Configuring CP 1243-7 LTE as Modbus TCP Server on S7-1200

Overview

The CP 1243-7 LTE (Siemens article number 6GK7243-7KX30-0XE0) is a communications processor that plugs into the left side of an S7-1200 CPU and provides wide-area network connectivity over LTE/UMTS/GSM cellular networks. Although Siemens documentation and forum examples most often show the module used to publish data to a Telecontrol Server or to set up S7-to-S7 connections between two S7-1200 stations, the module is also fully capable of acting as a transparent IP router for the CPU behind it. That capability is what makes the architecture "S7-1200 (Modbus TCP server) reachable from a remote non-Siemens PLC (Modbus TCP client) over a cellular LTE link" workable.

The key engineering constraint is that Modbus TCP is an application-layer protocol that rides on a working TCP/IP connection. The LTE side of the CP 1243-7 LTE must first establish a routable IP path between the remote client and the S7-1200. Once that path is verified (ping, port 502 reachability), the standard S7-1200 MB_SERVER instruction in the user program handles the Modbus TCP exchanges without any CP-specific configuration on top of basic IPv4 routing and firewall rules.

Prerequisites

• CPU: S7-1200 with firmware V4.2 or higher (V4.4+ recommended for current TIA Portal versions). The CPU must support the MB_SERVER instruction; this is standard from firmware V4.0 onward.
• CP 1243-7 LTE: Article 6GK7243-7KX30-0XE0 with current firmware (V2.1.x or later, depending on TIA Portal release).
• Antenna: Siemens ANT794-4MR (omnidirectional, SMA) or equivalent LTE/UMTS antenna matched to the band of the carrier.
• SIM card: Mini-SIM (2FF) from a carrier that provides a public IPv4 address or, more commonly, a private APN with inbound port mapping. Many M2M carriers offer static IP options.
• TIA Portal: V15.1 or later (V16, V17, V18 supported). Match the HSP for the CP 1243-7 LTE.
• User program libraries: "Modbus TCP" instructions delivered with TIA Portal under Instructions > Communication > Communication processor > Modbus TCP. This includes MB_SERVER and MB_CLIENT.
• Network reachability: The remote PLC (Modbus TCP client) must be able to route packets to the WAN IP assigned to the CP 1243-7 LTE and reach TCP port 502.
• Carrier APN: APN name, username, password, and PIN if applicable for the SIM.

CP 1243-7 LTE Module Capabilities and Limits

Per the CP 1243-7 LTE operating instructions, the module supports LTE bands FDD B1, B3, B7, B8, B20, B28 and TDD B38/B40/B41 depending on variant, with fallback to UMTS (B1, B8) and GPRS/EDGE. Maximum downstream rates are 100 Mbps LTE, 42 Mbps UMTS HSPA+, 236 kbps GPRS. The module has one RJ45 Ethernet port for the S7-1200 backplane and operates as a router between the cellular WAN and the local S7-1200.

The CP itself does not understand Modbus TCP. Modbus TCP terminates on the S7-1200 CPU using the MB_SERVER instruction. The CP only forwards IP packets between the cellular WAN and the CPU's IP address on the backplane. This is a critical mental model: the CP is a router, not a gateway.

Hardware Installation

1. Power down the S7-1200. Slide the CP 1243-7 LTE into the leftmost communication slot adjacent to the CPU until it latches. The module is recognized automatically by the CPU.
2. Connect the antenna (ANT794-4MR or equivalent) to the SMA jack on top of the CP. Mount the antenna where LTE signal strength is adequate; signal quality is reported in the CP diagnostics and via the CP_IDENT / web diagnostics pages.
3. Insert the Mini-SIM (2FF) into the SIM holder with contacts facing down, beveled corner as marked on the CP housing. Power up the CPU.
4. Observe the STATUS LED on the CP: green flashing indicates LTE registration attempt; steady green indicates connected to the LTE network and the IP link is up.

TIA Portal Project Setup and CP Configuration

Open the S7-1200 project in TIA Portal and add the CP 1243-7 LTE from the hardware catalog (path: Communication > CP 1200 > CP 1243-7 LTE) into the device configuration of the S7-1200 station, in the slot to the left of the CPU. Then configure the following items in the CP properties:

Ethernet interface of the CP (LAN side)

• IP address: assign a fixed IPv4 address on the same subnet as the S7-1200 CPU's PROFINET interface. Typical choice: 192.168.0.10 for the CPU and the CP acts as router with 192.168.0.1 on the LAN side. The CP's LAN IP is the default gateway the CPU uses for outbound traffic.
• Subnet mask: 255.255.255.0.

Mobile network interface (WAN side)

• APN: as supplied by the M2M carrier.
• APN user / password: as supplied (may be empty for transparent APNs).
• PIN: only if the SIM requires one.
• Preferred network: LTE preferred with UMTS/GPRS fallback (default).
• DNS server: automatic unless the carrier requires static DNS.
• Authentication protocol: PAP or CHAP per carrier requirement.

Firewall / security settings

• The CP firewall is enabled by default with a restrictive policy. Open TCP port 502 inbound from the remote client's public IP (or from any for testing only). The MAC firewall is separate from the IP firewall; both can restrict unsolicited inbound.
• If the carrier uses NAT (CGNAT), inbound connections to port 502 from the public Internet will fail unless the carrier provides port mapping or a static public IP. Verify with the carrier before commissioning.

Step-by-Step: Verify TCP Connectivity Before Modbus

Before configuring any Modbus registers, prove that the LTE path is delivering routable packets between the remote client and the S7-1200's CPU IP. Two practical methods:

Method 1 — Ping from the remote site

1. Determine the WAN IP of the CP 1243-7 LTE. This is either a static public IP supplied by the carrier or the public IP of the carrier's NAT gateway (visible from a PC on the same LTE network).
2. From the remote Modbus TCP client PLC (or a service laptop), issue ping <CP-WAN-IP> and confirm reply.
3. From the S7-1200 side, ping the remote client's public IP using the CP ping diagnostic or a free PROFINET diagnostic tool. Successful echo on both directions confirms bidirectional IP routing.

Method 2 — Port-502 reachability with a generic TCP client

1. From a service laptop, use Test-NetConnection -ComputerName <CP-WAN-IP> -Port 502 (PowerShell) or nc -vz <CP-WAN-IP> 502 to verify that the firewall accepts inbound TCP 502. A successful TCP handshake before MB_SERVER is even running proves the path is clear; if it succeeds only after MB_SERVER is running, the CP firewall is correctly filtering.

Modbus TCP Server Configuration on S7-1200

Modbus TCP server function on the S7-1200 is delivered by the MB_SERVER instruction in the "Modbus TCP" library that ships with TIA Portal. The instruction runs in the CPU, not on the CP. The CP simply forwards TCP port 502 packets to the CPU's PROFINET IP.

Add the MB_SERVER instruction

1. In the S7-1200 program block (e.g., OB1 or a cyclic OB), add a new instance DB and drop the MB_SERVER instruction from Instructions > Communication > Modbus TCP.
2. Configure the instruction's input pins as below.

The MB_SERVER instruction handles up to 8 concurrent TCP connections in V4.4+ firmware. Each connection consumes roughly 1 KB of work memory and a portion of the CPU's connection resources. For most remote-telemetry use cases a single connection is sufficient.

Define the data image

Map the PLC tags you want to expose (sensor readings, actuator commands, status) into the Modbus address space using the MB_HOLD_REG pointer. For example, to expose DB100.DBWord0 through DB100.DBWord49 as Modbus holding registers 40001–40050:

Function code 03 (read holding), 06 (write single), 16 (write multiple) are supported natively by MB_SERVER. Function codes 01, 02, 05, 15 are supported via the discrete I/O image, configured separately if needed.

Security and Hardening Notes

• Firewall allowlist: Permit only the public IP (or VPN peer IP) of the remote client on TCP 502. Avoid 0.0.0.0/0 in production.
• Disable S7-1200 web server if not required; the web server is a known attack surface on WAN-facing CPUs.
• Set CPU access protection: in the CPU properties, restrict PUT/GET and Modbus write access with a password.
• TLS / VPN: Modbus TCP has no built-in encryption. If the data crosses untrusted networks, terminate it inside an IPsec tunnel. The CP 1243-7 LTE supports IPsec VPN connections per its manual.
• Carrier SIM PIN: leaving the PIN disabled is operationally convenient but a SIM-cloning risk; enable PIN if the carrier allows it.

Verification Procedure

1. Compile and download the project. The CP will reboot and reconnect to LTE; expect ~30–90 seconds for re-registration.
2. Confirm STATUS LED is solid green and the online diagnostics show the WAN IP, signal strength (RSSI/RSRP), and APN.
3. From the remote site, run a Modbus TCP client test (e.g., modpoll or any PLC vendor's Modbus TCP client) reading register 40001. Expect the value mapped in MB_HOLD_REG.
4. Perform a write test (function code 06 or 16) to a non-safety register and confirm the value lands in the corresponding DB word.
5. Disconnect the LTE antenna briefly and verify the connection drops and re-establishes within ~30 seconds after reconnection, with the Modbus client transparently re-connecting.

Troubleshooting Matrix

Alternative Architectures

If CGNAT prevents inbound Modbus TCP, three viable alternatives exist:

• Inverted roles: keep the S7-1200 as a Modbus TCP client using MB_CLIENT and have it dial the remote server. Useful when the remote side has a public IP but the S7-1200 side does not.
• VPN hub: deploy an IPsec tunnel from the CP to a central VPN concentrator and route Modbus TCP privately. The CP 1243-7 LTE operating instructions describe IPsec configuration in detail.
• Telecontrol Server Basic: use the CP's native telecontrol functionality to publish data points to a Siemens Telecontrol Server and let the remote system poll the server instead of the PLC directly.

Field-Proven Caveats

• Carrier selection matters more than the module. Choose an M2M carrier that offers static public IPv4 or a documented inbound port mapping. Consumer mobile SIMs almost always sit behind CGNAT.
• Antenna placement: indoor LTE performance is unreliable. Use an outdoor-rated antenna mounted clear of metal obstructions, and aim for RSRP > -100 dBm.
• CPU connection count: each Modbus TCP connection uses one of the S7-1200's open communication resources. The CPU firmware manual lists the maximum number of connections per resource type.
• Watchdog timeouts: long GPRS fallback paths can exceed the default Modbus client timeout. Raise the client-side timeout to 10–30 seconds for cellular links.