Industrial Security Gateway An All-Rounder for Secure Industrial Networks

Related Vendors

FAULHABER Drive Systems

Taiwan Machine Tool & Accessory Builders' Association (TMBA)

SIMTOS (Seoul International Machine Tool Show)

Secure machine networks are becoming mandatory with the European Machinery Regulation and IEC 62443. The Industrial NAT Gateway and machine firewall Wall IE from Helmholz is an equally effective and pragmatic solution for networked machines and production facilities.

The topic of machine safety now concerns everyone. At its core, it's about securely integrating machine networks into the overarching production network. The key term here is "Secure OT"—secure operational technology consisting of software and hardware for managing, securing, and controlling industrial control systems, devices, and processes.

In light of growing data communication, there is no way around the separation or segmentation of networks. Concepts with trust zones and secure zone transitions (Zones & Conduits) have proven to be particularly effective for this purpose. This is why IEC 62443 also prescribes a corresponding protection concept: According to this, it is often not appropriate for large or complex systems to apply the same level of protection to all components, as these are subject to different threats and risks. These differences can be represented through the concept of "security zones."

Secure Authentication Strategies

Passwordless MFA for Modern Cybersecurity

Robust And Cost-Effective Protection

At this point, the question arises as to how such a Zones & Conduits protection concept for networked machines can be specifically implemented. Medium-sized mechanical engineering companies and their customers, in particular, typically seek practical solutions that are not only safe and reliable but also streamlined, efficient, and easy to use without additional external support.

Such a solution is the NAT Gateway Wall IE from Helmholz. Easily and permanently installed between the machine and the production network, the robust and particularly compact security gateway combines bridge and firewall functions to the extent actually required.

Specifically, Wall IE protects networks by precisely regulating which participant is allowed to exchange data with which device. The prerequisite for this is a packet filter functionality: This allows access between the production network and the automation cell to be restricted. With WALL IE, IP addresses, ports, MAC addresses, and the type of telegram can be filtered in both directions.

All Machines Firmly in View

At the same time, Wall IE also enables the adaptation of the machine's existing IP addresses to the IP addresses in the factory network through NAT (Network Address Translation). Each device in the machine that should be visible externally is assigned an IP address within the factory's address space. Devices in the machine that are not intended to communicate with the outside world are simply excluded. The use of NAT also makes it possible to integrate multiple identical automation cells with the same address range into the production network without having to reconfigure the machines.

In the event that there are not enough IP addresses available in the factory network, the WALL IE can also be integrated into the production network with a single IP address. Access to the devices in the machine is then handled via port forwarding. Filtering and protection always function in both directions. This also allows a factory network to be protected from compromised devices within the machine.

Wall IE Can Also Be Used as a Bridge

As another special feature, the Wall IE can also be used as a bridge in addition to the NAT operating mode. In Bridge Mode, the network participants of the machine already have IP addresses in the same range as the factory network. All filter functions are active, but NAT is deactivated in this case.

The Wall IE was introduced ten years ago and is now active in over 15,000 applications. Mostly driven by customer requests, its functionality has been steadily growing since then. Among the latest innovations is the implementation of 802.1X for authentication. This new feature allows the end customer in the factory network to ensure that no unauthorized devices become active in the network.

Additionally, functions such as extended logging and improved user management have been implemented. Further features, such as Ping and Traceroute, will be integrated into the web interface in the future. Moreover, Helmholz continuously adapts the firmware of the Wall IE to the specific requirements of IEC 62443-4-2. The configuration of the Wall IE can be downloaded, saved, and edited at any time if needed. In 2026, the certification according to IEC 62443 will also be completed by the testing company TÜV.

Future-Proofing Additive Manufacturing

Ensuring Intellectual Property Security Within Decentralized Production