Anybus Defender 6004 - License type: NAT/FW

Anybus Defender 6004

Anybus Defender 6004 is an industrial firewall for isolating and securing machines, production lines, and other parts of the OT network. It helps restrict unwanted communication, resolve IP address conflicts, and protect connected devices when communicating with the production or enterprise network. Depending on the selected variant, it also provides industrial protocol inspection, protection of vulnerable devices without requiring updates, VPN, and advanced networking features.

Why choose Anybus Defender 6004?

• Connects up to four physical network segments – 1× WAN and 3× independently configurable LAN ports allow multiple parts of the system to be isolated using a single device.
• Reduces the risk of problems spreading through the network – individual machines, lines, or production areas can be separated from one another and only the required communication can be allowed between them.
• Makes it easier to connect identical machines – NAT allows systems with identical internal IP addresses to be connected without changing their configuration.
• Can be added to an existing network – in a bridge configuration, it controls communication without changing the IP addresses of PLCs, HMIs, and other devices.
• Provides visibility of connected devices – the Asset Discovery & Inventory feature helps identify devices in the OT network.
• Simplifies firewall configuration – configuration is performed through a web interface with wizards, and rules can be created directly from recorded communication.
• Can be adapted to the required level of protection – NAT/FW, DPI/FW, and PRO/FW variants are available with the same hardware but different feature sets.

Anybus Defender 6004 variants

Anybus Defender 6004 is available in three variants with the same hardware but different ranges of security and networking features:

• NAT/FW – basic protection for network isolation, communication control, and IP address translation,
• DPI/FW – all NAT/FW features + industrial communication inspection, IPS, protection of vulnerable devices without requiring updates, and VPN,
• PRO/FW – all DPI/FW features + advanced routing, network traffic management, and high availability.

Comparison of Anybus Defender variants

Anybus Defender 6004 NAT/FW

The NAT/FW variant is designed for isolating machines and production networks, controlling permitted communication, and resolving IP address conflicts. Thanks to three independently configurable LAN ports, a single Defender can isolate multiple physical network segments.

It includes a stateful firewall, NAT, transparent bridge operation, certificate management, Asset Discovery & Inventory, and support for central management.

Typical applications include isolating several machines or production cells from the higher-level network, creating a controlled connection between OT and IT, or connecting multiple systems with identical or overlapping IP addresses.

Anybus Defender 6004 DPI/FW

The DPI/FW variant includes all NAT/FW features and extends them with detailed inspection of the industrial protocols EtherNet/IP CIP, Siemens TCP/IP, and Modbus. The firewall therefore evaluates not only IP addresses and ports, but can also inspect the industrial communication itself.

The integrated traffic analyzer with automatic learning helps identify the industrial communication being used and simplifies the creation of corresponding rules. The Snort and Suricata IPS systems can detect known threats and protect, for example, legacy PLCs, HMIs, and other vulnerable devices without requiring a patch to be installed directly on the device (Virtual Patching).

DPI/FW also supports remote VPN access, secure VPN tunnels using WireGuard, OpenSSL, and IPsec, user authentication via RADIUS and LDAP / Active Directory, DHCP server and DHCP request forwarding, and time-based rule scheduling.

The DPI/FW variant is suitable where network isolation and standard communication filtering alone are not sufficient and more detailed inspection of industrial traffic, protection of vulnerable devices, or secure remote access is also required.

Anybus Defender 6004 PRO/FW

The PRO/FW variant includes all DPI/FW features and extends them with advanced routing, network traffic management, and high availability.

It supports the RIPv1, RIPv2, and BGPv4 routing protocols, Load Balancing, Multi-WAN, and Traffic Shaping. This makes it possible to manage data paths, the use of multiple network connections, bandwidth, and network traffic priority.

The PRO/FW variant also includes a Captive Portal, which can require users to log in before access to the protected network is granted.

Two devices can be configured in active-standby high-availability mode. If the active unit fails, the backup Defender can take over its function, reducing the risk of interruption to critical network communication.

The PRO/FW variant is suitable for larger production networks, applications with multiple network connections, and environments with higher requirements for availability, routing, and network traffic management.

Not sure which Defender to choose?

Tell us about your network and what you need to secure. We will recommend the right model and variant.

Consult your Defender selection

Isolation of multiple physical and logical networks

Anybus Defender 6004 is equipped with one Gigabit WAN port and three Gigabit LAN ports. The three independently configurable LAN ports make it possible to connect and isolate several machines, production cells, or other network segments without requiring an additional router or firewall.

Each interface can have its own communication rules. Individual parts of the system can therefore communicate with the higher-level network or with one another only within the permitted scope. VLAN support allows additional logically isolated networks to be created on the physical interfaces.

Defender 6004 is therefore suitable, for example, for isolating several production cells, service networks, data acquisition systems, or other parts of the OT infrastructure. For suitable applications, one of the LAN ports can also be configured as a second WAN port.

A firewall that allows only the required communication

All communication between connected networks passes through the stateful firewall. The Defender uses the principle “what is not allowed is denied”, so network communication is blocked unless it is explicitly permitted by configured rules.

For example, a PLC can be allowed to communicate only with a specific service computer, production data can be made available to a SCADA or MES system, while access to other parts of the production network remains blocked. Rules can be configured for individual interfaces or as common rules that apply to multiple interfaces.

Two connection modes

Bridge – without changing IP addresses

In a bridge configuration, the Defender can be added to an existing network connection without changing the IP addresses of connected devices. PLCs, HMIs, robots, drives, and other devices retain their original settings, while their communication starts passing through the firewall.

This configuration is particularly suitable for retrofitting security to an existing machine or production line where changing the network configuration would require a complex intervention or production downtime.

Gateway – network isolation and NAT

In a gateway configuration, the Defender operates as a router between isolated networks. Individual segments can use different IP address ranges, and communication between them is controlled using routing, NAT, and firewall rules.

NAT, or Network Address Translation, makes it possible to keep the original IP addresses inside the machine while communicating with the devices from the higher-level network using translated addresses. This is particularly useful when connecting multiple identical machines with the same internal IP addressing.

Visibility of devices in the OT network

The Asset Discovery & Inventory feature discovers devices in connected networks and, depending on the available information, can identify details such as their manufacturer, type, software version, update level, or serial number.

This helps provide an overview of the devices actually connected to the network and identify unknown or unexpected elements. The result also includes an identification confidence rating. The feature is available in all Defender 6004 variants.

Web interface and diagnostics

Configuration is performed through the integrated web interface directly in a web browser. Wizards are available for common connection scenarios and for configuring network and security features.

Rules can also be created directly from communication recorded in the firewall logs. The One-Click Easy Rule feature makes it easier to create the rules required for system operation. Common rules that can be applied across multiple interfaces are also available.

Diagnostic tools and network traffic analysis tools are included. A REST API is available for integration with higher-level systems, while maintenance can also be performed through the CLI via SSH or a local console. Multiple devices can optionally be managed using the central Anybus Cybersecurity Console.

Online documentation

Online documentation from the manufacturer is available for configuring and working with Anybus Defender features. It contains information on installation, firewall configuration, NAT, DPI, VPN, routing, and other functions depending on the specific model and variant.

Open Anybus Defender online documentation →