Anybus Defender 6019 - License type: NAT/FW
Industrial firewall and security router for segmenting and protecting multiple parts of an OT network. It provides 1× WAN, 8× Gigabit LAN ports and 1× SFP port for an additional RJ45 or fiber-optic connection, for a total of 10 physical network segments with VLAN support. It is available in 3 variants: NAT/FW for NAT and network segmentation, DPI/FW with deep inspection of industrial communication and IPS protection, or PRO/FW with advanced VPN, routing, traffic management and high-availability features. More
Code: ABD6019-NATFW
Industrial firewall and security router for segmenting and protecting multiple parts of an OT network. It provides 1× WAN, 8× Gigabit LAN ports and 1× SFP port for an additional RJ45 or fiber-optic connection, for a total of 10 physical network segments with VLAN support. It is available in 3 variants: NAT/FW for NAT and network segmentation, DPI/FW with deep inspection of industrial communication and IPS protection, or PRO/FW with advanced VPN, routing, traffic management and high-availability features. More
Code: ABD6019-NATFW
Options 3
| License type | Code | Availability | Price excl. VAT | |
|---|---|---|---|---|
| NAT/FW | ABD6019-NATFW | Delivery in 1-2 weeks |
2 610 EUR
|
|
| DPI/FW | ABD6019-DPIFW | Delivery in 1-2 weeks |
3 480 EUR
|
|
| PRO/FW | ABD6019-PROFW | Delivery in 1-2 weeks |
5 075 EUR
|
Anybus Defender 6019
Anybus Defender 6019 is an industrial firewall for isolating and securing multiple machines, production lines, and other parts of the OT network. It helps control communication between individual network segments, resolve IP address conflicts, and limit the spread of security incidents. Depending on the selected variant, it also provides detailed inspection of industrial communication, protection of vulnerable devices without requiring updates, VPN, and advanced networking features.
Why choose Anybus Defender 6019?
- Separates multiple parts of the production network with a single device – 1× WAN, 8× LAN, and 1× SFP allow you to work with up to 10 physical network segments.
- Limits the spread of problems between machines and production areas – communication between individual segments can be controlled using firewall rules.
- Makes it easier to resolve IP address conflicts – NAT can be configured for individual IP addresses, multiple addresses, or entire subnets.
- Can be added to an existing network – a transparent Layer 2 firewall allows interfaces to be bridged and communication to be filtered without changing the IP addressing.
- Supports both copper and fiber connections – depending on the SFP module used, the SFP port can provide an additional RJ45 or fiber connection.
- Allows additional logically separated networks to be created – in addition to physical segments, it also supports VLANs.
- Provides visibility of devices in the OT network – the Asset Discovery & Inventory feature helps identify connected industrial devices.
- Simplifies firewall configuration – the web interface includes wizards and allows rules to be created directly from firewall logs.
Anybus Defender 6019 variants
Anybus Defender 6019 is available in three variants with the same hardware but different ranges of security and networking features:
- NAT/FW – basic protection for network isolation, communication control, and IP address translation,
- DPI/FW – all NAT/FW features + industrial communication inspection, IPS, protection of vulnerable devices without requiring updates, and VPN,
- PRO/FW – all DPI/FW features + advanced routing, network traffic management, and high availability.
Comparison of Anybus Defender variants
| Feature / what it solves | NAT/FW Basic protection and network isolation |
DPI/FW Advanced industrial network protection |
PRO/FW Advanced networking features and high availability |
|---|---|---|---|
| Connecting networks with different or identical IP addresses (NAT 1:1, 1:∞) | ✔ | ✔ | ✔ |
| Firewall with connection state tracking (Stateful Firewall) | ✔ | ✔ | ✔ |
| Network protection without changing IP addresses (Transparent / Bridge Mode) | ✔ | ✔ | ✔ |
| Security certificate management (Certificate Management) | ✔ | ✔ | ✔ |
| Central management of multiple Defenders (Anybus Cybersecurity Console) | ✔ | ✔ | ✔ |
| Automatic discovery and inventory of network devices (Asset Discovery & Inventory) | ✔ | ✔ | ✔ |
| Event notifications by email, Syslog, Telegram, and Pushover | ✔ | ✔ | ✔ |
| Secure remote user connection via VPN (Remote Client VPN) | — | ✔ | ✔ |
| User authentication via corporate accounts (RADIUS, LDAP / Active Directory) | — | ✔ | ✔ |
| Industrial communication inspection and easier rule creation (DPI for EtherNet/IP CIP, Siemens TCP/IP, and Modbus) | — | ✔ | ✔ |
| Protection of vulnerable and legacy devices against known attacks without requiring device updates (IPS / Virtual Patching – Snort, Suricata) | — | ✔ | ✔ |
| Connecting networks through secure VPN tunnels (WireGuard, OpenSSL, IPsec) | — | ✔ | ✔ |
| Automatic IP address assignment and forwarding of DHCP requests (DHCP Server / Forwarding) | — | ✔ | ✔ |
| Enabling and disabling rules based on time (Rules / Policy Scheduler) | — | ✔ | ✔ |
| Login page for granting network access (Captive Portal) | — | — | ✔ |
| Advanced automatic routing between networks (RIP, BGP) | — | — | ✔ |
| Multiple network or internet connections and traffic distribution between them (Load Balancing, Multi-WAN) | — | — | ✔ |
| Management of network traffic priority and bandwidth (Traffic Shaping) | — | — | ✔ |
| Backup firewall to reduce downtime in case of failure (High Availability Redundancy) | — | — | ✔ |
Anybus Defender 6019 NAT/FW
The NAT/FW variant is designed for isolating a larger number of machines, production lines, and other network segments, controlling communication between them, and resolving IP address conflicts.
It includes a stateful firewall, NAT, transparent bridge operation, certificate management, Asset Discovery & Inventory, and support for central management. Thanks to the larger number of physical interfaces, it is suitable, for example, for isolating multiple machines or production cells with a single security device.
Typical applications include segmentation of a larger production area, isolation of several production cells, or connecting devices and networks with identical or overlapping IP addresses.
Anybus Defender 6019 DPI/FW
The DPI/FW variant includes all NAT/FW features and extends them with detailed inspection of the industrial protocols EtherNet/IP CIP, Siemens TCP/IP, and Modbus. The firewall therefore evaluates not only IP addresses and ports, but can also inspect the industrial communication itself.
The integrated traffic analyzer with automatic learning helps identify the industrial communication being used and simplifies rule creation. The Snort and Suricata IPS systems can detect known threats and protect, for example, legacy PLCs, HMIs, and other vulnerable devices without requiring a patch to be installed directly on the device (Virtual Patching). Customizable signatures are also supported.
DPI/FW also supports remote VPN access, secure VPN tunnels using WireGuard, OpenSSL, and IPsec, user authentication via RADIUS and LDAP / Active Directory, DHCP server and DHCP request forwarding, and time-based rule scheduling.
The DPI/FW variant is suitable where network isolation and standard communication filtering alone are not sufficient and more detailed inspection of industrial traffic, protection of vulnerable devices, or secure remote access is also required.
Anybus Defender 6019 PRO/FW
The PRO/FW variant includes all DPI/FW features and extends them with advanced routing, network traffic management, and high availability.
It supports the RIPv1, RIPv2, and BGPv4 routing protocols, Load Balancing, Multi-WAN, and Traffic Shaping. This makes it possible to manage data paths, the use of multiple network connections, bandwidth, and network traffic priority.
The PRO/FW variant also includes a Captive Portal, which can require users to log in before they are granted access to the protected network.
Two devices can be configured in active-standby high-availability mode. If the active unit fails, the backup Defender can take over its function, reducing the risk of network connection interruption.
The PRO/FW variant is suitable for larger OT networks and applications where industrial communication protection needs to be combined with advanced routing, traffic management, and high availability.
Not sure which Defender to choose?
Tell us about your network and what you need to secure. We will recommend the right model and variant.
Consult your Defender selection
Isolation of multiple physical and logical networks
Anybus Defender 6019 is equipped with one Gigabit WAN port, eight Gigabit LAN ports, and one SFP port for an additional RJ45 or fiber connection. In total, it can handle up to 10 physical network segments, while VLANs can be used to create additional logically isolated parts of the network.
It is suitable for applications where a larger number of machines, production cells, or other parts of the OT infrastructure need to be isolated using a single security device. Communication between individual segments can be controlled using dedicated security rules.
Firewall and network communication control
Anybus Defender 6019 uses a stateful firewall and allows precise control of communication between connected network segments. The principle “what is not allowed is denied” restricts communication to connections that are explicitly permitted by configured rules.
It can be used, for example, to separate production and enterprise networks, restrict communication between individual machines, or control access to selected parts of the technology.
Rules can be created directly from firewall logs using the One-Click Easy Rule feature. The Floating Rules feature allows common rules to be applied across multiple network interfaces.
NAT and transparent operation
Simplified NAT configuration allows translation to be set up for individual IP addresses, multiple addresses, or entire subnets. NAT can be used, for example, when connecting parts of a system with different or conflicting IP addressing.
The Defender also supports a transparent Layer 2 firewall. Interfaces can be bridged and communication between them filtered without requiring routing between different IP subnets.
 |
 |
Copper and fiber connections
In addition to nine Gigabit RJ45 ports, Anybus Defender 6019 is equipped with one SFP port. Depending on the SFP module used, it can provide an additional RJ45 or fiber network connection.
Fiber connectivity is suitable, for example, between more distant control cabinets or production areas where fiber cabling is preferable.
Visibility of devices in the OT network
The Asset Discovery & Inventory feature discovers and identifies devices in connected industrial networks. Depending on the available information, it can display details such as the manufacturer, device type, software version, and update level.
The result also includes an identification confidence rating. The feature helps provide an overview of the devices actually connected to the network and detect unknown or unexpected elements in the OT network.
Web interface and management
Configuration is performed through the integrated web interface directly in a web browser. Wizards are available for common use cases and for configuring network and security features.
Rules can be created directly from firewall logs using the One-Click Easy Rule feature, while Floating Rules can be applied across multiple interfaces. Diagnostic tools for monitoring and analyzing network traffic are also included.
A REST API is available for integration with higher-level systems, and a command-line interface via SSH or local console is available for maintenance. Multiple Anybus Defender devices can optionally be managed through the central Anybus Cybersecurity Console.
Online documentation
Online documentation from the manufacturer is available for configuring and working with Anybus Defender features. It contains information on installation, firewall configuration, NAT, DPI, VPN, routing, and other functions depending on the specific model and variant.
Technical specifications
Network interfaces and connection
- WAN: 1× RJ45, Gigabit Ethernet
- LAN: 8× RJ45, Gigabit Ethernet
- SFP: 1× SFP for an additional RJ45 or fiber connection, depending on the module used
- Number of physical network segments: up to 10
- VLAN: yes, for creating additional logically isolated network segments
- Transparent firewall: Layer 2 communication filtering with the option to bridge interfaces
NAT and IP address translation
- NAT configuration: simplified setup for individual IP addresses, multiple IP addresses, or entire subnets
- NAT applications: connecting networks with different or conflicting IP addressing
- Transparent operation: interfaces can be bridged and communication filtered without requiring routing between different IP subnets
Firewall and communication filtering
- Firewall type: stateful firewall
- Default security policy: communication is blocked unless explicitly permitted by configured rules
- One-Click Easy Rule: creates a rule directly from firewall logs
- Floating Rules: common rules that can be applied across multiple network interfaces
- Transparent filtering: Layer 2 traffic filtering between bridged interfaces
Device discovery in the OT network
- Feature: Asset Discovery & Inventory
- Purpose: discovering, querying, and identifying devices in the industrial network
- Detected information: depending on availability, manufacturer, device type, software version, and update level
- Output: overview of discovered devices including an identification confidence rating
Configuration and management
- Configuration: integrated web interface
- Setup wizards: yes, for typical use cases
- Rule creation: manually or using One-Click Easy Rule directly from firewall logs
- Diagnostics: tools for monitoring and analyzing network traffic
- Central management: optionally via Anybus Cybersecurity Console
NAT/FW variant features
- Stateful firewall: yes
- NAT: yes
- Routing: yes
- Transparent Layer 2 firewall: yes
- VLAN: yes
- Asset Discovery & Inventory: yes
- Central management: support for the optional Anybus Cybersecurity Console
Extended features of the DPI/FW and PRO/FW variants
- Deep Packet Inspection (DPI): detailed inspection of supported industrial communication
- Automatic traffic learning: analysis of industrial communication to reduce manual rule creation
- Intrusion Protection System (IPS): integrated Snort and Suricata technologies
- Virtual patching: protection of devices against known methods of exploiting vulnerabilities
- IPS signatures: customizable signatures
- VPN: available depending on the selected license for secure remote access and network interconnection
Extended features of the PRO/FW variant
- VPN: WireGuard, OpenSSL, and IPsec
- Routing protocols: RIPv1, RIPv2, and BGPv4
- Traffic Shaping: network traffic and bandwidth management
- High availability: redundant configuration of two devices in active-standby mode
Power supply
- Supply voltage: 24 VDC
- Maximum current consumption: 1,100 mA at 24 VDC
- Maximum power consumption: 26.4 W
Mechanical and operating specifications
- Dimensions (W × H × D): 69.6 × 179.7 × 140.4 mm
- Weight: 1,270 g
- Enclosure material: metal
- Cooling: passive, fanless
- Degree of protection: IP20
- Operating temperature: 0 to +50 °C at full CPU load, up to +60 °C under typical load
- Mounting: DIN rail according to EN 50022
Frequently Asked Questions (FAQ) – Anybus Defender 6019
Use and network connection
What is Anybus Defender 6019 and what is it used for?
Anybus Defender 6019 is an industrial firewall and security router for isolating and protecting multiple machines, production lines, and other parts of the OT network. It allows communication between network segments to be controlled, NAT to be used, separate networks to be created, and the spread of security incidents to be limited.
How can I isolate multiple machines or parts of a production network with one firewall?
Anybus Defender 6019 has 1× WAN, 8× LAN, and 1× SFP port, allowing up to 10 physical network segments to be created. VLANs can also be used to create additional logically isolated networks and control communication between them using firewall rules.
How can I isolate machines from the enterprise network and allow only the required communication?
Anybus Defender 6019 allows the network to be divided into separate segments and firewall rules to define which communication is allowed between them. For example, only the required connections between machines, the production network, and higher-level systems can be permitted while all other communication is blocked.
How can I secure an existing network without changing device IP addresses?
Anybus Defender 6019 supports a transparent Layer 2 firewall. In a bridge configuration, network interfaces can be connected and communication between them filtered without changing the IP addressing of connected PLCs, HMIs, and other devices.
How can I connect part of an industrial network via fiber?
Anybus Defender 6019 has 1× SFP port in addition to its Ethernet ports. Depending on the SFP module used, it can provide an additional RJ45 or fiber network connection.
Selecting a variant according to the application
What is the difference between Anybus Defender 6019 NAT/FW, DPI/FW, and PRO/FW?
Anybus Defender 6019 NAT/FW provides firewall, NAT, network segmentation, VLAN, and transparent Layer 2 filtering. Anybus Defender 6019 DPI/FW additionally provides Deep Packet Inspection of industrial protocols and IPS with virtual patching. Anybus Defender 6019 PRO/FW further extends the functionality with VPN, advanced routing, Traffic Shaping, and high availability.
How can I connect machines or networks with identical or overlapping IP addresses?
Anybus Defender 6019 supports NAT for individual IP addresses, multiple addresses, and entire subnets. It can therefore be used, for example, when connecting identical machines with the same or overlapping IP addressing without changing the addresses directly in the connected devices. For standard NAT and network segmentation, the Anybus Defender 6019 NAT/FW variant is sufficient.
How can I inspect not only IP addresses and ports, but also industrial communication?
Anybus Defender 6019 DPI/FW and Anybus Defender 6019 PRO/FW support Deep Packet Inspection (DPI) of common industrial protocols. This allows the Defender to inspect industrial communication in more detail than a standard firewall and learn from actual network traffic, making it easier to create security rules.
How can I protect older PLCs or HMIs that can no longer be updated?
Anybus Defender 6019 DPI/FW and Anybus Defender 6019 PRO/FW include IPS based on Snort and Suricata and support virtual patching. Using security signatures, the Defender can block known methods of exploiting vulnerabilities before malicious communication reaches the protected device.
How can I provide secure remote access or connect production networks at different locations?
Anybus Defender 6019 PRO/FW supports VPN using WireGuard, OpenSSL, and IPsec. It can therefore be used for secure remote access as well as encrypted connections between industrial networks at different locations.
How can I provide high availability for a firewall in an industrial network?
Anybus Defender 6019 PRO/FW allows two devices to be used in an active-standby configuration. If the active Defender fails, the backup device can take over its function, making this suitable for networks with high availability requirements.
How can I route and manage traffic between multiple industrial networks?
Anybus Defender 6019 PRO/FW provides advanced routing, including the RIPv1, RIPv2, and BGPv4 protocols, as well as Traffic Shaping. It is suitable for larger OT networks where, in addition to security, routing and network traffic also need to be managed.
Firewall, NAT, and network visibility
How can I easily create industrial firewall rules?
Anybus Defender 6019 allows rules to be created manually or directly from firewall logs using the One-Click Easy Rule feature. The Floating Rules feature allows common rules to be applied across multiple network interfaces.
How does NAT work on the Anybus Defender 6019 industrial firewall?
Anybus Defender 6019 provides simplified NAT configuration for individual IP addresses, multiple addresses, and entire subnets. NAT can be used, for example, when connecting machines or parts of a system with identical or overlapping IP addressing.
How can I find out which devices are connected to the industrial network?
Anybus Defender 6019 includes the Asset Discovery & Inventory feature for discovering and identifying devices on the network. Depending on the available information, it can display details such as the manufacturer, device type, software version, and update level, including an identification confidence rating.
How can I create multiple isolated networks using VLANs?
Anybus Defender 6019 supports VLANs, so in addition to up to 10 physical network segments, additional logically isolated networks can also be created. Communication between them can then be controlled using firewall rules.
Configuration and management
How is Anybus Defender 6019 configured?
Anybus Defender 6019 is configured through the integrated web interface. Wizards are available for typical use cases, along with firewall logs from which rules can be created directly using the One-Click Easy Rule feature.
How can I manage multiple Anybus Defender firewalls from one place?
Multiple Anybus Defender devices can optionally be managed from one place using the Anybus Cybersecurity Console. Central management is suitable, for example, when multiple Defenders are deployed on machines, production lines, or in different parts of a plant.
Highlighted items are mandatory.