westermo Merlin SCADA Protocol Conversion User Guide

westermo Merlin SCADA Protocol Conversion

 Overview

• This application note demonstrates how to set up the IECD application for protocol conversion. The example scenario illustrates SNMP as the “Master” interface and  DNP3 as the server protocol. The application note will show the typical steps required for protocol conversion configuration through web management.
• A knowledge of SNMP and SCADA protocol (DNP3) parameters is required, and the setup is common for all Merlin and Westermo Ireland/Virtual Access brand routers available.
• The IECD application is available in the SCADA section. You must configure Master and Server interfaces as well as at least one Data Point for signal mapping. The interfaces used to communicate with local RTUs are referred to as the Master  Protocol, while the interface used to communicate with the external Master is referred to as the Server  (Slave) Protocol.

The table below shows the supported SNMP protocol conversion scenarios.

Firmware information 

• Firmware version: SXL-25.05.24.000 or newer.

Assumptions

• This application note shows the Merlin 3100 router and assumes the router has a factory default configuration. Instructions can be applied to other routers in the Merlin Series.

Corrections 

• Requests for corrections or amendments to this application note are welcome and should
• be addressed to support.ie@westermo.com
• Requests for new application notes can be sent to the same address.

Configuring an SNMPD application

Configuring SNMP 

• Browse to the SNMPD configuration page via the WebUI and follow the steps below.

1.  Click Agent.
2. Set the Agent Address. Default address is 0.0.0.0:161
3. Click VACM.
4.  Set a name for COM2SEC settings and click ADD to create a new COM2SEC rule.
5.  Set the Source from the dropdown list. Configure custom source by selecting the custom option.
6.  Set Community String.
7. . Set Security Name.
8. Set a name for Group Settings and click ADD to create a new group rule.
9. Assign the Security Name.
10.  Select the Group. Currently, only two unique groups (public and private) can be selected.
11. Set the Version.
12. Set a name for View Settings and click ADD to create a new view rule.
13. Set the Name.
14. Set the Type (included or excluded)
15. Set the OID.
16. . Set a name for Access Settings and click ADD to create a new access rule.
17.  Select the Group. Default value is public.
18.  Select the Version. Default value is Any.
19.  Select the level. Default value is noauth. For version 3, select other.
20.  Select the Read. View name will be displayed here.
21. Click on Save & Apply button on the bottom of the page, to save the configuration and run/restart IECD application.

 Configuring SNMP Version 3 

• To configure SNMP version 3, a USM user needs to be added. This can be done through the “USM Users” tab on the WebUI.

1.  Click ADD to create a new USM User.
2.  Set the Username.
3.  Select the Authentication Protocol (None, MD5, or SHA) .
4. Set the Authentication Password.
5. Set the Privacy Protocol (None, DES, or AES).
6.  Set the Privacy Password.
7.  Set the OID to restrict this user to. This is similar to view restrictions in v1 and v2c.

 Custom OIDs using Pass

• Custom OIDs can be created using “Pass” feature in SNMP that allows users to define their own custom OIDs and link them to internal User Defined Script. This is useful when the user wants SNMP to return data that isn’t available in the device’s MIBs. Currently, pass feature can only be configured using CLI.
• Requests for additional MIB OID parameters are welcome and should be addressed to support.ie@westermo.com

1.  Define the script in the UDS package, the script will be generated in the /var/uds
2. In SNMPD application, set the script path and assign the custom OID. When this OID is queried, SNMPD will execute the script and return its output as expected.

Configuring an IECD application

• Browse to the IECD configuration page via the WebUI, enable IECD and follow the steps below.

Setting up the scenario 

• To set up the scenario, you must configure three key elements: Enable application, the Server protocol, the master protocol and at least one data point for conversion. Enable the application and click SAVE & APPLY. Remember to save and apply your WebUI configuration regularly

 Configuring server protocol DNP3

1.  Click Slave Protocol.
2.  Select DNP3 as the Server protocol.
3. Click CONFIGURE MQTT.
4. Click Net.
5.  Set the DNP3 Local IP.
6.  Set the DNP3 Listening TCP Port. Default is 20000.
7. Click Link.
8.  Set DNP3 SRC Address. Default value is 1.
9. . Set DNP3 DST Address. Default value is 1.

 Configuring DNP3 TLS

At minimum, to enable TLS communication, user needs to provide three files:

• CA certificate
•  Client Public key (certificate)
•  Client Private key (certificate)

1. Click TLS tab.
2. Select Enable in DNP3 ENABLE TLS.
3. Click Choose File to upload Client Public key.
4. Click Choose File to upload Client Private key.
5.  Click Choose File to upload CA public key.

Click SAVE & APPLY at the bottom of the page.

Configuring Master protocol – SNMPD link

 Configuring SNMP Master 

1. Click on Master Protocols tab.
2. Select Per Data Point as the Master protocol from the drop-down list.
3. Click on Configure SNMP.
4. Set the SNMP Command Prefix. Default value is “-v1 -c public 127.0.0.1”
5.  To save the configuration and restart the IECD application, scroll to the bottom of the page and click SAVE & APPLY.

Note: Only SNMP GET is supported. SNMP SETS are not supported.

Configuring SNMP Master (Version 3) 

Since SNMP Version 3 uses authentication and encryption, its command prefix will include the relevant security parameters:

1.  -v3 — SNMP version 3
2. . -l — security level
3.  -u — configured username
4.  -a — authentication protocol
5. -A — authentication password
6. -x — privacy protocol
7. -X – privacy password
8.  SNMP agent IP

Example -v3 -u user1 -a MD5 -A insertpass -x DES -X insertpass -l authPriv 127.0.0.1

Configuring data points (signal)

• Data points are essential for protocol conversion, requiring users to develop a data addressing/type map to facilitate the conversion between two distinct protocols. Each data point represents an individual value, such as mapping a Modbus Holding register to an IEC104 Measured Value. The configuration of data points adheres to the same principles as configuring communication interfaces, necessitating appropriate values for both the slave and Master sides.

Points configuration – manual 

Navigate to the main IECD page.

1.  Click Points.
2. Click CONFIGURE DATA POINTS.
3. Click ADD to create a point.
4.  Click EDIT to configure the added point.
5.  On the Data Point Configuration page, click GENERAL.
6. Set the Slave Protocol as DNP3.
7.  Set the Master/RTU protocol as SNMP.
8.  Assign a name to the data point (optional).
9.  Click on Server tab.
10.  Select the DNP3 Server Group from the drop-down list.
11. Set the DNP3 Server Index.
12.  Select the DNP3 Server Assigned Class from the drop-down list.
13. Click on Master tab.
14.  Set the SNMP Var Type from the drop-down list.
15. Set the SNMP OID.

• Click SAVE & APPLY at the bottom of the page.
• Note: It’s essential to match the SNMP variable type with the corresponding DNP3 Group correctly, any mismatch can lead to communication errors, incorrect data interpretation, and/or conversion failures.

 Points configuration – CSV file 

• Data points can be configured via CSV file upload. The CSV file shall include all required options in its header and their corresponding values in subsequent rows. Further instructions are available on the page via ‘Data and command points CSV file examples’ link, highlighted in Figure 22 below.

1. On the IECD Settings page, click Points.
2.  Click Choose File and select the CSV file.

With any text editor, save the content of the Figure 24 with .csv extension, upload that file to the router and click SAVE & APPLY at the bottom of the page. Router will parse the file and configure the data points.

 SNMP to DNP3 Mapping 

SNMP data types must be mapped to equivalent IECD Variable types.

Below table shows the mapping of SNMP with DNP3 types and ither SCADA protocols.

Requests for support of additional SNMP TYPES are welcome and should be addressed to support.ie@westermo.com

Essential OIDs

MOBILE COMMUNICATION

NETWORK

SYSTEM

GPIOs

Troubleshooting

IECD status via the WebUI 

• Basic troubleshooting such as verifying connections quality, values, mapping or addressing can be accessed via the dedicated IECD status page.

1.  On the main page, click Status.
2. Click IECD.

 IECD status via CLI

1.  To check the IECD status using CLI, connect to the router via SSH and enter the command iec show stats.
2. This will display the running protocols, serial interface in use, server and master protocol statistics such as the number of transmitted and received frames, and more. This information serves as a starting point for basic troubleshooting.

Configuring main debug level 

1.  Click SCADA.
2.  Click IECD.
3. Click Advanced.
4.  From the Syslog severity drop-down menu, set the Syslog severity to Debug.
5. To save the configuration and restart the IECD application, scroll to the bottom of the page and click SAVE & APPLY.

Enabling debug per protocol – DNP3 (Server)

• Via the WebUI, access IEC Server settings.
• Click Server Protocol and then CONFIGURE DNP3.

1. Click Debug.
2. Enable additional logging settings.

Enabling debug per protocol – SNMP (Master) 

1.  Click Master Protocol and then CONFIGURE SNMP.
2.  Check SNMP Debug Enable.
3.  To save the configuration and restart the IECD application, scroll to the bottom of the page and click SAVE & APPLY.

 Accessing logs using WebUI 

1. To check the logs, in the left-hand menu, click System.
2. Click System Log and search for logs related to IECD. These logs will have the name iecd.
3. To download the logs, click Download.

Accessing logs via CLI 

1.  To check the IECD logs using the CLI, connect via SSH and enter the command logread -f.
2. . Logs related to the server and master protocols will be displayed.

Note: users can download the log file, as syslog.messages in the root directory, via WinSCP.

FAQs