Configuring KTP Basic 7-inch HMI Remote Download via eWon VPN

Problem Overview

An S7-1500 controller (specifically an ET200S station with IM151-8 PN/DP CPU 1510SP or 1512SP) operates a machine together with a KTP700 Basic 7-inch HMI panel programmed in TIA Portal V13.1 SP1. An eWon Flexy VPN router on the machine's automation LAN provides remote engineering access through Talk2M. From a remote engineering PC, the engineer can successfully program and monitor the PLC over the VPN tunnel, but HMI project download fails: TIA Portal's Extended download to device or Accessible devices search reports "No devices were found" even though ICMP ping from the engineer's TAP adapter to the KTP700 IP succeeds.

This article documents the three independent root causes, the required eWon and KTP700 Control Panel configuration, and a verified remote download procedure that works for both 1st generation KTP Basic (engineering over Ethernet) and 2nd generation KTP Basic PN (engineering over Profinet) when accessed through eWon Flexy/Cosy routers and Talk2M VPN.

Root Cause Analysis

The discovery failure is not a network reachability issue. It is a Profinet DCP and IP-routing problem that maps onto three independent architectural mismatches between the Siemens engineering tools and the eWon VPN router. All three must be resolved for remote HMI download to succeed; fixing only one is the most common reason field engineers give up and drive to the site.

Mechanism 1: TIA Portal Discovery Uses Profinet DCP Multicast

When the engineer selects Online → Accessible devices or Extended download to device → Show accessible devices in TIA Portal, the engineering station transmits Profinet Discovery and Configuration Protocol (DCP) requests. DCP is a layer-2 Ethernet multicast protocol that uses destination MAC 01:0E:CF:00:00:00 and identifies Profinet stations by their Profinet station name, IP, MAC, and current operational state. The HMI panel answers DCP with its station name and assigned IP.

The eWon Flexy performs IP-level NAT between the Talk2M VPN tunnel and the automation LAN. It will forward unicast IP packets between the engineer's TAP adapter (typically 10.x.x.x on Talk2M) and the KTP700's automation IP (for example 192.168.0.15). It will not, by default, forward Profinet DCP multicast Ethernet frames because those frames never traverse the IP layer and are not routable at layer 3. eWon is an IP router, not a transparent layer-2 bridge.

Consequence: ping 192.168.0.15 succeeds through the VPN, but the DCP identifier request never reaches the panel and TIA Portal reports zero accessible nodes. This is the single largest reason "the panel is not found" appears on remote installations.

Mechanism 2: Missing Default Gateway on the HMI

Even when TIA Portal is told the target IP directly (bypassing DCP discovery by typing 192.168.0.15 into the Devices / IP address field in the Extended download dialog), the KTP700 must respond via the eWon router. If the panel's TCP/IP stack has no default gateway configured (Control Panel → Network and Dial-up Connections → PN/IE_1 → Properties → IP settings → Router), the panel answers on the local subnet but has no route for the VPN-bound reply path to the engineer's TAP address.

The default gateway on the panel must be the eWon Flexy's automation-LAN IP address (for example 192.168.0.200). With that gateway in place, the panel can route the TIA Portal download acknowledgement and engineering traffic back through the VPN tunnel.

Mechanism 3: PG/PC Interface Selection on the Engineer PC

The engineering PC's TIA Portal must select the Talk2M VPN TAP adapter as the PG/PC interface. If TIA Portal is bound to the local physical Ethernet adapter (the office LAN), the Windows routing table never associates the 192.168.0.0/24 automation subnet with the TAP interface and the download dialog times out without ever sending a packet. The TAP interface appears in the Windows network adapter list as ewon, TAP-Win32 Adapter, or Talk2M VPN once Ecatcher is connected. Selecting the right TAP is a frequently missed step when the engineer has both a corporate LAN and a USB Ethernet adapter active.

Hardware and Software Prerequisites

Network Architecture and Address Plan

The recommended address plan keeps the Talk2M TAP subnet (10.x.x.x/8) completely separate from the machine's automation subnet (192.168.0.0/24). All NAT happens at the eWon Flexy; the engineer PC never sees 192.168.0.0/24 as a directly connected network.

Address Plan Summary

Configuring the KTP Basic Control Panel

The gateway configuration is performed locally on the panel before remote download is possible; this step cannot be done remotely because Profinet DCP is the very mechanism the eWon VPN cannot forward. The local touch-time is typically 5-10 minutes per panel.

1. Power on the KTP700 and wait for the runtime loader to finish (about 60 s).
2. Open the Control Panel: tap an empty area of the desktop for 3 s, or use the system menu Start → Settings → Control Panel.
3. Navigate to Network and Dial-up Connections.
4. Double-tap PN/IE_1 (2nd generation) or Ethernet (1st generation).
5. Tap Properties → scroll to Internet Protocol (TCP/IP) → Properties.
6. Enter:
   • IP address: 192.168.0.15
   • Subnet mask: 255.255.255.0
   • Default gateway: 192.168.0.200 (eWon Flexy LAN IP)
7. Tap OK, close the dialogs, and reboot the panel via Start → Settings → Op Panel → Reboot.

For 2nd generation panels the Profinet device name must also match the TIA Portal project. Tap Start → Settings → Control Panel → PROFINET IO, set the device name (default convention is tp<size>-ktp, for example tp700-ktp) and confirm with Assign Name against the configured PROFINET IO controller. The PLC project must contain a PROFINET IO device with the same name or the panel will not enter data exchange with the IM151-8.

eWon Flexy Configuration for Profinet Forwarding

The eWon Flexy needs three configuration items so that remote TIA Portal traffic reaches the KTP700 over TCP/IP unicast, even though DCP discovery itself will not be forwarded.

1. NAT routing enabled. In the eWon Web interface (http://192.168.0.200), under Setup → Network → IP routing / NAT, enable IP forwarding and confirm the WAN interface is the Talk2M tunnel. The default Talk2M NAT covers 10.0.0.0/8 ↔ 192.168.0.0/24; verify with Diagnostics → Routing table that the TAP interface is up and that the static route to 192.168.0.0/24 points at the LAN bridge.
2. Firewall rules. Under Setup → Security → Firewall, open the following inbound rules on the WAN side (source: Talk2M TAP subnet):
   • UDP 50000, 50001, 50002 — Siemens HMI engineering
   • TCP 102 — S7comm / ISO-on-TCP (used by TIA Portal download)
   • TCP 80 / 443 — optional, for the eWon Web UI from remote
3. PN device name resolution. eWon does not natively resolve Profinet device names. Always address the HMI by its IP address (192.168.0.15) in TIA Portal, not by its Profinet name. This restriction is also documented in the HMS Networks eWon application note for S7-300/S7-400/S7-1200/S7-1500 on eWon support and in the HMS Networks KB article Download a project to a Siemens TP Comfort HMI through Talk2M / eWon.

For the Comfort panel alternative, the Comfort firmware supports an Remote Access → Connect to host mechanism where the panel initiates an outgoing connection to a Talk2M relay. eWon exposes this via Setup → Wizard → VPN connection and the Comfort panel's own remote configuration page (Control Panel → Remote). For KTP Basic, this option does not exist — the connection must originate from the remote PC.

Port Reference Table for HMI Engineering

TIA Portal PG/PC Interface and Download Settings

1. Connect to Talk2M via eCatcher. Wait until the eWon Flexy shows VPN OK in the eCatcher device list. Confirm the TAP adapter is enabled (Windows notification area shows ewon TAP as connected).
2. Open Control Panel → Network and Sharing Center on the engineer PC. Confirm the TAP adapter has a Talk2M address (for example 10.0.0.5/8) and that no other adapter has a route to 192.168.0.0/24.
3. Open TIA Portal. Go to Online → Accessible devices → click the PG/PC interface dropdown → select S7-Online → ewon TAP. If the TAP is not listed, install the eCatcher driver pack from the eWon support site and restart TIA Portal.
4. Open the project, then Online → Extended download to device.
5. Select the PG/PC interface as the TAP, and the target as the IM151-8 / KTP700 subnet.
6. Switch the Connection radio from Search for accessible devices to Devices / IP address and type 192.168.0.15.
7. Click Download and accept the certificate prompt (first-time only).

Step-by-Step Remote Download Procedure

1. Confirm the Talk2M tunnel is up and the eWon Flexy is reachable from the engineer PC:
   • ping 192.168.0.200 — should succeed (eWon LAN).
   • ping 192.168.0.10 — IM151-8 reply.
   • ping 192.168.0.15 — KTP700 reply (confirms panel reachability but not download readiness).
2. Open the TIA Portal project that matches the on-site runtime version. Mismatched TIA Portal versions cause download aborts on Basic panels with error "Firmware version of device is not compatible".
3. Compile the HMI project (Project → Compile → Software (rebuild all)) and confirm zero errors before attempting remote download.
4. Open Online → Extended download to device with the TAP interface selected.
5. Type 192.168.0.15 in Devices / IP address and click Download.
6. Select Overwrite all for the runtime transfer so the panel completely re-flashes; choose Transfer only if you intend to update an existing project without removing tags.
7. Wait for the runtime transfer to finish. Typical KTP700 Basic project of ~5 MB completes in 3-6 minutes over Talk2M with a typical broadband eWon uplink. Larger projects (15 MB+) may take 10-20 minutes; consider an on-site USB pre-stage for projects >25 MB.
8. Verify the panel restarts automatically with the new runtime.

Verification Procedure

After every remote HMI download, run the following four checks before handing the machine back to the operator.

1. Runtime version. On the panel, tap Start → Settings → Control Panel → OP → Properties → confirm the runtime build date matches the project you just downloaded.
2. Tag online values. In TIA Portal, open HMI tags → right-click → Monitor. Tags tied to PLC values should show live values from the IM151-8 over the same VPN tunnel. If tags show quality bad, the HMI-PLC connection is broken even though the HMI download succeeded.
3. Alarm log. Tap the alarm line on the panel and confirm at least one PLC alarm is visible. This proves the Profinet connection between IM151-8 and KTP700 is operational.
4. Ping round-trip. From the engineer PC: ping 192.168.0.15 -t for 30 s. Zero packet loss is required; intermittent loss indicates Talk2M relay saturation or eWon NAT exhaustion.

Comparison: KTP Basic 1st Generation vs 2nd Generation

If the on-site panel is 1st generation (no PN in the part number) and TIA Portal can already see it locally, the gateway fix alone is enough. If the panel is 2nd generation, both the gateway fix and the direct-IP-entry method in TIA Portal are mandatory.

Alternative Platforms: Comfort Panels and Unified Basic

When remote HMI download is a frequent operation, consider migrating to a Comfort panel (TP700, TP900, TP1200, TP1500, TP1900, TP2200) which has the following advantages over KTP Basic for eWon remote access:

• Dual engineering protocol. Comfort panels accept both Ethernet and Profinet download, so even if DCP discovery fails the Ethernet path still works through eWon.
• Outgoing remote connection. Comfort panels support Remote → Connect to host so the panel can initiate an outgoing HTTPS tunnel to a Talk2M relay, eliminating the need for inbound NAT/firewall rules.
• Sm@rtServer / Sm@rtClient. Comfort panels can publish the runtime view to remote browsers via Sm@rtServer, useful for first-line diagnostics without a TIA Portal session.
• Diagnostics. Comfort panels expose detailed remote diagnostics in the Control Panel that the Basic panels do not, including system logs and active alarm buffers.

For greenfield designs using Unified Basic panels (MTP700 Unified, MTP1200 Unified), the eWon Flexy works as for the Basic PN series but engineering ports include 443 (HTTPS for the Unified web download mechanism) in addition to the classic Siemens ports. The HMS Networks support portal documents eWon Flexy with WinCC Unified Basic configurations for this scenario.

Known Limitations and Workarounds

Troubleshooting Matrix

Frequently Asked Questions