BECKHOFF IPC-Security - Manual (Page 33)

Please also consult [11] for more information.
A.1.2. Remote maintenance from inside the organization
A very common scenario is that the service computer used for remote maintenance is located within the
same organization, meaning within the same corporate network. However, as the industrial network is often
separated by a Firewall from the regular IT network, the RDP communication needs to travel through that
firewall to reach the IPC.
A.1.3. Remote maintenance via central VPN server
In this scenario, the service computer used for maintenance is located outside the IT infrastructure, e.g. in
a home office. It is assumed that the IT infrastructure already provides some kind of VPN-Server. In the
picture from above, this VPN-Server is integrated into the first firewall (for example: Cisco ASA Firewall).
The communication from service computer to IPC will therefore only be encrypted until this VPN endpoint.
From that point on, the communication traveling through the IT network is plain RDP.
IPC Security 33