IEC 62443-4-2 SL2 Certified Routers
The routers are intended for applications where compliance with IEC 62443-4-2 Security Level 2 is required for the relevant Industrial Automation and Control System (IACS) component. IEC 62443-4-2 defines technical security requirements for IACS components and assigns a level of protection against intentional violations using simple means, low resources, generic skills and low motivation.
IEC 62443-4-2 SL2 Certified Models Available for Ordering can be found in our Router Selector
Basic Characteristics
The routers combine a specific production process and dedicated hardware capabilities, including CPU security features and OTP memory, with a hardened Linux-based ICR-OS firmware. Compared with standard ICR products, the SL2-certified routers use a more controlled software environment with limited configuration and extension options. This approach reduces the available attack surface while retaining the essential configuration and networking functionality required for industrial applications.
Throughout their lifecycle, IEC 62443-4-2 SL2-certified routers receive firmware updates through a dedicated firmware branch, ICR-OS S1, developed specifically for this product group and available from the Advantech website.
ICR-OS S1 is exclusively intended for IEC 62443-4-2 SL2-certified routers. It cannot be installed on standard ICR router models, and standard ICR-OS firmware cannot be installed on SL2-certified models.
IEC 62443-4-2 SL2 Routers Differentiation
| Key Differences Between IEC 62443-4-2 SL2 Routers and Standard Routers | IEC 62443-4-2 SL2 Routers | Standard Routers |
|---|
| Certification for IEC 62443-4-2 SL2 (level 2) | Yes | No |
| Secure boot | Yes | No |
| Read-only filesystem with integrity checks | Yes | No |
| Default username | admin | root |
| Router App format | .raw | .tgz |
| Min password requirements** | 12 chars, 3 classes | 6 chars, 1 class |
| Mandatory account lock | Yes | No |
| Available cryptographic algorithms* | strong only | both weak and strong |
| Web Admin | HTTPS only | HTTP and/or HTTPS |
| OpenVPN Security Level | 2 (medium) .. 5 (very high) | 0 (weak) .. 5 (very high) |
| FTP and Telnet | No | Yes |
| FW Support End indicator | Yes | No |
| Advanced Intrusion Detection Environment (AIDE) | Yes | No |
| Encrypted firmware image | Yes | No |
| Using scripts** | No | Yes |
| Root access (sudo) | limited set of commands | full |
| Wi-Fi AP/Station "Extra Options" | No | Yes |
| HTTP Content-Security-Policy | strict | permissive |
| Persistent syslog | mandatory | optional |
| IPsec aggressive mode | No | Yes |
| Persistent data storage | combined (/var) | router apps (/opt), user data (/var/data) |
IEC 62443-4-2 SL2 Router GUI
The SL2-certified routers retain the familiar web-based interface used for router configuration. Configuration functions are logically organized into categories, allowing users to configure and manage the router without changing the basic operating concept of the standard ICR products.
IEC 62443-4-2 SL2 Router Compatibility
IEC 62443-4-2 SL2 routers do not support native scripting available on standard ICR products. This restriction is part of the controlled software environment used to support the required security capabilities.
The functionality of the routers can nevertheless be extended using dedicated Router Apps instead of scripts. These Router Apps are different from those used with standard ICR-OS firmware and are distributed in .raw format.
Customers can also develop their own Router Apps in .raw format. In such cases, the customer or software developer is responsible for the security of the developed software and for ensuring that its use does not compromise the security of the router or the intended security level of the application.
IEC 62443-4-2 SL2 routers can also be integrated with other routers, network components and monitoring or management systems. Note that in this case, the system integrator is responsible for complete system cybersecurity certification (if required).
FAQ
?Is there any difference in the GUI between standard routers and IEC 62443-4-2 SL2 routers?
The SL2-certified routers retain the familiar web-based interface used for configuration of all our routers. For users who configure the router via the GUI there is virtually no difference between a standard router and an IEC 62443-4-2 SL2-certified router. Configuration functions are logically organized into categories allowing users to configure and manage the router without changing the basic operating concept of standard ICR products. You can identify an SL2-certified router by the "S1" label in the router model name within the web GUI. The orange color scheme also distinguishes it from the green color used in the standard production web GUI.
?I already have Advantech routers in my network. Is it possible to update them to become IEC 62443-4-2 SL2 routers?
No this is not possible. Routers must be ordered as IEC 62443-4-2 SL2-certified routers and produced as such directly at Advantech's manufacturing facility. The list of models holding IEC 62443-4-2 SL2 certification is available in the section "IEC 62443-4-2 SL2 Certified Models Available for Ordering" on this web page.
?I am currently operating scripts on standard Advantech routers. Can I use those scripts with IEC 62443-4-2 SL2-certified routers?
Scripts are not supported on IEC 62443-4-2 SL2-certified routers for security reasons. If you need to customize router behavior you can create a Router App for IEC 62443-4-2 SL2-certified routers in .raw format and upload it to the router(s).
?Can I use Router Apps designed for standard Advantech routers on IEC 62443-4-2 SL2-certified routers?
No this is not possible. Only Router Apps developed specifically for IEC 62443-4-2 SL2-certified routers and using the
.raw extension can be used. See the list
here.
?Is the firmware for IEC 62443-4-2 SL2-certified routers regularly updated?
Yes the firmware is continuously developed to address the latest security recommendations and improve the overall customer experience. Firmware updates are performed in the same way as with standard products using the dedicated ICR-OS S1 firmware branch.
?Does a firmware update or new firmware release for IEC 62443-4-2 SL2-certified routers affect the existing certification in any way?
Every release of the ICR-OS S1 firmware branch dedicated to IEC 62443-4-2 SL2-certified routers is based on the security architecture of the original firmware that passed IEC 62443-4-2 SL2 certification. New firmware releases are developed to preserve compliance with the security requirements covered by the IEC 62443-4-2 SL2 certification.
