Configuring Remote Web Access for Omron CJ1 PLC: Step-by-Step

Overview: Why the CJ1 Is Not Directly Web-Enabled

The Omron CJ1 series (CJ1M, CJ1G, CJ1H) ships without a built-in HTTP server, an integrated web SCADA runtime, or a browser-accessible HMI. Out of the box, the CPU communicates through its peripheral port (RS-232C), RS-232C port, or via dedicated communication units such as the ETN21 Ethernet module or the SCU21/SCU31 serial units using FINS, Host Link (C-mode), Modbus RTU/TCP, or CompoWay/F. There is no onboard web server, no HTML file system, and no Java applet or ActiveX control served from the CPU firmware itself.

This contrasts with the Allen-Bradley SLC 5/05, which exposes a web server on its Ethernet port for basic browser-based HMI. The CJ1's lack of a web interface is by design: the CPU firmware is built for deterministic scan execution and serial/fieldbus I/O, not embedded web serving. The Omron corporate strategy for browser access has historically been to push users toward an external gateway (eWON, Red Lion, or the legacy ITNC) rather than add a web server to the CPU.

Six practical architectures exist for remote access to a CJ1 over IP networks:

1. ETN21 Ethernet unit with NAT/port forwarding on the site router
2. eWON industrial router/gateway (Talk2M cloud relay, no inbound ports)
3. Red Lion Data Station Plus (multi-protocol gateway with integrated HMI/web SCADA)
4. Memory card FTP push from the ETN21 on a schedule
5. SMTP email notification from the CPU (ladder-driven, alert-only)
6. Omron ITNC Open Network Controller (legacy Ethernet gateway with browser access)

Reference material: Omron CJ1 Series product family, Omron Industrial Automation.

Prerequisites and Site Survey

Before deploying any of the architectures below, confirm the following on the CJ1 site. Skipping this step is the single most common cause of failed remote commissioning.

Perform this survey on every cabinet that will have a remote-access solution. Do not assume consistency across a 60-machine fleet - check each one.

Solution 1: ETN21 Ethernet Unit with Port Forwarding

The most direct approach uses the ETN21 Ethernet module (10/100 Mbps) installed in a CJ1 backplane slot. The ETN21 is a TCP/IP FINS node that listens on TCP/UDP port 9600 by default. CX-Programmer can connect to it from anywhere on the internet if the site router forwards port 9600 to the ETN21's private IP address.

ETN21 Default Parameters

Configuration Procedure

1. Connect CX-Programmer to the ETN21 via the peripheral port cable, or place your laptop on the same LAN as the ETN21 and connect directly to the unit's IP via a crossover or switch port.
2. Open the I/O Table view in CX-Programmer. Right-click the ETN21 entry and select Unit Setup to open the web configuration page.
3. Assign a static IP address in the plant subnet (e.g., 192.168.10.50/24). Avoid DHCP unless the router is configured to reserve the address by MAC.
4. Set the Node Address rotary dial on the front of the ETN21 to match the last octet of the IP in hex (e.g., 50 decimal = 32 hex). Cycle power to the ETN21 for the dial change to take effect.
5. Enable the FINS/TCP service if disabled. Set the destination node number to the local CPU (usually 00 or 01, depending on how the I/O table is configured).
6. Save settings to the ETN21's flash and verify with a ping from your laptop. The first response may take 2-3 seconds while the unit applies settings.

Router Port Forwarding

On the site's internet-facing router, configure a port forwarding rule with these values:

External Port: 9600 (TCP)
Internal IP:   192.168.10.50
Internal Port: 9600
Protocol:      TCP
Source:        (allow-list of remote engineer IPs, or 0.0.0.0/0 with firewall in front)

On the engineering PC, point CX-Programmer at the public IP (or DDNS hostname), set the Network Type to Ethernet (FINS/TCP), and enter the FINS node address of the CPU (not the ETN21). CX-Programmer negotiates the FINS/TCP session and the ladder is visible within 5-10 seconds on a typical broadband link.

Security Caveat

Port-forwarded FINS/TCP is plaintext and offers no authentication beyond the IP allow-list. Anyone who can reach the public IP on port 9600 can read and write the CPU. For production deployments, terminate this connection at an eWON or a corporate VPN endpoint rather than exposing the PLC directly to the internet.

Network Topology

Solution 2: eWON Industrial Router

The eWON family (now part of HMS Networks) was the gateway most prominently used by the Omron community for remote CJ1 access. The eWON talks to the CJ1 over the peripheral port - no Ethernet-equipped CJ1 is required. From the field, it tunnels traffic out over HTTPS to the eWON Talk2M cloud relay, and the engineering workstation pulls the tunnel down via eCatcher.

Reference: eWON Remote Access Solutions.

Why eWON Over Direct Port Forwarding

• No inbound firewall holes - all connections originate from the eWON outbound on TCP 443 (HTTPS).
• Works behind CGNAT, corporate firewalls, and cellular networks.
• Peripheral port, RS-232, or RS-485 connection to the CJ1 - no slot used on the CJ1 backplane.
• Centralized user authentication via Talk2M accounts with audit logs.
• Mature support for Omron FINS/Host Link as a built-in driver.

eWON Setup Sequence

1. Connect the eWON's serial port (typically RS-232) to the CJ1's peripheral port via the appropriate Omron cable (XW2Z-200S-CV for DB9 peripheral, or the equivalent USB-serial adapter cable).
2. Configure the eWON for outbound to the Talk2M server. Modern eWON units (Flexy, Cosy) auto-register on first power-up; legacy units require a USB configuration file.
3. Create a Talk2M account on the eWON portal and add the eWON's serial number (printed on the front label) to your account.
4. From the engineering PC, install eCatcher (the Talk2M client) and log in. The eWON appears as a VPN gateway in the device list.
5. Launch the eWON VPN. CX-Programmer sees the CJ1 as if it were connected via a local USB cable. Upload the program, go online, monitor, and disconnect.

Connection Topology

Peripheral-port configuration (no Ethernet on the CJ1):

eWON (serial, Host Link FCM/PCB) → CJ1 peripheral port

Ethernet configuration (ETN21 installed):

eWON (TCP FINS) → ETN21 → FINS routing → CJ1 CPU

The choice depends on whether you have an ETN21 installed. For brownfield CJ1 cabinets with no Ethernet, the peripheral port option is the strongest feature of the eWON platform - it avoids backplane surgery.

Connection Limits

Talk2M free and basic tiers support a small number of concurrent VPN sessions. For a 60-machine fleet with multiple engineers, budget for the Pro or higher tier. Confirm the concurrent-user licensing before the deployment, not after.

Solution 3: Red Lion Data Station Plus

The Red Lion Data Station Plus (DS1) and the newer CR1000/CR3000 human-machine interface platforms are protocol-converting gateways with an integrated web server. The DS1 supports up to four different Ethernet protocols simultaneously (FINS for Omron, Modbus TCP, EtherNet/IP, etc.) plus RS-232 and RS-485. The accompanying Crimson 3.x programming software is available as a free download from Red Lion.

Reference: Data Station Plus Product Page.

Capabilities

• Protocol conversion between four Ethernet masters and one serial master/slave at the same time.
• Integrated web server serves Crimson-developed HMI pages at 640x480 or 320x240 resolution.
• OPC server option (Crimson Control) exposes tag data to SCADA via DA/HDA.
• USB 2.0 port for configuration and removable storage of data logs.
• Optional cellular radio (CDMA or GSM/GPRS variants) for sites without wired internet.

Data Station Plus Setup

1. Install Crimson 3.x and create a new project. Select the DS1 model from the device list.
2. Add an "Omron FINS Ethernet" driver and point it at the ETN21's IP. Map the CPU data areas (DM, HR, WR, CIO) into Crimson tags. Use the same area designations as in CX-Programmer to keep tag names aligned.
3. Add additional protocol drivers (e.g., Modbus TCP) to expose the same tags to other systems. Up to four drivers can be active concurrently.
4. Build an HMI page using the Crimson graphics library. Bind tag values to numeric displays, bar graphs, and indicator lamps. Use the 640x480 page size for the web view.
5. Enable the web server under the Web Server node in the Crimson tree. Crimson serves a browser-based view of the active HMI page on TCP 80 (or TCP 443 if HTTPS is enabled in firmware).
6. Configure the DS1's network settings (static IP, gateway, DNS) and deploy the project to the unit over USB or Ethernet.
7. From the engineering PC, browse to http://ds1.local-ip/ and authenticate with the configured user. The HMI page loads, with live data sourced from the CJ1 over FINS/TCP.

Multi-Protocol Use Case

A common configuration is the DS1 reading CJ1 data via FINS/TCP and writing it to a third-party SCADA via Modbus TCP at the same time. This avoids the "two masters fighting on the same port" problem that occurs when both CX-Programmer and a SCADA try to access the same ETN21. The DS1 acts as a fan-out:

SCADA (Modbus TCP master) → DS1 (Modbus TCP slave)
                          → DS1 (FINS master) → ETN21 → CJ1 CPU
CX-Programmer  → ETN21 directly (separate FINS connection, node 0)
DS1            → ETN21 (FINS master, node 1)

Each FINS master gets its own node address on the ETN21 and CX-Programmer can connect in parallel without disconnecting the DS1.

Solution 4: Memory Card FTP Push

When bidirectional remote access is not required and only periodic data snapshots are needed, the CJ1 can be programmed to write a CSV or text file to its memory card and FTP-push it to a remote server on a schedule. The ETN21 supports FTP client operation natively when the FTP client function is enabled in the unit setup.

Ladder Logic Sketch

The following is a simplified CX-Programmer ladder approach using FREAD/FWRITE for the memory card and the SEND/RECV instructions to drive the ETN21's CMND buffer. This requires CX-Lite or full CX-Programmer for SEND instruction support.

Sequence:
  1. Trigger (e.g., 1-hour timer bit CIO 0.00)
  2. FWRITE to memory card (CSV with DM1000-DM1099 contents)
  3. SEND to ETN21 with FINS command code 2740 (FTP push)
       - Source file: /card/cj_log.csv
       - Destination: ftp://server.example.com/cjjlogs/cj_log_YYYYMMDD.csv
       - Username/password: stored in DM2000-DM2032
  4. ETN21 opens TCP 21 to the FTP server and uploads the file
  5. Ladder resumes; next trigger starts a new cycle

ETN21 FTP Settings

This is one-way: it writes to the server but does not allow remote program uploads. Pair it with the eWON solution if you also need the upload path.

Solution 5: SMTP Email Notification

The CJ1 can be programmed to send alert emails directly via the ETN21. The email passes through standard SMTP (TCP 25 or 587 with STARTTLS) and is the simplest way to get text-based diagnostics out of the PLC across corporate firewalls - emails are rarely blocked at the perimeter.

Implementation

1. Configure the ETN21 with the SMTP server address (often the customer's relay or a hosted SMTP service such as the corporate Exchange/Office 365 endpoint).
2. Use the SEND instruction with the email sub-command on the CMND buffer, or use CX-Lite to wrap the FINS email function block.
3. The email body contains up to 256 characters of free text plus DM-word-sourced variables (e.g., motor speed, fault code, timestamp).
4. The engineer receives the email on phone or laptop and decides if remote intervention is required.

Sample email body format:

Subject: [CJ1] Plant A Line 3 Fault
Body:
Timestamp: 2024-01-15 14:23:08
Fault code: DM100 = 47 (E-Stop pressed)
Line state: DM101 = 2 (Stopped)
Motor speed: DM102 = 0 rpm
Operator:   CIO 200.05 = 1 (acknowledged)

Solution 6: Omron ITNC Open Network Controller

The ITNC Open Network Controller (also referenced as the ONC) is an Omron-badged Ethernet gateway designed specifically to expose CJ-series and CS-series PLCs to a web browser. The unit hosts a web server and a simplified HMI renderer. It was positioned in the mid-2000s as the "Omron-native" web enablement path and was cited by integrators as the official answer to the question "can the CJ1 be web-enabled?"

ITNC Architecture

ITNC (web server) ← Ethernet FINS → ETN21 → CJ1
                       or
ITNC ← Host Link (RS-232) → CJ1 peripheral port

The ITNC sits between the CJ1 and the IT network, presenting a browser-accessible HMI without exposing the PLC directly to the internet.

Solution Comparison Matrix

Network Architecture and Security

None of the six solutions should be deployed to a CJ1 on a production line without explicit cybersecurity review. The following are the dominant risks and the standard mitigations for each architecture.

For all options, document the data flow in the plant's network architecture diagram, log the device MAC and serial number in the asset inventory, and follow IEC 62443 zone/conduit definitions when placing the CJ1 on a converged IT/OT network. A CJ1 in a Level 3 supervisory zone should never be directly reachable from a Level 4 enterprise zone without a firewall or diode.

Verification and Commissioning

Local Verification (on-site)

1. From a laptop on the same LAN as the CJ1, ping the ETN21's IP and verify the response time is <1 ms.
2. Connect CX-Programmer via Ethernet to the ETN21. Upload the program and confirm the program ID, revision, and section comments match the site documentation.
3. For the eWON path, confirm the eWON's Talk2M registration LED is solid green and the serial link to the CJ1 peripheral port is active (check the eWON web interface for link state).
4. For the Data Station Plus, browse to the DS1's web server on the local IP and verify the HMI page renders with live data (numbers update, alarms clear when conditions are met).

Remote Verification (off-site)

1. From an offsite network, run a TCP test against the public IP. On PowerShell: Test-NetConnection -ComputerName public.ip -Port 9600. On Linux: nc -vz public.ip 9600. Confirm a successful TCP handshake.
2. For eWON, launch eCatcher and connect through Talk2M. The VPN session should establish within 30 seconds.
3. Initiate a CX-Programmer online connection through the remote path. The Online indicator should turn green within 10 seconds. If it times out, check the FINS routing table on the ETN21 and confirm the local node is reachable from the remote master.
4. Force a bit (or write a DM value) from the remote CX-Programmer session and observe the change at the panel. Cycle the bit back to its original state. Do not leave forced bits in production logic.
5. For email/FTP paths, trigger a test event and verify the email arrives or the file appears on the server within one polling interval.
6. Document the public IP, DDNS hostname, port numbers, and Talk2M account IDs in the site commissioning record.

Commissioning Checklist

• [ ] ETN21 IP, mask, gateway recorded in the site network register
• [ ] FINS node number matches the IP last octet (hex)
• [ ] Port forwarding rule documented in the router config export
• [ ] CX-Programmer project file archived to the engineering repository
• [ ] Talk2M / Data Station Plus accounts added to the company password manager with 2FA enabled
• [ ] Firewall rule added to the security policy for the new external endpoint
• [ ] Change management ticket raised and approved by plant operations
• [ ] Site acceptance test (SAT) signed off by the customer representative

Troubleshooting Matrix

FAQ