Firewalls and security

DCOM relies on dynamically-assigned TCP ports. When an OPCAE client connects to an OPCAE server, it connects to port 135 (the RPC port mapper), which assigns one TCP port and one UDP port to the component. Communication between client and server is directed to those ports. Because of these limitations, it is difficult to configure DCOM to work through a conventional firewall.

Third-party vendors offer products that address these limitations. OPCAE tunnelers use a specialized OPCAE client that mirrors data to a specialized OPCAE server through an encrypted channel. OPCAE-aware firewalls enable secure communication with OPCAE servers with minimal configuration.

If third-party solutions are not desirable, secure OPCAE through configuration as follows:

• If the OPCAE server vendor supports it, install PI Interface for OPCAE on the machine running the OPCAE server. The local COM connection permits you to disregard firewall issues between client and server.

• If a separate interface node is required, locate the interface on the OPCAE server’s subnet. It is much easier to open a single firewall exception to port 5450 on the PI Data Archive server than to configure DCOM to work through a conventional firewall.

• Configure DCOM permissions on a “least privilege” basis, by including only specific service accounts in DCOM ACLs.

  Note: See DCOM Security and Configuration.

• Use the built-in Windows firewall that is included in the Windows version you are using.