Network and security
Zones and conduits (IEC 62443), firewall rules, every network flow, certificates and time.
Zones and conduits
The edge PC sits alone in a new diagnostics zone, on its own VLAN or firewall segment, at security level target SL 1 (IEC 62443-3-3).
| Conduit | Between | Carries |
|---|---|---|
| C1 | Diagnostics → control zone | Read operations only, opened by the edge PC. Nothing in the control zone needs to reach the edge PC |
| C2 | Plant office → diagnostics | The Web UI over HTTPS only |
| C3 | Diagnostics → site services | Directory (LDAPS), time source, backup storage, and in the hybrid profile the approved model endpoint |
A site that cannot approve C1 yet starts in the offline-import profile: no C1 at all.
Firewall rules
All rules are allow rules on the conduit firewall; everything else is denied.
| Rule | From | To | Port | Profiles |
|---|---|---|---|---|
| R1 | Edge | Each PLC or OPC UA server | 4840/TCP | production, hybrid |
| R2 | Edge | Each Modbus device | 502/TCP | production, hybrid, where used |
| R3 | Edge | Site historian database | its SQL port | production, hybrid, where used |
| R4 | Office clients | Edge | 443/TCP | all |
| R5 | Edge | Site directory | 636/TCP | all, where used |
| R6 | Edge | Site time source | 123/UDP | all |
| R7 | Edge | Backup share | SMB 445/TCP or NFS 2049/TCP | all |
| R8 | Edge | The approved model endpoint only | 443/TCP | hybrid only |
| — | Edge | Internet | any | Denied in production and offline import |
| — | Control zone | Edge | any | Denied in every profile |
Open the ports of the other connectors (F15–F20 below) only where the site uses them.
Network flows
| # | From → To | Port | Purpose |
|---|---|---|---|
| F1 | Edge (ingest) → PLC or OPC UA server | 4840/TCP, Sign or SignAndEncrypt | Read, Browse and Subscribe only |
| F2 | Edge (ingest) → Modbus TCP server | 502/TCP | Read function codes 1–4 only |
| F3 | Edge (assistant) → site historian database | its SQL port, TLS | SELECT in read-only transactions |
| F4 | Edge → site directory | 636/TCP LDAPS | Sign-in, if configured |
| F5 | Edge → time source | 123/UDP SNTP | Clock offset check |
| F6 | Office clients → Edge | 443/TCP HTTPS | The Web UI |
| F7 | Edge → approved model endpoint | 443/TCP HTTPS | Hybrid only: the question, conversation and cited excerpts |
| F8 | Edge → local speech-to-text server | HTTP on the plant network | Voice questions, if enabled |
| F9 | Edge (backup) → backup share | SMB or NFS | Daily backup |
| F10 | Site tools and MCP clients → Edge integration API | 443/TCP HTTPS, GET only | Only if integration accounts exist; off by default |
| F11 | Standby → primary store | 5432/TCP on the HA link | High availability only |
| F12 | Standby agent ↔ primary agent | 8099/TCP on the HA link, GET only | High availability only |
| F13 | Site collector → client's receiver | 443 or 8443/TCP HTTPS | Client cloud only; outbound only |
| F14 | Remote support engineer → Edge Web UI, over the site's VPN or jump host | 443/TCP HTTPS | Only while an administrator has a support window open (at most 4 hours); off unless config/remote_support.json exists. See Remote support |
| F15 | Edge (ingest) → MQTT broker | 1883/TCP, or 8883/TCP with TLS | Sparkplug B, subscribe only |
| F16 | Edge (ingest) → BACnet/IP device | 47808/UDP | Read services only |
| F17 | Edge (ingest) → SNMPv3 agent | 161/UDP authPriv | GET only |
| F18 | Edge (ingest) → DNP3 outstation | 20000/TCP | READ and CONFIRM only |
| F19 | Edge (ingest) → IEC 61850 server | 102/TCP MMS | Read and directory services only |
| F20 | Edge (cmms) → SAP PM, Maximo or a SQL view | 443/TCP, or the database port with TLS | Work orders through a read-only account |
No flow carries telemetry, licence checks or update checks: the licence is checked on the edge PC alone (see Licence).
Certificates
| What | Where |
|---|---|
| Web UI TLS certificate | deploy/config/tls/cert.pem and key.pem, from the site CA. make up makes a self-signed one until then |
| OPC UA application certificate and server trust list | opcua: in site.yaml: see Data sources and connectors |
| Directory CA | The edge PC's system trust store (LDAPS only) |
| Release signing key | /config/release-key.pub |
Time
Point BOOLE_TIME_SOURCE at the site time server. The edge PC reads its clock offset by SNTP (it never sets a clock); above 100 ms a platform alarm is raised, because the sequence of events depends on timestamps. Keep the PLCs and OPC UA servers on the same time source.
IEC 62443-3-3 SL 1
The release evidence pack maps each SL 1 system requirement to the BooleX control that meets it: named accounts and roles, the failed sign-in limit, HTTPS, the append-only audit log, read-only adapters, least-privilege database roles, signed updates, backups, and the secure-by-default configuration. See also Security support.