This guide is for the OT Software Defined Networking (OT-SDN) solution. It comprises of a OT-SDN Controller and OpenFlow compatible switches.

APPLICABLE PRODUCTS

OT-SDN Controller HW (for example: ABD4003-SDN-CTRL)

OT-SDN Controller License Subscription (ABD-SDN-LIC-1Y-1)

Software Version 3.3.1-20260218.1

OT-SDN Switches (for example: ABD-SDN-SW-60208 or ABD-SDN-SW-60216)

Firmware Version E20251027

OT-SDN Quick Start Guide

How to Get Started with SDN

This guide explains the basic steps required to configure and operate an OT-SDN network.

Before starting, verify that:

The SDN controller is powered on and accessible.
The SDN switches are powered on and connected.

In-Band Configuration

In-band management uses the same network for management traffic and normal device traffic.

Advantages:

Requires fewer physical interfaces.
Requires less additional cabling.
Can be simpler for small installations.

Considerations:

Management access depends on the operational network.
Incorrect rules may block access to the controller or switches.
Management traffic must be explicitly permitted.
Network failures may also interrupt management access.

When using in-band management:

Assign management IP addresses to the controller and switches.
Configure the correct VLAN, subnet and gateway settings.
Create rules that permit management communication.
Restrict management access to authorized computers.
Test controller and switch access before applying restrictive rules.
Keep a recovery method available.

Configure OT-SDN Controller

In an Inband configuration the switches are directly connected to each-other and the management traffic (OpenFlow) between the Controller and the switches is passed through the first switch - like a chain.

Connect a PC to ENP1 so you can access the Web GUI.

Each switch will have a management port that needs to have access to the Controller via a daisy chain..

Example:

Switch 1 Port 1 is connected to the Controller,

Switch 1 Port 2 is connected to Switch 2 Port 1,

Switch 2 Port 2 is connected to Switch 3 Port 1,

Switch 3 Port 2 is connected to Switch 4 Port 1,

Switch 4 Port 2 is connected to Switch 1 Port 3,

In order to achieve a redundant network, you will have to connect Switch 1 to Switch 3, and Switch 2 to Switch 4.

Example:

Switch 1 Port 4 is connected to Switch 3 Port 3

Switch 2 Port 3 is connected to Switch 4 Port 3

For Inband configuration you need to set the Controller Mode and you need to configure what switches to expect that will register with the controller.

Login to Controller

Connect to the OT-SDN Controller GUI by opening a browser and surfing to https://<ip-of-ethernet-1>/

Default IP:         192.168.200.2
Username:           admin
Default Password:   Veracity#1

Add Users and change Password

Navigate to Configurations -> Users.

To change password press the Key icon under Actions.

To add new users press +Add User

In role you can choose what the user is allowed to do on the controller.

Configure Ethernet Ports

Navigate to Configurations -> Controller.

Here you can change the default IP and activate the other ethernet port.

It is recommended to activate the other ethernet port to have access to the Web GUI, as the first port needs to be connected to the switches.

Configure for Inband

Go to Configurations -> Settings and scroll down to Inband Mode and enable it and Supplemental Configuration.

Then we add the switches.

Switches -> +Add Inband Switch

Give the switch a name, the IP address it has and the management port (the port that the switch uses to connect to the SDN Controller)

Disable Supplemental Configuration after you have added all switches, after a while the switches will become operational.

Configure OT-SDN Switches

The OT-SDN switches are configured initially through the Console port.

NOTE: Alternatively you can use a regular ethernet (IP), the default IP is printed on the side, and connect through SSH, however once connected inband to the controller you will loose capability to connect through the switch through SSH.

Open a tool that enables serial connection (Like Putty), connect the switch using the Console port (COM) to your USB port. Make sure you have the right COM number, you can find it in “Device Manager” under Ports (COM & LPT) COM9 is used this example:

In PuTTY, mark Connection Type Serial, select the COM port and set Speed to 115200.

Once the console has appeared you will be asked to login.

CLI Commands

Use username: admin and password: admin to login.

SDN Inband

Enable
Conf t
ip address 192.168.20.12 255.255.255.0 #IP you want the switch to have
openflow controller ip 192.168.20.2 #IP of the SDN controllers ethernet port
openflow controller port 6653
openflow store-flow
openflow enable
openflow inband #To disable Inband type “no openflow inband”
copy run start
reboot

When successful all switches will turn green and be marked Operational in the "Switches" view in the OT-Controller web interface.

Other commands

erase startup-config #Clears all saved settings and return the switch to factory default

Learning Mode

Learning Mode allows the controller to observe network traffic and identify connected devices and communication flows. In learning mode traffic security rules will be disabled, you can connect any device and talk any protocol - the switches function like a normal open switch.

Use Learning Mode when:

Installing a new network.
Adding new switches.
Identifying required communication between devices.
Creating an initial rule set.

Recommended procedure:

Enable Learning Mode.
Allow the network to operate normally.
Ensure that all expected devices communicate during the learning period.
Review the detected devices and communication flows.
Remove unexpected or unnecessary communication.
Disable Learning Mode.

Do not leave Learning Mode enabled permanently. Traffic that did not occur during the learning period may not be included in the generated rules.

Adding Devices and Rules Manually

Devices can be added manually when automatic discovery or Learning Mode is not suitable.

Go to Devices in the left sidebar.

When adding a device, specify the required information, such as:

Device name.
MAC address.
VLAN Type. (If applicable, normally leave Untagged)

And the optional information:

IP Address. (will be detected)
Device Type.
Zone.
Multicast Group.
Any additional information can be added in Notes.

Adding Rules

After adding the devices, create rules that define which devices may communicate.

There are two ways you can manually add rules.

First way:

Go to Policies in the left sidebar, then Rules at the top.

A rule normally includes:

Add to an existing Policy or create a new Policy.
Directive: Allow, Monitor or Block.
Protocol.
Source/Destination: Can be Zone, Device, Type.

Second way:

Click one device and ctrl click another, you will see a blue dotted line connect them.

In the right sidebar you will see information about the two devices, including Traffic Rules and Allowed Traffic.

Click the + besides Traffic Rules to bring up the same Add Rule window shown above, this time with the Source and Destination already pre-selected.

Note: The first device selected will be the Destination and the second device selected will be the Source.

Use the principle of least privilege. Only allow the communication required for normal operation.

Broadcast Members

Broadcast Members define which devices or switch ports are allowed to receive broadcast traffic.

Broadcast traffic may be required for:

Address resolution.
Device discovery.
Network configuration services.
Legacy industrial communication.
Other Layer 2 services.

To configure Broadcast Members:

Go to Devices in the left sidebar.
Press the “Edit Device” button.
Press “Enable Multicast Group” and assign a number, then add the relevant devices to the broadcast group.
Limit the group to only the required members.
Save the configuration.
Test the required broadcast-dependent functions.

Avoid forwarding broadcasts to every network port unless it is required. Limiting broadcast members reduces unnecessary traffic and improves network segmentation.

Controller and Switch Upgrade

Keep the controller and switches on supported and compatible software versions.

Before upgrading:

Review the release notes.
Verify controller and switch compatibility.
Back up the current configuration.
Record the current firmware versions.
Confirm that the upgrade file is intended for the correct product model.
Plan a maintenance window.
Ensure stable power during the upgrade.

Recommended upgrade order:

Back up the controller configuration.
Upgrade the controller if required.
Confirm that the controller starts correctly.
Upgrade the switches one at a time.
Confirm that each switch reconnects to the controller.
Verify device communication and rules.
Check alarms, logs and monitoring data.

Do not disconnect power or network connectivity during an upgrade.

Monitor Functionality

The monitoring functions provides the possibility to mirror specific flow from anywhere in the SDN network towards a connected device.

Recommended monitoring procedure:

Connect a device where you want to receive monitor traffic. For instance a machine running Wireshark on a promiscuous interface.
Go to Configuration -> Settings and Redirection MAC will be the first option.
Write the MAC address of the chosen interface.
You can now use Wireshark on that interface and get the mirrored traffic.

Regular monitoring helps identify disconnected devices, incorrect rules, network loops, unexpected traffic and communication failures.

To mirror any traffic you change the rule from Allow to Monitor - as in the example below:

NOTE: Be careful not to overflow the amount of traffic send to the monitoring port.

Adding custom protocols

Go to Configuration -> Protocol -> Add Protocol

Give it a name then press + beneath Protocol Definition.

Here you can choose Ether type, Ether Hex, IP Proto, IP Proto Custom and Port.

After you are done press Save and you can now choose the new protocol in Policies -> Rules.