CIP Security - Cell Firewalls

[aavnet89]

Rockwell's FactoryTalk services (Platform, Networking Manager, View Software, Policy Manager, System Services) as a product group achieve device authentication, data integrity and data confidentiality, by means of certification, cryptographic protocols, HMAC and data encryption. For those of you that are in the space already, or have working experience with Industrial Network devices, what scenario / use-case would require a Cell / Area based Industrial Firewall (Cisco in this case), given (from my understanding) that the Firewalls are stateless, and act as a whitelist / ACL filter in essence, which similarly, Rockwell's FactoryTalk architecture is able to deliver? Defense in-depth is always a consideration, with overlapping security layers, I am curious to hear of real world use cases.

My thoughts;

- Supplicant / endpoint / cell requires additional routing to an SSL / TLS proxy for Cloud based communications?
- Additional micro-segmentation, off-loading / dropping packets at the cell border, rather than traffic hitting a distribution switch, network manager and identity services?
- Where a Cell / Zone is larger, with it's own Network Services internal to the Cell?

Many thanks

[ahollifield]

Not really sure what you are asking here?  Maybe its my ignorance of industrial networking requirements.  https://community.cisco.com/t5/security-documents/how-to-ask-the-community-for-help/ta-p/3704356

[aavnet89]

Thanks for replying.

My questions is; - if a top level Firewall / Security Appliance (Rockwell in this scenario) has the ability to encrypt data, provide traditional, Certificate verification, segmentation, ACLs etc. what purpose is a Firewall at Levels 0-2 of the Purdue / Converged Ethernet models? Which by design is downstream of the Level 3 Firewall.

[ahollifield · Accepted solution]

Your question would probably be better answered here: https://community.cisco.com/t5/internet-of-things-iot/ct-p/iot

[aavnet89]

Thanks, I have moved my post.