Anybus Defender 4002 - License type: NAT/FW

Anybus Defender 4002

Anybus Defender 4002 is an industrial firewall for isolating and securing machines, production lines, and other parts of the OT network. It helps restrict unwanted communication, resolve IP address conflicts, and protect connected devices when communicating with a higher-level production or enterprise network. Depending on the selected variant, it also provides industrial protocol inspection, protection of vulnerable devices without requiring updates, VPN, and advanced networking features.

Why choose Anybus Defender 4002?

• Reduces the risk of production downtime – by isolating machines and production networks, it helps prevent problems and cyber threats from spreading to other parts of the operation.
• Allows only the required communication – the stateful firewall controls communication according to configured rules and blocks unauthorized connections.
• Makes it easier to connect identical machines – NAT allows multiple machines with identical internal IP addresses to be connected without changing their configuration.
• Can be added to an existing network – in a bridge configuration, it monitors communication without changing the IP addresses of PLCs, HMIs, and other devices.
• Provides visibility of connected devices – the Asset Discovery & Inventory feature helps identify devices in the OT network.
• Simplifies configuration and diagnostics – configuration is performed through a web interface with wizards, diagnostic tools, and the option to create rules directly from firewall logs.
• Can be adapted to the required level of protection – NAT/FW, DPI/FW, and PRO/FW variants are available with the same hardware but different feature sets.

Anybus Defender 4002 variants

Anybus Defender 4002 is available in three variants with the same hardware but different ranges of security and networking features:

• NAT/FW – basic protection for network isolation, communication control, and IP address translation,
• DPI/FW – all NAT/FW features + industrial communication inspection, IPS, protection of vulnerable devices without requiring updates, and VPN,
• PRO/FW – all DPI/FW features + advanced routing, network traffic management, and high availability.

Comparison of Anybus Defender variants

Anybus Defender 4002 NAT/FW

The NAT/FW variant is designed for isolating machines and network segments, restricting access, and resolving IP address conflicts.

It includes a stateful firewall, NAT, bridge operation, certificate management, Asset Discovery & Inventory, and support for central management. It is suitable for applications where it is necessary to define precisely which devices and services may communicate between individual networks.

Typical applications include securing a standalone machine, separating production and enterprise networks, or connecting several identical machines with the same internal IP addressing.

Anybus Defender 4002 DPI/FW

The DPI/FW variant includes all NAT/FW features and extends them with detailed inspection of the industrial protocols EtherNet/IP CIP, Siemens TCP/IP, and Modbus. The firewall therefore evaluates not only IP addresses and ports, but can also inspect the industrial communication itself.

The integrated traffic analyzer with automatic learning helps identify the industrial communication being used and simplifies rule creation. The Snort and Suricata IPS systems can detect known threats and protect, for example, legacy PLCs, HMIs, and other vulnerable devices without requiring a patch to be installed directly on the device (Virtual Patching).

DPI/FW also supports remote VPN access, secure VPN tunnels using WireGuard, OpenSSL, and IPsec, user authentication via RADIUS and LDAP / Active Directory, DHCP server and DHCP request forwarding, and time-based rule scheduling.

The DPI/FW variant is suitable where network isolation and standard communication filtering alone are not sufficient and more detailed inspection of industrial traffic, protection of vulnerable devices, or secure remote access is also required.

Anybus Defender 4002 PRO/FW

The PRO/FW variant includes all DPI/FW features and extends them with advanced routing, network traffic management, and high availability.

It supports the RIPv1, RIPv2, and BGPv4 routing protocols, Load Balancing, Multi-WAN, and Traffic Shaping. This makes it possible to manage data paths, the use of multiple network connections, bandwidth, and network traffic priority.

The PRO/FW variant also includes a Captive Portal, which can require users to log in before they are granted access to the protected network.

Two devices can be configured for high availability. If the active unit fails, the backup Defender can take over its function, reducing the risk of network connection interruption.

The PRO/FW variant is suitable for critical production networks, connections between remote sites, and applications with higher requirements for availability, routing, and network traffic management.

Not sure which Defender to choose?

Tell us about your network and what you need to secure. We will recommend the right model and variant.

Consult your Defender selection

Network connection and protection of network communication

Anybus Defender 4002 is installed between the protected machine network and a higher-level production, enterprise, or other network. It is equipped with one Gigabit WAN port and one Gigabit LAN port. All communication between the two sides passes through the firewall, which evaluates it according to the configured rules.

The firewall follows the principle “what is not allowed is denied”. This makes it possible, for example, to allow a PLC to communicate only with a specific service computer, SCADA system, or data collection server and block all other connections.

Two connection options

Bridge – without changing IP addresses

In a bridge configuration, the Defender can be inserted into an existing network without changing the IP addresses of connected devices. PLCs, HMIs, robots, and drives keep their original configuration, while their communication with the higher-level network starts passing through the firewall.

This configuration is particularly suitable for adding security to an existing machine or production line.

Gateway – network isolation and NAT

In a gateway configuration, the Defender operates as a router between the machine network and the higher-level network. Both sides can use different IP address ranges, while communication between them is controlled using routing, NAT, and firewall rules.

NAT, or Network Address Translation, makes it possible to keep the original addresses inside the machine while communicating with the devices from the higher-level network using translated addresses. This is particularly useful when connecting multiple identical machines with the same internal IP addressing.

Network segmentation using VLAN

VLAN support makes it possible to divide communication into multiple logically isolated networks even when using only two physical Ethernet ports. Individual machines, technologies, or groups of devices can therefore have their own network rules and communicate with each other only to the permitted extent.

Visibility of devices in the OT network

The Asset Discovery & Inventory feature discovers devices in the connected network and, depending on the available information, can identify details such as the manufacturer, device type, software version, update level, or serial number.

This helps create an overview of connected devices and identify unknown or unexpected elements in the network. The feature is included in all Defender 4002 variants.

Web interface and diagnostics

Configuration is performed through the integrated web interface directly in a web browser. Wizards are available for common connection scenarios and for configuring network and security features.

Firewall rules can also be created directly from communication recorded in the log. Diagnostic tools, certificate management, and system logs are also included. The device also supports notifications via email, Syslog, Telegram Messenger, and Pushover.

A REST API is available for integration with higher-level systems. Multiple devices can optionally be managed using the central Anybus Cybersecurity Console.

Online documentation

Online documentation from the manufacturer is available for configuring and working with Anybus Defender features. It contains information on installation, firewall configuration, NAT, DPI, VPN, routing, and other functions depending on the specific model and variant.

Open Anybus Defender online documentation →