Cisco Catalyst IR1101 Rugged Series Router Software Configuration Guide - Information About SCADA [Cisco Catalyst 1101 Rugged Router] (2025)

SCADA refers to a control and management system employed in industries such as water management, electric power, and manufacturing. A SCADA system collects data from various types of equipment within the system and forwards that information back to a Control Center for analysis. Generally, individuals located at the Control Center monitor the activity on the SCADA system and intervene when necessary.

The Remote Terminal Unit (RTU) acts as the primary control system within a SCADA system. RTUs are configured to control specific functions within the SCADA system, which can be modified as necessary through a user interface.

On the IR1101, line is 0/2/0 same as the Async interface.

In the network, the Control Center always serves as the master in the network when communicating with the IR1101. The IR1101 serves as a proxy master station for the Control Center when it communicates with the RTU.

The IR1101 provides protocol translation to serve as a SCADA gateway to do the following:

• Receive data from RTUs and relay configuration commands from the Control Center to RTUs.

• Receive configuration commands from the Control Center and relay RTU data to the Control Center.

• Terminate incoming requests from the Control Center, when an RTU is offline.

The IR1101 performs Protocol Translation for the following protocols:

• IEC 60870 T101 to/from IEC 60870 T104.

• DNP3 serial to DNP3 IP

The following terms are relevant when you configure the T101 and T104 protocol stacks on the IR1101:

• Channel–A channel is configured on each IR1101 serial port interface to provide a connection to a single RTU for each IP connection to a remote Control Center. Each connection transports a single T101 (RTU) or T104 (Control Center) protocol stack.

• Link Address–Refers to the device or station address.

• Link Mode (Balanced and Unbalanced)–Refers to the modes of data transfer.

  • An Unbalanced setting refers to a data transfer initiated from the master.

  • A Balanced setting can refer to either a primary or secondary initiated data transfer.

• Sector–Refers to a single RTU within a remote site.

• Sessions–Represents a single connection to a remote site.

The following terms are relevant when you configure the DNP3 protocol stacks on the on the IR1101:

• Channel–A channel is configured on the IR1101 serial port interface to provide a connection to a single RTU for each IP connection to a remote Control Center. Each connection transports a single DNP3 serial (RTU) or DNP3 IP (Control Center) protocol stack.

• Link Address–Refers to the device or station address.

• Sessions–Represents a single connection to a remote site.

In the figure below, the IR1101 (installed within a secondary substation of the Utility Network) employs Protocol Translation to provide secure, end-to-end connectivity between Control Centers and RTUs within a SCADA System.

The IR1101 connects to the RTU (slave) through a RS232 connection. To protect the traffic when forwarded over public infrastructures (for example, cellular), the IR1101 forwards SCADA data from the RTU to the Control Center in the SCADA system through an IPSec tunnel (FlexVPN site-to-site or hub and spoke). The IPSec tunnel protects all traffic between the IR1101 and the Head-end aggregation router. SCADA traffic can be inspected through an IPS device positioned in the path of the SCADA traffic before it is forwarded to the proper Control Center.

RTUs must be configured and operating in the network.

For each RTU that connects to the IR1101, you will need the following information for T101/T104:

• Channel information

  • Channel name

  • Connection type: serial

  • Link transmission procedure setting: unbalanced or balanced

  • Address field of the link (number expressed in octets)

• Session information

  • Session name

  • Size of common address of Application Service Data Unit (ASDU) (number expressed in octets)

  • Cause of transmission (COT) size (number expressed in octets)

  • Information object address (IOA) size (number expressed in octets)

• Sector information

  • Sector name

  • ASDU address, (number expressed in octets)

For each RTU that connects to the IR1101, you will need the following information for DNP3:

• Channel information

  • Channel name

  • Connection type: serial

  • Link address

• Session information

  • Session name

Each channel supports only one session.

Each sessions supports only one sector.

This section includes the following topics:

Note	Before making any configuration changes to a IR1101 operating with Protocol Translation, please review the section on Starting and Stopping the Protocol Translation Engine.

The following example shows how to configure the serial port interface for T101 connection, configure T101 and T104 protocol stacks, and starts the Protocol Translation Engine on the IR1101.

router# configure terminal router(config)# interface async 0/2/0router (config-if)# no shutdownrouter (config-if)# encapsulation scadarouter (config-if)# exitrouter(config)# scada-gw protocol t101router(config-t101)# channel rtu_channelrouter(config-t101-channel)# role masterrouter(config-t101-channel)# link-mode unbalancedrouter(config-t101-channel)# link-addr-size onerouter(config-t101-channel)# bind-to-interface async 0/2/0router(config-t101-channel)# exitrouter(config-t101)# session rtu_sessionrouter(config-t101-session)# attach-to-channel rtu_channelrouter(config-t101-session)# common-addr-size tworouter(config-t101-session)# cot-size onerouter(config-t101-session)# info-obj-addr-size tworouter(config-t101-session)# link-addr 3router(config-t101-session)# exitrouter(config-t101)# sector rtu_sectorrouter(config-t101-sector)# attach-to-session rtu_sessionrouter(config-t101-sector)# asdu-addr 3router(config-t101-sector)# exitrouter(config-t101)# exitrouter(config)# scada-gw protocol t104router(config-t104)# channel cc_master1router(config-t104-channel)# k-value 12router(config-t104-channel)# w-value 8router(config-t104-channel)# t0-timeout 30router(config-t104-channel)# t1-timeout 15router(config-t104-channel)# t2-timeout 10router(config-t104-channel)# t3-timeout 30router(config-t104-channel)# tcp-connection 0 local-port 2050 remote-ip anyrouter(config-t104-channel)# tcp-connection 1 local-port 2051 remote-ip anyrouter(config-t104-channel)# exitrouter(config-t104)# session cc_master1router(config-t104-session)# attach-to-channel cc_master1router(config-t104-session)# cot-size tworouter(config-t104-session)# exitrouter(config-t104)# sector cc_master1-sectorrouter(config-t104-sector)# attach-to-session cc_master1router(config-t104-sector)# asdu-adr 3router(config-t104-sector)# map-to-sector rtu_sectorrouter(config-t104)# exitrouter(config-t104)# session cc_master2router(config-t104-session)# attach-to-channel cc_master2router(config-t104-session)# cot-size tworouter(config-t104-session)# exitrouter(config-t104)# sector cc_master2-sectorrouter(config-t104-sector)# attach-to-session cc_master2router(config-t104-sector)# asdu-adr 3router(config-t104-sector)# map-to-sector rtu_sectorrouter(config-t104-sector)# exitrouter(config-t104)# exitrouter(config)# scada-gw enable

This example configures end-to-end communication between Control Centers and RTUs within a SCADA system using the DNP3 protocol stacks and starts the Protocol Translation Engine on the IR1101:

router# configure terminal router(config)# interface async 0/2/0router (config-if)# no shutdownrouter (config-if)# encapsulation scadarouter (config-if)# exitrouter(config)# scada-gw protocol dnp3-serialrouter(config-dnp3s)# channel rtu_channelrouter(config-dnp3s-channel)# bind-to-interface async 0/2/0router(config-dnp3s-channel)# link-addr source 3router(config-dnp3s-channel)# unsolicited-response enablerouter(config-dnp3s-channel)# exitrouter(config-dnp3s)# session rtu_sessionrouter(config-dnp3s-session)# attach-to-channel rtu_channelrouter(config-dnp3s-session)# link-addr dest 3router(config-dnp3s-session)# exitrouter(config-dnp3s)# exitrouter(config)# scada-gw protocol dnp3-iprouter(config-dnp3n)# channel cc_channelrouter(config-dnp3n-channel)# link-addr dest 3router(config-dnp3n-channel)# tcp-connection local-port default remote-ip anyrouter(config-dnp3n-channel)# exitrouter(config-dnp3n)# session cc_sessionrouter(config-dnp3n-session)# attach-to-channel cc_channelrouter(config-dnp3n-session)# link-addr source 3router(config-dnp3n-session)# map-to-session rtu_sessionrouter(config-dnp3n)# exitrouter(config)# exitrouter(config)# scada-gw enable

Note	IOA addresses obtained from T101 side are sent to T104 side without any modification by the SCADA Gateway

The Cisco IOS XE 17.1.1 release introduces support for the Cisco IOS XE YANG model for the Scada System. Previous releases already provided Yang models in other areas.

https://github.com/YangModels/yang/tree/master/vendor/cisco/xe/17111 .

You can configure the DNP3 serial and DNP3 IP protocol stacks, which allow end-to-end communication between Control Centers and RTUs within a SCADA system.

This example shows the output from the show scada tcp and show scada statistics commands:

router# show scada tcpDNP3 network channel [test]: 4 max simultaneous connectionsconn: local-ip: 3.3.3.21 local-port 20000 remote-ip 3.3.3.15 data-socket 1Total: 1 current client connections 0 total closed connectionsrouter# show scada statistics DNP3 network Channel [test]: 5 messages sent, 2 messages received 0 timeouts, 0 aborts, 0 rejections 2 protocol errors, 2 link errors, 0 address errorsDNP3 serial Channel [test]: 152 messages sent, 152 messages received 1 timeouts, 0 aborts, 0 rejections 0 protocol errors, 0 link errors, 0 address errors

This section lists some debug commands that are helpful when troubleshooting.