Configuring GET Communication Across Siemens CP343-1 Advanced

The CP 343-1 Advanced is a full-featured communications processor for the SIMATIC S7-300 family that provides TCP/IP, ISO-on-TCP, UDP, S7, and PROFINET connectivity. A recurring engineering problem is the use of the GET function block across this CP when the local CPU (for example an S7-317-2 PN/DP) and the partner CPU (for example an S7-315) are split across two different IP subnets, with the partner S7-315 accessed only through its CP 343-1 Advanced. The S7-300 to S7-300 GET path must be configured as an S7 communication that targets the partner CPU slot, not the CP slot, even when the IP packet terminates at the CP. The CP performs S7 routing and forwards the S7 PDU to the backplane CPU.

This article consolidates the configuration rules, TSAP layout, NetPro setup, block selection, and field-proven troubleshooting checks required to make GET/PUT communication work across a CP 343-1 Advanced. All references link to official Siemens Industry Online Support pages and the CP 343-1 Advanced equipment manual.

1. Problem Definition

The application is a unidirectional read of process data from a remote S7-315 station into a local S7-317-2 PN/DP station. The S7-317-2 PN/DP is on the plant network and contains no CP of its own. The S7-315 sits on a separate (local) network segment. The S7-315 has a CP 343-1 Advanced fitted in slot 4 of the rack; the CPU occupies slot 2. The CP is the only element of the S7-315 station that is visible on the plant network.

The symptom reported in the field is a fully configured, "unspecified" S7 connection in NetPro that points at the CP's IP address, paired with rack 0 / slot 4 in the partner TSAP field and a literal string "FD" in the TSAP subfield. The GET call in OB1 never returns DONE, the STATUS/RERROR/NDR outputs do not toggle to the success state, and the block returns a STATUS code in the high word. The connection is administratively up but the data exchange never completes.

The root cause is consistent across the class of problem: the S7 connection must reference the CPU's rack/slot (slot 2 in this example), not the CP's (slot 4), and the TSAP must use the S7 connection resource byte that resolves to a CPU endpoint. The CP 343-1 Advanced supports S7 routing, so packets addressed to the CPU slot are forwarded by the CP into the backplane. Packets addressed to the CP slot terminate in the CP and never reach the application.

2. Prerequisites

1. STEP 7 V5.5 SP2 (or later V5.x) with the HSP for the CPU 31x family installed. The configuration tools are SIMATIC Manager, NetPro, and HW Config. The same workflow applies to STEP 7 Professional in the TIA Portal with the S7-300 add-on packages; this article uses the classic STEP 7 V5.x form because CP 343-1 Advanced projects are typically maintained in SIMATIC Manager.
2. Firmware on CP 343-1 Advanced: firmware V2.x or V3.x (see the CP 343-1 Advanced Equipment Manual, section "Firmware versions and functional scope"). For S7 routing with security features enabled, firmware V3.0.23 or later is required.
3. SIMATIC NET CD or its successor DVD image containing the S7-300 Standard Library with the PUT and GET function blocks (FB12, FB13). Library name: Standard Library > Communication Blocks.
4. PG/PC Ethernet interface assigned to the same plant network as the CP 343-1 Advanced, with TCP/IP enabled in the PG/PC interface selection (Set PG/PC Interface > TCP/IP <your NIC>.S7ONLINE).
5. CPU 317-2 PN/DP and CPU 315-2 DP/PN with hardware configuration loaded and a successfully built SD/Flash card. The S7-315 must show "RUN" with no SF/BF errors.
6. IP plan: the CP's plant-side IP address, the local CPU's IP, and the subnet mask. If the partner CPU is on a separate IP subnet, define the IP gateway in the CP's Ethernet interface.

3. Network Architecture

The reference architecture is two IP subnets separated by an L3 boundary. The local station (S7-317-2 PN/DP) is on subnet A (e.g. 10.10.0.0/16). The CP 343-1 Advanced is on subnet A and acts as the visible endpoint. The CPU 315 is on subnet B (e.g. 192.168.10.0/24) and is reachable only through the CP's second Ethernet interface or through a gateway in the CP. The CP performs routing between the two IP subnets and also performs S7 routing on the S7-300 backplane.

The CP must be configured with a default gateway in its Ethernet interface properties ("Router") so that any traffic it originates toward the CPU's IP subnet is forwarded correctly. The S7 connection's local endpoint is the local CPU's PN interface; the partner endpoint is the partner CPU's backplane address reached through the CP.

4. Hardware Configuration of the CP 343-1 Advanced

Open HW Config for the S7-315 station. Verify the following in the CP 343-1 Advanced properties dialog.

1. Ethernet interface: assign a fixed IP address. Enable Use router and enter the IP gateway that can reach the CPU's subnet if the CP is on a different subnet than the CPU. With the default architecture above, the CP is on the plant network and the CPU is on the local network; the CP must use the IP router of the local network as its default gateway so that S7 routing back to the CPU is possible.
2. S7 routing: the CP 343-1 Advanced supports S7 routing by default. Confirm Activate S7 routing is checked in the CP's Options dialog. If the CP is also used as a PROFINET IO controller, routing still works but consumes additional CP resources.
3. Security features: if the Security function is enabled, the CP 343-1 Advanced manual requires that the interfaces used by S7 routing are not blocked by the firewall. Open the Security > Firewall rules and ensure that the IP/port pairs used by S7 communication (ISO transport, port 102) are allowed for both the partner IP and the local IP.
4. Time-of-day synchronization and NTP are not required for the GET to work, but if a Secure Communication certificate is in use, ensure the CP's system time is valid before commissioning.

5. NetPro S7 Connection Configuration

The S7 connection is created in NetPro, not in the block. Once the connection is administratively online, the GET/PUT blocks reference it by its connection ID (hexadecimal handle).

5.1 Insert the connection on PLC1 (CPU 317-2 PN/DP)

1. Open the S7-317 station in NetPro.
2. Right-click the CPU icon > Insert New Connection.
3. Connection partner: unspecified. Connection type: S7 connection.
4. The local endpoint is the CPU 317's PN interface; the local ID is assigned automatically (typically 1 for the first S7 connection, hex 0001).
5. In the partner address tab, enter the CP's IP address (10.10.5.21 in the example). This is the IP that TCP transport will actually use.
6. Open Address Details to set the TSAP pair.

5.2 TSAP layout

The TSAP is a 2-byte ISO transport address. For S7 connections to a CPU, the convention is:

• Local TSAP = 01.HH where HH is the local rack-slot in hex (rack*32 + slot for an S7-300).
• Partner TSAP = 01.HH where HH is the partner rack-slot in hex.

Examples for the reference architecture:

The reported symptom of using "FD" in the TSAP subfield is a leftover of the unspecific S7 connection wizard: when the partner is left unspecified, the wizard fills 01.FD as a placeholder. This placeholder is the most common reason the GET does not return DONE. Replace it with the correct partner TSAP 01.02.

5.3 Activate the connection

1. Save and compile the S7-317 station, then download the connection configuration. NetPro writes the connection to the offline project and to the CPU's online configuration after download.
2. Open Online > Accessible Nodes and confirm that the CP 343-1 Advanced appears with the configured IP.
3. In the S7-317 online view, right-click the connection > Connection Status. Status should be established. If status is not established, the partner endpoint is unreachable, the firewall is blocking port 102, or the partner TSAP is wrong.

6. CPU Property: Permit PUT/GET Access

On the S7-315, the property Permit access by PUT/GET communication from remote partner must be enabled. Without it, the CPU rejects every PUT and GET request with the S7 error 0x0031 "Function not allowed in current protection level".

1. Open HW Config for the S7-315.
2. Double-click the CPU 315.
3. Tab Protection.
4. Check Permit access with PUT/GET communication from remote partner(s).
5. Save, compile, and download to the S7-315.

7. GET Block Programming on the S7-317

For S7-300, the GET function is FB13 "GET" in the Standard Library > Communication Blocks. The block is a multi-instance capable FB and is called cyclically from OB1.

7.1 STL example

// OB1 - call GET cyclically, REQ on rising edge
A     M     100.0        // Trigger from sequence
FP    M    200.0         // Edge flag
=     "GET_DB".REQ

CALL  "GET" , "GET_DB"
REQ   := "GET_DB".REQ
ID    := W#16#0001
ADDR_1:= P#DB100.DBX0.0 BYTE 20
RD_1  := P#DB200.DBX0.0 BYTE 20
DONE  := M100.1
ERROR := M100.2
STATUS:= MW102

7.2 Block timing

A GET request takes between one and three OB1 cycles to complete. The DONE bit is set for exactly one OB1 cycle on success. If the connection is administratively down, the block returns STATUS = W#16#81A0 ("Connection not established"). If the partner CPU rejects the read, STATUS = W#16#8034 (S7 protocol error). The S7 communication error code subfield is the lower byte of STATUS and is the same family of codes documented in the SIMATIC S7-300/S7-400 Communication Functions manual.

8. S7 Routing Through the CP 343-1 Advanced

S7 routing is a Siemens-specific mechanism that allows a CPU at one IP address to communicate with a CPU on a different IP address by passing through a CP. The CP holds a routing table that maps an S7 connection to a target CPU slot in the same backplane. The CP 343-1 Advanced supports S7 routing for S7 connections, ISO-on-TCP, and TCP.

When the GET block on the S7-317 issues a request, the S7 PDU is sent to the partner IP 10.10.5.21 with the partner TSAP 01.02. The CP 343-1 Advanced accepts the TCP connection on port 102, reads the partner TSAP, looks up the routing table, and forwards the S7 PDU to the CPU in slot 2 over the backplane. The CPU replies, the CP relays the reply back over TCP, and the GET block completes.

To confirm that routing is active on the CP:

1. In NetPro, expand the CP 343-1 Advanced in the S7-315 station.
2. Right-click the CP > Object Properties > tab Options.
3. Confirm S7 routing activated is checked.
4. Also confirm that the S7-315 station is listed in the S7 routing table (built automatically by STEP 7 when the project is compiled).

9. Alternative: Open TCP Communication (no GET block)

If GET/PUT through S7 routing cannot be used (different project, multiple vendor CPU, blocked security on the CP), use open TCP communication. The S7-317 side uses TSEND and TRCV FBs; the S7-315 side uses AG_SEND (FC5) and AG_RECV (FC6) to forward the TCP payloads to and from the CP 343-1 Advanced. The CP 343-1 Advanced manual, section "Open Communication", documents the FC5/FC6 interface.

This alternative path is unidirectional from PLC1 to PLC2 without requiring the GET block or the partner CPU to expose PUT/GET access. It is also the path recommended by the Siemens support threads when the partner CPU is on a different network and S7 routing fails for project-topology reasons.

10. Firewall and Security Configuration

If the CP 343-1 Advanced's Security function is enabled (IP firewall, MAC ACL, VPN), S7 routing and S7 communication must be explicitly allowed for both the local CPU IP and the partner CPU IP. The CP 343-1 Advanced manual, section "Security > Firewall", lists the default port as ISO transport (port 102) and the IP ACL configuration as a list of source/destination IP pairs. The rule of thumb is to allow:

• Source IP = local CPU (10.10.5.20), Destination IP = CP (10.10.5.21), Protocol = TCP, Port = 102.
• Source IP = CP, Destination IP = local CPU, Protocol = TCP, Port = 102 (for replies).

If only one direction is allowed, the GET block returns STATUS = W#16#81C3 "Connection aborted by partner" within 3 to 5 seconds of issuing the request.

11. Common STATUS Codes and What They Mean

Decoding the upper byte reveals the communication layer; decoding the lower byte reveals the S7 protocol error. Always evaluate ERROR first and read STATUS only when ERROR=1.

12. Step-by-Step Commissioning Procedure

1. Download HW Config to the S7-315. Confirm the CPU is in RUN with no SF/BF.
2. Open the CPU 315 properties in HW Config, tab Protection, enable Permit access with PUT/GET communication from remote partner(s). Download the configuration.
3. Open HW Config for the S7-317. No change required other than the IP of the PN interface.
4. In NetPro, open the S7-317 station. Right-click the CPU > Insert New Connection. Choose unspecified partner, type S7 connection.
5. Edit the partner IP to 10.10.5.21 (CP's plant-side IP).
6. Edit the partner TSAP to 01.02 (CPU at slot 2, rack 0). Do not use 01.FD.
7. Save and compile. Download the NetPro configuration to the S7-317.
8. Insert FB13 "GET" from Standard Library > Communication Blocks in OB1 of the S7-317. Set ID = W#16#0001, ADDR_1 = P#DB100.DBX0.0 BYTE 20, RD_1 = P#DB200.DBX0.0 BYTE 20.
9. Trigger REQ from a 1-Hz blinking bit to test the path. Watch DONE; if it toggles, the link is live. If ERROR toggles, evaluate STATUS.
10. Open Online > Connections on the S7-317 and confirm status = established.
11. Open Online > Diagnose > Module Information on the CP 343-1 Advanced and confirm S7 routing is active and the S7 connection is listed.

13. Verification

The link is verified when three independent indicators are positive simultaneously:

1. Connection state: NetPro Online > Connections shows the S7 connection as established. The CP 343-1 Advanced's online diagnostics show the connection in its active list.
2. Block state: FB13 GET reports DONE=1 on a REQ pulse. The destination DB in the S7-317 contains the data written by the partner CPU at the source address.
3. Diagnostics buffers: both CPUs report no S7 communication faults in the diagnostic buffer. The CP's security log does not show denied packets for ISO transport (port 102).

A VAT or a watch table in the S7-317 online view is the fastest method to confirm the data roundtrip. Place the source address in a VAT on the S7-315 with a known pattern (e.g. DB100.DBW0 = 16#1234), trigger the GET, and verify that DB200.DBW0 in the S7-317 shows the same value within 3 OB1 cycles.

14. Troubleshooting Matrix

15. Field-Proven Caveats

• The CP 343-1 Advanced S7 routing table is built from the STEP 7 project. If the partner station is in a separate project, the routing table will be empty and the GET will fail with STATUS = 0x8034 even though the IP path is healthy. In this case, the only solution is open TCP communication (Section 9) or a bridging gateway.
• If the partner CPU is reached through a NAT device, S7 routing does not traverse NAT. Use a routed path on the same L2 domain or open TCP communication with explicit IP/port mapping.
• The CP 343-1 Advanced allows up to 32 S7 connections. Each S7 routing connection consumes one CP-side connection resource. Plan headroom for HMI and PG connections.
• GET with RD_1 longer than 160 bytes is split into multiple PDUs by the S7 protocol. The block is transparent to this, but the call takes longer; allow at least 200 ms per 160 bytes for the response.
• If the S7-315 CPU is configured as a "server only" for the S7 connection (the connection partner is unspecified but the CPU is the server), the GET call may be rejected. Always configure the CPU as the partner explicitly in the S7-317's NetPro.

16. Related Siemens Documentation

• CP 343-1 Advanced Equipment Manual (GH_CP343-1-Adv-GX31_76)
• SIMATIC S7-300 CPU 31xC and CPU 31x Operating Instructions
• SIMATIC S7-300/400 Communication Functions (System and Standard Functions) reference manual
• STEP 7 V5.5 Programming and Operating Manual
• S7 communication - connection configuration FAQ

FAQ