Schneider Electric Control Expert
The only communication mode currently supported is TCPIP (not USB or Serial).
The below example was tested with EcoStructure Control Expert V15.0 on Windows 10.
The Control Expert software can be run inside a VM if desired.
Theory of Operation and Data Flow
A PLC is located at a remote location. The location has no inbound access, no VPN available. It may be behind a cellular or satellite modem, it may have a restrictive firewall.
An Agilicus Connector is installed at this location such that the connector can reach the PLC on TCP port 502 (Modbus). The Connector must also be able to reach out to the Agilicus AnyX infrastructure on port 443.
On the user’s desktop, the Agilicus Launcher is installed. When the user selects the ‘Control Expert’ icon from their desktop start menu, or, when they select the icon from the Agilicus Profile, the network activity of the Control Expert software is seamlessly intercepted and tunneled to the PLC.
Authentication (and multi-factor authentication) is performed via a browser which may appear if the user is not signed in.
Unlike a VPN-style connection:
- no PLC’s (nor any other network resources) other than the granted one can be accessed
- no need to change local IP addressing in case of overlap
- multiple sites and PLC can be used simultaneously
- No reverse-path network traffic is allowed
- No inbound connectivity to the remote site is required
The PLC Modbus traffic is tunneled over HTTPS, over WebSocket, end-to-end encrypted from the User’s PC to the Agilicus Connector in the remote site.
Configuration and Setup
There are 4 basic steps:
- Create a Network Resource for the PLC
- Create a Launcher
- Set user permissions
- Install Launcher on Desktop
Create Network Resource (PLC)
We will create a ‘network resource’, this acts as the endpoint of the PLC. It has a name (example-plc in below) and the IP/port of the actual PLC (as reachable by the connector on site). Later in the Control Expert software we will refer to this IP (even though it is not locally reachable).
Now we will create a Launcher resource. This models the executable on the user’s PC, taking the executable path and the network resources to encapsulate as arguments. If you have PLC’s on multiple sites with multiple connectors, associate them all here.
In the screen shots above in the ‘Create Launcher’, we assigned initial permissions. (Note: we recommend using groups to assign permissions since it simplifies configuration. For example, create a group called PLC-Admins, assign the users to it once, and then assign the PLC access permissions to the group. For more information, see “Using Groups for Assigning Role-Based Permissions“
On the PC with Control Expert installed, we will install the Agilicus Launcher. Refer to “Agilicus Launcher: Browser Desktop Integration“. This is done (on the PC with Control Expert installed) from a browser opened to https://profile.YOURDOMAIN.
Once the launcher is installed on this machine, we will see a ‘demo-plc’ icon on the start menu (and also in the profile web interface if the browser extension is installed).
At this stage, the user can open Control Expert, either via the profile web interface, or the desktop start menu. It will automatically be able to connect to the IP address of the PLC used above in the Network Resource (even though that IP is not reachable from this machine).
Return to Product Configuration
- Sample: CNAME With Google Domains
- Sample Application Demonstration
- Sample Hosted Application
- Sample React Application
- Sample LibreNMS Application
- Sample Grafana In Kubernetes
- Agilicus AnyX Demo
- Sample Node Red
- Agilicus Connector in Private VPC In AWS EC2
- Sample Kafka Messaging From AWS VPC To Private Network
- Sample Ubiquiti EdgeRouter-X EdgeMax Web Interface
- Sample Dual-Endpoint Web Application (Dashboard + API)
- VTScada and Twilio Inbound Access
- Sample: Hosted Icecast
- Sample: Schneider Electric Control Expert
- Sample: Rockwell Studio 5000
- Sample: Synology Local SSL
- UDP via SSTP VPN