Professional Documents
Culture Documents
3620 DS 20180803
3620 DS 20180803
Gateway
➤ Ease of Use. Simplify configuration and maintenance with a secure web interface that allows for convenient setup
and management.
➤ Reliability. Rely on the SEL-3620, built for availability, hardened for the substation, and backed by a 10-year
warranty.
➤ Ethernet Port Bridge. Support a reliable Ethernet ring topology.
➤ Encrypted Terminal Communications. Securely communicate with IEDs via Secure Shell (SSH)-encrypted
terminal programs.
➤ 5 V Pin One Power on Serial Ports. Directly power 5 V devices from the serial ports.
➤ Bit-Based Conversion. Transform Conitel and other bit-based protocols to Ethernet and reduce reliance on
expensive analog circuits.
➤ Service Port. Automate base-lining of the device settings with a basic command-line interface.
Functional Overview
The SEL-3620 is a router, VPN endpoint, and firewall An integrated stateful, deny-by-default firewall prevents
device that can perform security proxy services to serial unauthorized communications from entering or exiting
and Ethernet-based IEDs. The SEL-3620 is an access the protected network. The SEL-3620 filters incoming
control solution for control systems environments with and outgoing TCP, UDP, ICMP, AH, and ESP communi-
both Ethernet and serial communications. The SEL-3620 cations based on a user-configurable set of rules.
filters all incoming and outgoing traffic with a deny-by-
default stateful firewall that only allows authorized traf-
fic. IPsec VPNs protect all site-to-site communications. Trusted
Network
Trusted Trusted
Network Network
SEL-3620
SEL-3620
!
SEL-3620
peers, and directory servers relies on X.509 certificates.
The Online Certificate Status Protocol (OCSP) verifies
the legitimacy of any certificates the SEL-3620 receives.
Applications
The SEL-3620 is ideally suited for electronic access
point routing, message encryption, packet authentication,
Secure Communications Over
and user authentication. The authorization and serial Untrusted Networks
capabilities of the SEL-3620 provide a strong solution
for user-based access to legacy IEDs that have shared The SEL-3620 secures all communication by establish-
user accounts. ing IPsec VPN tunnels with other SEL-3620 gateways
and IPsec-enabled devices.
Point-to-Point Serial Over The SEL-3620 supports IPsec and SSH for encrypted
and authenticated communications. This provides an
Ethernet Network easy transition from existing costly analog serial lines to
Ethernet transport networks without having to upgrade
Figure 6 shows the SEL-3620 in a point-to-point applica- remote terminal units (RTU) or communication front
tion in which bit- and byte-based serial devices can com- ends (CFE).
municate with each other across an Ethernet network.
SEL-3620 SEL-3620
SEL-3530
SEL-3373
SEL-734
SEL-351
SEL-734
SEL-351 SEL-351
SEL-2411
SEL-351 SEL-2407
SEL-3620
SEL-3620
SEL-2411
SEL-351
Functional Description
Cryptographic Message Protection Security associations are shared pieces of information
that we can use to secure communications channels. An
IPsec VPN initiation requires that three tasks be per- SA includes the encryption and authentication algo-
formed: the two peers must authenticate each other, the rithms the channel uses along with their respective keys.
IKE security associations (SAs) must be established, and An Internet Key Exchange (IKE) SA defines the secure
the IPsec SAs must be established. Upon establishment channel on which IPsec SA negotiation takes place. An
of the IPsec SAs, the SEL-3620 transmits all messages IPsec SA defines the communications parameters that
that route through this “tunnel” within an Encapsulating will be in use for communication across a VPN. The
Security Payload. The SEL-3620 performs all of these SEL-3620 contains preconfigured settings in “Profiles”
steps when it connects to any peer IPsec-enabled device. to simplify connecting to non-SEL devices.
1. Authenticate Peers
2. Establish IKE SA
3. Establish IPsec SA
SEL-3620 SEL-3620
4. Encrypt Messages
Encryption ensures that communications are confidential the payload. This prevents the possibility of information
and only readable by authorized parties. The SEL-3620 leakage about the structure of your protected networks.
uses the IPsec Encapsulating Security Protocol to protect The hardware-accelerated encryption algorithms the
the entire original packet, including both the header and SEL-3620 supports are AES, 3DES, and Blowfish.
Provide access
Request credentials
Provide credentials
Verify credentials
Credentials verified
and authorization
Successful
authentication
Request IED access
Connect to communications
processor
Connect to IED
Maintaining logs of user activity is very important for record of as many as 60,000 event logs in nonvolatile
auditing purposes. The SEL-3620 monitors all user activ- memory, and it generates, stores, and forwards syslog
ity and logs each session to a locally stored file. At the messages to multiple destinations.
same time, the SEL-3620 generates syslog messages,
indicating the start of a session and the end of a session,
to alert that activity has taken place. Users with appropri- SNMP
ate privileges can export the user log files for later exam-
ination as necessary. Simple Network Management Protocol (SNMP) support
on the SEL-3620 allows administrators to query some
state information from the device, as well as to receive
Password Management notifications (traps) for events that indicate a device
integrity fault, such as SELinux audit messages, and
The SEL-3620 manages the passwords for all managed whitelist integrity failures. The Management Information
devices. It maintains an internal list of all the managed Base (MIB) provides information about data and traps
devices, their current states, their initial passwords, their available via SNMP. The MIB can be downloaded as a
currently used passwords, and their proposed passwords. zip file from the SEL-3620 from the SNMP Settings
Password change cycles are broken into three steps: page on the web management interface.
Step 1. Password generation creates a new list of pro-
posed passwords for all selected managed
devices. Firewall
Step 2. Report generation and download creates and To protect your private network from malicious traffic,
stores a list of all the currently used and pro- the stateful firewall in the SEL-3620 denies all traffic by
posed passwords for all managed devices. default. Explicitly identifying traffic that the SEL-3620
Step 3. Password application changes the passwords of permits makes it far less likely that the SEL-3620 will
all managed device accounts/access levels overlook specific types of traffic.
which have proposed passwords.
The web interface provides a manual method to perform Secure Management
these tasks as needed. The master port self-controller
provides a method to easily script these steps for auto- Configuration of the SEL-3620 occurs through a secure
mated systems, such as TEAM Security. The flexibility web management interface that uses HTTPS incorporat-
of the web interface provides a means to enable or dis- ing transport layer security (TLS). Mutual authentication
able managed devices so they are not included in bulk takes place before a secure web management session
operations, as well as the ability to select which devices opens. The device uses an X.509 server-side certificate to
to generate passwords for. Finally, the web interface pro- authenticate to the user, and the user uses a username and
vides the ability to set persistent and shared passwords password to authenticate to the device. The SEL-3620
that are never changed as part of a bulk operation. then restricts users to actions for which they have autho-
rization through their account assignments. There are
two roles: administrator and technician. The technician
Multiple Access Methods may perform any task on the SEL-3620 except create or
edit user accounts, modify date/time settings, or reset,
Users have multiple methods of accessing IEDs to halt, or restart the device. Administrators may perform
provide flexibility for various types of software. SSH and any action on the SEL-3620, including creating and edit-
Telnet provide a command line interface to protected ing all accounts on the box.
devices through the SEL-3620. You can also map
specific TCP and UDP ports to physical serial ports. Web management provides simple-to-use graphic config-
uration pages that display the gateway configuration
through network diagrams. You can use this to confirm
Syslog that all configurations are as you intend. The web inter-
face supplies you a single place from which you can
The SEL-3620 uses the syslog format to log events. retrieve all communications channel information and net-
These logs contain several fields that indicate event work diagrams associated with the SEL-3620. The
severity, event origin, the type of event that occurred, and device also features a basic command-line interface Ser-
details regarding the cause of the event. Additionally, the vice Port that allows for the automation of configuration
event message contains such event tracking information base-lining. The Service Port is read-only and requires
as the entity that triggered the event and the time and administrative credentials to access.
date of the event. The SEL-3620 maintains an internal
i4468e
Panel Mount
i4467f
Copper Ethernet
IRIG–B IN GND
IRIG-B COM 17
A09
SHIELD
OUT
IN101 OUT101 POWER
+TX
–T X
+RX
–RX
ETH 1 ETH 2 COM 9 COM 10 COM 11 COM 12 COM 13 COM 14 COM 15 COM 16 + — + —
190-2997-01
OUT COM 1 COM 2 COM 3 COM 4 COM 5 COM 6 COM 7 COM 8
i4731c
Fiber Ethernet
IRIG–B IN
IRIG-B COM 17 GND
SHIELD
OUT A09
+TX
–T X
+RX
–RX
IN101 OUT101 POWER
ETH 1 ETH 2 COM 9 COM 10 COM 11 COM 12 COM 13 COM 14 COM 15 COM 16 + —
+ —
190-2997-01
OUT COM 1 COM 2 COM 3 COM 4 COM 5 COM 6 COM 7 COM 8
i4732c
Mixed Ethernet
IRIG–B IN
IRIG-B COM 17 GND
SHIELD
OUT A09
+TX
–T X
+RX
–RX
IN101 OUT101 POWER
ETH 1 ETH 2 COM 9 COM 10 COM 11 COM 12 COM 13 COM 14 COM 15 COM 16 + —
+ —
190-2997-01
OUT COM 1 COM 2 COM 3 COM 4 COM 5 COM 6 COM 7 COM 8
i4985a
Specifications
Syslog
Compliance
Telnet
Designed and manufactured under an ISO 9001 certified quality
management system Transmission Control Protocol (TCP)
Networking VLAN
Maximum number of VLANs
Web Management per physical interface:
Protection Protocols: HTTPS, TLSv1.1, TLSv1.2 4
Demodulated IRIG-B000 Even Parity (BNC and Serial) Rated Supply Voltage: 125–250 Vdc; 110–240 Vac, 50/60 Hz
48–125 Vdc; 120 Vac, 50/60 Hz
On (1) State: Voh 2.4 V 24–48 Vdc
Off (0) State: Vol 0.8 V Input Voltage Range: 85–300 Vdc or 85–264 Vac
38.4–137.5 Vdc or 88–132 Vac,
Load: 50 18–60 Vdc polarity dependent
Output Drive Levels Power Consumption
Demodulated IRIG-B: TTL 120 mA, 3.5 Vdc, 25 AC: < 40 VA
Serial Port: TTL 2.5 mA, 2.4 Vdc, 1 k DC: < 30 Watts
Network Time Protocol (Ethernet) Input Voltage Interruptions
Accuracy: 250 µs (ideal on LAN) 20 ms @ 24 Vdc
20 ms @ 48 Vdc
Communications Ports 50 ms @ 125 Vac/Vdc
Ethernet Ports 100 ms @ 250 Vac/Vdc
Safety
Dielectric Strength: IEC 60255-5:2000
2500 Vac on contact inputs and contact
outputs, 1 min
3100 Vdc on power supply, 1 min
IEEE C37.90-2005
2500 Vac on contact inputs and contact
outputs, 1 min
3100 Vdc on power supply, 1 min
Impulse: IEC 60255-5:2000, 0.5 Joule
5 kV
IEEE C37.90-2005, 0.5 Joule
5 kV
IP Code: IEC 60529:2001 + CRGD:2003
IP20
Notes
*PDS3620-01*
This product is covered by the standard SEL 10-year warranty. For warranty details, visit
selinc.com or contact your customer service representative.