This article explains how to connect Anybus Defender to Talk2M directly, in order to provide remote access capabilities via eCatcher. To achieve this a Talk2M software agent needs to be purchased, this agent works with FlexEdge and Anybus Defender. Article #: DAA00AC1LIT2M000 

After purchasing this agent and provisioning it to a Talk2M account - you will find "Software Agents" among the list of Ewons in eCatcher. From here the setup starts:

Talk2M OpenVPN Client Setup

Step 1. Retrieve the Software Agent's Serial Number

Once the order has been processed, the device will appear in eCatcher.

1. Select the specific device you want to provision.

   

2. Click Properties.
3. Copy the serial number shown in the first field.

The serial number should have the following format:

xxxx-xxxx-xx

2. Create the CSR on Anybus Defender

In the Anybus Defender GUI:

Go to System -> Certificate Manager -> Certificates, and press +Add/Sign.

Method:           Create a Certificate Signing Request
Descriptive name: Talk2M-Manual
Key type:         RSA 4096
Common Name:      Dxxxx-xxxx-xx #This is the serial number from above. OBS must start with D.

Save.

3. Send in the CSR file to HMS Support

The CSR created must now be send to HMS in order to create a specific certificate. 

On the certificate screen press the Export Request (Between the pencil and key)

It will download a file with extension .req.

Go to https://support.hms-networks.com and submit a support request using Ewon as the product brand, and Talk2m as the product group.

Please include your Talk2m account number as well as the .req file.

You will get the Certificate file by email, simply extract it somewhere safe.

4. Import the Certificate Authority

Now it's time to import the received certificate files in Anybus Defender.

Open the .ovpn file you got in the email by right clicking and choosing Edit in Notepad.

Go to:

System → Certificate Manager → CAs

Click Add and configure the following:

• Method: Import an existing Certificate Authority
• Certificate data: Paste the CA certificate, including the beginning and ending lines:

-----BEGIN CERTIFICATE-----
Certificate data
-----END CERTIFICATE-----

Click Save.

5. Update the Client Certificate

Go to:

System → Certificate Manager → Certificates

Press Update CSR on the Talk2M-Manual (the pencil).

Open the .cert file you got in the email by right clicking and choosing Edit in Notepad.

Copy everything:

-----BEGIN CERTIFICATE-----
Certificate data
-----END CERTIFICATE-----

And then Paste it in Final certificate data

Click Update.

6. Configure the OpenVPN Client

Go to:

VPN → OpenVPN → Clients

Create a new client using the following settings:

Click Save and apply the changes if prompted.

7. Configure Firewall Rules

You will have to configure access rules in the Defender to allow traffic through. By default all will be denied, on the standard OpenVPN TAB in Firewall Rules you can add a general allow all rule.

NOTE: All traffic will pass through, you SHOULD implemented firewall rules in Talk2M eCatcher with this setting. Alternatively you can add specific firewall rules in Defender. The benefit of this is that local logging can be enabled - check optional septs C below for instructions. 

To configure open access:

Firewall -> Rules, TAP: "OpenVPN". 

Add a rule: Protocol: Any, Source: Any, Destination, Any

The result will look like this:

To configure security you must implement firewall rules in eCatcher instead. Here is an example on how to allow HTTPS management traffic to a local Switch with IP 192.168.200.203:

8. Verify the Connection

You are now ready to connect!

Go to:

Status → OpenVPN

Confirm that the OpenVPN client shows as connected.

Return to eCatcher. You should now be able to connect to the device by selecting it and clicking the green Connect button.

Validate to connect to the specific hosts and services connected.

Optional Extra Steps

To improve the usability and security of service it is advised to go through the below steps as well. 

A. Rename Agent in eCatcher

In eCatcher you can rename the name and description of the agent to match the Defender you just connected. 

Select the software agent you want to change name on and press Properties.

Select Modify in the first block:

Change the name and optionally the description:

B. Configure Outbound NAT

By default the Anybus Defender functions as a router, meaning that when packets come from the VPN interface towards the LAN interface, they will remain their original source IP addresses. This means that devices on the LAN side must have the Anybus Defender LAN interface set as their default gateway, otherwise return packets will not find their way. 

To mitigate this Outbound NAT can be configured on the Defender so that it translates the Source IP for each packet going out of the LAN interface to it's own - so that each device can return packets to the Defender interface directly. 

To configure this in the Anybus Defender, go to: Firewall -> NAT and then TAB: Outbound.

Select mode Hybrid Outbound NAT rule generation, Save and Apply.

And then Add a custom mapping, press green Add button. 

And mark the LAN interface and keep the rest default:

The result looks like this:

Packets going out on LAN will now have the Defender's LAN Interface address as Source IP, and translations are made automatically. 

C. Configure Firewall Rules in Defender

In order to configure specific rules it's advices to first configure the VPN connection as a specific interface on the Defender. 

Interfaces -> Assignments

Look for the Talk2M interface in the drop down box, select it and Add

After adding, select the interface name (blue text on the left)

Check "Enable Interface" and change description to "Talk2M"

Save -> Apply Changes

Then go to Firewall -> Rules, and select TAB called TALK2M.

To be able to connect to the Web-interface via eCatcher, it is recommended to add a rule: From All, to Firewall (Self) with TCP port HTTPS:

In order to reach a Switch on the network via the Talk2M connection, add a specific rule:

NOTE: Log packets is enabled and will result in creation of local log entries in Defender, that will be forwarded to Syslog if enabled. 

In order to allow Ping to the network devices via the Talk2M connection, add the following rule.

NOTE:

• The certificate you will receive from Talk2M support will have a validity of 7 years. Before it expires you are advised to renew the certificate with the same process. 
• The Connection Type in eCatcher must remain "Permanent". "Triggered" is not supported. 
• Firmware upgrade is not managed via eCatcher, but instead in each individual Defender.