IEC 62443-3-1 Clause 6.1 – Network Firewalls | Automation Engineering Body of Knowledge

Teaching note: Paraphrased from IEC/TR 62443-3-1:2009 (ISA-TR99.00.01-2007) for learning. The technical report is informational, not a requirements standard. Confirm wording in the published TR. Later normative parts (2-1, 3-3, 4-2) state the shalls.

What it is

A network firewall is a hardware (preferred) or software device that regulates communication between connected networks by inspecting traffic against rules. It is the usual technical control at an IT/OT or zone boundary, often with a DMZ.

Classes in common use:

Packet filter — headers only (address, port, protocol, direction). Fast; no application view.
Stateful inspection — permits packets that belong to an allowed session. Default closed.
Application proxy — terminates the client, inspects the application, opens a new connection. Higher latency.
Deep packet inspection — headers and payload, including industrial function codes where the product supports them. Teaching note: industrial DPI was emerging in 2007 and is now a standard OT firewall class.

Vulnerabilities addressed

Unauthorised paths between enterprise and process networks, unconstrained remote access, and lateral movement across zones. A firewall does not fix a bad architecture; it enforces one.

Typical deployment

Enterprise zone ↔ industrial control zone
DMZ ↔ control network
Remote access ↔ control systems

Hardware appliances protect whole networks independently of endpoints. They commonly sit ahead of PLCs, SCADA, DCS, RTUs and industrial servers. For planning, configuration, test, deploy and manage, see Firewall Planning and Lifecycle.

Known issues and weaknesses

Misconfiguration is the usual failure mode.
Generic firewalls may not inspect industrial protocols.
A firewall in the control path is a potential availability and latency risk.

Use in IACS

Primary boundary control between trust levels. Prefer a small set of hardware models and people who know them. Not every hop needs a firewall — a managed switch ACL may suffice inside a zone; a firewall is for a change of trust.

Recommendations

Use hardware firewalls from recognised vendors, and a limited number of models.
Use knowledgeable, dedicated personnel to set up and operate them.
Traffic between zones connected to the firewall is generally closed (stateful deny-by-default).
Open traffic from the process network to the administrative network or DMZ as required. Do not allow traffic directly from the administrative network into the process network.
From the DMZ, open only to the administrative network and to selected servers on the process side.