Siemens SENTRON 7KN POWERCENTER 3000 Manual page 96

Application examples
6.1 Network environments
① 7KN Powercenter 3000 is connected to a router via the external Ethernet interface X1P1. This router, e.g.
SCALANCE XM408-4C, represents the intranet.
② If access via wireless LAN (WLAN, WiFi) is enabled, e.g. for SENTRON powerconfig, this WLAN should only be used
for this purpose and be accessible to a restricted range of nodes.
③ Multiple web user interfaces can be operated on the external Ethernet interface of the 7KN Powercenter 3000.
Because the behavior and the setup of the 7KN Powercenter 3000 are accessible via a web user interface, protec-
tion via an IP filter is offered here, too. On no account must the web user interface of the 7KN Powercenter 3000 be
accessible from the Internet without protection. The web user interface of the external interface can be restricted to
pure display functions by web server write protection.
④ SENTRON powermanager, Energy Manager PRO and many third-party applications, e.g. SCADA systems, today
communicate with SENTRON devices in the intranet via Modbus TCP and will continue to do so. These applications
can still be used and expanded with the 7KN Powercenter 3000. Communication via the Modbus TCP gateway
should only be permitted to nodes whose IP address/address range is entered in the IP filter (= Firewall Whitelist).
⑤ Communication with MindSphere is established by the 7KN Powercenter 3000. The target address is taken from the
onboarding key of MindSphere. Connection to port 443 for the https communication protocol is enabled by default
in most firewalls. Because of the https protocol, the data stream is encrypted and cannot therefore be decoded by
third parties.
⑥ With powermind, SENTRON offers a MindSphere application for full transparency in low-voltage power distribution,
which is supported by 7KN Powercenter 3000 ≥ V1.1 in a special way.
⑦ Both a private email server in the intranet and a public email server in the Internet can be used.
⑧ Communication by means of MQTT with a defined cloud is established by the 7KN Powercenter 3000. Port 8883
must be enabled in the network infrastructure / firewall.
⑨ The 7KN Powercenter 3000 can communicate with partners in the Internet. In particular, activation of the write
protection for the web user interface is advisable.
⑩ Alongside all other communication paths, access for an optional powerconfig makes sense as long as the security
risks are within reason. In this case, too, the IP filter with the Firewall Whitelist is recommended.
94
7KN POWERCENTER 3000
Equipment Manual, 07/2020, L1V30579222003-03