For security and performance reasons, the firewall IPD is supplied from Emerson with a version of the operating software that is set up for compatibility with the DeltaV system. No other firewall should be used within the DeltaV Control Network.
The firewall IPD is supplied from Emerson with a tested set of rules and thresholds that are the controlled trigger mechanisms for allowing DeltaV packets to transverse the firewall IPD ports. If a packet does not match any of the configured parameters it is dropped or rejected. For example, if the rate of packets is higher than the configured thresholds, the extra packets are dropped. If the packet protocol type, port number, or configured address does not match the incoming packet, the packet is rejected. By default, the firewall IPD allows all properly configured DeltaV workstations and controllers to communicate with each other regardless of whether the firewall IPD is installed on the Primary or Secondary DeltaV networks. This enables the firewall IPD to be inserted into the DeltaV network without any further configuration. A maintenance person can easily hot-swap the firewall IPD and it will operate with the DeltaV system to provide protection.
The firewall IPD IP address can be changed for web management. Web management is required to change the default passwords, which should be unique for each firewall IPD.
Although applying additional rules to the firewall IPD is not recommended, if a firewall IPD with additional rules applied is replaced, the new firewall IPD must be reconfigured with the additional rules. Each firewall IPD can be uniquely configured and the configurations can be saved to a server for later retrieval. Any custom configuration should only increase accessibility, not further restrict it unless otherwise directed in KBA AK-1600-0290.