This guide is for the OT Software Defined Networking (OT-SDN) solution. It comprises of a OT-SDN Controller and OpenFlow compatible switches.
APPLICABLE PRODUCTS
OT-SDN Controller HW (for example: ABD4003-SDN-CTRL)
OT-SDN Controller License Subscription (ABD-SDN-LIC-1Y-1)
Software Version 3.3.1-20260218.1
OT-SDN Switches (for example: ABD-SDN-SW-60208 or ABD-SDN-SW-60216)
Firmware Version E20251027
PRE-REQUISITES
In an Inband configuration the switches are directly connected to each-other and the management traffic (OpenFlow) between the Controller and the switches is passed through the first switch - like a chain.
Connect a PC to ETH0 so you can access the Web GUI.
Each switch will have a management port that needs to have access to the Controller via a daisy chain..
Example:
Switch 1 Port 1 is connected to the Controller,
Switch 1 Port 2 is connected to Switch 2 Port 1,
Switch 2 Port 2 is connected to Switch 3 Port 1,
Switch 3 Port 2 is connected to Switch 4 Port 1,
Switch 4 Port 2 is connected to Switch 1 Port 3,
In order to achieve a redundant network, you will have to connect Switch 1 to Switch 3, and Switch 2 to Switch 4.
Example:
Switch 1 Port 4 is connected to Switch 3 Port 3
Switch 2 Port 3 is connected to Switch 4 Port 3
Configure OT-SDN Controller
For Inband configuration you need to set the Controller Mode and you need to configure what switches to expect that will register with the controller.
Login to Controller
Connect to the OT-SDN Controller GUI by opening a browser and surfing to https://<ip-of-ethernet-1>/
Default IP: 192.168.200.10
Username: admin
Password: ??? (default: Veracity#1 )Configure Ethernet Ports
Navigate to Configurations -> Controller.
Here you can change the default IP and activate the other ethernet port.
It is recommended to activate the other ethernet port in order to have access to the Web GUI, as one port need to be connected to the switches
Configure for Inband
Go to Configurations -> Settings and scroll down to Inband Mode and enable it.
Then we add the switches.
Switches -> +Add Inband Switch
Give the switch a name, the IP address it has and the management port (the port that the switch uses to connect to the SDN Controller)
Configure OT-SDN Switches
The OT-SDN switches are configured initially through the Console port.
NOTE: Alternatively you can use a regular ethernet (IP), the default IP is printed on the side, and connect through SSH, however once connected inband to the controller you will loose capability to connect through the switch through SSH.
Open a tool that enables serial connection (Like Putty), connect the switch using either the Console port (COM) to your USB port. Make sure you have the right COM number, you can find it in “Device Manager” under Ports (COM & LPT) COM9 is used this example:
In PuTTY, mark Connection Type Serial, select the COM port and set Speed to 115200.
Once the console has appeared you will be asked to login.
CLI Commands
Use username: admin and password: admin to login.
SDN Inband
Enable
Conf t
ip address 192.168.200.20 255.255.255.0 #IP you want the switch to have
openflow controller ip 192.168.200.2 #IP of the SDN controllers ethernet port
openflow controller port 6653
openflow store-flow
openflow enable
openflow inband #To disable Inband type “no openflow inband”
copy run start
reboot
Other commands
erase startup-config #Clears all saved settings and return the switch to factory default
Configuring Traffic Policies
From this point on you control the switches and their policies through the OT-SDN Controller GUI only.
In this setup, connect to the OT-SDN Controller GUI by opening a browser and surfing to https://<ip-of-ethernet-1>/
There are 2 ways to add policies:
-
Add Traffic Rules manually - this is recommended to keep tight control of your deny-by-default traffic policies. To achieve this good preparation is recommended by mapping What device, shall initiate connection to What device on what UCP/TCP port (or with what other protocols like ICMP or L2 protocol). Each flow that will be initiated will require a rule to be allowed.
-
Using Learning Mode - In this mode the system can record all the flows that are initiated in the network. This can give a quick start to build policies, but policies should be reviewed in detail afterwards.
NOTE: This mode can add flows that are happing, but are undesired in the network. This can also add flows that are desired only in specific circumstances, like during maintenance mode. And finally this mode can miss flows that are required, in case they are not happing exactly during the learning period. For example automated update checks once a day.
Add Traffic Rules manually
On the left press “Policies” -> Rules (Top left) then +Add Rule (Top right), in the new window you will see this:
Policy: Where you want the rule to be
Directive: What you want the rule to do
Protocol: What protocol the rule should affect
Source: What the source is, this could be Any, Zone, the device or the type
Destination: What the source is, same options as above
Bottom field: Describes what the rule does
Example:
Learning Mode
Top right you will see “Mode” and under that “Operational” click it and more options will appear, click “Learning Mode”, a new window pops up, click “Enable” and the Controller will now be in “Learning Mode”
The Controller will now automatically add rules depending on the traffic in the SDN network.
To see the automatically added rules, on the left press “Policies” -> Rules (Top left).
Under the policy column you will see "Learned Rules", these are are the rules that has been added by "Learning Mode"