FW for OT

[Thuan]

Hello experts,

My case: I have to use 1570R to protect OT network. But the 1570R device is not performing enough. So I needed a solution that didn't change the client's architecture.

[G_W_Albrecht]

Why are you using a 1570R industrial ? You should estimate needed performance and decide between SMB (1600/1800) or GAiA appliance based on this.

[Thuan]

I'm confused as to whether network firewalls (like 1600/1800, quantum 6000, ...) can handle industrial protocols.
I know that in the category (application/application control wiki) there are entries for the scada protocols. But I'm not sure about that. I haven't found any documentation that a network firewall can handle industrial protocols.
As you (Legend) say, I can use network firewall in this case.

[_Val_]

Which particular protocols are you enquiring about?

[Thuan]

modbus, OPC, IEC, electrical industry related protocols

[G_W_Albrecht]

See sk177203: Quantum IoT Controller [IoT Protect] Security Best Practices

If you need special protocols i would ask TAC and/or your local CP SE !

[Thuan]

modbus, OPC, IEC, electrical industry related protocols. I wonder if CP 6200 is ok?

[Chris_Atkinson]

1570R is environmentally hardened compared with 6200 is that a requirement?

You can search for specific protocols like Modbus here:

https://appwiki.checkpoint.com/appwikisdb/public.htm

[_Val_]

Did you search the community for answers?

Look here, for example: https://community.checkpoint.com/t5/IoT-Protect/Protect-ICS-SCADA-Network-Whitepaper/td-p/40878

[Thuan]

Thank you!

In short I want to ask if CP 6200 can work with industrial protocol: modbus, OPC, IEC, ... (electrical industry related protocols).

I know that in the category (application/application control wiki) there are entries for the scada protocols. But I'm not sure about that. 

Is it possible to answer yes/no in this case?

[_Val_ · Accepted solution]

I have already provided you with the answer, which is yes. Go by the link in the comment above, and download the attached white paper, it contains all the info you are looking for, including policy examples with modbus and other related services.

[Thuan]

Thanks expert.
I apologize if I have bothered you for a while on this topic.

I have read 1_protect-ics-scada-network-whitepaper (Protecting Industrial Control Systems and SCADA Networks | White Paper)
Does the section Enforce with Zero Impact/page 7 prove what you say?

[_Val_]

Hi, there is no need to apologize, we are here to help.

Page seven has an example with mudbus enforcement. Also, quite a few documents and guides are available on the main site in the Scada section: https://www.checkpoint.com/industry/industrial-control-systems/

If you need any further help, please let me know.