We ship a labeller with a CompactLogix 5069-L320ER, a PanelView Plus 7 and a FactoryTalk View SE station for recipes. The support contract says remote diagnostics within four hours, and on the bench that means unattended TeamViewer on the SE PC with Studio 5000 going through it.
New customer's IT has said no. TeamViewer isn't going on anything that touches the line. We offered it with a long password and their approval before each session, then a 4G modem straight on the PLC's second port, which got a louder no and a meeting. So we're stuck.
I don't want to argue with their IT, they're right I think, but I need a way in that plants will actually accept. What do plants actually sign off on for an OEM, because I need something to put in the contract before the next one ships?
Start from what leaves the plant, not what comes in. Their IT said no to a desktop sharing tool because it's a full session on a Windows box on the line, doing whatever the far end wants. Does the labeller PC need to be reachable at all, or only the PLC and the panel?
> only the PLC and the panel
Mostly the PLC, Studio 5000 online, and the panel for pushing a screen fix. The SE station is only recipes, I don't need to see it. The machine subnet is 192.168.10.x and that's all I've ever needed. The 4G modem was the same thought really, reach 192.168.10.x and nothing else. They didn't see it that way.
What our remote sites and every OEM we work with accept is an outbound VPN router on the machine subnet. The box dials out to a broker, nothing inbound gets opened at the plant, and the plant decides when it's allowed to dial. What happens when the link drops? Nothing. The machine runs, the router reconnects, which is the point. Write that up as your standard and take it to their IT as a proposal instead of as a tool.
Took the outbound idea to their IT and they liked the direction. Two things back. Who controls when the session is open, they don't want it always on, and can we reach the SE PC through it, because if we can they're back to no. They want a log of every session they can pull themselves as well, and I'm not sure what to tell them on that one.
All three are standard. Permissive: a key switch or a button wired to the router's digital input, so the plant turns access on and off. Scope: the router only routes the machine subnet, leave the SE PC out of the route list so even you can't reach it. Log: MFA on your side and session logging on the vendor portal, give their IT a read account. Ewon Cosy, Secomea, Tosibox, same shape. There's a writeup on the remote side here: https://plctr.com/remote-monitoring-and-control-of-plc-systems/
Went with an Ewon Cosy on the machine subnet, outbound only, key switch on the panel door wired to its digital input, plant holds the key. Our portal has MFA and the session log, their IT got a read account. The Cosy routes 192.168.10.x only, so the L320 and the panel are reachable and the SE PC isn't in the list.
The real problem was me proposing a desktop tool on a line PC, which IT hears as an open door. Outbound VPN with a permissive, logging and a subnet limit is what got signed. Standard build ships the Cosy and key switch now.
The older machines still have TeamViewer on them and I don't know how many. Thanks wandak, mira88.
Count the older ones before their IT does.