preconfigured login access sets Administrator, Engineer and User cannot
be edited, as they contain a set of default logins used internally by RUGGEDCOM
CROSSBOW.
3. On the Login Access Sets pane, right-click the desired login access set, and then
click Edit. The Login Access Sets Edit dialog box appears.
1 5
2 6
1 Name Box
2 Description Box
3 Status Box
NOTICE
A login access set must be enabled before associating a user group with a
device type. For more information about enabling login access sets, refer to
"Enabling/Disabling Login Access Sets" (Page 164).
5. In the login access set list, select the desired device type(s) to be associated with
the password set.
6. Click OK. The dialog box closes.
7. Click OK to save changes.
3. On the Login Access Sets pane, right-click the desired login access set, and then
click Copy. The Login Access Sets Edit dialog box appears.
1 5
2 6
1 Name Box
2 Description Box
3 Status Box
NOTICE
A login access set must be enabled before associating a user group with a
device type. For more information about enabling login access sets, refer to
"Enabling/Disabling Login Access Sets" (Page 164).
5. In the login access set list, select the desired device type(s) to be associated with
the password set.
6. Click OK. The dialog box closes.
7. Click OK to save changes.
Returned files include SET_ALL.TXT, SET_1.TXT, etc., along with the file
_ListOfSettingsFiles.txt
• Download SET_61850.CID file: Enabling this option retrieves the configuration in
the .cid file format.
• Download CFG.XML file: Enabling this option retrieves the configuration in
the .xml file format.
users to quickly determine whether new files have been stored, or previously-
approved files are missing during the current process.
1
4
2
6
3
7
1 Description Box
2 Repetition Lists
3 Start Time Options
4 OK Button
5 Cancel Button
6 Repetition Values
7 Start Time Box
Figure 4.89 Scheduling Get and Approve Configuration Dialog Box
Note
On some devices, the ActiveConfigFile advanced parameter may need to be defined
in order to restore configurations. For more information about which devices
support this parameter, refer to "Advanced Parameters Supported by Device Family/
Type" (Page 374).
1
4
2
6
3
7
1 Description Box
2 Repetition Lists
3 Start Time Options
4 OK Button
5 Cancel Button
6 Repetition Values
7 Start Time Box
Figure 4.90 Scheduling Change Password Dialog Box
Note
The firmware version is displayed in the Firmware field on the Device Properties
Identification tab.
a firmware file if it is new or if it differs from its last-stored version, marks the file
as Approved, and clears any Firmware File-Mismatch alert associated with the
file.
For information about which devices/gateways support these operations, refer to
"Special Operations Supported by Device Family/Type" (Page 357).
Firmware CAM
The Firmware CAM also performs individual firmware-retrieval tasks and processes
each firmware file that is retrieved or created.
The CAM first runs the Retrieve Firmware special operation, which stores the
firmware information in the Device Properties Firmware field, and for those devices
whose Firmware_Retrieval advanced parameter includes "Firmware File", it also
stores a firmware file if it is new or if it differs from its last-stored version.
Once the special operation has completed all firmware-retrieval tasks, the CAM
performs a comparison of the newest firmware information with the information
stored in the CAM Properties Firmware Version Override field. A Firmware Alert is
raised if the comparison fails. For devices that support a Firmware file, the CAM also
compares the newest and approved versions.
If the approved version differs from the newest version, the CAM will raise a
Firmware File-Mismatch alert unless such an alert already exists for the file. Both
the Firmware alert and Firmware File-Mismatch alert can be cleared by running the
GetAndApproveFirmware special operation. The Firmware File-Mismatch alert can
also be cleared by deleting the Firmware file that raised the alert.
2 3 4
1
1 Available CAMs
2 Run Now Button
3 Properties Button
4 Set Enabled Button
5 OK Button
6 Cancel Button
Figure 4.91 CAMs Screen (Example)
6. For the Firmware Version CAM, click Properties. The Properties for Firmware
Version CAM dialog box appears.
2 OK Button
3 Cancel Button
Figure 4.92 Properties for Firmware Version CAM Dialog Box
7. Enter the version number(s) for the firmware that should be running on devices/
gateways belonging to the device type.
8. Click OK to save changes.
1
2 3 4
1 Available CAMs
2 Run Now Button
3 Properties Button
4 Enabled Check Box
5 OK Button
6 Cancel Button
Figure 4.93 CAMs Screen (Example)
5. For the Firmware Version CAM, click Properties. The Properties for Firmware
Version CAM dialog box appears.
6. Enter the version numbers for the firmware that should be running on the
device/gateway.
7. Click OK to save changes.
8. Click OK.
Current Version column. For information about how to view the CAM reports,
refer to "Viewing CAM Reports" (Page 301).
For individual devices/gateways, refer to the identification properties for
the device/gateway. The Firmware parameter lists the current firmware
version(s). For more information, refer to "Configuring Identification
Properties" (Page 126).
Note
The Get and Approve Firmware Version special operation marks a firmware
version as approved by setting it as the expected firmware version override for
the target device/gateway. For more information about setting the expected
firmware version for a device/gateway, refer to "Setting the Expected Firmware
Version(s)" (Page 178).
1
4
3
6
1 Description Box
2 Repetition Lists
Note
The ability to add/delete firmware is not available for some devices/gateways, such as
select Novatech or GE UR Relay devices.
Note
Firmware for other devices and gateways stored in the RUGGEDCOM CROSSBOW
database and are version controlled, making it possible to store multiple versions for
future use or reference.
1 2 3
1 Device Families
2 Device Types
3 Devices and Gateways
Figure 4.96 Device Types Dialog Box
3. Right-click the device type for the desired devices/gateways and then click
Properties. The Device Type Properties dialog box appears.
4. Click the Firmware tab. The Firmware screen appears.
4 5 6
1 Available Firmware
2 OK Button
3 Cancel Button
4 Add File Button
5 Delete File Button
6 Select File Button
Figure 4.97 Firmware Screen
5. Click Add File. The New Firmware File dialog box appears.
1 4
5
2
6
Note
The ability to add/delete firmware is not available for some devices/gateways, such as
select Novatech or GE UR Relay devices.
Note
This procedure only describes how to delete firmware for non-Gauntlet devices and
gateways, for which there can be many firmware files stored in the RUGGEDCOM
CROSSBOW database. Only a single firmware file is retained for Gauntlet gateways on
the RUGGEDCOM CROSSBOW server, which is updated each time a new firmware file
is uploaded. It is recommended this file be retained.
1 2 3
1 Device Families
2 Device Types
3 Devices and Gateways
Figure 4.99 Device Types Dialog Box
3. Right-click the device type for the desired devices/gateways and then click
Properties. The Device Type Properties dialog box appears.
4. Click the Firmware tab. The Firmware screen appears.
4 5 6
1 Available Firmware
2 OK Button
3 Cancel Button
4 Add File Button
5 Delete File Button
6 Select File Button
Figure 4.100 Firmware Screen
5. Select the desired firmware file and then click Delete. A confirmation dialog box
appears.
6. Click Yes. The file is removed from the list.
7. Click OK to save changes.
4.5.17.6 Selecting the Version to Use for the Next Firmware Update
To select the firmware version to be installed during the next firmware update for a
specific device type, do the following:
1. Access the RUGGEDCOM CROSSBOW client workstation, launch RUGGEDCOM
CROSSBOW Client, and login as a user with the necessary administrative
privileges.
2. On the toolbar, click System Administration and then click Device Types. The
Device Types dialog box appears.
1 2 3
1 Device Families
2 Device Types
3 Devices and Gateways
Figure 4.101 Device Types Dialog Box
3. Right-click the device type for the desired devices/gateways and then click
Properties. The Device Type Properties dialog box appears.
4. Click the Firmware tab. The Firmware screen appears.
4 5 6
1 Available Firmware
2 OK Button
3 Cancel Button
4 Add File Button
5 Delete File Button
6 Select File Button
Figure 4.102 Firmware Screen
5. Select the desired firmware file and then click Select File. An asterisk (*)
appears next to the selected file in the Selected column.
6. Click OK to save changes.
1
6
3
8
1 Description Box
2 Repetition Lists
3 Start Time Options
4 From Version Box
5 To Version Box
6 OK Button
7 Cancel Button
8 Start Time Box
Figure 4.103 Scheduling Update Firmware
Note
If the Data CAM runs on a serial device that contains numerous event files, the CAM
may require a significant amount of time (30 minutes or more) to complete.
Note
If a mechanism for retrieving fault records from devices/gateways exists outside of
RUGGEDCOM CROSSBOW, configure the Event File Service (EFS) to automatically
retrieve event files from the specified network directories so they can be displayed
within RUGGEDCOM CROSSBOW. For more information, refer to "Configuring the
Event File Service" (Page 63).
3 4 5
1 Filter Bar
2 Faults
3 Open Button
4 Export Button
5 Details Button
6 OK Button
7 Refresh Button
8 Auto Refresh Check Box
Figure 4.104 Data For Dialog Box – Faults
The Faults screen lists the faults that have occurred on the selected device or
group of devices.
4. [Optional] Filter the data as required. For more information, refer to "Filtering
Data" (Page 74)
5. [Optional] Select a fault and click Open. The related waveform file opens in the
associated viewer.
6. [Optional] Select a fault and click Export to export the related waveform file.
7. [Optional] Select a fault and click Details. The Fault Details dialog box appears.
1
7
2 8
3
10 11
1 Facility Box
2 Device Box
3 Timestamp Box
4 Metadata Box
5 Event Details
6 Fault Type Box
7 OK Button
8 Location Box
9 Sliders
10 Minus (-) Button
11 Plus (+) Button
Figure 4.105 Fault Details Dialog Box
1 Filter Bar
2 Events
3 OK Button
4 Refresh Button
5 Auto Refresh Check Box
Figure 4.106 Data For Dialog Box – SOEs
The SOE screen lists events for each selected device as they occurred over the
specified time period.
4. [Optional] Filter the data as required. For more information, refer to "Filtering
Data" (Page 74)
5. Click OK when done.
Note
All files stored in the RUGGEDCOM CROSSBOW database are version controlled. When
a file is updated, either by a CAM or a user, a new version of the file is created.
1 Available Files
2 OK Button
Figure 4.107 Data For Dialog Box – Files
each file, open a file locally, check files out for editing, import a new file, and much
more.
Note
The Data CAM must be installed to perform actions on device files. For more
information about installing the Data CAM, refer to the "RUGGEDCOM CROSSBOW
Server Configuration Manual".
Note
Log files are retrieved using the Retrieve Device Logs special operation, which is
only supported by select devices/gateways. For information about which devices/
gateways support this operation, refer to "Special Operations Supported by Device
Family/Type" (Page 357).
Note
For information about how to view the logs collected from devices/gateways, refer to
"Viewing Device Files" (Page 196).
To retrieve the logs from a device/gateway belonging to specific facility, device group
or device family, do the following:
1. Access the RUGGEDCOM CROSSBOW client workstation and launch RUGGEDCOM
CROSSBOW Client.
2. Locate the desired facility, device group or device family.
• For information about locating facilities, refer to "Viewing the Field
Layout" (Page 71)
• For information about locating device groups, refer to "Viewing a List of
Device Groups" (Page 222)
• For information about locating device families, refer to "Viewing a List of
Device Families and Types" (Page 230)
3. Right-click the facility, device group or device family, point to Special
Operations, then click Retrieve Device Logs. The Scheduling Retrieve Device
Logs dialog box appears.
1
4
3
6
1 Description Box
2 Repetition Lists
3 Start Time Options
4 OK Button
5 Cancel Button
6 Start Time Box
Figure 4.108 Scheduling Retrieve Device Logs Dialog Box
4. Click OK. RUGGEDCOM CROSSBOW connects to the gateway and removes all log
files.
All file versions stored in the RUGGEDCOM CROSSBOW database are listed.
To help sort the list, add labels to each file version. Labels help categorize files,
making it easier to locate files of a specific type. For more information about applying
labels to files, refer to "Labeling Device Files" (Page 208).
2. Right-click the desired file and click View File Activity. The report appears in a
new window.
NOTICE
Security hazard – risk of unauthorized access and/or exploitation
Some files may contain sensitive, proprietary information, such as passwords.
Access should be restricted to only trusted personnel.
Note
Opening a file creates a temporary version on the user's workstation.
• Open With opens the Open With dialog box, which lists applications
installed on the workstation that may be able to open the selected file.
Select the desired application and then click OK.
1 Available Users
2 OK Button
3 Cancel Button
Figure 4.112 Dialog Box
3. Select a user and then click OK. A confirmation dialog box appears asking
whether or not to attach the file to the e-mail.
4. Click Yes to attach the file, or click No to exclude the file. The e-mail is sent
to the target user.
• Sending An E-Mail Notification to a Specific User Group
1. Display the files stored for the target device/gateway.
• For information about how to view the latest files, refer to "Viewing
Device Files" (Page 196)
• For information about how to view the previous versions of a specific
file, refer to "Viewing a File's Version History" (Page 199)
2. Right-click the desired file, point to Send File Notification To, and then click
CrossBow User Group. A dialog box appears.
3. Select a user group and then click OK. A confirmation dialog box appears
asking whether or not to attach the file to the e-mail.
4. Click Yes to attach the file, or click No to exclude the file. The e-mail is sent
to all users belonging to the target user group.
• Sending An E-Mail Notification to a Specific E-Mail Address
1. Display the files stored for the target device/gateway.
• For information about how to view the latest files, refer to "Viewing
Device Files" (Page 196)
• For information about how to view the previous versions of a specific
file, refer to "Viewing a File's Version History" (Page 199)
2. Right-click the desired file, point to Send File Notification To, and then click
Other Mail Recipient. A dialog box appears.
2
1 3
3. Type the recipient's e-mail address in the box, and then click OK. A
confirmation dialog box appears asking whether or not to attach the file to
the e-mail.
4. Click Yes to attach the file, or click No to exclude the file. The e-mail is sent
to the recipient.
Note
Files cannot be modified by other users when they are checked out. An Administrator
can, however, unlock a file if necessary. For more information about unlocking a file,
refer to "Locking/Unlocking Device Files" (Page 207).
1 Save Button
Figure 4.115 Save As Dialog Box
3. Select where to save the file and then click Save. While the file is checked out,
the color of the file information in the list changes and the Status column
indicates the user who checked out the file.
4. When finished modifying the file, import it back into the RUGGEDCOM
CROSSBOW as a new version. For more information, refer to "Checking In Device
Files" (Page 204).
Note
To avoid conflicts with a SAM-L in a facility, a device file cannot be checked in if
the SAM-L is performing or awaiting an activity on the file at the same time.
1
5
3 2 6
1 Filename Box
2 Browse Button
3 File Label List
4 OK Button
5 Cancel Button
6 Description Box
Figure 4.116 Check In File Dialog Box
3. Click Browse and select the file to check in. The file name and path appear
under Filename.
4. [Optional] Under File Label, type or select a file label. Pre-defined file labels
include Archive, As Built, As Left, IFC and Working.
5. [Optional] Under Description, replace the default description with a custom
description of the file.
Note
When a new version of an existing file is checked in, the new description is
applied to the file version only. The overall file description in the Files tab will
not be changed.
1 Save Button
Figure 4.117 Save As Dialog Box
Note
New files are associated with the database entity selected, including devices,
facilities, etc. For example, if viewing files for devices/gateways that belong to a
facility, any file imported will be associated with the facility.
To import a new file and associate it with a specific device, view the files for the
device specifically and not its parent gateway, facility or region.
1 4
2 5
3 6
1 Filename Box
2 Browse Button
3 File Label List
4 OK Button
5 Cancel Button
6 File Type List
7 Description Box
Figure 4.118 Import New File Dialog Box
3. Click Browse and select the file to import. The file name and path appear under
Filename.
4. [Optional] Under File Label, type or select a file label. Pre-defined file labels
include Archive, As Built, As Left, IFC and Working.
5. Under File Type, select the file type. Options include General, EventFile,
Configuration and Configuration Text.
6. [Optional] Under Description, replace the default description with a custom
description of the file.
7. Click OK to import the file.
3
1
4
3. [Optional] Under File Label, type or select a file label. Pre-defined file labels
include Archive, As Built, As Left, IFC and Working.
4. [Optional] Under Description, replace the default description with a custom
description of the file.
5. Click OK to save changes.
To quickly set the label for a file without checking it in, importing the file, or editing
its properties, do the following:
1. Display the versions available for the target file. For more information, refer to
"Viewing a File's Version History" (Page 199).
2. Right-click the desired file version, point to Set Label To and then select one of
the available labels.
Note
A file difference viewer must be configured to compare configuration files. This can
be either a default file difference viewer for file types, or a custom configuration file
difference viewer configured specifically for the parent device type.
For more information, refer to either "Configuring a Default File Difference
Viewer" (Page 66) or "Configuring an Alternate Configuration File Difference
Viewer" (Page 235).
1. Display the versions available for the target file. For more information, refer to
"Viewing a File's Version History" (Page 199).
2. Select two configuration file versions, then right-click the files and click
Compare Versions. The configurations are displayed in the available file
difference viewer.
NOTICE
Security hazard – risk of unauthorized access and/or exploitation
The database may contain confidential information. Access to information exported
from the database should be restricted to trusted personnel only.
NOTICE
The spreadsheet must conform to a format compatible with Bulk Importer v5.4. Do
not use spreadsheets created from previous releases of this tool. Instead, export and
modify a new spreadsheet, or generate a blank spreadsheet.
For more information, refer to "Exporting a Blank or Populated
Spreadsheet" (Page 212).
For information about modifying a spreadsheet, refer to "Creating/Modifying a
Spreadsheet" (Page 214).
Note
The Bulk Importer only accepts Microsoft Office Excel spreadsheets with the XLSX
(*.xlsx) extension. Spreadsheets with the XLS (*.xls) extension are not accepted for
import.
NOTICE
If the RUGGEDCOM CROSSBOW database is encrypted, passwords for users, devices
and gateways are encrypted as they are imported.
1 5
1 Files List
2 Load Button
3 Remove Button
4 Validate Button
5 Import Button
6 View Log(s) Button
Figure 4.120 RUGGEDCOM CROSSBOW Bulk Importer
5. Click the Load button and choose the desired Excel spreadsheet from the
workstation/network. The file is loaded to the file list window. Repeat as
necessary to add additional files.
6. Select the desired file(s) and click Validate. Each file is checked for compatibility.
7. If a validation error appears, do the following:
a. Click View Log(s). A log file appears detailing the error(s).
b. Fix the error(s) and repeat step 5 (Page 212) and step 6 (Page 212) until
no further errors appear.
8. If permissions worksheets (i.e. Device Group Permissions, User Group
Permissions and Global Permissions) exist in the file to be imported, an alert will
appear. To include permissions worksheets, click Yes. Otherwise click No.
9. Click Import. A dialog box appears temporarily displaying the progress of the
import until it has completed.
NOTICE
Security hazard – risk of unauthorized access and/or exploitation
Encrypted data in the RUGGEDCOM CROSSBOW database is exported in cleartext
by the Bulk Importer tool. Make sure the output is saved in a secure location only
accessible by trusted personnel.
Note
The described menu items are only visible via the SAM-P.
Note
Only the owner of a particular file can delete it from the database. If a user
selects a file they did not generate, the Delete option will be disabled.
Modifying Worksheets
Whether modifying information exported from the RUGGEDCOM CROSSBOW
database or working with a blank spreadsheet, note the following before modifying a
spreadsheet:
• Many worksheets rely on information defined in previous worksheets. Make sure
to complete the previous worksheet before moving to the next.
• Some fields accept multiple values. When permitted, add additional values as a
comma separated list (e.g. value1,value2,value3).
• Not all fields are required. For instance, a phone number is not required for a
network-based device type. There is no harm in specifying a value for such fields,
but it will have no affect.
• Regions, facilities, device types, custom fields and BES Cyber Systems removed/
excluded from the spreadsheet will not be removed from the RUGGEDCOM
CROSSBOW database upon import. This can only be done via the RUGGEDCOM
CROSSBOW Client.
• Renamed devices or devices moved from one facility to another are treated as
entirely new devices.
Available Worksheets
Each spreadsheet contains the following worksheets:
Worksheet Description
Regions This worksheet lists the regions to be created (column 1) and
their parent regions (column 2). The regions must be created in
hierarchical order. Specifically, a region must be defined before it
can be used as a parent region in later rows.
Facilities This worksheet lists the facilities to be created (column 1) and
specifies their parent regions (column 2).
DeviceGroups This worksheet lists the device groups to be created.
CustomFields This worksheet defines custom fields for devices, including their
values, used on the Devices worksheet to identify devices. Each
custom field is defined by its name (row 2), its type (row 3), and its
allowed values (starting in row 4).
A total of 10 custom fields can be defined.
Note
RUGGEDCOM CROSSBOW v5.4 Bulk Importer currently supports
only list type custom fields.
Worksheet Description
BESCyberSystems This worksheet defines the BES Cyber System available to users via
RUGGEDCOM CROSSBOW Client. For each system, the worksheet
lists the name of the BES Cyber System (column 1), its impact
(column 2), and a description (column 3).
Devices This worksheet lists the devices that are to be created. Each device
is listed in hierarchical order. Specifically, a gateway must be
defined before the IED to which it is connected.
Note
Blank is an accepted value for most columns in this worksheet.
If in doubt about a specific column, leave the cell blank. The Bulk
Importer will indicate during import if the column requires a value.
Note
Some columns on this worksheet include a comment that indicates
if a property is required. It also includes a brief description to help
users understand which value is required.
Note
If the parent type is Facility, the parent gateway must be blank.
However, if the parent type is Gateway, the parent gateway
must be defined.
Note
The Parent Gateway Port column must be formatted as
text in the spreadsheet to avoid being read as an integer in
RUGGEDCOM CROSSBOW. Either format the column as text, or
add a single quote (') in front of the port number.
Worksheet Description
For more information about the advanced parameters that
can be defined on this worksheet, refer to the "RUGGEDCOM
CROSSBOW Client Configuration Manual".
• DeviceFilesExportEnabled: If true, the files for this device will
be exported via the FileExportService.
• Device ID: The device's unique key.
• Delete Device: If true, this device will be deleted rather than
updated.
• Rename Device: If true, this device's name will be updated.
DeviceLogins This worksheet defines the login information, including device type
and passwords, assigned to devices.
NOTICE
When importing a device, the credentials in the DeviceLogins
worksheet will be applied. If no credentials are specified for a
device in the worksheet, the credentials will be cleared on the
device inRUGGEDCOM CROSSBOW.
FileLabels This worksheet defines the labels assigned to files on the Files
worksheet.
Files This worksheet lists files to be imported from specific devices. Each
row in this worksheet defines the name of the file (column 1),
the device's facility (column 2), the name and full path to the file
(column 3), and the file label (column 4).
Device Group Permissions This worksheet lists the device group permissions that are to be
created.
Note
Blank is an accepted value for most columns in this worksheet.
If in doubt about a specific column, leave the cell blank. The Bulk
Importer will indicate during import if the column requires a value
Note
Some columns on this worksheet include a comment that indicates
if a property is required. It also includes a brief description to help
users understand which value is required.
Worksheet Description
• Access Level
• Change Password
• Clear DeviceLogs
• Discover Connected Devices
• Enable or Disable Ports
• Get and Approve Configuration
• Get And Approve Firmware Version
• Push SAC Database
• Program and Activate Device
• Program Device
• Push to ADM Agent
• Restore Configuration
• Retrieve Communications Summary Report
• Retrieve Configuration
• Retrieve Device Logs
• Retrieve Firmware Version
• Sync Managed Passwords
• Update Firmware
• Verify All Passwords
• Config Compare CAM
• Connectivity CAM
• Data CAM
• Firmware Version CAM
User Group Administration This worksheet lists the user group administration fields that are to
be created.
Note
Blank is an accepted value for most columns in this worksheet.
If in doubt about a specific column, leave the cell blank. The Bulk
Importer will indicate during import if the column requires a value.
Note
Some columns on this worksheet include a comment that indicates
if a property is required. It also includes a brief description to help
users understand which value is required.
Note
Blank is an accepted value for most columns in this worksheet.
If in doubt about a specific column, leave the cell blank. The Bulk
Importer will indicate during import if the column requires a value.
Worksheet Description
Note
Some columns on this worksheet include a comment that indicates
if a property is required. It also includes a brief description to help
users understand which value is required.
1 4
4 Edit Button
5 Delete Button
Figure 4.122 BES Cyber Systems Dialog Box
3. Click Add to add a new BES cyber system, or select an existing system and then
click Edit. The BES Cyber System dialog box appears.
1
3
4
2
5
1 Name Box
2 Impact List
3 Description Box
4 OK Button
5 Cancel Button
Figure 4.123 BES Cyber System Dialog Box
Note
When a BES Cyber System is deleted, any devices/gateways that were assigned to it
will become unassigned. Unassigned devices/gateways must be assigned to a BES
Cyber System before any other configuration changes can be saved for the device.
1 4
3. Select the desired BES cyber system and then click Delete. A confirmation dialog
box appears.
4. Click OK.
5. Click Done.
6. For each device/gateway previously assigned to the BES cyber system, assign
them to one of the other available systems. For more information, refer to
"Assigning a BES Cyber System" (Page 220).
Note
A device/gateway can only be assigned to one device group at a time. However,
different interfaces on a device/gateway can be assigned to multiple device groups.
2 3
2 3
3. Right-click anywhere in the Device Groups pane and then click Add Device
Group. The Device Group Properties dialog box appears.
1
4
5
2
1 Name Box
2 Description Box
3 Tabs
4 OK Button
5 Cancel Button
Figure 4.127 Device Group Properties Dialog Box
4. In the Name box, type the name of the new device group.
5. In the Description box, type a description of the new device group.
6. Configure the level of access individual user groups have to devices within the
device group. For more information, refer to "Assigning Access Privileges to a
User Group" (Page 225).
7. Configure the type of information available to individual user groups for devices
within the device group. For more information, refer to "Assigning Information
Privileges to a User Group" (Page 227).
8. Enable/disabled the available CAMs, if applicable. For more information, refer to
"Enabling/Disabling CAMs" (Page 303).
9. Click OK. The dialog box closes.
10. Click OK to save changes.
11. Assign devices and gateways to the device group as needed. For more
information, refer to "Configuring Interfaces" (Page 129).
Note
The (Unassigned) device group cannot be deleted.
Note
Device groups associated with devices and/or user groups cannot be deleted. Devices
and user groups must be associated with another device group before the target
device group can be deleted.
2 3
3 Devices/Gateways Pane
Figure 4.128 Device Groups Dialog Box
3. On the Device Groups pane, right-click the desired device group, and then click
Delete. A confirmation dialog box appears.
4. Click Yes.
Note
The same access privileges can be controlled when configuring a device group. For
information about how to assign access privileges when configuring a device group,
refer to "Assigning Device Group Access Privileges" (Page 35).
NOTICE
Access privileges are granted by device interface, not by the device itself. Therefore,
users can be given access to some interfaces, but be blocked from others on the
same device.
For example, in the case of a RUGGEDCOM ROX II device, one user group
representing operators can be granted access to the device's Web-based interface,
while another group representing administrators can be given access to both the
Web-based and SSH interfaces.
2 3
3 Devices/Gateways Pane
Figure 4.129 Device Groups Dialog Box
3. On the Device Groups pane, right-click the desired device group and then click
Properties. The Device Group Properties dialog box appears displaying the
Access Privileges tab.
4 5 6 7
1 User Groups
2 OK Button
3 Cancel Button
4 Command List Level List
5 Login Access List
6 Password Checkout Level List
7 Auto Login List
Figure 4.130 Access Privileges Tab
4. Select the user groups that will require access to the device group and then
configure the following for each:
Parameter Description
Parameter Description
Note
The same information privileges can be controlled when configuring a user group.
For information about how to assign information privileges when configuring a user
group, refer to "Assigning Device Group Information Privileges" (Page 38).
Note
Access to device/gateway data is independent from the user group's access
privileges. Specifically, a user group may be unable to connect to devices within a
specific device group, but still have access to the device data.
2 3
3. On the Device Groups pane, right-click the desired device group and then click
Properties. The Device Group Properties dialog box appears.
4. Click the Information Privileges tab. The Information Privileges screen
appears.
1 4 5 6
1 Device Groups
2 OK Button
3 Cancel Button
4 Alerts Check Box
5 Faults Check Box
6 File Access Level List
Figure 4.132 Information Privileges Screen
Alerts When enabled (selected), the user group can view all alerts
generated by devices/gateways within the device group.
Faults When enabled (selected), the user group can view all fault
messages generated by devices/gateways within the device
group.
Note
Every device type is a member of a device family. However, there are cases where a
unique device type is the one and only member of its containing device family (i.e.
it is a family of one). In this case, there is no separate folder displayed for the device
family.
1 2 3
3. [Optional] Select Show Enabled to show enabled device types, or select Show
All to show all device types.
4. Device types are listed in the Device Types pane under their associated device
families. To assist navigation, device types and families are displayed in bold
when a device of that type exists in the system. Expand/collapse the list to locate
the desired device type.
Selecting any device type in the left pane will display the associated devices,
gateways or Station Access Controllers (SACs) in the right pane.
Note
The cloned device type has the same device support as the source device type.
Upgrades to future versions of RUGGEDCOM CROSSBOW may break this support.
1 2 3
1 Device Families
2 Device Types
3 Devices and Gateways
Figure 4.134 Device Types Dialog Box
3. Locate and right-click the desired device type, and then click Clone. A dialog box
appears.
2
1 3
1 Name Box
2 OK Button
3 Cancel Button
Figure 4.135 Dialog Box
4. Replace the current name with a new name for the device type and then click
OK. The new clone is added to the Device Types pane. If the original device
type was part of a device family, the new device type is added to the same
family. Otherwise, a new device family is automatically created and both device
types are included.
Any scripts associated with the original device type are also cloned. For
information about scripts, refer to "Managing Scripts" (Page 280).
Note
Only cloned device types can be deleted, and only when there are no existing
instances of the device type in the RUGGEDCOM CROSSBOW database.
Note
When a cloned device type is deleted, all scripts associated with it are automatically
removed as well.
1 2 3
1 Device Families
2 Device Types
3 Devices and Gateways
Figure 4.136 Device Types Dialog Box
3. Locate and right-click the desired device type clone, and then click Delete. A
confirmation dialog box appears.
4. Click Yes. The clone and all associated scripts are deleted.
If the clone was part of a device family and only one device type remains, the
other device type is automatically unwrapped from the device family.
Note
Device types associated with a device are automatically enabled.
1 2 3
1 Device Families
2 Device Types
3 Devices and Gateways
Figure 4.137 Device Types Dialog Box
3. Locate and right-click the desired device type, and then click Properties. The
Device Type Properties dialog box appears displaying the Identification tab.
5
1
1 Name Box
2 Description Box
4. Select Enable to enable the device type, or clear Enable to disable the device
type.
5. Click OK to save changes.
1 2 3
1 Device Families
2 Device Types
3 Devices and Gateways
Figure 4.139 Device Types Dialog Box
3. Locate and right-click the desired device type, and then click Properties. The
Device Type Properties dialog box appears.
4. Click the Applications tab. The Applications screen appears.
1 Available Applications
2 Available Interface Sets
3 OK Button
4 Cancel Button
5 Application Box
6 Browse Button
7 Arguments Box
Figure 4.140 Applications Screen
Application The local path to the viewer's executable file. Type the path or
click the browse button (...) to browse for the file.
%BaseFile %CompareFile
Note
Only specific connection port types support command blocking. For more
information about supported connection port types, refer to "Adding/Configuring an
Application" (Page 275).
1 2 3
1 Device Families
2 Device Types
3. Locate and right-click the desired device type, and then click Properties. The
Device Type Properties dialog box appears.
5
1
1 Name Box
2 Description Box
3 Enable Check Box
4 OK Button
5 Cancel Button
Figure 4.142 Applications Screen
4. Click the Gateway Ports or Interfaces tab. The Gateway Ports or Interfaces
screen appears.
3 4 5 6 7
1 OK Button
2 Cancel Button
3 Available Interface Commands
4 Command Box
5 Type List
6 Description Box
7 User Level Check Boxes
Figure 4.143 Gateway Ports Screen
4 5 6 7 8
1 OK Button
2 Cancel Button
3 Available Interfaces
4 Available Interface Commands
5 Command Box
6 Type List
7 Description Box
8 User Level Check Boxes
Figure 4.144 Interfaces Screen
Note
The logging/blocking of commands for gateway ports apply to all gateway ports.
Only the logging/blocking of interface commands for interface connections are
specific to each interface.
6. In the bottom pane, define the name of the command, the command type, and
provide a short description (optional).
7. Select the user levels (L1 through L3) for which the command should be logged
and/or blocked.
8. Click OK to save changes.
9. [Optional] Review the Command List Level for the user group based on the new
configuration. For more information, refer to "Assigning Device Group Access
Privileges" (Page 35).
1 2 3
1 Device Families
2 Device Types
3 Devices and Gateways
Figure 4.145 Device Types Dialog Box
3. Locate and right-click the desired device type, and then click Bulk Export. A
dialog box appears.
4. Click Yes.
For information about opening, saving and deleting exported files, refer to
"Opening, Saving and Deleting Exported Files" (Page 213).
1 2 3
1 Device Families
2 Device Types
3 Devices and Gateways
Figure 4.146 Device Types Dialog Box
3. Locate and right-click the desired device type, and then click Properties. The
Device Type Properties dialog box appears displaying the Identification tab.
5
1
1 Name Box
2 Description Box
Note
For information about enabling/disabling a device type, refer to "Enabling/
Disabling Device Types" (Page 233).
Note
Gateway ports can also be configured at the individual gateway level. For more
information, refer to "Configuring Gateway Ports" (Page 133).
1 2 3
1 Device Families
2 Device Types
3 Devices and Gateways
Figure 4.148 Device Types Dialog Box
3. Locate and right-click the desired device type, and then click Properties. The
Device Type Properties dialog box appears.
4. Click the Gateway Ports tab. The Gateway Ports screen appears.
1 OK Button
2 Cancel Button
3 Available Ports
4 Available Interface Commands
Figure 4.149 Gateway Ports Screen
Note
If necessary, updated network ports from the Gateway Ports tab can be pushed
down to device instances of the same type in that system.
5. [Optional] If ports are associated with the device type, change the port number
of each desired port by double-clicking then editing the existing port number.
Click OK. A prompt appears.
Select Yes to update the settings of all associated devices with the new
configuration, or No to update only the current device.
6. [Optional] Define the interface commands that should be logged or blocked for
all gateway ports associated with the device type. For more information, refer to
"Logging/Blocking Interface Commands" (Page 237).
7. [Optional] If network ports are associated with the device type, change the port
number of each desired port by double-clicking then editing the existing port
number.
8. [Optional] Define the interface commands that should be logged or blocked for
all gateway ports associated with the device type. For more information, refer to
"Logging/Blocking Interface Commands" (Page 237).
9. Click OK to save changes.
10. If port numbers were updated, a confirmation message appears asking if the
port settings should be pushed to other gateways belonging to the same device
type.
Select Yes to update the other gateways, or No to update only the current
gateway.
1 2 3
1 Device Families
2 Device Types
3 Devices and Gateways
Figure 4.152 Device Types Dialog Box
3. Locate and right-click the desired device type, and then click Properties. The
Device Type Properties dialog box appears.
4. Click the Interfaces tab. The Interfaces screen appears.
5 6
3
1 OK Button
2 Cancel Button
3 Available Interfaces
4 Available Interface Commands
5 Show Credentials Check Box
6 Enabled Check Box
Figure 4.153 Interfaces Screen
5. For each available interface, define either the network port, gateway port,
or TCP proxy port used by the interface as appropriate. Only one port type is
applicable to the interface type.
6. Select Enabled for all interfaces that can be used to connect to devices
belonging to the device type. Clear Enabled for those that should not be used.
Note
The Show password credentials when login unsupported check box in the
application properties must also be enabled for the password to be presented.
For more information, refer to "Adding/Configuring an
Application" (Page 275).
7. [Optional] Select Show Credentials for all interfaces where the password should
be presented. Clear Show Credentials for those that should not have passwords
presented.
8. [Optional] Define the interface commands that should be logged or blocked for
all interfaces associated with the device type. For more information, refer to
"Logging/Blocking Interface Commands" (Page 237).
9. Click OK to save changes.
1 2 3
1 Device Families
2 Device Types
3 Devices and Gateways
Figure 4.154 Device Types Dialog Box
3. Locate and right-click the desired device type, and then click Properties. The
Device Type Properties dialog box appears.
4. Click the Interface Sets tab. The Interface Sets screen appears.
3
1
1 Available Interfaces
2 OK Button
3 Cancel Button
Figure 4.155 Interface Sets Screen
1 4
Note
An interface set requires a name and at least one included interface to be
configured.
1 4
2
5
Note
Interface sets marked as Required = True cannot be edited.
2. Edit the interface set name in the Interface Set Name box.
3. Select the desired interfaces in the Included Interfaces list.
4. Click OK to save changes.
Note
Interface sets marked as Required = True cannot be deleted.
Note
Applications enabled at the device type level can be disabled at the individual device/
gateway level. However, if an application is disabled at the device type level, it
cannot be enabled at the individual device level.
1 2 3
1 Device Families
2 Device Types
3 Devices and Gateways
Figure 4.158 Device Types Dialog Box
3. Locate and right-click the desired device type, and then click Properties. The
Device Type Properties dialog box appears.
4. Click the Applications tab. The Applications screen appears.
1 Available Applications
2 Available Interface Sets
3 OK Button
4 Cancel Button
5 Application Box
6 Browse Button
7 Arguments Box
Figure 4.159 Applications Screen
5. [Optional] For each application listed, select the interface sets to which the
application is applicable.
6. Click OK to save changes.
7. If application associations were updated, a confirmation message appears asking
if the application settings should be pushed to other devices belonging to the
same device type.
Select Yes to update the other devices, or No to update only the current device.
NOTICE
Password rules set at the device type level will not override any password defined
in the Change Password operation generated using the RUGGEDCOM CROSSBOW
Scheduler. If a specific password is defined in the Scheduler, the characters entered
will be used regardless of whether or not they conform to the password rules set for
the device type.
1 2 3
1 Device Families
2 Device Types
3 Devices and Gateways
Figure 4.161 Device Types Dialog Box
3. Locate and right-click the desired device type, and then click Properties. The
Device Type Properties dialog box appears.
4. Click the Password Rules tab. The Password Rules screen appears.
1 OK Button
2 Cancel Button
3 Maximum/Minimum Character Options
4 Allowed Character Options
5 Required Character Options
6 Prohibited Characters and Strings List (Example)
Figure 4.162 Password Rules Screen
Note
The following characters are not permitted in passwords and will be ignored if
defined in the password rules:
• single quote (')
• semi-colon (;)
• pipe (|)
Note
A device-type specific list of prohibited characters and strings is displayed. The
list is non-configurable. Do not use the displayed characters or strings when
creating passwords.
6. Under Allowed Characters, select the types of characters that can be used in
the password and/or define specific characters.
7. Under Required Characters, select the types of characters for which there
must be at least one in the password. Specific characters can only be selected if
defined under Allowed Characters.
8. Click OK to save changes.
Note
Some advanced parameter settings may not be applicable to all devices/gateways
belonging to the same device type. Some devices/gateways may have specific
requirements depending on the firmware version installed. In such cases, consider
creating a clone of the device type and define unique settings for the associated
devices/gateways.
2. On the toolbar, click System Administration and then click Device Types. The
Device Types dialog box appears.
1 2 3
1 Device Families
2 Device Types
3 Devices and Gateways
Figure 4.163 Device Types Dialog Box
3. Locate and right-click the desired device type, and then click Properties. The
Device Type Properties dialog box appears.
4. Click the Advanced tab. The Advanced screen appears.
4 5
1 OK Button
2 Cancel Button
3 Properties
4 Default Value List
5 Set/Edit Button
Figure 4.164 Advanced Screen
5. Review the available properties and their values. For more information, refer to
"Available Advanced Parameters" (Page 341).
6. For each property that needs to be modified, do one of the following:
a. Select the property, type or select an alternate value from the drop down
list, then click Set; or
b. Select the property, click Edit, then select an alternate value from the Edit
Special Parameter Default Value list.
7. Click OK to save changes.
Note
System administrators are responsible for adding custom device logins to their
custom login access sets, otherwise actions such as checking out passwords may not
function properly.
For more information about login access sets, refer to "Managing Login Access
Sets" (Page 163).
1 2 3
1 Device Families
2 Device Types
3 Devices and Gateways
Figure 4.165 Device Types Dialog Box
3. Locate and right-click the desired device type, and then click Properties. The
Device Type Properties dialog box appears.
4. Click the Logins tab. The Logins screen appears.
Note
The built-in device type logins that have been marked as Required = True cannot
be disabled.
5. Right-click the desired device type login and then click either Enable or Disable,
as applicable. A confirmation dialog box appears.
6. Click Yes. The Status column updates accordingly.
7. Click OK to save changes.
Note
Only certain devices support adding new logins. This feature is unavailable on
unsupported devices.
1 2 3
1 Device Families
2 Device Types
3 Devices and Gateways
Figure 4.167 Device Types Dialog Box
3. Locate and right-click the desired device type, and then click Properties. The
Device Type Properties dialog box appears.
4. Click the Logins tab. The Logins screen appears.
3 Cancel Button
Figure 4.168 Logins Screen
5. Right-click anywhere in the Device Type Login pane and then click Add. The
Device Type Login Add dialog box appears.
1
4
5
2
6
3 8
Login Reference Name The name of the login reference, up to 40 characters. The name
must be unique within the device type.
Login Display Name The name of the login display, up to 40 characters. The name
must be unique within the device type, and cannot be the same
as another login reference name.
7. [Optional] Select the Supports User Name check box if a user name is required
as part of the credentials login.
8. [Optional] Select the Supports Password check box if a password is required as
part of the credentials login.
9. [Optional] Select the Supports Password Change check box to allow
management of password sets by RUGGEDCOM CROSSBOW. For
more information about password sets, refer to "Managing Password
Sets" (Page 155).
Note
Added device type logins are enabled by default. For more information about
enabling or disabling device type logins, refer to "Enabling/Disabling a Device
Type Login" (Page 258).
1 2 3
1 Device Families
2 Device Types
3 Devices and Gateways
Figure 4.170 Device Types Dialog Box
3. Locate and right-click the desired device type, and then click Properties. The
Device Type Properties dialog box appears.
4. Click the Logins tab. The Logins screen appears.
Note
The built-in device type logins that have been marked as Required = True cannot
be deleted.
5. On the Device Type Login pane, right-click the desired device type login, and
then click Delete. A confirmation dialog box appears.
6. Click Yes.
7. Click OK to save changes.
1 2 3
1 Device Families
2 Device Types
3 Devices and Gateways
Figure 4.172 Device Types Dialog Box
3. Locate and right-click the desired device type, and then click Properties. The
Device Type Properties dialog box appears.
4. Click the Logins tab. The Logins screen appears.
3 Cancel Button
Figure 4.173 Logins Screen
5. Right-click anywhere in the Device Type Login pane and then click Edit. The
Device Type Login Edit dialog box appears.
1
4
5
2
6
3 8
NOTICE
Only the login display name can be edited for the built-in device type logins
Administrator, None, and User1.
Login Reference Name The name of the login reference, up to 40 characters. The name
must be unique within the device type.
Login Display Name The name of the login display, up to 40 characters. The name
must be unique within the device type, and cannot be the same
as another login reference name.
7. [Optional] Select the Supports User Name check box if a user name is required
as part of the credentials login.
8. [Optional] Select the Supports Password check box if a password is required as
part of the credentials login.
9. [Optional] Select the Supports Password Change check box to allow
management of password sets by RUGGEDCOM CROSSBOW. For
more information about password sets, refer to "Managing Password
Sets" (Page 155).
Note
Added device type logins are enabled by default. For more information about
enabling or disabling device type logins, refer to "Enabling/Disabling a Device
Type Login" (Page 258).
Note
For information about each special operation available in RUGGEDCOM
CROSSBOW and which devices/gateways support them, refer to "Available Special
Operations" (Page 339) and "Special Operations Supported by Device Family/
Type" (Page 357).
Note
Special operations may only be scheduled by users with the necessary administrative
privileges.
1 Scheduled Operations
Figure 4.175 Automation Summary Window
Double-clicking a row in the Execution History list opens the Execution Details
window, which provides further details about target devices, status details, and
duration. The results can be filtered to view specific operation details such as the
facility, device type and execution status.
For more information about filtering, refer to "Filtering Data" (Page 74).
If a scheduled operation is pending, the target devices for the scheduled operation
are populated approximately five minutes before the operation is executed.
Special operations can be stopped before the activity has started on a target. Once
a special operation has started on a target device, it will continue until it has been
completed. For more information about stopping a special operation, refer to
"Stopping an Operation" (Page 272).
Special operations can be cleared from the list by deleting them. For more
information, refer to "Deleting/Canceling an Operation" (Page 273).
Special operations that have failed can be retried. For more information, refer to
"Retrying a Failed Operation" (Page 271).
Scheduled Activity information is retained in the RUGGEDCOM CROSSBOW
database according to the RUGGEDCOM CROSSBOW database growth management
configuration. For more information about managing database growth, refer to the
"RUGGEDCOM CROSSBOW Server Configuration Manual".
To view the properties of a device that has completed a special operation, select the
operation in the Execution Details window, and then click Device Properties. The
Device Properties or Gateway Properties dialog box appears.
Each time a user attempts to perform a special operation, they are given the option
to run the operation immediately or configure a schedule for the operation. The
operation can be set to occur on a specific date/time, or after a certain number of
days, weeks, months or years. Once set, the operation appears in the Automation
Summary window.
When a device, gateway or SAM-L is out of service, any scheduled special operations
targeting it will be skipped until it is back in service. If a SAM-L is out of service, new
or updated special operations will not be able to be synced to it until the SAM-L is
back in service.
Note
For more information about viewing scheduled special operations, refer to "Viewing
Scheduled Operations and Log Reports" (Page 266).
Figure 4.178 Example: Scheduling a Password Change for Multiple Devices Every Month
Note
Operations can only be stopped when they are in progress.
1 Scheduled Operations
2 Operation Details
Figure 4.179 Automation Summary Window
3. Right-click the desired operation, and then select View Execution History. The
Execution History window appears.
4. Right-click the desired pending operation, and then select View Execution
Details. The Execution Details window appears.
5. Right-click the target, and then select Show Automation History. The
Automation Summary window for the selected device appears.
Details of all the special operations run on the target devices/gateways are
displayed.
1 Details
2 Run Now Button
Figure 4.180 Automation Summary Dialog Box
6. Click Run Now for the desired special operation. The associated configuration
form appears.For information about how to run specific special operations, refer
to "Performing Special Operations" (Page 268).
1 Scheduled Operations
2 Operation Details
Figure 4.181 Automation Summary Window
Note
Failed operations are displayed in red.
3. Right-click the desired operation, and then select View Execution History. The
Execution History window appears.
4. Right-click the desired operation, and then select View Execution Details. The
Execution Details window appears.
5. Right-click the desired failed operation and click Retry Operation. RUGGEDCOM
CROSSBOW will rerun the failed operation(s).
1 Scheduled Operations
2 Operation Details
Figure 4.182 Automation Summary Window
3. Right-click the desired operation and click Stop. A confirmation dialog box
appears.
4. Click Yes.
Note
Operations can only be deleted/canceled when they are either pending or completed.
1 Scheduled Operations
2 Operation Details
Figure 4.183 Automation Summary Window
3. Right-click the desired operation and click Delete. A confirmation dialog box
appears.
4. Click Yes.
Note
Default application definitions cannot be deleted.
For a full list of available applications by device family and device type, refer to
"Applications Supported by Device Family/Type" (Page 503).
Administrators are allowed to create definitions for any other applications that may
be required.
Individual users are also permitted to override the default definition and either
launch a different application and/or change how the application runs. All overrides
are stored locally on the users workstation.
1 Available Applications
Figure 4.184 Applications Screen
1
9
10
2
11
3
12
4
8
6
13
14
1 Name Box
2 Description Box
3 Defaults EXE Path Box
4 Personal Overrides EXE Path Box
5 Connection Port Type Options
6 Network Address Options
7 Network Specific Check Box
8 Launch Once Only Check Box
9 OK Button
10 Cancel Button
11 Defaults Arguments Box
12 Personal Overrides Arguments Box
13 Settings Box
14 Show Credentials When Login Unsupported Box
Figure 4.185 Application Properties Dialog Box
Note
Users are only permitted to configure an alternative executable and/or
command-line argument different from the default settings configured by
administrators. Overrides apply only to the users workstation.
Parameter Description
EXE Path The local path to the application's executable file. Type the path
or click … to browse for the file.
http://<ipaddress>:<D1>
Where:
• <ipaddress> is a placeholder for the device's IP address,
inserted by RUGGEDCOM CROSSBOW when launching
the application. If the Proxy Using Localhost Address
mechanism is used, this would be replaced by localhost.
• <D1> is a placeholder for the port number, inserted by
RUGGEDCOM CROSSBOW when launching the application.
EXE Path The local path to an alternative executable file. Type the path or
click … to browse for the file.
7. Under Connection Port Type, select the type of port the application will use to
connect to the device/gateway. Options include:
• Virtual Serial Port – The application opens a virtual serial port on the Client
side to connect to the device/gateway. This command-blocking and stream-
oriented protocol can be used for text interfaces, for example.
• Network Port – The application opens a network port on the Client side
to connect to the device/gateway. This port type is typically used for text-
based stream-oriented protocols such as Telnet and SSH, where command
blocking can be implemented. A proxy mechanism must be selected.
• Network Proxy Port – The application opens a network proxy port on the
Client side to connect to the device/gateway. The user defines the network
port for the application to connect with (e.g. RDP, FTP). This port type can be
used for any network-based protocols, but is typically used for proprietary
and encrypted traffic. It does not support command line blocking. A proxy
mechanism must be selected.
8. If the Network Port or Network Proxy Port is selected, under Network
Address, select a proxy mechanism. Options include:
• Real Device Address – The application must specify the device's real IP
address when establishing a connection. Even though the real IP address is
specified, the connection is still proxied through the server.
• Localhost Address – The application must access the Client machine
localhost proxy when establishing a connection.
With either option, the traffic will be routed through RUGGEDCOM CROSSBOW.
9. [Optional] Select Network Specific to have the application connect via a
network port, instead of the local (virtual) serial port. When selected, this option
allows the application to be launched multiple times (simultaneously) for user
connections to devices in the field.
10. [Optional] If Network Specific is selected, select Launch Once Only.
When selected, this option allows the application to be selected for multiple
simultaneous user connections to devices in the field, but only a single instance
of the application will be launched. The user will be expected to use the already-
running application instance for all of the associated RUGGEDCOM CROSSBOW
device connections.
11. Under Advanced CrossBow Configuration, configure the following parameter
as required:
Parameter Description
12. [Optional] Select the Show Credentials When Login Unsupported check box to
allow interface and device group passwords to be displayed.
Credentials will be displayed when the corresponding device groups and
interfaces are also configured to show credentials.
For more information about configuring access to device groups, refer to
"Assigning Device Group Access Privileges" (Page 35).
Note
Default application definitions cannot be deleted.
1 Available Applications
Figure 4.186 Applications Screen
Each baseline script can be customized as required to either enhance the current
functionality or change the behavior of the script entirely. For information about how
to develop scripts, script requirements, and available variables and functions, refer to
the "RUGGEDCOM CROSSBOW v5.4 Scripting Reference Guide".
Customized scripts can also be reverted back to their original state at any time.
If a script fails during operation, RUGGEDCOM CROSSBOW logs an error message
in the RUGGEDCOM CROSSBOW Logger and creates a copy of the script for
troubleshooting purposes. For information about how to troubleshoot script errors,
refer to "Scripts" (Page 336).
NOTICE
Scripting requires a firm understanding of the communication mechanisms,
protocols and commands used to communicate with specific end devices. It also
requires knowledge of advanced programming language concepts.
As such, only advanced users with the appropriate training and experience should
participate in the development of scripts for RUGGEDCOM CROSSBOW. Leaving a
script in an invalid state will result in the inability to communicate with a device(s).
NOTICE
When RUGGEDCOM CROSSBOW is upgraded, some baseline scripts may be updated
to optimize their performance with the new release. However, versions of these
baseline scripts that have been customized will be unaffected. Users are prompted
to save and revert edited scripts on upgrade.
Siemens recommends reviewing any updated baseline scripts and mirroring the
enhancements in the customized versions where applicable.
Note
Scripts cannot be deleted. However, any scripts created when a device type was
cloned will be removed automatically when the associated device type is deleted.
Note
The name of each script indicates which device type it is associated with and its basic
function. For example, the sel_login.vbs script controls the login process for SEL
devices, while the sel_3354_login.vbs script controls the login process specifically for
SEL 3354 devices.
Scripts that are created when a device type is cloned adopt the name of
their associated device type in their file name. For example, when creating
a clone called Cisco 2900 Test, a copy of the Cisco_2900_login.vbs script
associated with the original device type is created with the name Cisco 2900 Test
(Clone)_Cisco_2900_login.vbs.
Note
Scripts are not required for all device types.
2 3
1 Available Scripts
2 Edit Script Button
3 Revert Script Button
Figure 4.187 Scripts Screen
The available scripts are displayed in a table, which displays the following
information about each script:
• The name of the script.
• The script type.
• A description of the script. This parameter is optional.
• The status of the script. If the status is base, the script has not been modified
from its original version. However, if the status is Edited, the script has been
modified.
2 3
1 Available Scripts
2 Edit Script Button
3 Revert Script Button
Figure 4.188 Scripts Screen
3. Select the desired script and then click Edit Script. The Script Properties dialog
box appears.
1 OK Button
2 Cancel Button
3 Edit Window
Figure 4.189 Script Properties Dialog Box
Note
For easier editing, copy the contents of the script to an external editor, then
copy the modified version back into the Script Properties dialog box.
4. Modify the script as required. For information about how to develop scripts,
script requirements, and/or available variables and functions, refer to the
"RUGGEDCOM CROSSBOW v5.4 Scripting Reference Guide".
5. Click OK. The status of the script on the Scripts screen changes automatically to
Edited to indicate the script has been modified from its baseline version.
Note
All modifications will be lost permanently. To retain the modifications for future use
or reference, copy the contents to an external editor and save them.
2 3
1 Available Scripts
2 Edit Script Button
3 Revert Script Button
Figure 4.190 Scripts Screen
3. Select the desired script and then click Revert Script. A confirmation dialog box
appears.
4. Click Yes. The status of the script on the Scripts screen changes automatically to
Base to indicate the script has not been modified from its baseline version.
NOTICE
Depending on the access privileges set for the requester's user group, password
checkout requests may be blocked or require prior approval from an administrator.
For information about configuring the access privileges for user groups, refer to
"Assigning Device Group Access Privileges" (Page 35).
Note
Passwords can be checked out on behalf of other users when needed to support
individuals in the field.
Note
Once a password is checked back in or the time expires, the entry is automatically
removed from the list.
3. [Optional] Right-click a row to view more details about passwords that have
been checked out. The Checked Out Passwords Detail dialog box appears.
NOTICE
Depending on the access privilege settings for the requester's user group or the
device group to which the device or gateway belongs, password checkout requests
may be blocked or require prior approval from an administrator. Contact an
administrator for more information.
Note
An e-mail address must be defined in the requester's user profile to checkout
passwords. For more information, refer to "Configuring a User Profile" (Page 29).
NOTICE
Security hazard – risk of unauthorized access and/or exploitation
E-mails sent to requesters are unencrypted. Administrators are responsible for
making sure passwords are only checked out when necessary. Requesters are
responsible for making sure passwords are kept secure and confidential upon
receipt.
1
4
5
2
6
3
7
1 Target Box
2 Start Time Box
3 On Behalf Of Check Box
4 OK Button
5 Cancel Button
6 End Time List
7 Reason Box
8 On Behalf Of Check List
Figure 4.193 Password Checkout Request Dialog Box
Note
If the OK button is inactive, password checkout requests are not allowed for the
selected device/gateway.
4. In the End Time list, select the date at which the password will be automatically
checked back in by RUGGEDCOM CROSSBOW. The minimum duration is one
hour from the moment the request is initiated.
5. In the Reason box, type the reason for checking out the password.
6. [Optional] If the request is on behalf of another user, select the check box and
then select the user from the list. The e-mail notification will be sent to the
selected user.
7. Click OK. An e-mail is automatically sent under the following conditions:
• Approval Required
If approval is required by the device group or the requester's user group, an
e-mail is sent to all members of the administrative user group, excluding
the requester if they are part of the administrative user group. A secondary
e-mail is sent to the requester indicating whether or not the request was
approved. If the request was approved, the e-mail includes the user name
and password for the target device/gateway.
Note
If a password is not manually checked in before the checkout period ends, it is
automatically checked in by RUGGEDCOM CROSSBOW.
Note
RUGGEDCOM CROSSBOW can be configured to automatically run the firmware
version CAM or Configuration CAM on the device/gateway once the password has
been checked in. For more information, refer to "Running CAMs Automatically After
Password Check-Ins" (Page 290).
3. Right-click the desired checkout request, and then click Check In Passwords.
The entry is automatically removed. If all users have checked in their passwords,
Note
For more information about these CAMS, refer to either "Configuration Compare
CAM" (Page 297) or "Firmware Version CAM" (Page 299).
2 3 4 5
1 Available CAMs
2 Report Button
3 Run Now Button
4 Properties Button
5 Enabled Check Box
Figure 4.195 CAMs Dialog Box (Example)
3. Click Properties next to the chosen CAM. The Properties for {Name} CAM
dialog box appears.
3
1
4. Select Run After Password Check In to enable this feature for the chosen CAM,
or clear the check box to disable the feature.
5. Click OK to save changes.
Note
For information about permitting and blocking password checkout requests, refer to
"Adding a User Group" (Page 33) or "Adding a Device Group" (Page 223).
The State column indicates which checkout requests are awaiting approval.
3. Right-click the desired checkout request, and then click either Approve Request,
Deny Request or Revoke Request. An e-mail is immediately sent to the
requester informing them of the decision.
5
1
1 Categories Pane
2 OK Button
3 Configure Button
4 Cancel Button
5 Auto Refresh Check Box
Figure 4.198 System Dashboard (Default View, Partially Shown)
• Device Status
This panel displays a bar graph indicating the number of devices in the system
that have the following state(s): In Service, Out of Service, Discovered and
Maintenance Mode. As Maintenance Mode is not mutually exclusive to the
other states, the sum total of all four bars in this graph is not necessarily equal to
the total number of devices in the system.
• Connections
This panel displays the currently connected users in the system.
For more information about connected users, refer to "Managing Users, Groups
and Authentication" (Page 23).
• Most Recent Alerts
This panel displays the most recent chronological alerts, up to a maximum of
seven alerts.
For more information about alerts, refer to "Viewing/Acknowledging All
Alerts" (Page 79).
• Password Checkouts
This panel displays passwords currently checked out by users.
For more information about password checkouts, refer to "Managing Password
Checkouts" (Page 285).
• Event Log Record Counts
This panel displays the number of records that appear in the Event Log over
various time frames. The Today total includes events logged since midnight. The
Last 7 Days and Last 30 Days totals include the Today total, starting at midnight
on the start days.
For more information about the event log, refer to the "RUGGEDCOM CROSSBOW
Server Configuration Manual".
• Active Automation Tasks
This panel displays the automation tasks in progress on each server in a cluster.
For more information about automation tasks, refer to "Managing Special
Operations" (Page 266).
• Recently Completed Automation Tasks
This panel displays the last 10 completed automation tasks, including SAM-L
automation tasks.
For more information about automation tasks, refer to "Managing Special
Operations" (Page 266).
• Licenses
This panel displays the license limits for certain objects (users, devices, etc.) in
the database according to the license installed on the RUGGEDCOM CROSSBOW
server, as well as the counts of those objects currently in the database.
For more information about licenses, refer to the "RUGGEDCOM CROSSBOW
Server Configuration Manual".
Note
The Configuration Compare CAM is a separately licensed plug-in that can be be
added to any RUGGEDCOM CROSSBOW server (v4.0 or later). For more information
about installing a CAM, refer to the "RUGGEDCOM CROSSBOW Server Configuration
Manual".
Note
The Time Compare CAM is a separately licensed plug-in that can be be added to any
RUGGEDCOM CROSSBOW server (v4.0 or later). For more information about installing
a CAM, refer to the "RUGGEDCOM CROSSBOW Server Configuration Manual".
Note
The Data CAM is a separately licensed plug-in that can be be added to any
RUGGEDCOM CROSSBOW server (v4.1 or later). For more information about installing
a CAM, refer to the "RUGGEDCOM CROSSBOW Server Configuration Manual".
Note
If the Data CAM runs on a serial device that contains numerous event files, the CAM
may require a significant amount of time (30 minutes or more) to complete.
The Data CAM can gather the following data from IEDs:
• Target status
• Sequence of event (SOE) data
• Fault reports
• Oscillography files
All data collected is stored in the RUGGEDCOM CROSSBOW database, along with the
time and date it was last updated.
For information about how to view data collected by the Data CAM, refer to "Viewing
Device Data" (Page 192).
Note
The Firmware Version CAM is a separately licensed plug-in that can be be added to
any RUGGEDCOM CROSSBOW server (v4.0 or later). For more information about
installing a CAM, refer to the "RUGGEDCOM CROSSBOW Server Configuration
Manual".
For information about how to use the Firmware CAM, refer to "Setting the Expected
Firmware Version(s)" (Page 178) and "Retrieving the Current Firmware Version(s) for
a Device/Gateway" (Page 181).
Note
The Connectivity CAM is a separately licensed plug-in that can be be added to any
RUGGEDCOM CROSSBOW server (v4.3 or later). For more information about installing
a CAM, refer to the "RUGGEDCOM CROSSBOW Server Configuration Manual".
The Connectivity CAM must be enabled for specific devices and/or device types.
When enabled, the CAM collects and manages the following statistics for each device
and/or devices belonging to the device type:
Note
In most cases, the Connectivity CAM does not attempt to log into a device(s)/
gateway(s). Therefore, connectivity testing does not include verify passwords. One
exception is SSH interfaces, where authentication is an integral part of the protocol.
Note
For a list of supported CAMs, refer to "CAMs Supported by Device Family/
Type" (Page 557).
The following details the mechanisms by which connectivity is tested (i.e. what
defines a successful connection):
Device Type Connectivity Test
Newline response After the Connectivity CAM establishes a text-
based connection to the device, it sends a newline
(e.g. carriage return/line feed combination or a
single carriage return only, depending on the
device type) and listens for a response. The
connection test is considered successful if any
response is received. This could be a password
prompt, a command prompt, or a text-based
menu, for example.
In most cases the CAM does not analyze the
response in any way, it simply detects whether or
not it received one. One exception is SEL devices,
where the CAM verifies that it received a properly
formatted SEL prompt using existing SEL scripts.
SSH connection The Connectivity CAM establishes a typical Secure
Shell (SSH) connection to devices that support it.
As long as the SSH connection is successful, the
CAM considers the connection test successful.
Telnet Connection A Connectivity CAM establishes a Telnet
connection with the device. This makes sure the
1 Report Details
2 Close Button
Figure 5.1 Sample CAM Report
2 3 4 5
1 Available CAMs
2 Report Button
3 Run Now Button
4 Properties Button
5 Enabled Check Box
Figure 5.2 CAMs Dialog Box (Example)
3. Click Report for the desired CAM. The report appears in a new window.
4. When done, click OK.
Note
A CAM can only be enabled if it is first enabled at the global level.
2 3 4 5
1 Available CAMs
2 Report Button
3 Run Now Button
4 Properties Button
5 Enabled Check Box
Figure 5.3 CAMs Dialog Box (Example)
3. For the desired CAM, select Enabled to enable the CAM, or clear Enabled to
disable the CAM.
Note
The CAM must first be enabled for all devices/gateways. For more information, refer
to "Enabling/Disabling a CAM for All Devices/Gateways" (Page 303).
2
4
3
1 CAM List
2 Filter By Lists
3 Enable All In List Button
4 Disable All In List Button
5 Available Devices/Gateways
Figure 5.4 Bulk Enable/Disable Devices for CAMs Dialog Box
1
2 3 4
1 Available CAMs
2 Run Now Button
3 Properties Button
4 Enabled Check Box
5 OK Button
6 Cancel Button
Figure 5.5 CAMs Screen (Example)
5. Select the Enabled check box next to the desired CAM. A confirmation dialog
box appears.
6. Click OK. The dialog box closes.
7. Click OK to save changes.
1 2
4
5
6
7
1 Description Box
2 OK Button
3 Cancel Button
4 Repetition Lists
5 Repetition Values
6 Start Time Options
7 Start Time Box
Figure 5.6 Scheduling Data CAM (Example)
1
4
3
6
1 Description Box
2 Repetition Lists
3 Start Time Options
4 OK Button
5 Cancel Button
6 Start Time Box
Figure 5.7 Scheduling Config Compare CAM (Example)
6. Under Start Time (On Server), select Now or Specific Time. If Now is selected,
proceed to step 8 (Page 308).
7. Select a date and time at which the operation should occur.
8. Click OK to save changes. The operation will commence at the selected time.
For information about how to monitor scheduled operations, refer to "Viewing
Scheduled Operations and Log Reports" (Page 266).
2 3 4 5
1 Available CAMs
2 Report Button
3 Run Now Button
4 Properties Button
5 Enabled Check Box
Figure 5.8 CAMs Dialog Box (Example)
3. Click Run Now. The task is added to the scheduler and the following appears in
the Messages pane:
Scheduler: Schedule activity created.
Activity sent to the Scheduler
1
2 3 4
1 Available CAMs
2 Run Now Button
3 Properties Button
4 Enabled Check Box
5 OK Button
6 Cancel Button
Figure 5.9 CAMs Dialog Box (Example)
5. Click Run Now. The task is added to the scheduler and the following appears in
the Messages pane:
Scheduler: Schedule activity created.
Activity sent to the Scheduler
NOTICE
Raw transmitted or received device data must be enabled on the RUGGEDCOM
CROSSBOW Server to generate audit logs. Default audit levels for raw data and other
sensitive information are configurable via the Server.
For more information about managing audit logs at the system level, refer to the
"RUGGEDCOM CROSSBOW Server Configuration Manual".
1 Available Logs
2 OK Button
3 Refresh Button
Figure 6.1 Audit Log Files Dialog Box
3. [Optional] Click the Refresh button to update the list of active audit files.
4. Select one or more audit logs, right click then select Open Audit Log File(s) to
open the selected file(s). Alternatively, select Open Audit Log File(s) With and
choose an application such as Notepad to open the desired file(s).
5. Click OK to close the Audit Log Files form.
4. Enter the ID number of the audit log from the System Activity report, then click
Open. The audit log appears as a Notepad file in a separate window.
1 Available Logs
2 OK Button
3 Refresh Button
Figure 6.3 Audit Log Files Dialog Box
3. Right-click the desired log file(s), then click Delete Log File. Multiple files can be
selected at once.
4. A confirmation dialog appears. Click Yes.
5. When done, click OK to close the Audit Log Files form.
NOTICE
Raw transmitted or received device data must be enabled on the RUGGEDCOM
CROSSBOW Server to generate audit logs. Default audit levels for raw data and other
sensitive information are configurable via the Server.
For more information about managing audit logs at the system level, refer to the
"RUGGEDCOM CROSSBOW Server Configuration Manual".
2 3 4 5 6 7
1
1 Available Interfaces
2 Enable Check Box
3 Network Port
4 Gateway Port
5 Proxy Ports Box
6 Device Group List
7 Audit Level List
8 OK Button
9 Cancel Button
Figure 6.4 Interfaces Screen (Example)
5. Under Audit Level, click the drop down menu and select the desired audit level
for the device or gateway.
6. Repeat step 5 (Page 314) for each desired interface.
7. Click OK to save changes.
NOTICE
Generated reports may contain sensitive information, such as IP addresses and
credentials. The user generating these reports is responsible for the proper storage
and distribution of this material.
Note
Reports can only be generated by administrators and sub-administrators. For
information about how to grant the ability to generate reports to a user, refer to
"Assigning Administrative Privileges" (Page 40).
NOTICE
For this report to be generated, the
DatabaseCapacityCheckEnabled global advanced parameter
must be set to True.
For more information about configuring global advanced
parameters, refer to the "RUGGEDCOM CROSSBOW Server
Configuration Manual".
Time Compare CAM Report The Time Compare CAM Report lists the device time retrieved
versus the database server time, and whether this difference is
considered a mismatch for the device type.
User Authorization Report The User Authorization Report lists the access privileges and
permissions for a specified user.
User Information Report The User Information report lists general information about each
RUGGEDCOM CROSSBOW user, including their full name, e-mail
address, current status, the age of their password, and user group
memberships.
Administrators will see information about all users, while sub-
administrators may see a reduced list of users and associated user
groups based on the sub-administrator's assigned privileges.
Note
The password age listed in the report refers to the user's password
for accessing RUGGEDCOM CROSSBOW. It is not tied to passwords
used for strong authentication, such as RSA or Active Directory.
2 4
1 5
Note
Not all parameters apply to each report type. The form will display the available
parameters depending on the selected criteria.
Filter by Time Filters the report based on a specified time period. Options
include:
• From/To – The desired start and end date/time to report.
• Last – The last number of minutes, hours, days, weeks,
months or years to display.
Filter by Scope Filters the report based on specified devices and/or users.
Options include:
• Devices – The device list to display. Options include:
• Device Type
• Device Group
• Individual Device
• Individual Device (Historical)
• Devices in a Facility
• Devices in a Region
• Users – The user group or individual user to display.
Filter by Alert De Filters the report based on the type, severity and/or source of
tails alert. Options include:
• Type – The type of alert. Options include Configuration
Mismatch, Connectivity Test Failed, and Scheduled Activity
Failed. For the complete list, select the drop-down menu.
• Severity – The severity level. Options include:
• INFO
• WARNING
• CRITICAL
• Source – The alert source (e.g. Configuration Compare
CAM).
Parameter Description
Note
Reports are generated with a minute timestamp resolution.
Alerts generated immediately before a report is created may not
appear in the report.
4. [Optional] Click Save Filters and name the file to save the configuration for
future use, or Delete Filters to delete any existing saved filters.
5. Click Generate. The Scheduling Report Operation dialog box appears.
6
7
10 9
11
1 Description Box
2 OK Button
3 Cancel Button
4 Activity Type Box
5 Target Type Box
6 Target Box
7 Repetition Options
8 Start Time (on Server) Options
9 Report Format Options
6. Under Repetition, choose Once to run the report a single time or select the
desired frequency to repeat the report generation.
7. Select Now to run the report immediately, or choose a specific time to run the
report.
8. Under Report Format, choose to output the file as either PDF or Excel.
9. Under Assign Report To, choose the user, user group or a specific email address
as the assignee of the report. The report will be available to the assignee as well
as the user who generated the report.
10. [Optional] Select the Also Send to Users with Email check box to send the
report via email to the recipient(s) configured in step 9 (Page 320). The sender
email address will be the user who generated the report.
11. When done, click OK to generate the report or Cancel to cancel the operation.
Note
There may be a delay between the alert and the report availability, depending
on the size and type of report being generated.
To confirm if report generation has started, check its status in the Automation
Summary window. For more information, refer to "Viewing Scheduled
Operations and Log Reports" (Page 266).
When the report has been fully generated, the logged in user will receive an
alert notifying that the report is available for viewing. For information about
viewing a report, refer to "Viewing a Report" (Page 320).
1 Available Reports
2 OK Button
Figure 7.3 Available Reports for Admin
3. Double click the desired report. The report opens in either PDF or Excel format,
as configured. For information about configuring the report format, refer to
"Generating a Report" (Page 317).
4. When done, click OK to close the Available Reports for Admin form.
NOTICE
Security hazard – risk of unauthorized access and/or exploitation
Administrators are responsible for making sure maintenance mode is enabled
only when necessary, and is disabled when no longer needed. For added security,
maintenance mode is automatically disabled daily, at midnight.
Note
Maintenance mode configuration is only available to Admin users or users with
password change permissions.
Device Status
The following details the device status when maintenance mode is enabled or
disabled:
Status Description
Enabling Maintenance Maintenance mode is enabled and password
change operations are still in progress.
Maintenance Enabled Maintenance mode is enabled and all password
change operations have completed with no errors.
Maintenance Enabled - Error(s) Maintenance mode is enabled and all password
change operations have completed, with at least
one error.
Disabling Maintenance Maintenance mode is disabled and password
change operations are still in progress.
No Label (Blank) Maintenance mode is disabled and all password
change operations have completed (with or
without errors).
Note
RUGGEDCOM CROSSBOW Logger is automatically installed alongside both
RUGGEDCOM CROSSBOW server and RUGGEDCOM CROSSBOW client.
RUGGEDCOM CROSSBOW Background Logger is automatically installed alongside the
RUGGEDCOM CROSSBOW server.
For more information about installing RUGGEDCOM CROSSBOW, refer to the
"RUGGEDCOM CROSSBOW Server Configuration Manual".
Note
To capture all interactions between RUGGEDCOM CROSSBOW clients and the
RUGGEDCOM CROSSBOW server(s), a logger must be present on the machine hosting
each component.
2 3 4 5 6 7 8 9 10 11
1 Messages
2 Input Filter Check Box
3 Input Filter Box
4 Invert Check Box
5 Font Button
6 Set Level Button
7 Open Button
8 Save Button
9 Disable/Enable Button
10 Clear Button
11 Close Button
Figure 8.2 CROSSBOW Logger Dialog Box
Launching Logger
Launch RUGGEDCOM CROSSBOW Logger by either:
• Double-clicking the RUGGEDCOM CROSSBOW Logger shortcut icon on the
desktop
• Clicking Start, selecting All Programs, selecting RuggedCom, selecting
CrossBow Logger, then selecting CrossBow Logger
Filtering Messages
The log can be filtered to show or hide messages that match or contain a specific
string. Simply select Input Filter and then type the string. Only messages that match
or contain that string will display going forward.
To exclude messages that match or contain the specified string, select Invert.
Note
Filtering only applies when it is enabled. It does not apply to previous log messages.
Enabling/Disabling Logger
To disable any further logging of messages without closing RUGGEDCOM CROSSBOW
Logger, click Disable. To re-enable logging, click Enable.
Closing Logger
To close RUGGEDCOM CROSSBOW Logger, click Close.
Note
To log messages, the Background Logger Service must be configured and running
on the RUGGEDCOM CROSSBOW Server. For more information about configuring
the Background Logger Service, refer to the "RUGGEDCOM CROSSBOW Server
Configuration Manual".
Note
RUGGEDCOM CROSSBOW Background Logger does not automatically stop writing log
messages. If the log files are full, RUGGEDCOM CROSSBOW Background Logger will
automatically delete the first file and start a new one until the user stops the process.
1 5
3 Refresh Button
4 Auto Refresh Box
5 Rotate Now Button
Figure 8.3 Server Logs Screen
Note
If CXBLog.zip already exists, RUGGEDCOM CROSSBOW Background Logger will ask
whether or not to overwrite the file. Click Yes to overwrite, or No to cancel.
Note
For further assistance, contact Siemens Customer Support.
8.4.1 Devices/Gateways
The following details potential problems related to devices and gateways and how to
troubleshoot them:
Problem Potential Cause Suggested Solution
Configuration mismatch The approved configuration First compare the approved and
does not match the current current configurations by doing
configuration. the following:
1. Make sure a configuration
file difference viewer
is configured. This can
either be a default viewer
for all file types or a
custom viewer specifically
configured for the parent
device type. For more
information, refer to
either "Configuring a
Default File Difference
Viewer" (Page 66)
or "Configuring an
Alternate Configuration
File Difference
Viewer" (Page 235).
2. View the list of alerts
for the device. For more
information, refer to
"Viewing/Acknowledging
Device Alerts" (Page 81).
3. Right-click the configuration
mismatch alert and
click Compare. The
configurations are displayed
in the configuration file
difference viewer.
4. Review the differences
between the two
configurations.
Depending on the device
type, update the configuration
either directly or remotely via
RUGGEDCOM CROSSBOW.
Firmware mismatch The approved firmware does not Depending on the device type,
match the current firmware. update the firmware directly or
via RUGGEDCOM CROSSBOW.
For information about updating
the firmware via RUGGEDCOM
CROSSBOW, refer to "Managing
Firmware" (Page 177).
8.4.3 CAMs
The following details potential problems related to the RUGGEDCOM CROSSBOW
Application Modules (CAMs) and how to troubleshoot them:
Problem Description Suggested Solution
Unable to locate executable A new CAM has been installed, This alert appears if the
but the following alert is CAM has not been properly
generated whenever it is run: installed. Make sure the installer
(*.msi) has been run. For
more information, refer to the
Unable to run a CAM The CAM is visible, but 1. Make sure the CAM
unavailable when right-clicking a is enabled. For more
device/gateway information, refer to
"Enabling/Disabling
CAMs" (Page 303).
2. Make sure the parent device/
gateway is online.
8.4.4 Scripts
RUGGEDCOM CROSSBOW's typical behavior when running scripts is to:
1. Create a temporary run-time version of the script (typically under C:\Windows
\TEMP), which includes any other scripts that are referenced, in place of the
#include directive. The file name for the run-time script is made unique by
appending a unique code, such as sel_login_a07704.vbs.
2. Run the run-time script.
3. Delete the temporary run-time script.
However, if an error is encountered when running the script, RUGGEDCOM
CROSSBOW moves the run-time script to C:\{install-directory}\Ruggedcom
\CrossBow\ScriptErrors for troubleshooting and renames it. Each script in the
ScriptErrors folder is named ScriptError_{original-name}.{py|vbs}, where {original-
name} is the name of the original script (e.g. ScriptError_sel_login.vbs).
RUGGEDCOM CROSSBOW also logs an error in the RUGGEDCOM CROSSBOW Debug
Logger to indicate which script failed and which line caused the error. In the
following example, an error was detected at character 1 on line 539 in the file C:
\Windows\TEMP\sel_login_a07704.vbs:
14:46:50.204: WinRC (1359425606.1 7708: ScriptRunner::ScriptThread():88: Script
stdout:
14:46:50.204: WinRC (1359425606.1 7708: ScriptRunner::ScriptThread():94: Microsoft
(R) Windows Script Host Version 5.8
14:46:50.204: WinRC (1359425606.1 7708: ScriptRunner::ScriptThread():94: Copyright
(C) Microsoft Corporation. All rights reserved.
14:46:50.204: WinRC (1359425606.1 7708: ScriptRunner::ScriptThread():102: Script
stderr:
14:46:50.204: WinRC (1359425606.1 7708: ScriptRunner::ScriptThread():108: C:\Win
dows\TEMP\sel_login_a07704.vbs(539, 1) Microsoft VBScript runtime error: Variable
is undefined: 'LoginLevel'
14:46:50.204: WinRC (1359425606.1 7708: ScriptRunner::ScriptThread():114: ***
Contents detected script stderr even though exit code was 0. Considering this a
script error.
To troubleshoot a script error similar to this, refer to the temporary run-time script
saved in the ScriptErrors folder. The line number referenced in the error message
aligns with this version, not the original script.
Any modifications required for the script following troubleshooting must be made to
the original script via RUGGEDCOM CROSSBOW Client.
8.4.5 Automation
The following is a list of common issues related to special operations and how to
troubleshoot them:
Problem/Message Description Suggested Solution
At least one device in this device The device or parent gateway Make sure the desired device
chain is not in service has been tagged as out of or gateway is in service. For
service in the RUGGEDCOM more information, refer to
CROSSBOW Client. The scheduler "Configuring Identification
will skip this activity. Properties" (Page 126).
Automation and auto-login to The event log is nearing its Connect to the device manually.
GarrettCom 6K devices fail storage capacity limit. Special If you see the prompt "Event Log
operations and auto login fail Storage Space is almost full. Do
until the prompt is cleared. you want to clean up? [Y/N]",
select Y to clear the prompt.
For more information about
connecting to a device, refer
to "Connecting to a Device/
Gateway" (Page 114).
SMP special operation A Cooper Power Systems device Install the Cooper Power
fails. The event log shows is in use. The RUGGEDCOM Systems Root CA on the
"W:SMPSpecialOperations:: CROSSBOW Server requires the RUGGEDCOM CROSSBOW
Login():103: Post call failed: Cooper Power Systems Root CA Server. The certificate is installed
Server certificate verification to be installed. with the SMP Manager, so this
failed. Connection aborted". software can be installed on the
server. Alternatively, if the SMP
Manager is installed elsewhere,
the certificate can be exported
from that server and installed
on the RUGGEDCOM CROSSBOW
Server. For more information
about managing certificates,
refer to the "RUGGEDCOM
CROSSBOW Server Configuration
Manual".
The device does not have a The device configuration is Adjust the configuration of
parent gateway port selected. incomplete. the child device to select
the appropriate gateway
port on the parent device.
For more information,
refer to "Configuring
Interfaces" (Page 129).
ERROR: Did not Rx a recognized Potential baud rate issue. Verify the baud rate set in the
SEL prompt. Gateways have device matches the baud rate
been successfully traversed and set on the parent gateway port
a CRLF sent to the appropriate connected to the device. For
serial port, but the SEL device
Note
For a list of which special operations are supported by specific device families
and device types, refer to "Special Operations Supported by Device Family/
Type" (Page 357).
Note
For more information about configuring system-level global advanced parameters,
refer to the "RUGGEDCOM CROSSBOW Server Configuration Manual".
Note
For a list of which advanced parameters are supported by specific device families
and device types, refer to "Advanced Parameters Supported by Device Family/
Type" (Page 374).
Parameter Description
ApplicationDeviceIdenti The DIGSI 4 Application has both a network and serial version. This
fier parameter specifies the VD (Virtual Device) address configured on
the device.
BulkImporterEDISLock Default: 60
Timeout
The EDIS and Bulk Importer do not process their imports at the
same time. Each obtains a lock via the database before proceeding
with their import. This parameter defines the period in seconds
each will wait for the lock before either proceeding or failing.
To proceed, the other process must finish and unlock within the
specified timeout. For the EDIS, failing means it will not proceed
with the current cycle's import, but will wait for the next one. For
the Bulk Importer, the requested Validate or Import operation will
be marked as Failed.
This is a system-level parameter configurable via RUGGEDCOM
CROSSBOW server.
CaptureCount Default: 40
CaptureDelay Default: 2
CaptureDuration Default: 10
Parameter Description
This is a system-level parameter configurable via RUGGEDCOM
CROSSBOW server.
This parameter specifies the SEL command that will cause the
device to return to access level 0 without dropping the connection
to RUGGEDCOM CROSSBOW. If the device does not have an access
level 0, or if the device will drop the connection if it receives a
command to return to access level 0, this parameter should be left
blank.
Note
For information about which value to use, refer to the relay
manufacturer's documentation.
Note
For information about which value to use, refer to the relay
manufacturer's documentation.
This parameter specifies the wait time between issuing the SHO
commands for configuration related special operations.
Parameter Description
Note
Discrepancies have been identified between the Register names
in the GE documentation and those defined by the devices
themselves. Changes to the spelling of some Registers may be
required. For assistance, contact Siemens Customer Support.
DataCAM_CEV_Command This parameter specifies the command(s) used by the Data CAM
to obtain a Compressed Event History report from SEL devices.
Multiple CEV commands must be separated by a comma (,). The
commands are device-specific - SEL relays are capable of reporting
event history in different resolutions.
DataCAM_EventFileRe This parameter specifies the date criteria used by the Data CAM to
trievalMaxAgeDays filter fault files. This allows users with a long device fault history
to filter out items older than the configured date the first time the
CAM is run.
DataCAM_HIS_Commands This parameter specifies the command(s) used by the Data CAM
to obtain an Event History report from SEL devices. Multiple HIS
commands must be separated by a comma (,). For example,
HIS,HIS C retrieves the Event History report, then clears the history
buffer.
DataCAM_LDP_Commands This parameter specifies the command(s) used by the Data CAM
to obtain a Load Profile report from SEL devices. Multiple LDP
commands must be separated by a comma (,). For example,
Parameter Description
LDP,LDP C will retrieve the Load Profile report, then clear the signal
profile data.
Parameter Description
DevicePasswordMaxAccept Default: 90
ableAge
Defines the maximum acceptable age (in days) for a device
password in RUGGEDCOM CROSSBOW. This parameter is available
only when DevicePasswordAgeMonitoringEnabled is set to True.
This is a system-level parameter configurable via RUGGEDCOM
CROSSBOW server.
DiscoveredDeviceName This parameter specifies the prefix for the name of the discovered
device.
Note
For best performance, it is recommended that the
EDISIntegrationPeriod and GuardianTimerDelay parameters be
set to the same intervals.
Parameter Description
When enabled, the Show password credentials when login
unsupported check box appears on the User Group Properties
form. For more information, refer to "Assigning Device Group
Access Privileges" (Page 35).
This is a system-level parameter configurable via RUGGEDCOM
CROSSBOW server.
Extended_Logging Default: 0
This parameter specifies the first register where fault reports are
stored on a GE UR relay.
FirmwareVersionReg Default: 2
FirstSeenRate Default: 5
FtpFilePath This parameter specifies the location of the configuration and log
files in the device. It is used for transferring files to and from the
device when executing special operations. For example, the file
path for a Novatech Orion5r gateway is mnt/c/diskonship.
FTP_Port Default: 21
Parameter Description
Note
For best performance, it is recommended that the
EDISIntegrationPeriod and GuardianTimerDelay parameters be
set to the same intervals.
LastSeenRate Default: 30
LMD_PrefixAddress This parameter specifies the LMD address required for SEL devices
using the SEL Distributed Port Switch (LMD) serial protocol. Valid
characters are @, #, $, % or &, followed by the numbers 01 to 99
(e.g. @56).
This parameter is used to control the log level for local logging
from the ADM Agent. Can be set to debug, info, warning, error,
or critical, with debug being the lowest level and critical being the
highest level. When set to a particular level, all messages at that
level or higher are logged, meaning debug logs all messages for all
levels, while critical only logs critical messages.
Parameter Description
ATDT5555555,,88,88,88,88
Where:
• D – The Dial command.
• T – The Tone command.
• , – The pause command. Additional pauses may be required if
the Gauntlet gateway requires more time to pick up (i.e. it is on
a remote phone line).
• 88 – The transfer code. In this example, 88 refers to port 8 on
the Gauntelt gateway. It is recommended to repeat the transfer
code four times for consistent results.
Note
The chosen interface must match the pass-through interface
configured on the gateway.
Parameter Description
• iDial – RUGGEDCOM CROSSBOW connects to the gateway
using the iDial interface. If selected, the network port
configured in RUGGEDCOM CROSSBOW for the pass-through
interface must match the TCP port originally configured for the
gateway.
For information about configuring the network port for pass-
through interface, refer to "Configuring Interfaces" (Page 129).
PostTerminationTimeout Default: 0
ProtocolLayerLimit Default: 7
RebootDelaySeconds Default: 60
This parameter specifies the time (in seconds) to wait for an Orion
device to finish rebooting before verifying the device password
was successfully changed. The delay must be greater than the time
required by the device to complete a quick restart operation.
Parameter Description
This is a system-level parameter configurable via RUGGEDCOM
CROSSBOW server.
Parameter Description
adding the SAMLSyncTimerdelay to the last attempted sync
time.
• 2-specific time of day – In this mode, the SAM-L is synced as
soon as possible after the daily sync time, based on the Daily
Sync Time parameter as configured in the SAM-L.
For more information about the Daily Sync Time parameter,
refer to "Configuring Connection Properties" (Page 105).
This is a system-level parameter configurable via RUGGEDCOM
CROSSBOW server.
Parameter Description
This is a system-level parameter configurable via RUGGEDCOM
CROSSBOW server.
ServerTimeoutOfflineFor Default: 30
BulkImporter
Number of seconds until the RUGGEDCOM CROSSBOW Bulk
Importer considers a server to be offline.
This is a system-level parameter configurable via RUGGEDCOM
CROSSBOW server.
ServerTimeoutUnrespon Default: 60
sive
Maximum number of seconds until a server is considered
unresponsive.
This is a system-level parameter configurable via RUGGEDCOM
CROSSBOW server.
ServerTimeoutUnrespon Default: 5
siveForBulkImporter
Number of seconds until the RUGGEDCOM CROSSBOW Bulk
Importer considers a server unresponsive.
This is a system-level parameter configurable via RUGGEDCOM
CROSSBOW server.
Note
For information about which value to use, refer to the relay
manufacturer's documentation.
Note
For information about which value to use, refer to the relay
manufacturer's documentation.
SSH EncryptionAlgorithms This parameter specifies the list of supported encryption algorithms
used for negotiation during the SSH handshake process in device/
gateway connections.
The values in the list are assigned a security grade from 0 to 5.
Siemens recommends using grade 3 and above security grades.
Listed values with a security grade lower than 3 are to support
older devices.
Parameter Description
Note
The handling mode is controlled by the Secure Access Manager
(SAM). The method can not be altered at the station Access
Controller (SAC) level, unless imported from the SAM.
SSH HostKeyAlgorithms This parameter specifies the list of supported public key algorithms
used for negotiation during the SSH handshake process in device/
gateway connections.
The values in the list are assigned a security grade from 0 to 5.
Siemens recommends using grade 3 and above security grades.
Listed values with a security grade lower than 3 are to support
older devices.
SSH KeyExchangeAlgo This parameter specifies the list of supported key exchange
rithms algorithms used for negotiation during the SSH handshake process
in device/gateway connections.
The values in the list are assigned a security grade from 0 to 5.
Siemens recommends using grade 3 and above security grades.
Listed values with a security grade lower than 3 are to support
older devices.
SSH MacAlgorithms This parameter specifies the list of supported Mac algorithms
used for negotiation during the SSH handshake process in device/
gateway connections.
Parameter Description
The values in the list are assigned a security grade from 0 to 5.
Siemens recommends using grade 3 and above security grades.
Listed values with a security grade lower than 3 are to support
older devices.
Note
SFTP is not supported on Orion5r gateways.
TEAMGlobalDeviceId This parameter specifies the ID for the global TEAM server. The
value must be the same as the Global Device ID configured for the
SEL device in the AcSELerator Quickset®.
TerminationString Default: ^D
Parameter Description
This parameter specifies the Modbus register that the time is stored
on the specific device.
Parameter Description
Special operations are supported by the following device families and device types:
Restore Configuration
Program
Device
Family Device Type
ABB ABB AFS 66x - SSH
ABB ABB AFS 67x - SSH
ABB ABB PCD-2000 -
Serial
ABB ABB PCD-2000 -
Telnet
ABB ABB Relion 615 v2 -
Network
ABB ABB Relion 670 v1 -
Network
ABB ABB RTU560 -
Network
ABB ABB TPU/DPU - Serial
Bitronics Bitronics M57x -
Serial
Bitronics Bitronics M57x -
Telnet
Bitronics Bitronics M660/M661
- Network
Cisco Cisco 2900 - SSH
Cisco Cisco Catalyst 2960 -
SSH
Cisco Cisco Catalyst 3750 -
SSH
Cisco Cisco CGR 2010 - SSH
Cisco Cisco CGS 2520 - SSH
Comtrol ComtrolDeviceMaster8
CrossBow CrossBow ADM
Asset Agent
Discovery &
Management
Restore Configuration
Program
Device
Family Device Type
CrossBow Secure Access
Secure Manager - Local
Access
Manager -
Local
CrossBow Station Access
Station Controller
Access
Controller
Data Track Data Track T2700
DIGI DIGI TS1 - Prompted
SSH
DIGI DIGI TS1 - Prompted
Telnet
DIGI DIGI TS16 - Prompted
SSH
DIGI DIGI TS16 - Prompted
Telnet
DIGI DIGI TS2 - Prompted
SSH
DIGI DIGI TS2 - Prompted
Telnet
DIGI DIGI TS4 - Prompted
SSH
DIGI DIGI TS4 - Prompted
Telnet
DIGI DIGI TS8 - Prompted
SSH
DIGI DIGI TS8 - Prompted
Telnet
DIGI DIGI TSx - Mapped
SSH
DIGI DIGI TSx - Mapped
Telnet
GarrettCom DynaStar 1500
Restore Configuration
Program
Device
Family Device Type
GarrettCom DynaStar 2000
GarrettCom DynaStar 5000
GarrettCom GarrettCom 10RX
GarrettCom GarrettCom 10XTS
GarrettCom GarrettCom 6K
GarrettCom GarrettCom 6K
Secure
GarrettCom GarrettCom DX1000
GarrettCom GarrettCom DX40
GarrettCom GarrettCom DX800
GarrettCom GarrettCom DX900
Gauntlet Gauntlet Bow 4-Port
Gauntlet Gauntlet Bow 8-Port
GE - Other GE RT430/RT434
Clock - Network
GE - UR GE UR B30 Network
Relays
GE - UR GE UR B30 Network
Relays v7.0+
GE - UR GE UR B30 Serial
Relays
GE - UR GE UR B30 Serial
Relays v7.0+
GE - UR GE UR B60 Network
Relays
GE - UR GE UR B90 Network
Relays
GE - UR GE UR B90 Network
Relays v7.0+
GE - UR GE UR B90 Serial
Relays
Restore Configuration
Program
Device
Family Device Type
GE - UR GE UR B90 Serial
Relays v7.0+
GE - UR GE UR C30 Network
Relays
GE - UR GE UR C30 Network
Relays v7.0+
GE - UR GE UR C30 Serial
Relays
GE - UR GE UR C30 Serial
Relays v7.0+
GE - UR GE UR C60 Network
Relays
GE - UR GE UR C60 Network
Relays v7.0+
GE - UR GE UR C60 Serial
Relays
GE - UR GE UR C60 Serial
Relays v7.0+
GE - UR GE UR C70 Network
Relays
GE - UR GE UR C70 Network
Relays v7.0+
GE - UR GE UR C70 Serial
Relays
GE - UR GE UR C70 Serial
Relays v7.0+
GE - UR GE UR C90 Plus
Relays Network
GE - UR GE UR C90 Plus
Relays Network v1.8+
GE - UR GE UR D30 Network
Relays
GE - UR GE UR D30 Network
Relays v7.0+
Restore Configuration
Program
Device
Family Device Type
GE - UR GE UR D30 Serial
Relays
GE - UR GE UR D30 Serial
Relays v7.0+
GE - UR GE UR D60 Network
Relays
GE - UR GE UR D60 Network
Relays v7.0+
GE - UR GE UR D60 Serial
Relays
GE - UR GE UR D60 Serial
Relays v7.0+
GE - UR GE UR F35 Network
Relays
GE - UR GE UR F35 Network
Relays v7.0+
GE - UR GE UR F35 Serial
Relays
GE - UR GE UR F35 Serial
Relays v7.0+
GE - UR GE UR F60 Network
Relays
GE - UR GE UR F60 Network
Relays v7.0+
GE - UR GE UR F60 Serial
Relays
GE - UR GE UR F60 Serial
Relays v7.0+
GE - UR GE UR L90 Network
Relays
GE - UR GE UR L90 Network
Relays v7.0+
GE - UR GE UR L90 Serial
Relays
Restore Configuration
Program
Device
Family Device Type
GE - UR GE UR L90 Serial
Relays v7.0+
GE - UR GE UR N60 Network
Relays
GE - UR GE UR N60 Network
Relays v7.0+
GE - UR GE UR T35 Network
Relays
GE - UR GE UR T35 Network
Relays v7.0+
GE - UR GE UR T60 Network
Relays
GE - UR GE UR T60 Network
Relays v7.0+
GE - UR GE UR T60 Serial
Relays
GE - UR GE UR T60 Serial
Relays v7.0+
Generic Generic Direct
Gateway - Serial
Generic Generic Direct
Gateway - Telnet
Generic Generic IED - Dial-Up
Generic Generic IED -
Network
Generic Generic IED -
Network/SSH/Telnet
Generic Generic IED - Serial
Generic Generic IED - SSH
Generic Generic IED - Telnet
Generic Unconnected Device
Generic Unconnected
Gateway
Restore Configuration
Program
Device
Family Device Type
Lantronix Lantronix ETS16PR
Mapped TCP
Lantronix Lantronix ETS16PR
Type 2 Mapped TCP
Lantronix Lantronix ETS32PR
Mapped TCP
Lantronix Lantronix ETS32PR
Mapped Telnet
Lantronix Lantronix ETS32PR
Prompted Telnet
Lantronix Lantronix ETS32PR
Type 2 Mapped TCP
Lantronix Lantronix ETS8P
Mapped TCP
Lantronix Lantronix ETS8P
Mapped Telnet
Lantronix Lantronix ETS8P
Prompted Telnet
Novatech Novatech DDIO -
Network
Novatech Novatech DDIO -
Serial
Novatech Novatech Orion 5r -
Telnet
Novatech Novatech Orion LX -
SSH
Novatech Novatech Orion LX -
Telnet
Nozomi Nozomi Guardian
Other Ametek Pulsar UPLC -
Network
Other Beckwith M-2001D -
Network
Restore Configuration
Program
Device
Family Device Type
Other Checkpoint Firewall -
SSH
Other Doble IDD Monitor -
Network
Other Dynamic Ratings DR-
E3 - Serial
Other Dynamic Ratings DR-
E3 - SSH
Other Dynamic Ratings DR-
E3 - Telnet
Other MiCOM Agile P44T -
Network
Other MiCOM P14x -
Network
Other MiCOM P14x - Serial
Other Palo Alto PA-200 -
SSH
Other Palo Alto PA-820/850
- SSH
Other Qualitrol Transformer
Monitor ITM 509
Other ZIV Relay - Network
Other IOLAN STS16 - SSH
Gateways
Other IOLAN STS24 - SSH
Gateways
Other IOLAN STS4 - SSH
Gateways
Other IOLAN STS8 - SSH
Gateways
Other RFL 9660 - Serial
Gateways
Other SEL-20xx Emulator -
Gateways Serial
Restore Configuration
Program
Device
Family Device Type
Other SM1-16 Multiplexor -
Gateways Dial-Up
RuggedCom RuggedCom i800 -
SSH
RuggedCom RuggedCom i800 -
Telnet
RuggedCom RuggedCom RMC20/
RMC30 - SSH
RuggedCom RuggedCom RMC20/
RMC30 - Telnet
RuggedCom RuggedCom RMC40/
RMC41 - SSH
RuggedCom RuggedCom RMC40/
RMC41 - Telnet
RuggedCom RuggedCom RS400/
RS401 - SSH
RuggedCom RuggedCom RS400/
RS401 - Telnet
RuggedCom RuggedCom RS416 -
SSH
RuggedCom RuggedCom RS416 -
Telnet
RuggedCom RuggedCom RS8000
- SSH
RuggedCom RuggedCom RS8000
- Telnet
RuggedCom RuggedCom RS900/
RS930/RS940/RS950
- SSH
RuggedCom RuggedCom RS900/
RS930/RS940/RS950
Telnet
RuggedCom RuggedCom RS910/
RS920 - SSH
Restore Configuration
Program
Device
Family Device Type
RuggedCom RuggedCom RS910/
RS920 - Telnet
RuggedCom RuggedCom RS969 -
SSH
RuggedCom RuggedCom RS969 -
Telnet
RuggedCom RuggedCom
RSG2100/RSG2200/
RSG2300 - SSH
RuggedCom RuggedCom
RSG2100/RSG2200/
RSG2300 Telnet
RuggedCom RuggedCom
RSG2288/RSG2488 -
SSH
RuggedCom RuggedCom
RSG2288/RSG2488 -
Telnet
RuggedCom RuggedCom
RSG907R/RSG909R -
SSH
RuggedCom RuggedCom
RSG907R/RSG909R -
Telnet
RuggedCom RuggedCom
RSG908C/RSG910C -
SSH
RuggedCom RuggedCom
RSG908C/RSG910C -
Telnet
RuggedCom RuggedCom
RSG920P - SSH
RuggedCom RuggedCom
RSG920P - Telnet
RuggedCom RuggedCom RSL910
- SSH
Restore Configuration
Program
Device
Family Device Type
RuggedCom RuggedCom RSL910
- Telnet
RuggedCom RuggedCom
RST2228/RST2228P -
SSH
RuggedCom RuggedCom
RST2228/RST2228P -
Telnet
RuggedCom RuggedCom
RST916P/RST916C -
SSH
RuggedCom RuggedCom
RST916P/RST916C -
Telnet
RuggedCom RuggedCom RX1000/
RX1100 v1 - SSH
RuggedCom RuggedCom RX1400
- SSH
RuggedCom RuggedCom RX1500
- SSH
RuggedCom RuggedCom RX1501
- SSH
RuggedCom RuggedCom RX1510
- SSH
RuggedCom RuggedCom RX1511/
RX1512 - SSH
RuggedCom RuggedCom RX1524
- SSH
RuggedCom RuggedCom RX1536
- SSH
RuggedCom RuggedCom RX5000
- SSH
SATEC SATEC PM17x - Serial
Schneider Schneider ION 7650 -
Network
Restore Configuration
Program
Device
Family Device Type
Schneider Schneider Quantum
CPU - Network
SEL - 20xx SEL-2020 - Dial-Up
Gateways
SEL - 20xx SEL-2020 - Serial
Gateways
SEL - 20xx SEL-2030/2032 -
Gateways Dial-Up
SEL - 20xx SEL-2030/2032 -
Gateways Serial
SEL - 20xx SEL-2030/2032 -
Gateways Telnet
SEL - Other SEL TEAM Server
SEL - Other SEL-2488 Clock -
Network
SEL - Other SEL-2885 - Serial
SEL - Other SEL-2890 - Telnet
SEL - Other SEL-3354 - Telnet
SEL - Other SEL-35xx RTAC
(APRs) - Dial-Up
SEL - Other SEL-35xx RTAC
(APRs) - Serial
SEL - Other SEL-35xx RTAC
(APRs) - SSH
SEL - Other SEL-35xx RTAC
(APRs) - TCP
SEL - Other SEL-35xx RTAC
(APRs) - Telnet
SEL - Other SEL-35xx RTAC (SEL
Server) - Dial-Up
SEL - Other SEL-35xx RTAC (SEL
Server) - Serial
SEL - Other SEL-35xx RTAC (SEL
Server) - SSH
Restore Configuration
Program
Device
Family Device Type
SEL - Other SEL-35xx RTAC (SEL
Server) - TCP
SEL - Other SEL-35xx RTAC (SEL
Server) - Telnet
SEL - Other SEL-3610/3620/3622
- Mapped TCP
SEL - Other SEL-3610/3620/3622
- Mapped Telnet
SEL - Other SEL-3610/3620/3622
- Prompted Serial
SEL - Other SEL-3610/3620/3622
- Prompted SSH
SEL - Other SEL-3610/3620/3622
- Prompted Telnet
SEL - Relays SEL IED - Serial
SEL - Relays SEL IED - Telnet
SEL - Relays SEL-187V - Serial
SEL - Relays SEL-2100 - Serial
SEL - Relays SEL-221F - Serial
SEL - Relays SEL-2410 - Serial
SEL - Relays SEL-2411 - Serial
SEL - Relays SEL-2411 - Telnet
SEL - Relays SEL-2431 - Serial
SEL - Relays SEL-2431 - Telnet
SEL - Relays SEL-2440 - Serial
SEL - Relays SEL-2440 - Telnet
SEL - Relays SEL-251 - Serial
SEL - Relays SEL-251D - Serial
SEL - Relays SEL-2523 - Serial
SEL - Relays SEL-2533 - Serial
SEL - Relays SEL-2664S - Serial
Restore Configuration
Program
Device
Family Device Type
SEL - Relays SEL-2664S - Telnet
SEL - Relays SEL-279H - Serial
SEL - Relays SEL-287V - Serial
SEL - Relays SEL-300G - Serial
SEL - Relays SEL-311A - Serial
SEL - Relays SEL-311B - Serial
SEL - Relays SEL-311C - Serial
SEL - Relays SEL-311C - Telnet
SEL - Relays SEL-311L - Serial
SEL - Relays SEL-311L - Telnet
SEL - Relays SEL-321 - Serial
SEL - Relays SEL-351 - Serial
SEL - Relays SEL-351 - Telnet
SEL - Relays SEL-351A - Serial
SEL - Relays SEL-351A - Telnet
SEL - Relays SEL-351R - Serial
SEL - Relays SEL-351RS - Serial
SEL - Relays SEL-351RS - Telnet
SEL - Relays SEL-351S - Serial
SEL - Relays SEL-351S - Telnet
SEL - Relays SEL-352 - Serial
SEL - Relays SEL-387 - Serial
SEL - Relays SEL-387A - Serial
SEL - Relays SEL-387E - Serial
SEL - Relays SEL-387E - Telnet
SEL - Relays SEL-387L - Serial
SEL - Relays SEL-401 - Serial
SEL - Relays SEL-401 - Telnet
SEL - Relays SEL-411L - Serial
Restore Configuration
Program
Device
Family Device Type
SEL - Relays SEL-411L - Telnet
SEL - Relays SEL-421 - Serial
SEL - Relays SEL-421 - Telnet
SEL - Relays SEL-451 - Serial
SEL - Relays SEL-451 - Telnet
SEL - Relays SEL-487B - Serial
SEL - Relays SEL-487B - Telnet
SEL - Relays SEL-487E - Serial
SEL - Relays SEL-487E - Telnet
SEL - Relays SEL-487V - Serial
SEL - Relays SEL-487V - Telnet
SEL - Relays SEL-501 - Serial
SEL - Relays SEL-547 - Serial
SEL - Relays SEL-551 - Serial
SEL - Relays SEL-551C - Serial
SEL - Relays SEL-587 - Serial
SEL - Relays SEL-587Z - Serial
SEL - Relays SEL-651R - Serial
SEL - Relays SEL-651R - Telnet
SEL - Relays SEL-651RA - Serial
SEL - Relays SEL-651RA - Telnet
SEL - Relays SEL-700BT - Serial
SEL - Relays SEL-700BT - Telnet
SEL - Relays SEL-700G - Serial
SEL - Relays SEL-700G - Telnet
SEL - Relays SEL-700GT - Serial
SEL - Relays SEL-700GT - Telnet
SEL - Relays SEL-700GW - Serial
SEL - Relays SEL-700GW - Telnet
Restore Configuration
Program
Device
Family Device Type
SEL - Relays SEL-701 - Serial
SEL - Relays SEL-710 - Serial
SEL - Relays SEL-710 - Telnet
SEL - Relays SEL-710-5 - Serial
SEL - Relays SEL-710-5 - Telnet
SEL - Relays SEL-734 - Serial
SEL - Relays SEL-734 - Telnet
SEL - Relays SEL-735 - Serial
SEL - Relays SEL-735 - Telnet
SEL - Relays SEL-749M - Serial
SEL - Relays SEL-751 - Serial
SEL - Relays SEL-751 - Telnet
SEL - Relays SEL-787 - Serial
SEL - Relays SEL-787 - Telnet
SEL - Relays SEL-849 - Serial
SEL - Relays SEL-849 - Telnet
SEL - Relays SEL-851 - Serial
SEL - Relays SEL-851 - Telnet
SEL - Relays SEL-T400L - Serial
SEL - Relays SEL-T400L - Telnet
SEL - Relays SEL-T401L - Telnet
Siemens Siemens SICAM PAS -
SICAM PAS Network
Siemens Siemens SICAM SCC -
SICAM SCC Network
Siemens Siemens SIPROTEC 4
SIPROTEC 4 - Network
Siemens Siemens SIPROTEC 4
SIPROTEC 4 - Serial
Siemens Siemens SIPROTEC 5
SIPROTEC 5 - Network
Restore Configuration
Program
Device
Family Device Type
SMP SMP 16/CP - TCP
SMP SMP 16/CP - Telnet
SMP SMP 16/SG - TCP
SMP SMP 16/SG - Telnet
SMP SMP 4 - TCP
SMP SMP 4 - Telnet
SMP SMP SG-4250 - TCP
SMP SMP SG-4250 - Telnet
Telvent SAGE 1410 RTU -
Network
Connectivity CAM
FirmwareVersion
ConfigCompare
Time Compare
DataCAM
CAM
CAM
CAM
Device Family Device Type
ABB ABB AFS 66x - SSH
ABB ABB AFS 67x - SSH
ABB ABB PCD-2000 - Serial
ABB ABB PCD-2000 - Telnet
ABB ABB Relion 615 v2 - Network
ABB ABB Relion 670 v1 - Network
ABB ABB RTU560 - Network
ABB ABB TPU/DPU - Serial
Bitronics Bitronics M57x - Serial
Bitronics Bitronics M57x - Telnet
Bitronics Bitronics M660/M661 - Network
Cisco Cisco 2900 - SSH
Cisco Cisco Catalyst 2960 - SSH
Cisco Cisco Catalyst 3750 - SSH
Cisco Cisco CGR 2010 - SSH
Cisco Cisco CGS 2520 - SSH
Comtrol ComtrolDeviceMaster8
CrossBow Asset Discovery & CrossBow ADM Agent
Management
CrossBow Secure Access Secure Access Manager - Local
Manager - Local
CrossBow Station Access Station Access Controller
Controller
Data Track Data Track T2700
DIGI DIGI TS1 - Prompted SSH
DIGI DIGI TS1 - Prompted Telnet
DIGI DIGI TS16 - Prompted SSH
DIGI DIGI TS16 - Prompted Telnet
DIGI DIGI TS2 - Prompted SSH
Connectivity CAM
FirmwareVersion
ConfigCompare
Time Compare
DataCAM
CAM
CAM
CAM
Device Family Device Type
DIGI DIGI TS2 - Prompted Telnet
DIGI DIGI TS4 - Prompted SSH
DIGI DIGI TS4 - Prompted Telnet
DIGI DIGI TS8 - Prompted SSH
DIGI DIGI TS8 - Prompted Telnet
DIGI DIGI TSx - Mapped SSH
DIGI DIGI TSx - Mapped Telnet
GarrettCom DynaStar 1500
GarrettCom DynaStar 2000
GarrettCom DynaStar 5000
GarrettCom GarrettCom 10RX
GarrettCom GarrettCom 10XTS
GarrettCom GarrettCom 6K
GarrettCom GarrettCom 6K Secure
GarrettCom GarrettCom DX1000
GarrettCom GarrettCom DX40
GarrettCom GarrettCom DX800
GarrettCom GarrettCom DX900
Gauntlet Gauntlet Bow 4-Port
Gauntlet Gauntlet Bow 8-Port
GE - Other GE RT430/RT434 Clock - Network
GE - UR Relays GE UR B30 Network
GE - UR Relays GE UR B30 Network v7.0+
GE - UR Relays GE UR B30 Serial
GE - UR Relays GE UR B30 Serial v7.0+
GE - UR Relays GE UR B60 Network
GE - UR Relays GE UR B90 Network
GE - UR Relays GE UR B90 Network v7.0+
GE - UR Relays GE UR B90 Serial
GE - UR Relays GE UR B90 Serial v7.0+
GE - UR Relays GE UR C30 Network
GE - UR Relays GE UR C30 Network v7.0+
GE - UR Relays GE UR C30 Serial
GE - UR Relays GE UR C30 Serial v7.0+
GE - UR Relays GE UR C60 Network
GE - UR Relays GE UR C60 Network v7.0+
GE - UR Relays GE UR C60 Serial
Connectivity CAM
FirmwareVersion
ConfigCompare
Time Compare
DataCAM
CAM
CAM
CAM
Device Family Device Type
GE - UR Relays GE UR C60 Serial v7.0+
GE - UR Relays GE UR C70 Network
GE - UR Relays GE UR C70 Network v7.0+
GE - UR Relays GE UR C70 Serial
GE - UR Relays GE UR C70 Serial v7.0+
GE - UR Relays GE UR C90 Plus Network
GE - UR Relays GE UR C90 Plus Network v1.8+
GE - UR Relays GE UR D30 Network
GE - UR Relays GE UR D30 Network v7.0+
GE - UR Relays GE UR D30 Serial
GE - UR Relays GE UR D30 Serial v7.0+
GE - UR Relays GE UR D60 Network
GE - UR Relays GE UR D60 Network v7.0+
GE - UR Relays GE UR D60 Serial
GE - UR Relays GE UR D60 Serial v7.0+
GE - UR Relays GE UR F35 Network
GE - UR Relays GE UR F35 Network v7.0+
GE - UR Relays GE UR F35 Serial
GE - UR Relays GE UR F35 Serial v7.0+
GE - UR Relays GE UR F60 Network
GE - UR Relays GE UR F60 Network v7.0+
GE - UR Relays GE UR F60 Serial
GE - UR Relays GE UR F60 Serial v7.0+
GE - UR Relays GE UR L90 Network
GE - UR Relays GE UR L90 Network v7.0+
GE - UR Relays GE UR L90 Serial
GE - UR Relays GE UR L90 Serial v7.0+
GE - UR Relays GE UR N60 Network
GE - UR Relays GE UR N60 Network v7.0+
GE - UR Relays GE UR T35 Network
GE - UR Relays GE UR T35 Network v7.0+
GE - UR Relays GE UR T60 Network
GE - UR Relays GE UR T60 Network v7.0+
GE - UR Relays GE UR T60 Serial
GE - UR Relays GE UR T60 Serial v7.0+
Generic Generic Direct Gateway - Serial
Generic Generic Direct Gateway - Telnet
Connectivity CAM
FirmwareVersion
ConfigCompare
Time Compare
DataCAM
CAM
CAM
CAM
Device Family Device Type
Generic Generic IED - Dial-Up
Generic Generic IED - Network
Generic Generic IED - Network/SSH/
Telnet
Generic Generic IED - Serial
Generic Generic IED - SSH
Generic Generic IED - Telnet
Generic Unconnected Device
Generic Unconnected Gateway
Lantronix Lantronix ETS16PR Mapped TCP
Lantronix Lantronix ETS16PR Type 2
Mapped TCP
Lantronix Lantronix ETS32PR Mapped TCP
Lantronix Lantronix ETS32PR Mapped
Telnet
Lantronix Lantronix ETS32PR Prompted
Telnet
Lantronix Lantronix ETS32PR Type 2
Mapped TCP
Lantronix Lantronix ETS8P Mapped TCP
Lantronix Lantronix ETS8P Mapped Telnet
Lantronix Lantronix ETS8P Prompted
Telnet
Novatech Novatech DDIO - Network
Novatech Novatech DDIO - Serial
Novatech Novatech Orion 5r - Telnet
Novatech Novatech Orion LX - SSH
Novatech Novatech Orion LX - Telnet
Nozomi Nozomi Guardian
Other Ametek Pulsar UPLC - Network
Other Beckwith M-2001D - Network
Other Checkpoint Firewall - SSH
Other Doble IDD Monitor - Network
Other Dynamic Ratings DR-E3 - Serial
Other Dynamic Ratings DR-E3 - SSH
Other Dynamic Ratings DR-E3 - Telnet
Other MiCOM Agile P44T - Network
Other MiCOM P14x - Network
Connectivity CAM
FirmwareVersion
ConfigCompare
Time Compare
DataCAM
CAM
CAM
CAM
Device Family Device Type
Other MiCOM P14x - Serial
Other Palo Alto PA-200 - SSH
Other Palo Alto PA-820/850 - SSH
Other Qualitrol Transformer Monitor
ITM 509
Other ZIV Relay - Network
Other Gateways IOLAN STS16 - SSH
Other Gateways IOLAN STS24 - SSH
Other Gateways IOLAN STS4 - SSH
Other Gateways IOLAN STS8 - SSH
Other Gateways RFL 9660 - Serial
Other Gateways SEL-20xx Emulator - Serial
Other Gateways SM1-16 Multiplexor - Dial-Up
RuggedCom RuggedCom i800 - SSH
RuggedCom RuggedCom i800 - Telnet
RuggedCom RuggedCom RMC20/RMC30 -
SSH
RuggedCom RuggedCom RMC20/RMC30 -
Telnet
RuggedCom RuggedCom RMC40/RMC41 -
SSH
RuggedCom RuggedCom RMC40/RMC41 -
Telnet
RuggedCom RuggedCom RS400/RS401 - SSH
RuggedCom RuggedCom RS400/RS401 -
Telnet
RuggedCom RuggedCom RS416 - SSH
RuggedCom RuggedCom RS416 - Telnet
RuggedCom RuggedCom RS8000 - SSH
RuggedCom RuggedCom RS8000 - Telnet
RuggedCom RuggedCom RS900/RS930/
RS940/RS950 - SSH
RuggedCom RuggedCom RS900/RS930/
RS940/RS950 Telnet
RuggedCom RuggedCom RS910/RS920 - SSH
RuggedCom RuggedCom RS910/RS920 -
Telnet
RuggedCom RuggedCom RS969 - SSH
RuggedCom RuggedCom RS969 - Telnet
Connectivity CAM
FirmwareVersion
ConfigCompare
Time Compare
DataCAM
CAM
CAM
CAM
Device Family Device Type
RuggedCom RuggedCom RSG2100/RSG2200/
RSG2300 - SSH
RuggedCom RuggedCom RSG2100/RSG2200/
RSG2300 Telnet
RuggedCom RuggedCom RSG2288/RSG2488
- SSH
RuggedCom RuggedCom RSG2288/RSG2488
- Telnet
RuggedCom RuggedCom RSG907R/RSG909R
- SSH
RuggedCom RuggedCom RSG907R/RSG909R
- Telnet
RuggedCom RuggedCom RSG908C/RSG910C
- SSH
RuggedCom RuggedCom RSG908C/RSG910C
- Telnet
RuggedCom RuggedCom RSG920P - SSH
RuggedCom RuggedCom RSG920P - Telnet
RuggedCom RuggedCom RSL910 - SSH
RuggedCom RuggedCom RSL910 - Telnet
RuggedCom RuggedCom RST2228/RST2228P
- SSH
RuggedCom RuggedCom RST2228/RST2228P
- Telnet
RuggedCom RuggedCom RST916P/RST916C -
SSH
RuggedCom RuggedCom RST916P/RST916C -
Telnet
RuggedCom RuggedCom RX1000/RX1100 v1
- SSH
RuggedCom RuggedCom RX1400 - SSH
RuggedCom RuggedCom RX1500 - SSH
RuggedCom RuggedCom RX1501 - SSH
RuggedCom RuggedCom RX1510 - SSH
RuggedCom RuggedCom RX1511/RX1512 -
SSH
RuggedCom RuggedCom RX1524 - SSH
RuggedCom RuggedCom RX1536 - SSH
RuggedCom RuggedCom RX5000 - SSH
SATEC SATEC PM17x - Serial
Schneider Schneider ION 7650 - Network
Connectivity CAM
FirmwareVersion
ConfigCompare
Time Compare
DataCAM
CAM
CAM
CAM
Device Family Device Type
Schneider Schneider Quantum CPU -
Network
SEL - 20xx Gateways SEL-2020 - Dial-Up
SEL - 20xx Gateways SEL-2020 - Serial
SEL - 20xx Gateways SEL-2030/2032 - Dial-Up
SEL - 20xx Gateways SEL-2030/2032 - Serial
SEL - 20xx Gateways SEL-2030/2032 - Telnet
SEL - Other SEL TEAM Server
SEL - Other SEL-2488 Clock - Network
SEL - Other SEL-2885 - Serial
SEL - Other SEL-2890 - Telnet
SEL - Other SEL-3354 - Telnet
SEL - Other SEL-35xx RTAC (APRs) - Dial-Up
SEL - Other SEL-35xx RTAC (APRs) - Serial
SEL - Other SEL-35xx RTAC (APRs) - SSH
SEL - Other SEL-35xx RTAC (APRs) - TCP
SEL - Other SEL-35xx RTAC (APRs) - Telnet
SEL - Other SEL-35xx RTAC (SEL Server) -
Dial-Up
SEL - Other SEL-35xx RTAC (SEL Server) -
Serial
SEL - Other SEL-35xx RTAC (SEL Server) - SSH
SEL - Other SEL-35xx RTAC (SEL Server) - TCP
SEL - Other SEL-35xx RTAC (SEL Server) -
Telnet
SEL - Other SEL-3610/3620/3622 - Mapped
TCP
SEL - Other SEL-3610/3620/3622 - Mapped
Telnet
SEL - Other SEL-3610/3620/3622 - Prompted
Serial
SEL - Other SEL-3610/3620/3622 - Prompted
SSH
SEL - Other SEL-3610/3620/3622 - Prompted
Telnet
SEL - Relays SEL IED - Serial
SEL - Relays SEL IED - Telnet
SEL - Relays SEL-187V - Serial
SEL - Relays SEL-2100 - Serial
Connectivity CAM
FirmwareVersion
ConfigCompare
Time Compare
DataCAM
CAM
CAM
CAM
Device Family Device Type
SEL - Relays SEL-221F - Serial
SEL - Relays SEL-2410 - Serial
SEL - Relays SEL-2411 - Serial
SEL - Relays SEL-2411 - Telnet
SEL - Relays SEL-2431 - Serial
SEL - Relays SEL-2431 - Telnet
SEL - Relays SEL-2440 - Serial
SEL - Relays SEL-2440 - Telnet
SEL - Relays SEL-251 - Serial
SEL - Relays SEL-251D - Serial
SEL - Relays SEL-2523 - Serial
SEL - Relays SEL-2533 - Serial
SEL - Relays SEL-2664S - Serial
SEL - Relays SEL-2664S - Telnet
SEL - Relays SEL-279H - Serial
SEL - Relays SEL-287V - Serial
SEL - Relays SEL-300G - Serial
SEL - Relays SEL-311A - Serial
SEL - Relays SEL-311B - Serial
SEL - Relays SEL-311C - Serial
SEL - Relays SEL-311C - Telnet
SEL - Relays SEL-311L - Serial
SEL - Relays SEL-311L - Telnet
SEL - Relays SEL-321 - Serial
SEL - Relays SEL-351 - Serial
SEL - Relays SEL-351 - Telnet
SEL - Relays SEL-351A - Serial
SEL - Relays SEL-351A - Telnet
SEL - Relays SEL-351R - Serial
SEL - Relays SEL-351RS - Serial
SEL - Relays SEL-351RS - Telnet
SEL - Relays SEL-351S - Serial
SEL - Relays SEL-351S - Telnet
SEL - Relays SEL-352 - Serial
SEL - Relays SEL-387 - Serial
SEL - Relays SEL-387A - Serial
SEL - Relays SEL-387E - Serial
Connectivity CAM
FirmwareVersion
ConfigCompare
Time Compare
DataCAM
CAM
CAM
CAM
Device Family Device Type
SEL - Relays SEL-387E - Telnet
SEL - Relays SEL-387L - Serial
SEL - Relays SEL-401 - Serial
SEL - Relays SEL-401 - Telnet
SEL - Relays SEL-411L - Serial
SEL - Relays SEL-411L - Telnet
SEL - Relays SEL-421 - Serial
SEL - Relays SEL-421 - Telnet
SEL - Relays SEL-451 - Serial
SEL - Relays SEL-451 - Telnet
SEL - Relays SEL-487B - Serial
SEL - Relays SEL-487B - Telnet
SEL - Relays SEL-487E - Serial
SEL - Relays SEL-487E - Telnet
SEL - Relays SEL-487V - Serial
SEL - Relays SEL-487V - Telnet
SEL - Relays SEL-501 - Serial
SEL - Relays SEL-547 - Serial
SEL - Relays SEL-551 - Serial
SEL - Relays SEL-551C - Serial
SEL - Relays SEL-587 - Serial
SEL - Relays SEL-587Z - Serial
SEL - Relays SEL-651R - Serial
SEL - Relays SEL-651R - Telnet
SEL - Relays SEL-651RA - Serial
SEL - Relays SEL-651RA - Telnet
SEL - Relays SEL-700BT - Serial
SEL - Relays SEL-700BT - Telnet
SEL - Relays SEL-700G - Serial
SEL - Relays SEL-700G - Telnet
SEL - Relays SEL-700GT - Serial
SEL - Relays SEL-700GT - Telnet
SEL - Relays SEL-700GW - Serial
SEL - Relays SEL-700GW - Telnet
SEL - Relays SEL-701 - Serial
SEL - Relays SEL-710 - Serial
SEL - Relays SEL-710 - Telnet
Connectivity CAM
FirmwareVersion
ConfigCompare
Time Compare
DataCAM
CAM
CAM
CAM
Device Family Device Type
SEL - Relays SEL-710-5 - Serial
SEL - Relays SEL-710-5 - Telnet
SEL - Relays SEL-734 - Serial
SEL - Relays SEL-734 - Telnet
SEL - Relays SEL-735 - Serial
SEL - Relays SEL-735 - Telnet
SEL - Relays SEL-749M - Serial
SEL - Relays SEL-751 - Serial
SEL - Relays SEL-751 - Telnet
SEL - Relays SEL-787 - Serial
SEL - Relays SEL-787 - Telnet
SEL - Relays SEL-849 - Serial
SEL - Relays SEL-849 - Telnet
SEL - Relays SEL-851 - Serial
SEL - Relays SEL-851 - Telnet
SEL - Relays SEL-T400L - Serial
SEL - Relays SEL-T400L - Telnet
SEL - Relays SEL-T401L - Telnet
Siemens SICAM PAS Siemens SICAM PAS - Network
Siemens SICAM SCC Siemens SICAM SCC - Network
Siemens SIPROTEC 4 Siemens SIPROTEC 4 - Network
Siemens SIPROTEC 4 Siemens SIPROTEC 4 - Serial
Siemens SIPROTEC 5 Siemens SIPROTEC 5 - Network
SMP SMP 16/CP - TCP
SMP SMP 16/CP - Telnet
SMP SMP 16/SG - TCP
SMP SMP 16/SG - Telnet
SMP SMP 4 - TCP
SMP SMP 4 - Telnet
SMP SMP SG-4250 - TCP
SMP SMP SG-4250 - Telnet
Telvent SAGE 1410 RTU - Network
Security Notifications
• User has generated a password history report associated with an alert
• { username } has attempted to view checked out Passwords
• File Activity Report generated
• { username } showed the { login level } password to { username } for this reason:
{ reason }
• User has generated a Activity Log report
• User has generated a password history report
• Administrative user logged out of server { server machine name } ({ server type })
• User logged out of server { server machine name } ({ server type })
• Administrator { username1 } disconnected { username2 }
• Password for username { username } changed successfully
• CAM logged in: { details }
• User { username } was shown the { login level } credentials for device { device
name } for a device connection
• { server machine name } SAM-L Encryption has been Disabled to prepare for
Software Update
• { server machine name } SAM-L Encryption has been Enabled
• { server machine name } SAM-L Encryption has been Disabled
• { server machine name } SAM-L Encryption password has expired, database re-
encrypted
• User { username1 } attempted to delete full admin user id { userID2 }'s record and
was rejected
• User { username1 } attempted to update full admin user { username2 }'s record
and was rejected
• User { username1 } attempted to insert full admin user { username2 }'s record
and was rejected
• A client query was rejected for the following reason: { reason } (QueryID { id })
• Client query { query id } ({ query description }) validation failed for the given user
and supplied parameters. { validation error }
• Possible SQL Injection characters detected in incoming authentication response.
Disconnecting
• Attempted to switch authentication modes at a time when this is not allowed.
Disconnecting
• { transmitted character } Blocked
• User { username1 } attempted to change user { username2 }'s password and was
rejected
• Old password mismatch changing password
• New password was not different from old password when changing password
• User { username } attempted to access audit log file { filename }, which they do
not have access to
• User { username } has reached { maximum } consecutive failed logins and will be
locked out
• Potential DOS Attack Detected. Connections requested from Peer Address { ip
address } has reached its maximum
• SSH connection rejected due to fingerprint mismatch
• Error: SSHAlgorithm mismatch detected. Device supports algorithms:
{ algorithms }. Listed algorithms may be enabled in the device or device-type
Advanced Parameter '{ parameter name }'
Siemens RUGGEDCOM
https://www.siemens.com/ruggedcom
Industry Mall
https://mall.industry.siemens.com