Advanced network settings
Data usage
Tip
See Data usage for more information about the data usage of the SmartgridOne Controller.
For troubleshooting high data usage, see also Troubleshooting - Data usage
Wiring
See wiring & connectivity guidelines for wiring the Ethernet network.
Security policy
Security policy: Download the PDF.
Firewall
Network ports for outbound connections
Tip
Most home and small business networks allow all outbound connections by default. You do not have to do anything in this case.
The SmartgridOne Controller requires that outbound connections in the network firewall are allowed on the following ports:
- TCP port 80 & 443: General Internet connection port. Without this port, the SmartgridOne Controller cannot function. Some monitored & controlled devices use port 80 locally for communication, but this port is not generally used for internet communication.
- TCP port 1194: Remote service connection port for updates, diagnostic services and remote support. The SmartgridOne Controller can function without this port, but may not receive updates, and remote support is not possible. It is recommended to enable this port. You can change this port in the SmartgridOne Controller configuration to port 1192 or any port in the range 35000 to 40000 if needed.
- TCP port 1883 and 8883: Used for MQTT; required in case the SmartgridOne Controller must be able to receive live control signals (e.g. when coupled to the imbalance / FCR energy markets!)
- UDP port 123: NTP Port (Clock). Without this port, the SmartgridOne Controller cannot update its internal clock. This is important for proper communication.
- ICMP echo (ping): The SmartgridOne Controller verifies its own internet connection by pinging a few well-known hosts (see Connectivity check below). ICMP is a protocol of its own, not a TCP or UDP port, so it needs its own firewall rule. Without it the SmartgridOne Controller still sends all its data, but it cannot confirm its own connection: software from release 1.32 onwards then falls back to an HTTPS check of the cloud, keeps running normally and shows the blocked ping as a warning on its login page; older software considers the controller offline and restarts it every hour in an attempt to recover the connection.
Warning
Application inspection / IPS on the remote commissioning interface The remote commissioning interface reaches the SmartgridOne Controller through an OpenVPN tunnel to vpn.eniris.be on TCP port 1194. Some corporate firewalls and mobile (private APN) networks inspect the content of allowed connections and silently drop VPN protocols even though the port itself is open: the connection opens, but the first packet of the tunnel never arrives. Make sure the connection from the SmartgridOne Controller to vpn.eniris.be is exempt from application control, IPS and deep packet inspection. The typical symptom is a SmartgridOne Controller that sends its data normally but cannot be reached through the remote commissioning interface.
Connectivity check (ICMP)
The SmartgridOne Controller regularly checks whether it is online by sending an ICMP echo request (a ping) to the following hosts, in this order, and stops at the first one that answers:
- eniris.be
- authentication.eniris.be
- google.com
- time.sckcen.be
Allowing ICMP echo request/reply between the SmartgridOne Controller and eniris.be is enough; the other hosts are fallbacks. Also let ICMP fragmentation needed messages reach the SmartgridOne Controller: they are part of normal TCP operation, and networks that drop them cause stalled connections.
Warning
A network that blocks ICMP looks like a working installation, but is not Corporate firewalls and mobile (private APN) networks often drop ICMP towards the internet. All measurements then still arrive normally, but the SmartgridOne Controller cannot confirm its own connection with a ping. Software from release 1.32 onwards falls back to an HTTPS check of the cloud, stays online and shows ping blocked on its login page. Older software reports itself as offline in the connectivity overview and, after one hour without a successful ping, restarts itself to recover a connection it believes is lost - and keeps doing so every hour. If a SmartgridOne Controller sends data but shows as offline, or restarts about once an hour, check the ICMP rules of the network first.
Network ports for inbound connections
The SmartgridOne Controller does not require opening any network ports for inbound connections.
Warning
It is strongly discouraged and NOT necessary to configure your firewall to port forward or allow incoming TCP and UDP connections on the listed ports above! This is a serious security risk.
Domain whitelist
To avoid connectivity issues after future updates, it is recommended to whitelist all the eniris.be and eniris.io domains with a wildcard:
- *.eniris.be
- *.eniris.io
- a2j3w1vc0ecyne-ats.iot.us-east-1.amazonaws.com (Only when using Yuso)
At least the following SmartgridOne domains are used at present by the SmartgridOne Controller:
- api.eniris.be - (telemetry & energy measurements) - TCP port 443:
- authentication.eniris.be - (authentication) - TCP port 443
- public-health.eniris.be - (device health monitoring system) - TCP port 443
- mender.eniris.be - (device update system) - TCP port 443
- public-mender.eniris.be - (device update system) - TCP port 443
- mqtt.eniris.be - (MQTT) - TCP ports 1883 & 8883
- neoregistry.eniris.be - (device update system) - TCP port 443
- neodata-ingress.eniris.be - (data ingress api) - TCP port 443
- vpn.eniris.be - (remote commissioning interface, OpenVPN) - TCP & UDP ports 1192-1194 and 35000-40000 - must be exempt from application inspection / IPS
- eniris.be - (connectivity check) - ICMP echo request/reply (ping); fallback hosts: authentication.eniris.be, google.com, time.sckcen.be
- ntp.eniris.be - (clock synchronization) - UDP port 123
Fixed IP addresses
The SmartgridOne Controller is by default configured to use DHCP. You can change this to a fixed IP address in the 'Settings' tab of the commissioning interface.
Tip
Only configure a fixed IP address in the SmartgridOne Controller if you have no other choice. It is recommended to always use DHCP, and configure your router to always assign the same IP address to the SmartgridOne Controller instead!
Warning
Write down the IP address you configure. You will need this if the SmartgridOne Controller would become inaccessible after changing the IP address!
Note
Lost access to the commissioning interface If you lose access to the commissioning interface after setting a fixed IP address, then check out the troubleshooting section.
VLAN
Tip
As an optional security measure, the SmartgridOne Controller can be placed within a dedicated VLAN. When implementing this configuration, ensure that all devices requiring communication with the controller are assigned to the same VLAN.