B&R PLC Remote Connection: ANSL TCP Tunneling & SiteManager Setup

Overview

Connecting an engineering workstation running Automation Studio (AS) to a remote B&R controller (APC2200, APC910, X20 CPU, or older PP series) requires either a routed IP path or a TCP tunnel through an intermediary host. The canonical online port used by the ANSL (Automation Studio Network Layer) protocol is 11169/TCP; Automation Studio targets this port on the controller's IP address by default. When the controller sits behind a customer NAT, firewall, or lacks a public address, you must either (a) install a relay that tunnels 11169 back to your laptop, (b) deploy a B&R SiteManager/SRM gateway, or (c) perform an offline media swap.

This reference covers five field-proven methods in priority order: AnyDesk TCP tunneling, TeamViewer VPN with PVI Manager, B&R SiteManager (SRM) hardware, customer-hosted VPN, and CFast/CompactFlash card swap. Each method has specific prerequisites, port requirements, and compatibility constraints based on PVI runtime version.

Prerequisites

Before attempting any remote connection, verify the following at the customer site:

1. Network reachability — confirm the engineering PC and PLC are on the same IP subnet (e.g., PC 10.21.3.80/24, PLCs 10.21.3.81–90/24). ANSL does not traverse Layer 3 boundaries without explicit routing.
2. ANSL service active on PLC — the controller must have ARwin/CONF runtime loaded with the ANSL server enabled. Default listen port: 11169/TCP.
3. Automation Studio version parity — install the same major AS version that originally programmed the machine. AS4.x projects do not open cleanly in AS3.x.
4. PVI version — if PVI < 4.6 is installed on the remote machine (legacy PP41x/PVIS), AnyDesk TCP tunneling will not establish an ANSL session; use TeamViewer VPN + PVI Manager instead.
5. Remote desktop agent — AnyDesk, TeamViewer, or Chrome Remote Desktop must be pre-installed on the on-site laptop with unattended-access credentials. See Chrome Remote Desktop device setup and Microsoft Remote Desktop Connection for agent installation patterns.

Network Topology and Address Planning

The reference deployment topology for AnyDesk TCP tunneling is:

The remote laptop must remain in the same Layer 2 broadcast domain as the PLCs (or have a static route), because AnyDesk's TCP tunnel is a port forward, not a routed VPN.

Method 1 — AnyDesk TCP Tunneling (Recommended for PVI ≥ 4.6)

This is the fastest field method when the customer has a Windows laptop permanently installed in the control cabinet and connected to the machine network. It requires no hardware, no firewall changes, and works through virtually any NAT.

Step-by-Step Procedure

1. Install AnyDesk on the remote laptop with unattended access enabled.
2. From your office, connect via AnyDesk to the remote laptop.
3. In AnyDesk, open Settings → TCP-Tunneling and configure a new tunnel entry:

   Parameter	Value
   Tunnel name	PLC_ANSL_90
   Source port (remote laptop side)	11169
   Destination host	10.21.3.90
   Destination port	11169

4. Activate the tunnel. AnyDesk binds 127.0.0.1:11169 on your office laptop.
5. In Automation Studio on your office laptop, open the project and choose Online → Connection. Set the target address to 127.0.0.1 and leave the port at the default ANSL value (11169).
6. Click Connect. AS performs the ANSL handshake through the AnyDesk tunnel to the controller at 10.21.3.90.

Why This Works

AnyDesk's TCP Tunneling feature is a SOCKS-style port forward that traverses AnyDesk's relay servers. From Automation Studio's perspective, the controller is reachable on loopback at the standard ANSL port; the actual L3 path is encrypted and relayed by AnyDesk. No changes are required on the controller or the customer firewall.

Limitations

• PVI runtime version < 4.6 on the target PLC breaks the ANSL session negotiation over the tunnel — fall back to Method 2.
• AnyDesk free tier has bandwidth and session-length limits; commercial licenses remove them.
• Only one tunneled controller can be reached per AnyDesk session unless you map multiple source ports (11169, 11170, …) to multiple PLC destinations.

Method 2 — TeamViewer VPN with PVI Manager (PVI < 4.6)

Legacy B&R systems running PVI (Process Visualization Interface) versions older than 4.6 do not negotiate ANSL cleanly through AnyDesk tunnels. The proven workaround is to use TeamViewer's VPN driver plus the legacy PVI Manager on the remote laptop.

1. Install TeamViewer with VPN driver on both laptops.
2. Establish a TeamViewer session, then activate VPN from the connection menu. TeamViewer assigns a virtual IP (typically 7.x.x.x) to each end.
3. On the remote laptop, install PVI Manager matching the controller's PVI runtime version.
4. Launch PVI Manager and verify it can see the controller locally (e.g., TCP/IP → 10.21.3.90:11169).
5. From the office laptop, route the PVI traffic through the TeamViewer VPN to the remote laptop's virtual IP, then to the controller's real IP.

Method 3 — B&R SiteManager / Secure Remote Maintenance (SRM)

B&R's official remote-maintenance product line is Secure Remote Maintenance (SRM), built around the SiteManager gateway hardware (models 4G/E, DSL, and industrial variants). The SiteManager sits between the machine network and the internet and is provisioned through B&R's Remote Maintenance Portal.

Architecture

• SiteManager (customer site) — establishes an outbound TLS tunnel to the SRM portal. No inbound firewall rules required.
• SiteManager Portal (cloud or on-prem) — brokers connections between engineers and machines.
• Engineer workstation — connects to the portal, selects the target machine, and is presented with an ANSL route to the controller.

Deployment Steps

1. Order the SiteManager model that matches the customer's connectivity (DSL for fixed line, 4G/E for cellular).
2. Connect the SiteManager's LAN port to the machine network and its WAN port to the customer's internet gateway.
3. Activate the device against the SRM portal using the printed activation key.
4. From Automation Studio on the engineer laptop, configure an online connection using the SRM portal's published relay address and the controller's machine ID.

Trade-offs

• Pros: Hardware-managed, B&R-supported, multi-user audit trail, firewall-friendly (outbound only).
• Cons: Per-device subscription cost; first-time setup is best performed on site because the SRM portal provisioning UI requires local browser access.

Method 4 — Customer-Hosted VPN

If the customer already maintains a corporate VPN (WireGuard, OpenVPN, IPsec) that can reach the machine subnet, the simplest solution is to obtain VPN credentials and connect from the engineering laptop as if on site. This is functionally identical to being on the local network — Automation Studio will find the controller at its native IP and port.

Verify before relying on this method:

• The VPN profile pushes a route for the machine subnet (e.g., 10.21.3.0/24).
• MTU is at least 1400 to avoid ANSL fragmentation.
• Split-tunneling is disabled or correctly excludes only the machine subnet.

Method 5 — CFast / CompactFlash Program Swap

For firmware or program updates that do not require online debugging, the lowest-tech option is to ship a pre-programmed CFast (APC2200/APC910) or CompactFlash (legacy PP series) card. The on-site technician powers down, swaps the card, and reboots.

This method eliminates the entire network stack from the equation but forfeits online monitoring, breakpoint debugging, and live variable forcing. Always ship the original card back for fallback if the new image misbehaves.

Port and Protocol Reference

PVI / ANSL Compatibility Matrix

Verification Checklist

After establishing the remote session, confirm the following before making any online change:

1. Identity check — verify the controller's serial number, project name, and CPU type match the project you opened in AS.
2. Firmware parity — compare the AR runtime version shown in Online → System Information against the project's expected version.
3. Variable test — force a non-critical boolean, observe the change on the HMI, then revert.
4. Backup first — use Project → Transfer → Backup to capture the live project before any modification.
5. Rollback plan — if using a CFast swap, retain the original card for physical restoration.

Troubleshooting Matrix

Security Considerations

• AnyDesk and TeamViewer are convenient but introduce third-party relay servers — ensure commercial licenses with end-to-end encryption are used, and rotate unattended-access passwords between engagements.
• SRM SiteManager keeps all remote-maintenance traffic inside B&R's audited infrastructure and is the preferred option for production machines handling sensitive processes.
• Customer-hosted VPN is the most secure option when the customer is willing to provision credentials, because no third-party relay touches the ANSL traffic.
• Always enforce the principle of least privilege: ship a temporary VPN or remote-desktop account per engagement, and revoke it after the work is complete.

FAQ