Section 3 Secure System Setup; Physical Interfaces; Communication Ports And Services - ABB RELION 670 SERIES Manual

1MRK 511 399-UEN B
Section 3
3.1
3.2
Table 1: Available ports
Port Protocol Default
state
21 TCP open
21 TCP open
102 TCP closed
123 UDP closed
Table continues on next page
670 series 2.2 IEC
Cyber security deployment guideline
Secure system setup

Physical interfaces

To reduce exposure for cyber-attacks and thus comply with cyber security
requirements, it must be possible to prevent services in the IED from operating on
other physical interfaces than the ones specified by the vendor or by the owner.

Communication ports and services

The port security guideline cannot suggest concrete products for a secure system
setup. This must be decided within the specific project, requirements and existing
infrastructure.
The ports used in the IED series to set up a firewall are given in table 1. The ports
are listed in ascending order. The column "Default state" defines whether a port is
open or closed by default. All ports that are closed can be opened as described in
the comment column in the table. Front refers to the physical front port. On the rear
side of the IED there are four network interfaces labeled 301, 302, 303 and 304. If
there is an OEM02 module installed there are two additional optical network
interfaces on the rear side, they are labeled 3061 and 3062. The protocol
availability on these ports can be configured using the Ethernet configuration tool.
ABB recommends using common security measures, like firewalls, up to date anti
virus software, etc. to protect the IED and the equipment around it.
It is recommended to deactivate the Access points and protocols
that are not in use to increase cyber security.
Front 301 302 303
OFF OFF OFF OFF
ON ON ON ON
OFF OFF OFF OFF
OFF OFF OFF OFF
304 3061 3062 Service
OFF OFF OFF FTP
ON OFF OFF FTPS
OFF OFF OFF IEC 61850
(MMS)
OFF OFF OFF SNTP
Section 3
Secure system setup
GUID-DA029F79-3173-4D17-A7B9-AA213FAC8F68 v1
GUID-A5E2256D-C7E2-4CAC-8EAD-E7DBBCB4AF08 v7
Comment
File transfer protocol
Explicit FTP over TLS
MMS communication
Enabled when IED is configured
as SNTP master.
15