Configuring Remote Internet Access to S7-300 via SINEMA Remote

1. Problem Statement and Use Case

An engineer needs to perform STEP 7 Manager operations (online view, program upload/download, hardware configuration edit, firmware update, diagnostic buffer read-out) on a remote SIMATIC S7-300 station equipped with a CPU 315-2 PN/DP (order number 6ES7 315-2EG10-0AB0). The station sits on a factory network and cannot be reached directly from the office LAN or from a mobile laptop on the road. The objective is to bridge the laptop and the PLC over the public internet without sacrificing the integrity of the production network.

The 6ES7 315-2EG10-0AB0 is a PROFINET-capable S7-300 CPU with two PROFINET interfaces (X1 P1, X1 P2 on a single RJ45 jack pair) and one combined MPI/PROFIBUS-DP interface (X2). The PROFINET side is the carrier of choice for STEP 7 online traffic over TCP/IP. The standard S7 protocol rides on ISO-on-TCP (port 102) and S7 communication (ports 102/3000+).

2. Architecture Options Overview

Three credible architectures exist for remote STEP 7 access to an S7-300 over the public internet:

1. Siemens SINEMA Remote Connect (SINEMA RC) — Siemens-native VPN server with OPC UA / PG tunnel, combined with a SCALANCE M-class cellular or SCALANCE S615 industrial router on site. This is the recommended path when the customer IT policy mandates a Siemens-supported stack and Siemens-signed certificates.
2. Third-party industrial VPN router (eWon, Moxa, Cisco IR, Hirschmann) — equipment establishes an IPsec/OpenVPN tunnel to a cloud relay or directly to the laptop. Suited for retrofit plants that already have a non-Siemens router fleet.
3. Direct cellular or DSL router + IPsec/OpenVPN — site router terminates the tunnel directly on the laptop (or on a small VPN concentrator). Cheapest, but you take on the entire security and certificate lifecycle.

All three architectures share a common rule: the PLC never receives a routable public IP. The laptop initiates the tunnel outward, the site terminates it, and STEP 7 talks to the PLC over the encrypted overlay. This rules out inbound NAT/port-forwarding in the plant firewall and rules out exposing the S7-300 directly to the internet.

3. Reference Topology

Figure 1 — Outbound-only SINEMA Remote Connect topology. All arrows are outbound TCP/443 from the field sites; no inbound rule is required on the plant firewall.

4. Prerequisites

• STEP 7 V5.5 + SPx or TIA Portal with S7-300 HSP installed. For the 6ES7 315-2EG10-0AB0 specifically, verify the installed HSP supports the MLFB; refer to the Siemens Industry Online Support article for compatible TIA Portal versions.
• SINEMA RC Server (on-premise virtual appliance, AWS AMI, or Siemens-hosted). Refer to the SINEMA RC manual entry SIOS 26662448 for sizing and licensing.
• SCALANCE router on site: SCALANCE M876-4 (LTE/4G, EU/global variants), SCALANCE M874-3 (3G fallback), SCALANCE M826-2 (DSL/Ethernet), or SCALANCE S615 (Ethernet uplink, security router). All must run firmware with the SINEMA RC option enabled (typically firmware V4.x or higher for M-class).
• Public IP / DNS for the SINEMA RC server, or a fixed hostname (e.g. sinemarc.customer.com). The plant only needs outbound HTTPS.
• X.509 PKI: either a CA-issued certificate for the SINEMA RC server plus device certificates for each SCALANCE, or the self-signed certificate workflow supported by SINEMA RC from V2.0 onward.
• IP plan: assign the S7-300 CPU a fixed PROFINET IP, e.g. 192.168.10.10/24. The SCALANCE LAN-side default must be a different subnet, e.g. 192.168.10.1/24 if the PLC is direct-connected, or 192.168.20.1/24 if routed through an industrial switch.

5. SINEMA Remote Connect Server — Commissioning

1. Install the SINEMA RC server on a Windows Server 2019/2022 VM (minimum 4 vCPU, 8 GB RAM, 100 GB disk) or deploy the AWS AMI from SIOS 26662448.
2. Import the server certificate (CN must match the public hostname). For proof-of-concept, generate a self-signed CA with OpenSSL:

   openssl genrsa -out sinemarc.key 2048
   openssl req -new -x509 -days 730 -key sinemarc.key \
     -subj "/CN=sinemarc.customer.com/O=CustomerAG" \
     -out sinemarc.crt
   

3. Create user accounts for engineers and one device account per SCALANCE router. Role mapping: Operator (read-only diagnostic), Maintenance (full PG tunnel + download), Administrator.
4. Define the PG tunnel access rule. This is the rule that lets the laptop reach the S7-300 over IP:

   Source user group : Field_Engineers
   Target device     : PlantA_SCALANCE_M876
   Allowed services  : S7 (TCP/102), PG tunnel
   Time window       : Mon-Fri 06:00-22:00

5. Bind the server to 0.0.0.0:443. Confirm reachability from the public internet: curl -vk https://sinemarc.customer.com:443.

6. SCALANCE Router — Site Configuration

1. Open the SCALANCE Web-Based Management (default https://192.168.1.1) and load the latest SINEMA-capable firmware. For SCALANCE M876-4 the current family is firmware V5.x; cross-check on the Siemens Industry Online Support firmware download portal.
2. In Layer 3 > Static Routes, install a default route through the cellular or DSL interface.
3. In Security > SINEMA Remote Connect, set Connection mode = SINEMA RC Client, enter the server FQDN, port 443, and upload the device certificate.
4. Configure the LAN-side IP of the SCALANCE (e.g. 192.168.10.1/24). Connect PROFINET port X1 P1 of the CPU directly, or via an SCALANCE XB managed switch.
5. Configure the S7-300 CPU PROFINET interface in STEP 7 (or with the CPU display if available):

   IP address       : 192.168.10.10
   Subnet mask      : 255.255.255.0
   Router address   : 192.168.10.1
   PROFINET device name : s7-300-cpu315pn

6. Verify that the SCALANCE has an active tunnel: Information > SINEMA Remote Connect > Connection Status should show Connected with the assigned tunnel IP.

7. STEP 7 Manager — Laptop Side

1. Install the SINEMA RC Client on the laptop (bundled with the server media kit).
2. Import the user certificate issued by the SINEMA RC CA. Log in with the user account.
3. The client establishes the outbound tunnel; the S7-300 CPU now appears as if it were on the laptop's local network through the virtual SINEMA RC adapter (typically a tap or win-tun device with IP in the 172.17.x.x range).
4. Open STEP 7 Manager, choose Options > Set PG/PC Interface, and select SINEMA RC Adapter > TCP/IP. This routes the S7 protocol through the tunnel.
5. Choose PLC > Accessible Nodes; the CPU should appear as 192.168.10.10 within a few seconds. Double-click to go online.

8. SCALANCE Hardware Selection Matrix

Always confirm the active order number and firmware on the Siemens Industry Online Support portal; variants differ by power supply, antenna bundle, and approvals (ATEX, UL, CE).

9. Security Hardening Checklist

• Certificate pinning. Pin the SINEMA RC server certificate in the SCALANCE configuration to defeat rogue CA injection.
• TLS minimum. SINEMA RC V2.x negotiates TLS 1.2 by default; disable TLS 1.0/1.1 on the server's web frontend.
• Time windowing. Bind user accounts to maintenance windows (e.g. only Mon-Fri 06:00-22:00) and require re-authentication outside the window.
• Two-factor. Enable TOTP (RFC 6238) for engineer accounts. SINEMA RC supports this from V2.0.
• PLC protection level. In STEP 7, set the CPU protection level to Write protection for Failsafe blocks only or higher, and assign a separate password per level (read, write, F-CPU password). See SIOS for the protection matrix.
• Plant segmentation. Place the S7-300 in a dedicated PROFINET VLAN. The SCALANCE LAN port must not bridge into the office VLAN.
• Audit logging. Forward SINEMA RC logs to a central syslog server; capture user, source IP, target device, timestamp.

10. Verification Procedure

1. From the laptop, after SINEMA RC client reports Connected, run ping 192.168.10.10 -t. You should see replies within 50-150 ms typical RTT over LTE.
2. In STEP 7 Manager: PLC > Accessible Nodes must list the CPU with its PROFINET MAC.
3. Open PLC > Online & Diagnostics, then Diagnostic Buffer. Successful read confirms ISO-on-TCP/102 is flowing through the tunnel.
4. Perform a non-destructive download test: PLC > Download to Target Device with a no-change configuration. STEP 7 will report Download successful.
5. Disconnect and reconnect the SINEMA RC client. The tunnel should renegotiate in < 30 s without laptop reboot.

11. Troubleshooting Matrix

12. Alternative: Third-Party Industrial VPN (eWon)

If the customer mandates a non-Siemens remote access stack, the eWon Cosy+ or Flexy line from HMS Networks is a common substitute. It runs an outbound IPsec/OpenVPN tunnel to the eFive cloud relay, similar to SINEMA RC's posture. The differences engineers encounter in the field:

• No native Siemens certificate workflow; eWon uses its own CA.
• STEP 7 PG/PC interface must be set to VPN > eWon Adapter, not the SINEMA adapter.
• License model is per-device annual subscription (Talk2M Pro) vs. SINEMA RC's per-user licensing.
• Throughput and latency similar; both rely on outbound HTTPS so NAT/CGNAT is not a problem.

The configuration procedure mirrors SINEMA RC: assign the eWon a fixed LAN-side IP, point its VPN target to Talk2M, set the S7-300 CPU PROFINET IP, then connect the laptop through the eCatcher client. STEP 7 Manager configuration is identical to the SINEMA RC case once the tunnel is up.

13. Throughput, Latency, and Programming Performance

STEP 7 block upload/download is bandwidth-tolerant but latency-sensitive. Empirical numbers from field deployments with SCALANCE M876-4 over LTE Cat-4:

RTT above ~400 ms makes interactive online editing sluggish; if the cellular link is marginal, prefer DSL or a wired SCALANCE M826 uplink.

14. Frequently Asked Questions