DS Agile C26x
Addendum to Technical Manual
System version: from 5.1.0 to 5.1.7
C26x/EN M/C67
WARNING
This Addendum added to the Technical Manual that it complements give instructions for installation,
commissioning and operation of the DS Agile C26x. However, the guide cannot cover all conceivable
circumstances or include detailed information on all topics. In the event of questions or specific problems,
do not take any action without proper authorization. Please, contact the appropriate Alstom technical
sales office and request the necessary information.
Refer to the System Release Notes for new features.
Any agreements, commitments, and legal relationships and any obligations on the part of Alstom,
including settlement of warranties, result solely from the applicable purchase contract, which is not
affected by the contents of the guide.
DS Agile C26x
Addendum to Technical Manual
Contents
1
INTRODUCTION
3
2
FIREWALL USAGE REQUIREMENTS
4
2.1
2.1.1
2.1.2
2.2
2.2.1
2.2.2
Firewall Usage SCE Configuration
SCS level
Computer level
Network Separation SBUS and Maintenance Access Point
Firewall usage set to YES (Enabled)
Firewall usage set to NO (Disabled)
4
4
5
6
6
6
3
LIMITS
7
C26x/EN AD/C67
AD-1
Addendum to Technical Manual
DS Agile C26x
AD-2
C26x/EN AD/C67
DS Agile C26x
1
Addendum to Technical Manual
INTRODUCTION
The Firewall usage function allows network separation which enforces the security and reduces the
intrusions.
The C26x uses the configuration settings in the SCE for the Firewall usage function.
Use the SCE for configuring the network separation between:
 Eth 1 Sbus network
 Eth 2 Maintenance access network
C26x/EN AD/C67
AD-3
Addendum to Technical Manual
2
DS Agile C26x
FIREWALL USAGE REQUIREMENTS
Firewall usage requirements for network separation on the C26x BCU are:
 Different subnet IP addresses on Eth1 and Eth2.
(Default subnet mask is 255.255.255.0).
 Operational database.
Note:
Firewall usage is configured only in Off-line mode through the SCE.
2.1
FIREWALL USAGE SCE CONFIGURATION
Configure the Firewall usage in SCE.
During the configuration this parameter can be set to:
 Yes (Enabled)
 No (Disabled)
2.1.1
SCS LEVEL
SCS level set the value of attributes Firewall Usage:
W0410ENa
AD-4
C26x/EN AD/C67
DS Agile C26x
2.1.2
Addendum to Technical Manual
COMPUTER LEVEL
Computer level defines the IP-Address for Sbus port ( ETH1) and Maintenance port (ETH2):
W0411ENa
Note:
Eth1 and Eth2 IP addresses are set in different subnets via CMT.
The configured IP addresses must be the same as the IP addresses of the C26x BCU.
Use the CMT tool:
 For configuring the different IP addresses on Eth1 and Eth2.
 To define the host IP.
 To enable/disable one by one the tools of the Maintenance applications, whether the Firewall is:

Yes (Enabled)

No (Disabled)
Host IP address during software upgrade phase:
The Host IP address provides the C26x BCU with the IP address of the PC which contains the C26x
software.
The software upgrade is only available from Eth 1.
The host IP address must be defined in the sub-network of Eth 1.
Host IP address during operational phase:
The host IP address provides the C26x BCU with the IP address of the PC from which to retrieve the
settings.
The host IP address has to be set to the IP address of the PC supporting Micom S1 in the sub-network of
Eth 2.
C26x/EN AD/C67
AD-5
Addendum to Technical Manual
2.2
DS Agile C26x
NETWORK SEPARATION SBUS AND MAINTENANCE ACCESS POINT
Firewall function is activated only when:
 The Firewall function is enabled in the configured Database.
 The configured Database with the Firewall function enabled is set as the current Database.
Firewall function is disabled if there is no operational Database on the C26x BCU.
The maintenance application features which are not allowed on Eth2 are:
2.2.1

Upgrading software (Bootrom and Bootinstall)

Flash formatting
FIREWALL USAGE SET TO YES (ENABLED)
 SBUS network is managed only by Eth1.
When C26x BCU starts in Network Boot / Flash Boot the maintenance application features are only available
on Eth 2.
When C26x BCU starts in Bootrom boot the maintenance application features are only available on Eth1.
2.2.2
FIREWALL USAGE SET TO NO (DISABLED)
 SBUS network is managed only by the Eth1.
 Maintenance access is allowed on both Eth1 and Eth2.
AD-6
C26x/EN AD/C67
DS Agile C26x
3
Addendum to Technical Manual
LIMITS
The Firewall usage is forbidden when the C26x BCU is used in one of these architectures:
 Mulitrack mode
 RTU mode
 PBus mode
Firewall is only configurable in Off-line mode trough the SCE.
The SCE applies the Firewall Usage on all the C26x BCUs configured in the Database.
When C26x maintenance IP address is changed, the computer has to be rebooted:
 The service on SBUS network is interrupted for 60 seconds.
When C26x SBUS IP address is changed, reloading the database is required.
If the C26x BCU with the Firewall usage is used as a T104 gateway the Eth 1 port must be used for SCADA
connection.
Firmware upgrade
The commands used for the firmware upgrade must start in Bootrom boot on Eth1:
 Update BootRom
 Flash Format
 BootInstall
C26x/EN AD/C67
AD-7
Addendum to Technical Manual
DS Agile C26x
AD-8
C26x/EN AD/C67
Alstom Grid
© - ALSTOM 2015. All rights reserved.
Information contained in this document is
indicative only. No representation or warranty
is given or should be relied on that it is
complete or correct or will apply to any
particular project. This will depend on the
technical and commercial circumstances. It is
provided without liability and is subject to
change without notice. Reproduction, use or
disclosure to third parties, without express
written authority, is strictly prohibited.
Alstom Grid Worldwide Contact Centre
www.alstom.com/grid/contactcentre/
Tel: +44 (0) 1785 250 070
www.alstom.com