SX-500-1402 Serial Device Server Cryptographic Officer Guidance Manual Part Number 140-00188-210A
© 2009 Silex Technology America, Inc. All rights reserved. June2009 Silex Technology America SPECIFICALLY DISCLAIMS THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS OF THIS PRODUCT FOR A PARTICULAR PURPOSE. Silex shall not be liable for any errors contained in this manual or for any damages resulting from loss of use, data, profits, or any incidental or consequential damages arising from the use of SILEX products or services.
Contents About This Reference Guide....................................................................................................................................1 Safety Precautions................................................................................................................................................1 Emissions Disclaimer............................................................................................................................................
Chapter 7 Product Specifications............................................................................................................................................35 TCP Port Connections........................................................................................................................................36 Appendix A Advanced Security Configuration............................................................................................................................
Table 6 Extended AT Commands..........................................................................................................................31 Table 7 Response Codes......................................................................................................................................32 Table 8 Product Specifications..............................................................................................................................35 Table 9 Radio Performance Specifications.
About This Reference Guide Safety Precautions To prevent damage to the Serial Device Server’s electronic circuit components, follow established ESD practices and procedures for handling static-sensitive devices. All ESD-sensitive components must be stored and shipped in ESD-conductive bags or bubble-wrap and labeled as such using the standardized ESD adhesive warning label.
REVISION HISTORY Rev. No. Date Revision by A 2009.08.
Chapter 1: Introduction The SX-500-1402 Serial Device Server provides a FIPS 140 compliant encrypted wireless LAN connection for an attached client device. The client device may attach to the SX-500 via a serial port or wired Ethernet port.
PHYSICAL PORTS The physical ports on the SX-500 are as follows: Port Name Description Power Jack for attachment of external power supply Ethernet RJ-45 connector for attachment of Ethernet cable Serial DB-9 connector for attachment of serial interface cable Wireless RP-SMA connector for attachment of an external antenna Button Momentary push button LED Green, Yellow and Orange LEDs For installation and connection of the interface ports, refer to Chapter 2.
FIPS-140-2 Interface Status Output Physical Interface Logical Interface Button Invoke configuration/status function Ethernet Plaintext status response from console task via Telnet Plaintext status response from web config via HTTP Wireless Status response from console task via Telnet Status response from web config via HTTP Power Interface Serial Plaintext status response from button push LEDs Indicate link and unit error status Power Serial When the module enters an error state, all Data In
In particular, the WPA2-WPA transition mode is NOT FIPS 140-2 compliant. Only networks exclusively using WPA2 (AES-CCMP) encryption comply. The current security settings for the device may be observed by logging into the unit web server and navigating to the network security page, which will show the currently active and configured values for the above parameters (and others). The settings may also be observed with the configuration console command SHOW NW.
Physical Protection There are no user serviceable parts inside the SX-500 enclosure. If the enclosure should be opened for any reason, the Cryptographic Officer should zeorize the module before the enclosure is opened. Secure Operation The Cryptographic Officer and any users of the SX-500 module must be familiar with the SX-500 Cryptographic Security Policy and must follow its guidelines for proper operation.
Chapter 2 Installing the Serial Device Server Hardware The Serial Device Server includes most of the hardware and software components required for installation. The one item that you will need to purchase separately is a cable to connect your serial device to the Serial Device Server (this cable is not included because of the wide variety of connector types used on serial devices). Verify Package Contents The Serial Device Server includes the components listed in Table 1.
2. Write down the 12-digit MAC (Media Access Code) address printed on the label located on the bottom of the Serial Device Server (for example: 004017023F96). You may need this number in order to configure the Serial Device Server. 3. If you have a wireless model, connect the antenna to the unit. 4. Connect the Serial Device Server to your serial device. If you are using RS-232, you may use standard PC cabling (you should normally use a null modem crossover cable).
7. The Serial Device Server’s IP address must be configured before a network connection is available. If your network offers DHCP (Dynamic Host Configuration Protocol), the Serial Device Server will automatically search for a DCHP server upon power up and obtain an IP address. If your network does not offer DHCP, a static (fixed) IP address must be assigned (see your system administrator for assistance).
Chapter 3 Configuring the Serial Device Server This chapter describes the methods for configuring the basic settings of the Serial Device Server, including the IP address, serial port settings, and wireless security. The Serial Device Server also has an extensive range of advanced configuration capabilities that are described in Chapter 5, Appendix A, and Appendix B.
• Flow Control In addition to the above parameters, the Serial Device Server allows you to configure numerous other capabilities. These other capabilities provide you with the unparalleled flexibility to use the Serial Device Server on virtually any 802.11 or Ethernet network with a wide range of serial devices. Configuration Methods There are two ways to configure the Serial Device Server: • Internal Web Pages (HTTP).
First-Time IP Address Configuration NOTE: Skip this section if you have already configured the SX-500 IP address If you are configuring the Serial Device Server from a non-Windows computer or if you cannot use an Ethernet connection, you must first configure the Serial Device Server IP address. Note that it is only necessary to perform this task one time -- once the address has been configured, the Serial Device Server can be accessed from any computer on the network that has the appropriate privileges.
ping ipaddress Where ipaddress is the desired IP address of the Serial Device Server and macaddress is the MAC address of the Serial Device Server (found on the label affixed to the Serial Device Server). For example: arp –s 192.168.5.53 00:40:17:00:00:01 ping 192.168.5.53 Note that Windows systems use the format xx-xx-xx-xx-xx-xx for the MAC address (for example, 00-0017-00-00-01).
Using a Web Browser to Configure the Serial Device Server After you have entered an IP address into the Serial Device Server, you can use any standard web browser to access the internal web pages for configuring the Serial Device Server. Simply specify the IP address of the Serial Device Server in your browser and then follow the steps below: IMPORTANT: You must click the Submit button when you have finished configuring an internal web page. If you do not do this, your changes will not be saved. 1.
If you used DHCP, verify that the IP address is correctly set. If you used the default 192.0.0.192 IP address, you MUST change it to a new valid IP address. If necessary, change the Subnet Mask and Gateway. It is generally not necessary to change the other parameters on this page (refer to Chapter 5 for advanced configuration information. Note that on-line help information is available on every configuration page.
5. Select the appropriate wireless encryption mode and enter the required settings (check with your network administrator for the proper settings if you do not know them). Appendix A lists the possible encryption settings. Click the Submit button at the bottom of the window (you may need to scroll) to save your changes. To enter the Authentication Server root signing certifcate, click on Configure Authentication Server Certificate 6. Enter the filename containing the CA key certificate.
8. Configure the serial port settings so that they match the settings on your device. For example, if your device is set for 9600bps, odd parity, and XON/XOFF flow control, you must change the settings on the Serial Device Server to these settings. Click the Submit button at the bottom of the window (you may need to scroll) to save your changes. When you have finished with all your configuration changes, you must restart the Serial Device Server for these changes to take effect.
Using the Internal Command Console to Configure the Serial Device Server You may skip this section if you have completely configured the SX-500 using the SX-500 Internal Web Pages. The Internal Command Console is a command line oriented method for configuring the Serial Device Server. It provides more comprehensive capabilities than the Internal Web Pages, but is not as easy to use. Advanced users may prefer to use this method because it is concise, fast, and powerful.
For WPA2-PSK or WPA-PSK, enter the command: SET NW WPAPSK [sets pre-shared key for WPA2 or WPA, where is the key] SET NW WPAGROUP [enables or disables WPA group key mode, where is ENABLED or DISABLED; default is DISABLED] For WEP (WEP64 or WEP128), use the following commands: SET NW KEYVAL SET NW KEY# n [Sets WEP key, where is 10 hex characters for WEP64 or 26 hex characters for WEP128] [sets the number of the WEP key that will be used as the transmit key, where n=
Chapter 4 Using the Serial Device Server with Your Application The Serial Device Server includes a number of capabilities that enable it to be used in a wide range of applications. These capabilities include: 1. 2. 3. 4. 5. 6. 7. 8. Serial Port Emulator (SPE) software Raw TCP connection RFC2217 ECable Mode Print Server mode FTP Console mode switching AT commands These methods are described in the following sections.
After the Serial Port Emulator software has started, you will see a list of all the configured Serial Device Servers on the network. Right click on the name of the Serial Device Server that you want the virtual COM port to connect to (the default name is SLXxxxxxx, where xxxxxx is the last six digits of the Serial Device Server MAC address), and then click Virtual Port. You will be asked to select the name of the virtual COM port (for example, COM3).
where ipaddress is the IP address of the Serial Device Server and portnumber is the Serial Device Server TCP port number. For example: telnet 192.168.5.
a. Select UDP as ECable I/O Mode. b. Enter the UDP port number (Destination Port) used by the destination device to communicate with the Serial Device Server. This number must be a valid port on the destination device (check the documentation for that device to determine the valid port numbers). c. Enter the UDP port number (Local Port) used by the Serial Device Server to communicate with the destination device. This number must be greater than 1023, but is otherwise arbitrary.
NOTE: The serial port console mode cannot be used in a FIPS 140-2 approved mode. The Cryptographic Officer must leave the console string as NULL (the factory default value). To switch the serial port to console mode, you must first define a console string. When the Serial Device Server receives this string on the serial port, it will automatically switch the port to console mode. To define the console string, use a web browser to access the Serial Device Server internal web pages.
Chapter 5 Advanced Configuration The Serial Device Server Serial Device Server is equipped with a default configuration that works with most serial-to-Ethernet connections. You can modify the settings to suit your installation requirements. The web browser interface is the recommended method for setting advanced configuration parameters. However, regardless of the method to access the configuration parameters, the method for modifying the parameters is virtually identical.
Parameter Description Settings Default Setting number (required for E-Cable UDP mode only) Ectmmsec Cable connection time resolution Enable, Disable Disable Ecudp ECable UDP mode Enable, Disable Disable Restoring Factory Default Settings The factory default settings can be restored at any time To do this, hold down the Reset pushbutton for more than five seconds.
2. Verify the settings, as defined in Table 4. Table 4 TCP/IP Settings Parameter IP Address Setting To assign a static IP address, enter it in this field The IP address must follow the format XXX.XXX.XXX.XXX, where each XXX is a number between 0 and 255. The default IP address mask is 192.0.0.192. Subnet Mask Default Gateway Boot Method Set to STATIC for a static IP address, set to DHCP or AUTO to attempt to automatically assign the IP parameters from a network server.
Standard AT Commands Supported The Serial Device Server recognizes a subset of the standard AT command set. The data channel must be in the command mode for commands to be recognized. The data channel will be in command mode upon power up or reset. There are two operating modes for the unit when the AT command option is enabled. In command mode, data received from the serial port is passed to the AT command processor, and responses are returned to the serial port.
Parameter Echo control Command ATEn Description If n=0, commands are not echoed. If n=1, subsequent commands will be echoed. The default, upon unit reset, is for no echo (ATE0). Disconnect ATHn If n=0, any connection to a remote host is dropped. Other value of n is ignored. Return to data mode ATOn Exits command mode and places the serial port in the data mode. All subsequent data is sent to the network application, if connected, until an enter command mode sequence is received.
Response Codes Table 7 details the response codes for codes other than #C commands.
Chapter 6 Troubleshooting If you have experience problems with the Serial Device Server, please check the following troubleshooting steps: 1. Make sure that you are getting power to the Serial Device Server. The orange LED should be on solid if the proper power is being received. If it is not on, check the power supply connections, and if possible, try a different Silex Serial Device Server power supply. 2. Make sure that you have a valid network connection. a.
b. Make sure that have a good cable connection between your serial device and the Serial Device Server. If possible, try a different cable. c. Make sure that the cable pinouts are correct. In order to communicate properly, the transmit data line on the Serial Device Server must be connected to the receive data line on your serial device, and the receive data line on the Serial Device Server must be connected to the transmit data line on your serial device.
Chapter 7 Product Specifications Table 8 Product Specifications Component Specifications Model SX-500 Serial Device Server Processor Cavium NITROX Soho CN210 RAM Memory 16 Mbytes SDRAM. Processor Speed 167 MHz Interfaces Supported Serial: RS-232-C; Ethernet: 10/100BaseT Wireless: 802.11b/g (SX-500); Dimensions SX-500: 125.73 x 75.11 x 24.08 mm (4.95 x 2.957 x 0.
Parameter Specifications Differential Quadrature Phase Shift Keying (DQPSK) Differential Binary Phase Shift Keying (DBPSK) Channel Number IEEE 802.11b and g: Channels 1 to 11 and 12 to 14 Data Rate 54 Mbps with fallback rates of 48, 36, 24, 18, 12, 11, 9, 6, 5.5, 2, and 1 Mbps Security Encryption: WEP 64/128 bits, WPA (TKIP), WPA2 (AES) Authentication: WEP Open System and Shared Key; WPA-PSK, WPA2-PSK, 802.
Appendix A Advanced Security Configuration There are numerous possible security settings. It is therefore important that you verify the appropriate settings with your network administrator. If you enter the settings incorrectly, the Serial Device Server will not be able to communicate on your network. The following table summarizes the wireless settings required for each encryption mode and authentication type. The bold values are those which are FIPS 140-2 approved.
you would need to enter a User ID and Password, an Authentication Certificate, and a Private Key with corresponding public key certificate.. The following is a description of the authentication settings used by the Serial Device Server: Encryption Mode (Wireless Security Only) The possible Serial Device Server wireless encryption modes include: • • • • • 64 and 128 bit WEP. These are available for basic WIFI compatibility. Because of known security issues, WEP should be avoided if possible. Dynamic WEP.
Wireless Authentication Type (Wireless Security Only) This parameter sets the type of authentication to be performed with the network access point (Radius authentication server), or with a peer unit in Ad Hoc mode. The Serial Device Server supports Shared Key and Open System Authentication with WEP, and PSK, TLS, TTLS, LEAP and PEAP with WPA, WPA2, DYNAMIC WEP, and WPA2-WPA.
• Certificate Root Key This is the authentication key used to verify the root certificate in the certificate chain provided by the authentication server. To set to null, send leave this field blank. Enter the certificate root key on the Configure Authentication Certificate page in the Serial Device Server internal web pages, or use the console command SET NW CERTKEY , where is the value of the key.
Appendix B Console Commands The following tables describe the console commands available from the internal command console. Access the command console through the serial port (if enabled for console mode) or over the network using a Telnet session or a web browser.
Command SET NW AUTHtype Description Sets wireless authentication type The default value is Open System Format: SET NW AUTHtype [OPEN | SHARED | TTLS | LEAP | PEAP | TLS | PSK ] NOTE: For FIPS 140-2 approved operation, this parameter must be TLS, PEAP or PSK SH NW AUTH Shows wireless authentication type Sample output: Authentication type= OPEN SYSTEM SET NW ETHAUTH Sets Ethernet wired authentication type The default value is Open System Format: SET NW ETHAUTH [TTLS | TLS | PEAP ] SH NW ETHAUTH Shows E
Command Description WiFi encryption is Disabled SET NW KEY# Selects the WLAN WEP key entry (the WEP key that will be used as the transmit key) The possible values are 1, 2, 3, or 4; the default value is 1. Format: SET NW KEY# SET NW KEYVAL n Sets the WLAN WEP key entry to the specified hex value For WEP128, the key is 10 hex characters long; for WEP128, the key is 26 hex characters long; the default value is null.
Command Description CL NW BSsid Clears BSSID value and allows the server to use SSID, not a specific AP Format: CL NW BSsid SET NW RTS Sets WLAN RTS threshold The possible values are between 1 and 3000; the default value is 2432.
Command SH NW CERTCN Description Shows the value of first common name check string The default is null (blank) string. The command SH NW TTCN also returns this information. Sample output: Common name 1 SET NW CERTCN2 Sets second EAP Common Name Format: SET NW CERTCN2 SH NW CERTCN2 Shows the value of the second common name check string The default is null (blank) string. Sample output: Common name 2 SET NW CERTEXP Sets EAP Certificate Exponent value The default value is 10001 Hex.
Command SET NW INAP Description Sets EAP inner-authentication protocol The possible protocols are PAP and MSCHAP_V2; the default value is PAP. Format: SET NW INAP SH NW INAP [PAP|MSCHAP_V2] Shows the inner authentication mode The deprecated command SH NW TTAP also returns this data. Sample output: Authentication protocol = PAP SET NW REALM Sets the realm portion of the 802.1x EAP authentication ID This value can also be set with the ID command. The default value is null.
Command SET NW WPATRACE Description Sets WPA trace level. This command is for internal diagnostic purposes only. The default value is 0 or disabled. Format: SET NW WPATRACE nn SH NW DISCONN SET NW DISCONN NOTE: For FIPS 140-2 approved operation, this parameter must be 0 Displays the current value of the network disconnection timer Sample output: Disconnect Timer: 5 Sets the period of the network link disconnection watchdog timer.
Command Description If the remote host is connected, additional data received will be discarded. Format: CL PORT S1 JOB SET PORT S1 FLOW Sets serial port flow control to NONE, XON/XOFF, CTS, or DSR The default value is none. Format: SET PORT S1 FLOW SET PORT S1 PARITY Sets serial port parity to NONE, EVEN, ODD, MARK, or SPACE The default value is none. Format: SET PORT S1 Parity SET PORT S1 SIZE Sets data bits on the serial port The default value is 8.
Command Description Format: SET SERVEr SET SNMP CONtact NAme Sets system contact string The default value is null. Format: SET SNMP CONtact SET SNMP LOCation Sets system location string The default value is null.
Command SH VErsion Description Shows firmware version of print server Protocols supported: NetBIOS SNMP TCP/IP EMail DHCP Sample output: serial server Firmware Ver. 4.19 (2004.10.31) Boot Ver. 1.
Command Description # SET SERVI FMS Service Name Filter 1 TWC_FFFFFF 0: No Filter 2 BINARY_P1 0: No Filter 3 TEXT_P1 1: Text Substitution m= LF, r= CRLF 4 TWC_FFFFFF_P1_4 0: No Filter 5 TWC_FFFFFF_P1_5 0: No Filter 6 TWC_FFFFFF_P1_AT 4: PostScript Tagged Binary Sets filter 1 text replacement match string index. If the index is zero, the default string of (line feed) is used. The default value is 0.
Command Description name> RECeive This option is required only for host applications that do not operate properly if data is received from the serial device. The default value is disabled. Sample output: SET SERVI RECeive DIsable] SET SERVI TCP [ENable | Sets raw TCP port for service If port number is 0, raw TCP is disabled on service. The default value is 9100 for service 1, 3001 for service 2.
Command SH STRing [string_num] Description Defines the BOT and EOT strings used in services If string_num is provided, then the specific string definition and expansion are displayed. If string_num is not provided, then all string definitions are displayed without their expansions.
Command SET IP RANge Description Allows or prevents access to a range of remote addresses The default value is empty list. Format: SET IP RANge [EN | DI | ALL] aa.bb.cc.dd {MAx ee.ff.gg.hh] SH IP ACcess Displays current access list settings Sample output: All hosts permitted access SET IP ADdress Sets server IP address The default value is 192.0.0.192 Format: SET IP ADdress aa.bb.cc.dd SET IP ARP ENable Enables or disables setting of IP address with an ARP packet The default value is Enable.
Command SET IP FTP Description Enables or disables FTP protocol The default value is Enable. Format: SET IP FTP SET IP HTTP [ENable | DIsable] Enables or disables HTTP protocol The default value is Enable. Format: SET IP HTTP SET IP KEepalive [ENable | DIsable] Sets interval in minutes for sending TCP keepalive packets on a connection The default value is 5 minutes. Format: SET IP KEepalive n SET IP LPD Enables or disables the LPD protocol The default value is Enable.
Command SET IP ROuter Description Sets default router address The default value is 0.0.0.0. Format: SET IP ROuter SET IP SUbnet aa.bb.cc.dd Sets IP subnet mask The default value is 0.0.0.0. Format: SET IP SUbnet SET IP TCP aa.bb.cc.dd Enables or disables the raw TCP 9100 protocol The default value is Enable. Format: SET IP TCP SET IP TELnet [ENable | DIsable] Enables or disables Telnet protocol The default value is Enable.
Command SH IP Description Shows TCP/IP related parameters Sample Output: IP is enabled IP address 192.0.0.192 Boot tries 3 Subnet mask 0.0.0.0 Boot method AUTO IP Gateway 0.0.0.
Firmware Update Table 17 Firmware Update Command SET LOAd ENable Description Sets the firmware to perform a soft reset and enter the server boot program after the next Exit command. This command is used for diagnostic purposes only. The default value is Disable. Format: SET LOAd (ENable | DIsable ] SET LOAd HOst Sets the node name of the TFTP boot host. This command is used for diagnostic purposes only.
Miscellaneous Commands Table 18 Miscellaneous Commands Command Description SET DEFAULT Set parameters to factory defaults EXIT This command exits the current configuration console session. SH FATal Shows fatal error log, if fatal errors exist. CL FATal Clears the fatal error log INIT Instructs the server to execute a soft reset when the next exit command is executed.
Console Commands Silex Part Number 140-00188-210A Page 59
Appendix C Firmware Update Procedures Occasionally it may be necessary to update the Serial Device Server to take advantage of new features or to fix specific problems. The simplest way to perform this update is with the Silex UpdateIP utility for Windows XP and 2000 computers. This utility can be found on the CD-ROM that is included with the Serial Device Server, or it can be downloaded from the Support & Downloads section of the Silex website (www.silexamerica.com).
where ipaddress is the IP address of the Serial Device Server, filename is the file name (and path, if necessary), and is the Serial Device Server password (if you changed this password, use your new password instead of “access”). For example, to download the file tathsti130.bin from the updates directory on your computer into a Serial Device Server with an IP address of 192.168.5.70, you would enter the command: tftp -i 192.168.5.70 put /updates/tathsti130.
Appendix D Safety and Regulatory Notices Information for United States Users This equipment has been tested and found to comply within the limits for a Class B digital device pursuant to Part 15 of the FCC Rules. These limits are designed to provide reasonable protection against harmful interference in a residential installation.
Declaration of Conformity (FCC) (SX-500) According to 47CFR, Part 2 and 15 for Class B Personal Computers and Peripherals; and/or CPU Boards and Power Supplies used with Class B Personal Computers: We: Located at: Silex Technology America, Inc. 157 West 7065 South Salt Lake City, UT 84047, USA Declare under sole responsibility that the product identified herein, complies with 47CFR Part 2 and 15 of the FCC rules as a Class B digital device FOR HOME OR OFFICE USE.
Information for European Users (SX-500) The server and its built-in 802.11b, and 802.11g wireless technology is in compliance with the Class B Information Technology Equipment requirements and other relevant provisions of European Directive 1999/5/EC. The limits for Class B equipment were derived for typical residential environments to provide reasonable protection against interference with licensed communications devices. The internal function is a radio device using the 2.4 GHz frequency band (2.
Appendix E Silex Contact Information Silex Technology America, Inc. www.silexamerica.com Technical Support: support@silexamerica.com Sales: sales@silexamerica.com Tel: (801) 748-1199 8:00 to 5:00 Mountain Time Tel: (866) 765-8761 toll-free Fax: (801) 748-0730 Silex Technology Europe GmbH www.silexeurope.com Tel: +49-2159-67500 Tel: 0800-7453938 German toll free Email: contact@silexeurope.com Silex Technology Beijing, Inc. www.silex.com.cn Tel: +86-10-8497-1430 Email: contact@silex.com.
Silex Technology America, Inc. www.silexamerica.
