Firewalls for FactoryTalk and Logix systems: open the right ports, not "any"

Why it so often ends up as "any-any"

A FactoryTalk system uses many Windows services that talk to each other: FactoryTalk Directory, Linx, Alarms and Events, Activation, plus DCOM with its dynamic port range. When a system is built without a list of flows, the quickest way to "make it work" is to open everything — and that rule stays in place for years. Rockwell wrote a dedicated set of Configuring Firewalls for… documents so customers can do the exact opposite: analyse the risk and open as few ports as possible through the firewall (FTSP-RM001A p. 5).

Zones first, rules second

Rockwell's security design guidelines (SECURE-RM001J) divide the plant according to the Converged Plantwide Ethernet model, applying ISA/IEC 62443 (pp. 16, 21–22):

• Cell/Area Zone (Level 0–2): controllers, I/O, drives, local HMIs; sits inside the Industrial Zone.
• Industrial Zone (Level 0–3): contains the Cell/Area Zones above plus Site Operations (Level 3) — where SCADA servers, historians, engineering workstations, FactoryTalk Directory and Active Directory are located.
• IDMZ: the buffer zone between the control network and the office network.
• Enterprise Zone (Level 4–5): office network, ERP.

The principles for the IDMZ (pp. 25–26): all traffic terminates in the IDMZ and no traffic passes straight through; the IDMZ is the only path between the two sides; EtherNet/IP control traffic stays within the Industrial Zone; data passes through application mirrors placed in the IDMZ; there must be a way to quickly cut the connection into the Industrial Zone; AD, DNS, DHCP and NTP are set up separately inside the Industrial Zone. Rockwell's example ACL ends with "Deny All Other Traffic" — blocking every remaining flow (p. 23).

From there, the right question is not "which ports do I open for FactoryTalk" but "which flows really have to pass through this firewall" — usually only a few flows between Level 3 and the IDMZ remain.

Commonly encountered ports

Taken from FTSP-RM001A (FactoryTalk Services Platform 6.40) and FTAC-RM001B (FactoryTalk AssetCentre 15.00):

Three points to keep in mind when using this table:

1. Dynamic ports cannot be avoided. DCOM and the 49152–65535 range are still needed between FactoryTalk computers; in Rockwell's testing, 51 dynamic ports were actually used (FTSP p. 27). Narrowing the range too far causes timeouts (p. 27) — so place FactoryTalk computers that talk to each other a lot in the same zone, rather than trying to punch holes in a firewall between them.
2. The list changes with the version. For example, 3061 exists only from 6.40, and diagnostic port 7147 from 6.21 (FTSP pp. 19, 23). Always use the document for the version actually installed; Rockwell's master list is the technote TCP/UDP Ports Used by Rockwell Automation Products (Knowledgebase 898270), referenced by SECURE-RM001J (p. 28).
3. The two documents do not fully agree — for example, FTAC-RM001B recommends disabling IPv6 because the product supports IPv4 only (p. 5), while FTSP-RM001A still lists TCPv6 ports (pp. 24–25); RSLinx port 2221 is listed as TCP in one document and UDP in the other. Where they conflict, test on the real system and record the result in the handover documentation.

Workstations and switches

SECURE-RM001J recommends removing unused applications, services and ports on workstations, managing computers through a domain, and installing and updating endpoint protection software (p. 41); for product versions in Preferred/Managed status, Rockwell notifies when a security patch affects the product (p. 40). For Stratix switches: port locking by MAC address, Layer 3 ACLs, VLAN separation, management over SSH/HTTPS/SNMPv3 (p. 29). Where a Layer 3 switch that is still on sale is needed, one option is the Stratix 5800 with Layer 3 firmware (1783-MMS10R, 1783-MMS10AR, 1783-MMS10ER, 1783-MMS10EAR) — with ACLs, NAT, static routing and OSPF/EIGRP/IS-IS dynamic routing — but Rockwell notes that NAT does not replace a firewall (1783-UM012N pp. 15–16, 142).

Recommended sequence

List each flow that is really needed (source, destination, port, reason) together with operations and IT; write rules per flow, ending with deny-all; test each function (trends, alarms, program download, activation) after applying the rules; hand over the rule list with the reasons, so the next change does not reopen "any". For remote access for technical support, see the secure remote access package.