Experimental Physics and
Industrial Control System

The IOC servers can't do what you're trying, any port they accept connections through will be r/w unless you configure Access Security for the clients, in which case you don't need the second port. Michael added IP address support to the access security system fairly recently (I forget if you have to turn it on though), so if you know what all the IP addresses or DNA names are of one or the other client groups (r/w or r/o) you can just set up an access security file with a HAG containing just those addresses. I forget whether it allows for subnet addresses. However, that only works for IOCs recent-enough versions of Base.

 

It would be relatively easy to run separate CA (and PVA) gateways on a other ports to provide read-only access; this would work for all EPICS versions.

 

- Andrew