130-07E3

Identify connection source

Note the %2 parameter in the alarm message which shows the source IP address attempting the connection. Verify this is an authorized device on your network.

The alarm remains in the error log for security audit purposes even after acknowledgment - useful for tracking unauthorized access attempts

Update browser/application connection

Change the connection URL from http://[control-ip] to https://[control-ip]. Update any bookmarks, DNC configurations, or automated scripts to use the secure protocol.

Modern browsers may cache the HTTP connection attempt - clear browser cache or use Ctrl+Shift+R to force refresh

Verify security settings

Access MOD function (if not locked) > Network Settings > Security. Check the setting 'Enforce secure connections' and verify if this aligns with your shop requirements.

Modifying security settings requires appropriate access rights and may be password protected by machine tool builder

Accept security certificate

If using HTTPS for first time, the browser will prompt about self-signed certificate. Accept and add exception to allow the TNC's certificate for secure communication.

The TNC uses a self-signed certificate by default. For production environments, consider installing a proper SSL certificate via MOD > Certificate Management

Check DNC software version

Verify the version of your DNC software or TNCremo. For TNC 640 and newer controls with current firmware, ensure TNCremo version 2.x or higher which supports secure protocols.

TNCremo versions below 2.0 do not support secure file transfer protocols required by newer TNC security policies

Update connection settings in DNC

In your DNC software configuration, change protocol from FTP to SFTP (SSH File Transfer Protocol) and verify port 22 is accessible. Update any file transfer scripts or automated processes.

Test file transfers with a non-critical program first to verify SFTP connectivity before using in production

Enable SSH/SFTP on control if disabled

Access MOD > System > Network Services and verify that SSH/SFTP service is enabled. Check service status shows 'Active' and port 22 is listening.

Use TNCdiag > Network > Port Status to verify which services are actively running and their port assignments

Configure authentication credentials

Set up proper SSH authentication in your DNC software using the control's user credentials. For automated systems, consider configuring SSH key-based authentication via MOD > User Management > SSH Keys.

Key-based authentication is more secure than password authentication and prevents frequent password entry prompts

Review remote access configuration

Check MOD > System > Network Services > Remote Desktop settings. Verify if VNC service is enabled and what security level is configured (None/VNC Auth/Encryption).

TNC 640 and iTNC 530 support VNC with TLS encryption - always enable encryption for remote access over networks

Enable VNC encryption

In the Remote Desktop settings, change security type from 'VNC Authentication' to 'VNC Authentication + Encryption'. Save changes and restart the VNC service from the service management menu.

VNC service restart will disconnect any active remote sessions - coordinate with operators before making changes

Update VNC client settings

Configure your VNC viewer client (RealVNC, TightVNC, etc.) to use encryption. Enable 'Require encryption' in client settings and reconnect to the control.

Not all VNC clients support encryption - RealVNC and TigerVNC are recommended for encrypted connections to Heidenhain controls

Alternative secure remote access

Consider using SSH tunneling for VNC traffic: establish SSH connection first (ssh -L 5900:localhost:5900 user@control-ip), then connect VNC client to localhost:5900 for encrypted tunnel.

SSH tunneling provides strong encryption even with VNC clients that don't natively support encryption