Securely Traversing IACS Data across the IDMZ Using Cisco Firepower Threat Defense

References

---

This appendix, which lists the references used in the IDMZ system, includes the following major topics:

• Converged Plantwide Ethernet (CPwE)
• Active Directory Services
• Application Security
• Core Switch Architecture
• FactoryTalk Historian
• Identity Services
• Industrial Demilitarized Zone Firewalls
• Network Infrastructure Hardening
• Network Time Protocol
• Remote Access Server
• Routing Between Zones

Converged Plantwide Ethernet (CPwE)

• Design Zone for Manufacturing—Converged Plantwide Ethernet
  http://www.cisco.com/c/en/us/solutions/enterprise/design-zone-manufacturing/landing_ettf.html
• Industrial Network Architectures—Converged Plantwide Ethernet
  http://www.rockwellautomation.com/global/products-technologies/network-technology/architectures.page
• Converged Plantwide Ethernet (CPwE) Design and Implementation Guide:

– Rockwell Automation site:
http://literature.rockwellautomation.com/idc/groups/literature/documents/td/enet-td001_-en-p.pdf

– Cisco site:
https://www.cisco.com/c/dam/en/us/td/docs/solutions/Verticals/CPwE/CPwE-CVD-Sept-2011.pdf

• Deploying 802.11 Wireless LAN Technology within a Converged Plantwide Ethernet Architecture Design and Implementation Guide:

– Rockwell Automation site:
http://literature.rockwellautomation.com/idc/groups/literature/documents/td/enet-td006_-en-p.pdf

– Cisco site:
https://www.cisco.com/c/en/us/td/docs/solutions/Verticals/CPwE/NovCVD/CPwE_WLAN_CVD.html

• Deploying Network Address Translation within a Converged Plantwide Ethernet Architecture Design and Implementation Guide:

– Rockwell Automation site:
http://literature.rockwellautomation.com/idc/groups/literature/documents/td/enet-td007_-en-p.pdf

– Cisco site:
https://www.cisco.com/c/en/us/td/docs/solutions/Verticals/CPwE/3-5-1/NAT/DIG/CPwE_NAT_CVD.html

• OEM Networking within a Converged Plantwide Ethernet Architecture Design Guide:

– Rockwell Automation site:
http://literature.rockwellautomation.com/idc/groups/literature/documents/td/enet-td018_-en-p.pdf

– Cisco site:
https://www.cisco.com/c/en/us/td/docs/solutions/Verticals/CPwE/5-1/OEM/WP/CPwE-5-1-OEM-WP/CPwE-5-1-OEM-WP.html

• Deploying Identity and Mobility Services within a Converged Plantwide Ethernet Architecture Design and Implementation Guide:

– Rockwell Automation site:
http://literature.rockwellautomation.com/idc/groups/literature/documents/td/enet-td008_-en-p.pdf

– Cisco site:
http://www.cisco.com/c/en/us/td/docs/solutions/Verticals/CPwE/3-5-1/ISE/DIG/CPwE_ISE_CVD.html

• Securely Traversing IACS Data Across the Industrial Demilitarized Zone Design and Implementation Guide:

– Rockwell Automation site:
http://literature.rockwellautomation.com/idc/groups/literature/documents/td/enet-td009_-en-p.pdf

– Cisco site:
https://www.cisco.com/c/en/us/td/docs/solutions/Verticals/CPwE/3-5-1/IDMZ/DIG/CPwE_IDMZ_CVD.html

• Deploying Industrial Firewalls within a Converged Plantwide Ethernet Architecture Design and Implementation Guide:

– Rockwell Automation site:
http://literature.rockwellautomation.com/idc/groups/literature/documents/td/enet-td002_-en-p.pdf

– Cisco site:
https://www.cisco.com/c/en/us/td/docs/solutions/Verticals/CPwE/5-0/Firewalls/DIG/CPwE-5-IFS-DIG.html

• Cloud Connectivity to a Converged Plantwide Ethernet Architecture:

– Rockwell Automation site:
https://literature.rockwellautomation.com/idc/groups/literature/documents/td/enet-td017_-en-p.pdf

– Cisco site:
https://www.cisco.com/c/en/us/td/docs/solutions/Verticals/CPwE/5-1/Cloud/DIG/CPwE_Cloud_Connect_CVD.html

• Deploying Network Security within a Converged Plantwide Ethernet Architecture:

– Rockwell Automation site:
https://literature.rockwellautomation.com/idc/groups/literature/documents/td/enet-td019_-en-p.pdf

– Cisco site:
https://www.cisco.com/c/en/us/td/docs/solutions/Verticals/CPwE/5-1/Network_Security/DIG/CPwE-5-1-NetworkSecurity-DIG.html

• Deploying CIP Security within a Converged Plantwide Ethernet Architecture Design Guide:

– Rockwell Automation site:
https://literature.rockwellautomation.com/idc/groups/literature/documents/td/enet-td022_-en-p.pdf

– Cisco site:
https://www.cisco.com/c/en/us/td/docs/solutions/Verticals/CPwE/5-0/Firewalls/DIG/CPwE-5-IFS-%20DIG.html

• Deploying Scalable Time Distribution within a Converged Plantwide Ethernet Architecture:

– Rockwell Automation site:
https://literature.rockwellautomation.com/idc/groups/literature/documents/td/enet-td016_-en-p.pdf

– Cisco site:
https://www.cisco.com/c/en/us/td/docs/solutions/Verticals/CPwE/5-1/STD/DIG/CPwE-5-1-STD-DIG.html

• Deploying A Resilient Converged Plantwide Ethernet Architecture Design and Implementation Guide:

– Rockwell Automation site:
http://literature.rockwellautomation.com/idc/groups/literature/documents/td/enet-td010_-en-p.pdf

– Cisco site:
https://www.cisco.com/c/en/us/td/docs/solutions/Verticals/CPwE/4-0/Resiliency/DIG/CPwE_resil_CVD.html

• Deploying Parallel Redundancy Protocol within a Converged Plantwide Ethernet Architecture:

– Rockwell Automation site:
https://literature.rockwellautomation.com/idc/groups/literature/documents/td/enet-td021_-en-p.pdf

– Cisco site:
https://www.cisco.com/c/en/us/td/docs/solutions/Verticals/CPwE/5-1/PRP/DIG/CPwE-5-1-PRP-DIG.html

• Deploying Device Level Ring within a Converged Plantwide Ethernet Architecture Design Guide:

– Rockwell Automation site:
https://literature.rockwellautomation.com/idc/groups/literature/documents/td/enet-td015_-en-p.pdf

– Cisco site:
http://www.cisco.com/c/en/us/solutions/enterprise/design-zone-manufacturing/landing_ettf.html

Active Directory Services

Active Directory Domain Services:

• https://technet.microsoft.com/en-us/windowsserver/dd448614

Deploy Active Directory Domain Services (AD DS) in Your Enterprise

• https://technet.microsoft.com/en-us/library/hh472160.aspx

How Active Directory Replication Works

• http://social.technet.microsoft.com/wiki/contents/articles/4592.how-active-directory-replication-works.aspx

Active Directory Replication Technologies

• https://technet.microsoft.com/en-us/library/cc776877%28v=ws.10%29.aspx

Active Directory and Active Directory Domain Services Port Requirements

• https://technet.microsoft.com/en-us/library/dd772723%28v=ws.10%29.aspx

Active Directory Certificate Services

• https://technet.microsoft.com/en-us/windowsserver/dd448615.aspx

Active Directory Users and Computers

• https://technet.microsoft.com/en-us/library/cc754217.aspx

Application Security

FactoryTalk Security System Configuration Guide:

• http://literature.rockwellautomation.com/idc/groups/literature/documents/qs/ftsec-qs001_-en-e.pdf

Using Rockwell Automation Products with Microsoft Enhanced Mitigation Experience Toolkit (EMET):

• https://rockwellautomation.custhelp.com/app/answers/detail/a_id/546988

Using Rockwell Automation Software Products with AppLocker :

• https://rockwellautomation.custhelp.com/app/answers/detail/a_id/546989

How AppLocker Works:

• http://technet.microsoft.com/en-us/library/ee460948%28v=ws.10%29.aspx

The EMT configuration can be downloaded from the knowledgebase article at:

• https://rockwellautomation.custhelp.com/app/answers/detail/a_id/546988

Core Switch Architecture

Virtual Switching Systems (Release 15.1SY Supervisor Engine 2T Software Configuration Guide):

• http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/15-1SY/config_guide/sup2T/15_1_sy_swcg_2T/virtual_switching_systems.html

Virtual Switching Systems (Catalyst 6500 12.25X Software Configuration Guide):

• http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/12-2SX/configuration/guide/book/vss.html

Data Brokering

Cisco Telemetry Broker :

• https://www.cisco.com/c/en/us/products/security/telemetry-broker/index.html

Cisco Telemetry Broker Virtual Appliance Deployment and Configuration Guide :

• https://www.cisco.com/c/dam/en/us/td/docs/security/Telemetry_Broker/Deployment/TB_1_1_Virtual_Appliance_Deployment_and_Configuration_Guide_DV_3_0.pdf

FactoryTalk Historian

FactoryTalk Historian website

• http://www.rockwellautomation.com/rockwellsoftware/products/factorytalk-historian.page?

FactoryTalk Historian Installation and Configuration Guide:

• http://literature.rockwellautomation.com/idc/groups/literature/documents/in/hse-in025_-en-e.pdf

FactoryTalk Historian SE Historian To Historian Interface Installation and Configuration Guide:

• http://literature.rockwellautomation.com/idc/groups/literature/documents/in/h2h-in001_-en-e.pdf

FactoryTalk Historian SE FactoryTalk Historian To Historian Interface User Guide:

• http://literature.rockwellautomation.com/idc/groups/literature/documents/um/h2h-um001_-en-e.pdf

Identity Services

Deploying Identity Services within a Converged Plantwide Ethernet Architecture Design and Implementation Guide:

• http://literature.rockwellautomation.com/idc/groups/literature/documents/td/enet-td008_-en-p.pdf
• http://www.cisco.com/c/en/us/td/docs/solutions/Verticals/CPwE/3-5-1/ISE/DIG/CPwE_ISE_CVD.html

Cisco Identify Services Engine Hardware Installation Guide, Release 1.4 Cisco SNS-3400 Series Appliance Ports Reference:

• http://www.cisco.com/c/en/us/td/docs/security/ise/1-4/installation_guide/b_ise_InstallationGuide14/b_ise_InstallationGuide14_appendix_01010.html

Industrial Demilitarized Zone Firewalls

Cisco Secure Firewall :

• https://www.cisco.com/c/en/us/products/security/firewalls/index.html

Cisco Firepower 2100 Getting Started Guide; Deployment with FMC :

• https://www.cisco.com/c/en/us/td/docs/security/firepower/quick_start/fp2100/firepower-2100-gsg/ftd-fmc.html

Cisco Firepower Management Center Configuration Guide :

• https://www.cisco.com/c/en/us/td/docs/security/firepower/670/configuration/guide/fpmc-config-guide-v67.html

Licensing

Cisco Smart Licensing :

• https://www.cisco.com/c/en/us/products/software/smart-accounts/software-licensing.html

Cisco Smart Software On-Prem User Guide :

• https://www.cisco.com/web/software/286285517/147683/Smart_Software_Manager_On-Prem_7_User_Guide.pdf

Multi-Factor Authentication

Cisco Multi-Factor Authentication :

• https://www.cisco.com/c/en/us/products/security/adaptive-multi-factor-authentication.html

Cisco Duo Authentication Proxy :

• https://duo.com/docs/authproxy-reference

Cisco FTD VPN with AnyConnect :

• https://duo.com/docs/cisco-firepower

Duo Authentication for Windows Logon and RDP :

• https://duo.com/docs/rdp

Duo Authentication for Microsoft Remote Desktop Gateway on Windows 2012 and Later :

• https://duo.com/docs/rdgateway

Network Infrastructure Hardening

Cisco Guide to Harden Cisco IOS Devices:

• http://www.cisco.com/c/en/us/support/docs/ip/access-lists/13608-21.html

Software Configuration Guide, Cisco IOS Release 15.2(2)E (Industrial Ethernet 2000 Switch) Configuring Switch-Based Authentication:

• http://www.cisco.com/c/en/us/td/docs/switches/lan/cisco_ie2000/software/release/15_2_2_e/configuration/guide/scg-ie2000/swauthen.html

Network Time Protocol

Windows Time Service Technical Reference:

• https://technet.microsoft.com/en-us/library/cc773061%28v=ws.10%29.aspx

Network Time Protocol: Best Practices White Paper:

• http://www.cisco.com/c/en/us/support/docs/availability/high-availability/19643-ntpm.html

Windows Time Service Technical Reference:

• https://technet.microsoft.com/en-us/library/cc773061.aspx

Remote Access Server

Remote Access VPN for Firepower Threat Defense :

• https://www.cisco.com/c/en/us/td/docs/security/firepower/670/configuration/guide/fpmc-config-guide-v67/firepower_threat_defense_remote_access_vpns.html

Remote Desktop Services Overview :

• https://technet.microsoft.com/en-us/library/hh831447.aspx

Deploying Remote Desktop Gateway Step-by-Step Guide :

• https://technet.microsoft.com/en-us/library/dd983941%28v=ws.10%29.aspx

Routing Between Zones

Enhanced Interior Gateway Routing Protocol White Paper:

• http://www.cisco.com/c/en/us/support/docs/ip/enhanced-interior-gateway-routing-protocol-eigrp/16406-eigrp-toc.html

OSPF Design Guide:

• http://www.cisco.com/c/en/us/support/docs/ip/open-shortest-path-first-ospf/7039-1.html