FireSight OT OT remote access

Switch settings for Cloud Connectors (VLANs, mirror port)

For installers: what to set on the plant switch. Machine VLANs and the mirror port for Detect are new in FireSight OT 0.4.0 (in beta).

The Cloud Connector is an end device, like a PC: it never bridges ports or VLANs and never sends spanning-tree frames, so it takes no part in spanning tree. The settings are on the plant switch.

The Cloud Connector's machine port

• Edge port (PortFast) with BPDU Guard on. Root Guard isn't needed (it's for ports facing other switches).
• With machine VLANs: make it a trunk:
  • native (untagged) VLAN = the VLAN of the Cloud Connector's main machine network (the address under Device network → Machine network). Out of the box most switches use VLAN 1.
  • tagged / allowed VLANs = only the VLANs added on the Cloud Connector (10, 20…), with the same IDs.
  • Never also tag the native VLAN (the same network would arrive twice).
  • VLANs only, no untagged network: set the Cloud Connector's machine network to Off and the port's native VLAN to an unused one (also good practice: don't leave VLAN 1 as native).

Example (VLANs 10 and 20, main machine network in VLAN 100):

The mirror port (Detect)

Set the switch port the Cloud Connector's listening port plugs into as a mirror (SPAN) destination, copying the machine ports or the uplink to the PLCs. Where the switch is unmanaged, use a passive network tap in the cable instead. Never put the Cloud Connector in line between the switch and the machines.

Time zones

The Cloud Connector doesn't need a time zone. NTP always carries UTC; each machine applies its own time zone and daylight saving (on some older PLCs: the UTC offset in the PLC's settings). The console shows times in each viewer's local time.

See also Detect: threat detection and Install and upgrade FireSight OT (section 3.4).