First year here and I'm still finding out what we've got, because almost none of it is written down. Management want to see the line 2 HMI from home, mostly production counts and alarms. It's a PanelView Plus 7 on a CompactLogix 5380, one unmanaged switch, and the plant network sits on its own range behind a firewall IT look after.
So I asked IT to forward the VNC port on the terminal and got a flat no, and no to 3389 to the engineering PC either, with nothing beyond "not happening". Someone on my shift said TeamViewer, so I tried the free one for an hour and IT saw it and blocked it the same day. They won't hear of anything coming in.
Is a port forward really that bad if its only a viewer? Or any ideas for a way of doing this that IT would actually say yes to, because I'd rather not go back with the same ask twice?
Yes, it's that bad. A forwarded VNC port on a terminal is on Shodan inside a week, and the terminal has no lockout. IT were right and short with you, both.
What does the plant firewall allow outbound? Anything at all on 443?
Outbound 443 is open, that's how the engineering PC gets its updates. Nothing else that I know of. So if the box inside calls out that's allowed, and nothing calling in is. Might be something to work with there.
Outbound is the shape of the answer, and nothing inbound. A small VPN router on the machine network that dials out on 443 to a hosted service, eWON Cosy, Tosibox, Secomea, that class of box, and the people at home connect to the service with their own client and MFA. IT gets a device that only calls out, a user list and a session log, which usually turns a no into a yes.
Then decide what they can do. View only for management, the terminal's VNC in view mode, or a read only page of counts and alarms. Pressing buttons from a sofa needs a physical permissive on the machine, and I'd still argue against it.
There's a writeup on this here: https://plctr.com/remote-monitoring-and-control-of-plc-systems/
Took it to IT with the outbound only bit and the session log, and they said they'd look at it, which from them is a yes. Then they asked what the box was called. Which is the one question I couldn't answer.
Any of the three she named, and I think you pick the one your distributor stocks. Ask for the MFA option and the audit log in writing. And the terminal's VNC stays view only.
Ordered a Cosy through the distributor. IT approved it once they saw it only talks outbound on 443 and the service has MFA and a session log. Set the terminal's VNC to view only with a password, management gets a viewer account each, no control.
So my guess in the first post was wrong. A port forward isn't fine even for a viewer, and what plants do is a box that only calls out, with MFA and a session log, view only at the far end. What got it approved was asking IT for that instead of asking for a port.
One thing I hadn't thought about, the counts management want are on a screen the operators change every shift, so from home they'll see whatever page is up.
Thanks mira88 and suel.
Getting IT on side first is the hard part. Nicely done.