InTouch Access Anywhere Gateway Administrator Manual

44 Pages·2015·1.12 MB·English

by  Invensys Systems, Inc.

Wonderware InTouch Access Anywhere
Secure Gateway Administrator Manual
© 2018 AVEVA Group plc and its subsidiaries. All rights reserved.

No part of this documentation shall be reproduced, stored in a retrieval system, or transmitted by any
means, electronic, mechanical, photocopying, recording, or otherwise, without the prior written
permission of AVEVA. No liability is assumed with respect to the use of the information contained herein.
Although precaution has been taken in the preparation of this documentation, AVEVA assumes no
responsibility for errors or omissions. The information in this documentation is subject to change without
notice and does not represent a commitment on the part of AVEVA. The software described in this
documentation is furnished under a license agreement. This software may be used or copied only in
accordance with the terms of such license agreement.
ArchestrA, Aquis, Avantis, Citect, DYNSIM, eDNA, EYESIM, InBatch, InduSoft, InStep, IntelaTrac,
InTouch, OASyS PIPEPHASE, PRiSM, PRO/II, PROVISION, ROMeo, SIM4ME, SimCentral, SimSci,
Skelta, SmartGlance, Spiral Software, Termis, WindowMaker, WindowViewer, and Wonderware are
trademarks of AVEVA and/or its subsidiaries. An extensive listing of AVEVA trademarks can be found at:
https://sw.aveva.com/legal. All other brands may be trademarks of their respective owners.
Publication date: 11/7/2018

Contact Information
AVEVA Group plc
High Cross
Madingley Road
Cambridge
CB3 OHB. UK
https://sw.aveva.com/
For information on how to contact sales, customer training, and technical support, see
https://sw.aveva.com/contact.
Wonderware InTouch Access Anywhere Secure Gateway Administrator Manual

Contents
Welcome .................................................................................................................................... 5
Documentation Conventions ...................................................................................................... 5
Technical Support ..................................................................................................................... 6
Chapter 1 Introduction........................................................................................................... 7
About the Secure Gateway ........................................................................................................ 7
Important .................................................................................................................................. 7
Architecture .............................................................................................................................. 8
Chapter 2 Installation ............................................................................................................ 9
About Installing the Secure Gateway .......................................................................................... 9
Installation Overview ................................................................................................................. 9
Installation Prerequisites.......................................................................................................... 10
Secure Gateway Installation .................................................................................................... 10
Other Secure Gateway Installation Configurations ............................................................... 11
Secure Gateway and Authentication Servers on a Windows Workstation ........................ 11
Install the Secure Gateway and Authentication Server Separately or Together ................ 12
Uninstalling the Secure Gateway ............................................................................................. 13
Chapter 3 Secure Gateway Post Installation................................................................... 15
Connecting to an InTouch Access Anywhere Server through the Secure Gateway ...................... 15
Configuring the Secure Gateway Node to Point to a Single InTouch Access Anywhere Server..... 18
Configuring the Secure Gateway Node to Point to Multiple InTouch Access Anywhere Servers.... 19
Chapter 4 Configuration Portal .......................................................................................... 21
About the Configuration Portal ................................................................................................. 21
Dashboard.............................................................................................................................. 23
Mail Alerts .............................................................................................................................. 23
InTouch Access Anywhere HTML5 Client Configuration ............................................................ 25
Configure the Access Anywhere Server to Work with the Secure Gateway ................................. 25
Whitelist Security .................................................................................................................... 26
Configuring the Origin Header Parameter for Whitelist Security ............................................ 28
Configure Session Cookie Timeout .......................................................................................... 29
Advanced Configuration .......................................................................................................... 29
High Availability ...................................................................................................................... 29
Restricting Access To and From a Secure Gateway .................................................................. 30
Built-In Authentication Server................................................................................................... 30
3
Wonderware InTouch Access Anywhere Secure Gateway Administrator Manual Contents

Disabling Authentication Server with Brokers ...................................................................... 31
Chapter 5 Port and SSL Certificate................................................................................... 33
About Port and SSL Certificate ................................................................................................ 33
Manually Add a Trusted Certificate ..................................................................................... 37
Configure the Secured Port and SSL Certificate ........................................................................ 38
Configure Failover Gateways ............................................................................................... 39
Chapter 6 Built-In Web Server ........................................................................................... 41
About the Built-In Web Server .................................................................................................. 41
External Web Server ............................................................................................................... 42
Connecting to the Web Server ................................................................................................. 42
HTTP Redirect ........................................................................................................................ 42
Disabling HTTP/HTTPS Filtering .............................................................................................. 43
Advanced Configuration .......................................................................................................... 43
Preventing Access to Non-Listed Folders ................................................................................. 44
Chapter 7 Known Limitations ............................................................................................. 45
Common Error Messages ........................................................................................................ 45
Obtaining Log Files ................................................................................................................. 46

4
Wonderware InTouch Access Anywhere Secure Gateway Administrator Manual

Welcome
Use Wonderware® InTouch Access Anywhere™ Secure Gateway to access Wonderware InTouch®
applications hosted on Remote Desktop Servers via HTML5-compatible web browsers.
This manual assumes the reader has knowledge of the following:
 Wonderware InTouch
 Enabling and configuring RDP on Windows operating systems
 Firewall configuration
 Web server administration
Important terminology includes the following:
 DMZ (demilitarized zone) - a physical or logical subnetwork that contains and exposes an
organization’s external services to a larger untrusted network.
 HTML5 - a new update to the HTML specification. Extends HTML with new features and functionality
for communication, display and more.
 RDP - Remote Desktop Protocol. A remote display protocol developed by Microsoft. RDP is a
standard component of Microsoft Windows.
 RDP Host - a Windows system that can be remotely accessed using Microsoft RDP, such as a
Remote Desktop Server (RDP Session Host) or Windows workstation with remote access enabled.
 RDS - Remote Desktop Services, which includes the Remote Desktop Protocol (RDP).
 SSL - Secure Sockets Layer is a cryptographic protocol that provides communications security over
the Internet.
 VPN - Virtual Private Network. It enables a computer to securely send and receive data across
shared or public networks as if it were directly connected to the private network.
 WebSocket - a bi-directional, full-duplex communication mechanism introduced in the HTML5
specification.
Please visit www.wonderware.com (http://www.wonderware.com) for more information on this and other
Wonderware products.

Documentation Conventions
This documentation uses the following conventions:

Convention Used for
Initial Capitals Paths and file names.
Bold Menus, commands, dialog box names, and dialog box
options.
Monospace Code samples and display text.

5
Wonderware InTouch Access Anywhere Secure Gateway Administrator Manual Welcome

Technical Support
Wonderware Technical Support offers a variety of support options to answer any questions on
Wonderware products and their implementation.
Before contacting Technical Support, refer to the relevant section(s) in this documentation for a possible
solution to your problem.
If you need to contact technical support for help, have the following information ready:
 The type and version of the operating system you are using.
 Details of how to recreate the problem.
 The exact wording of the error messages you saw.
 Any relevant output listing from the Log Viewer or any other diagnostic applications.
 Details of what you did to try to solve the problem(s) and your results.
 If known, the Wonderware Technical Support case number assigned to your problem, if this is an
ongoing problem.

6
Wonderware InTouch Access Anywhere Secure Gateway Administrator Manual

C 1
HAPTER
Introduction
In This Chapter
About the Secure Gateway .............................................................................................................. 7
Architecture .................................................................................................................................... 8

About the Secure Gateway
InTouch Access Anywhere Secure Gateway is a complementary component of InTouch Access
Anywhere that provides secure, remote access to InTouch applications.
Secure Gateway provides the following benefits:
 Accesses InTouch applications running on an internal network using a single secure port
 Eliminates the need to purchase, install, configure, and manage a VPN
 Located in a perimeter network, also known as a DMZ, while all other resources reside securely
behind an internal firewall
 Provides the ability to install a single SSL digital certificate on the Secure Gateway node instead of
requiring a certificate for every host that needs to be accessed
 Compatible with HTML5 client browsers supported by InTouch Access Anywhere
Important
InTouch Access Anywhere is offered as two separate products based on how the product components
are installed. InTouch Access Anywhere Version 17.2 is included in the suite of products that are part of
Wonderware System Platform 2017 Update 2. InTouch Access Anywhere Version 17.2 components are
installed by selecting them from the list of the Wonderware System Platform 2017 Update 2 product
installer. InTouch Access Anywhere Version 17.2.100 is the stand-alone version delivered on a single
CD. After selecting the Setup.exe file on the CD, a menu appears to select the InTouch Access
Anywhere components to be installed.
Functionally, the two versions of InTouch Access Anywhere are the same. This manual describes how to
install, manage, and monitor the Secure Gateway for both versions of InTouch Access Anywhere.

7
Wonderware InTouch Access Anywhere Secure Gateway Administrator Manual Introduction

Architecture
Secure Gateway acts as a gateway between users in remote locations and InTouch applications running
in a control network. The following diagram shows the recommended architecture of the Secure
Gateway in a production environment. The Secure Gateway uses a single port for secured remote
access to InTouch applications. All web traffic from an external business network is tunneled through a
SSL-based connection of the Secure Gateway placed in a DMZ.

8
Wonderware InTouch Access Anywhere Secure Gateway Administrator Manual

C 2
HAPTER
Installation
In This Chapter
About Installing the Secure Gateway................................................................................................ 9
Installation Overview ....................................................................................................................... 9
Installation Prerequisites ............................................................................................................... 10
Secure Gateway Installation .......................................................................................................... 10
Uninstalling the Secure Gateway ................................................................................................... 13

About Installing the Secure Gateway
This chapter describes how to install the Secure Gateway. It describes installation prerequisites, several
step-by-step installation procedures, and how to uninstall a Secure Gateway.
After installation, the Secure Gateway runs as a service and can be stopped and restarted from the
Microsoft Windows Services Manager:

The Secure Gateway service is configured to run automatically when the computer starts. If the service
stops or is unable to listen on its configured port, clients will be unable to connect to InTouch applications
through the gateway. An error message will be written into the Windows application event log.
Note: InTouch Access Anywhere belongs to the suite of products included with Wonderware System
Platform 2017 Update 2. This book describes how to perform an independent stand-alone installation of
the InTouch Access Anywhere Secure Gateway. For instructions to install the Secure Gateway from the
Wonderware System Platform 2017 Update 2 installation media, see the Wonderware System Platform
Installation Guide.

Installation Overview
 It is recommended to install the Authentication Server on the safe side of the firewall, while the
Secure Gateway should be installed on a separate computer inside the DMZ. The Authentication
Server authenticates InTouch Access Anywhere users before granting them access to InTouch
applications.
The Authentication Server is disabled by default to be consistent with earlier versions of InTouch
Access Anywhere. For more information about enabling the Authentication Server, see Built-In
Authentication Server on page 30.
 The Secure Gateway is installed with a self-signed certificate. Some web browsers may show a
security warning when a self-signed certificate is detected.
9
Wonderware InTouch Access Anywhere Secure Gateway Administrator Manual Installation

Install a trusted certificate on the Secure Gateway to eliminate security warnings. For more
information about installing and configuring a trusted certificate on the Secure Gateway, see Port
and SSL Certificate on page 33.

Installation Prerequisites
The computer hosting the Secure Gateway must meet the following prerequisites before installation.
 Any existing instance of Secure Gateway must be uninstalled from the computer before installing a
new version.
 The Secure Gateway must be installed on a computer running a supported version of Windows,
which includes
o Windows 10 Professional or Enterprise (build 1607 and later) 32 or 64 bit
o Windows 2012 Data Center 64-bit
o Windows 2012 R2 Standard and Data Center 64-bit
o Windows 2016 Standard and Data Center 64-bit
 .NET Framework 4.6.2 Full Installation or later must be installed on the host computer if you are
completing a stand-alone installation of InTouch Access Anywhere.
Note: If you are installing InTouch Access Anywhere from Wonderware System Platform 2017
Update 2, the installer verifies the current, installed versions of .NET on the computer. When only
earlier versions of .NET are detected, the installer automatically updates the computer to .NET 4.7.1.
The different versions of .NET installed on the computer can be verified by looking at the following
registry key:
HKLM\SOFTWARE\Microsoft\.NETFramework
If you need to install .NET, you can download it from the Microsoft .NET download site
(https://www.microsoft.com/net/download/windows).
 The following ports must be configured on the computer hosting the Secure Gateway:
o Port 443 is required between an external network and the Secure Gateway server. This is a
common port that is also used by Microsoft Internet Information Services (IIS), and / or by
Remote Desktop, if Remote Desktop itself is enabled. Check for port conflicts. The port can be
changed.
Important: If Microsoft IIS is running on the same server that will host the Secure Gateway,
make sure there are no port conflicts. Either change the IIS ports to values other than 80 and
443, or change the Secure Gateway port to a value other than 443 and disable the HTTP auto
redirect feature after the installation. If there is a port conflict on either the HTTP or HTTPS port,
the Secure Gateway does not operate properly.
o Port 8080 is required between the Secure Gateway Server and the InTouch Access Anywhere
Server. The port can be changed.
o The Secure Gateway includes an HTTP proxy that listens on port 80 by default. The port can be
disabled after installing the Secure Gateway.

Secure Gateway Installation
InTouch Access Anywhere belongs to the suite of products included with Wonderware System Platform
2017 Update 2. This book describes how to perform an independent stand-alone installation of Secure
Gateway. For instructions to install the Secure Gateway from the Wonderware System Platform 2017
Update 2 installation media, see the Wonderware System Platform Installation Guide.
10