Siemens SCALANCE XR-300WG Series Operating Instructions Manual page 14

Safety notices
2.1 Security recommendations
Secure/non-secure protocols and services
● Avoid or disable non-secure protocols and services, for example HTTP, Telnet and TFTP.
For historical reasons, these protocols are available, however not intended for secure
applications. Use non-secure protocols on the device with caution.
● Check whether use of the following protocols and services is necessary:
– Non authenticated and unencrypted ports
– MRP, HRP
– IGMP snooping
– LLDP
– Syslog
– RADIUS
– DHCP Options 66/67
– TFTP
– GMRP and GVRP
● The following protocols provide secure alternatives:
– HTTP → HTTPS
– Telnet → SSH
– SNMPv1/v2c → SNMPv3
● Use secure protocols when access to the device is not prevented by physical protection
measures.
● If you require non-secure protocols and services, operate the device only within a
protected network area.
● Restrict the services and protocols available to the outside to a minimum.
● For the DCP function, enable the "Read Only" mode after commissioning.
● If you use RADIUS for management access to the device, activate secure protocols and
services.
Interfaces security
● Disable unused interfaces.
● Use IEEE 802.1X for interface authentication.
● Use the function "Locked Ports" to block interfaces for unknown nodes.
14
Check whether use of SNMPv1/v2c. is necessary. SNMPv1/v2c is classified as non-
secure. Use the option of preventing write access. The device provides you with
suitable setting options.
If SNMP is enabled, change the community names. If no unrestricted access is
necessary, restrict access with SNMP.
Use the authentication and encryption mechanisms of SNMPv3.
Operating Instructions, 05/2017, C79000-G8976-C454-01
SCALANCE XR-300WG