Troubleshoot a communication rule

In the firewall's web UI navigate to the Protection tab and based on the type of rule you are creating select either Inbound connections or Outbound connections.

Click the Add connection button.

Select Custom from the Application drop-down list.

Select the DeltaV workstation and the external workstation that will be communicating.

Select TCP from the Protocol drop-down list.

Enter 1-65534 in the Ports area to allow communications on all ports.

Check Enabled to enable logging and click Apply.

Repeat the above steps and create another rule using UPD as the protocol.

On the Protection tab, Inbound connections and Outbound connections pages, disable logging on any other rules between the DeltaV workstation and the external workstation for which you created the custom rules and click Apply.

This causes the log to contain only data from the custom rules making it much easier for you to analyze the data.

Exercise a test application on the DeltaV workstation and external computer. Use the application's full functionality including the functions that may not be working correctly. Run the application long enough to create log entries.

Open the log on the syslog server and search for all of the log entries matching the IP addresses of the computers using the application you are troubleshooting.

Compare the ports and protocols in the log with the ports and protocols in the rules you originally created for the application. You can use the Configuration audit page on the Administration tab or the Applications page on the Configuration tab to view the ports and protocol information.

Follow these steps if a port or protocol used by the application is not configured in the original rule:

Navigate to Protection Inbound or Outbound connection and disable the test custom rules you created.
Navigate to Dashboard → Summary and disconnect any communications that were created by the custom rule.
Create a new rule with the custom application using the missing ports and protocols and test the application to see if it resolves the issue. You may have to create both TCP and UDP rules. If creating a rule with the missing port and protocols resolves the issue, create a new application in the firewall's application list using the revised ports and protocols to allow the application to work. Do not revise the original application as you might need this for future rules. Consider using the word custom in the new application's name (for example OPC:Custom- OPC.NET Client Read/Write for xxxxxxx)
Use the new application to revise the original rule you created for this application.
Delete and disconnect any custom rules that you created.