Configuring S7-300 CP 343-1 Advanced for Remote Internet Access

Remote access to a SIMATIC S7-300 station that sits behind a consumer-grade DSL connection is a recurring requirement in service, retrofit, and field-engineering scenarios. A CP 343-1 Advanced IT attached to a CPU 315-2 DP exposes a full PROFINET stack on the LAN side, but the WAN side is typically nothing more than a single dynamic public IP address. This reference walks through the two production-grade options for reaching a remote S7-300 over the public Internet — an IPsec/OpenVPN tunnel and a port-forwarded DSL router — and the exact STEP 7 V5.x parameter set required on the CP 343-1 Advanced to make S7 communication, PG routing, and DB read/write work in both topologies. The official Siemens procedure is documented in Siemens Support Entry 26662448.

Problem Definition

When a STEP 7 project runs in the office, the engineer selects "Accessible Nodes", opens a Variable Table (VAT), or uses "Online → Monitor/Modify", and the SIMATIC programming device uses the local subnet (e.g., 192.168.100.0/24) to reach the CP 343-1 Advanced and through it the CPU 315-2 DP. Once the station is deployed at a remote site that only has an Internet connection with a dynamic public IP, the same workflow fails: the local IP of the CP (192.168.100.x) is not routable from the office, and the public address of the DSL router (e.g., 90.45.5.34) is not what STEP 7 expects in the project file.

Two distinct operations need to be solved, both carried over the same S7 protocol on TCP/102:

1. Read/write data blocks remotely for diagnostics, setpoint adjustment, and ad-hoc commissioning support.
2. Download a STEP 7 project to the CPU when the field is unreachable physically.

The CP 343-1 Advanced terminates TCP/102 on its PROFINET port and forwards S7 PDUs to the backplane bus toward the CPU 315-2 DP. The challenge is therefore to make TCP/102 between the office STEP 7 PC and the remote CP 343-1 actually traverse the Internet.

Prerequisites

Network Architecture

The reference topology has two private LAN segments separated by the public Internet. On the site side the CP 343-1 Advanced holds the only routable target, and the DSL router performs the WAN-to-LAN translation. On the office side, the STEP 7 PC is the only initiator of S7 traffic.

Figure 1 — S7-300 remote access topology. The DSL router's external interface holds the public IP (resolved via DynDNS from the office); the CP 343-1 sits on the private site LAN with a fixed IP. The optional VPN tunnel terminates at the DSL router and bridges both LANs.

Security Considerations

Choose the access method using the decision matrix below.

CP 343-1 Advanced IT — Relevant Capabilities

The CP 343-1 Advanced IT (6GK7343-1GX11-0XE0 / -1GX30-0XE0) is the top-of-line S7-300 communications processor. The "IT" suffix denotes features beyond plain S7 communication that are relevant to remote maintenance scenarios.

For remote-maintenance scenarios the IP access list is the most under-used feature. It lives on the CP itself and can be configured to accept S7 connections only from a specific office public IP, even when the DSL router's port forward is open. Combine it with the DSL router's source-IP filter for defence in depth.

Option A — VPN Tunnel (Recommended)

A VPN makes the remote site appear as another subnet on the office LAN. STEP 7 then uses the CP's private IP (192.168.100.10) just as it would locally, and the public address is never referenced in the project.

1. Choose the VPN technology. Most enterprise firewalls (Cisco ASA, Fortigate, Sophos, pfSense) and prosumer routers (Mikrotik, Ubiquiti) support IPsec IKEv2 with PSK or X.509 certificates. OpenVPN on a small Linux box or a Mikrotik is also common.
2. Configure the site DSL router as the VPN endpoint. Define a virtual IP pool (e.g., 10.10.10.0/24) for the office clients and add a static route for 192.168.100.0/24 via the tunnel.
3. Configure the office router/PC as the VPN client. After the tunnel comes up, ping the CP 343-1 at 192.168.100.10 — the response confirms bidirectional routing.
4. Open STEP 7 → Options → Set PG/PC Interface and select the TCP/IP <network adapter> access point bound to the S7ONLINE application. The VPN's virtual TAP/Win driver is selected automatically if it is the default route.
5. Open the STEP 7 project, PLC → Accessible Nodes. The CP 343-1 and CPU 315-2 DP appear with their private IP 192.168.100.x. Proceed to "Monitor/Modify", open a VAT, or "Download" as if on site.

No change to the CP 343-1 IP configuration is required. The "Use Router" field is not strictly needed for VPN-based access because every packet the office PC sends to 192.168.100.10 is delivered to the CP via the tunnel endpoint, which is itself in the same 192.168.100.0/24 subnet or has a direct route to it. Leave it set defensively in case the CP needs to call out to an NTP server or an e-mail receiver on the office side.

Option B — DSL Port Forwarding with DynDNS

When VPN is not available, a single S7 station can be reached by forwarding one TCP port on the DSL router to the CP 343-1. The CP must know the address of the DSL router as its default gateway so that any S7 reply packet to the office PC is sent out through the router's WAN interface.

1. Set up DynDNS on the DSL router (e.g., myplant.dyndns.org → current public IP 90.45.5.34). The CP 343-1 itself does not need a DynDNS client — the router updates the hostname. Most consumer routers integrate with No-IP, DynDNS, or a generic custom provider; configure update interval ≤ 60 s.
2. Create a port-forward rule on the DSL router: WAN: TCP/102 → 192.168.100.10:102. Disable any "SPI" or "WAN ping" features that are not strictly required, and do not forward UDP/102 — S7 over ISO-on-TCP uses TCP only.
3. Configure a firewall rule that allows TCP/102 from the office public IP only. Do not leave TCP/102 open to 0.0.0.0/0. If the office has a dynamic public IP, whitelist the upstream ISP range (CIDR block) and refresh quarterly.
4. Configure the CP 343-1 with the "Use Router" option pointing to 192.168.100.1, the DSL router's LAN-side address. The full parameter set is in the next section.
5. Enable S7 routing on the CP 343-1 (HW Config → CP properties → "S7 routing" checkbox). This is what allows STEP 7 to reach the CPU 315-2 DP behind the CP.
6. In STEP 7, point the S7ONLINE access point at the DynDNS hostname: myplant.dyndns.org as the target address. Do not change the CP's IP in HW Config — the CP itself keeps 192.168.100.10 in the project.
7. Run PLC → Accessible Nodes. STEP 7 issues an S7 connection attempt to myplant.dyndns.org:102; the DSL router translates the destination to 192.168.100.10:102, the CP answers, and the connection establishes.

CP 343-1 Advanced Configuration in STEP 7

Open the STEP 7 project, expand the S7-300 station in SIMATIC Manager, and double-click the CP 343-1 in HW Config. The parameters below must be set in Properties → Interface → Ethernet. Apply the same values via NCM S7 Industrial Ethernet / "Ethernet (CP 343-1 IT)" if the project uses a separate PC station.

For Option B, the "Use Router" field is what makes the difference: when the office PC sends an S7 PDU to 90.45.5.34:102, the packet reaches the CP 343-1 with a destination IP of 192.168.100.10 after the DSL router's NAT. The S7 PDU from the CP back to the office PC must be sent to a source IP that will be accepted by the DSL router's NAT, which means the CP must reply to the office public IP. Since that IP is not in 192.168.100.0/24, the CP uses the configured router (192.168.100.1) as the next hop. If "Use Router" is empty, the CP drops the reply or sends it with no L3 next hop and the connection times out at the STEP 7 side — exactly the symptom described in the original post.

STEP 7 V5.x — Remote Project Download

The same S7 connection carries both online DB access and full project download. The download path is identical for VPN and port forwarding.

1. Set the PG/PC interface: Options → Set PG/PC Interface → Access Point of the Application: S7ONLINE (STEP 7) → Interface Parameter Assignment Used: TCP/IP <your LAN adapter>. For VPN, the adapter is the virtual TAP/Win driver; for port forwarding, the physical Ethernet or Wi-Fi adapter.
2. Open the project and select the S7-300 station. Right-click the CPU 315-2 DP → Download.
3. Enter the target address:
   • VPN topology: target address = 192.168.100.20 (CPU's PROFINET address) or 192.168.100.10 (CP) — STEP 7 performs PG routing through the CP to the CPU on the backplane.
   • Port-forwarding topology: target address = myplant.dyndns.org or the static public IP. STEP 7 first connects to the CP, which then forwards the download to the CPU via S7 routing.
4. Confirm the "Download to Target System" dialog. For the CPU 315-2 DP, the tool offers to STOP the CPU before download — accept only if a stop is operationally acceptable. To download blocks without stopping, choose "Download user program to target — entire program".
5. Verify online: PLC → Accessible Nodes should show the CPU with its actual station name, module order number (e.g., 6ES7 315-2AH14-0AB0 V2.6), and rack/slot 0/2.

For TIA Portal, the procedure is similar under Online → Accessible Devices, with the target address entered in the same dialog. The "PG/PC interface" settings for S7ONLINE must match the VPN adapter (TAP-Windows) for tunneled access or the physical adapter for port-forwarded access.

Reading and Writing Data Blocks Remotely

Once an S7 connection is up, three practical paths exist for inspecting and modifying DB contents without downloading a project.

Path 1 — STEP 7 Online Monitoring

1. Open the project, expand "Blocks" in the S7-300 station.
2. Double-click the target DB (e.g., DB100) or open a Variable Table (VAT) such as VAT_1. The VAT opens in offline view by default.
3. Switch to Online → Monitor (or press Ctrl+F7). The current values are polled cyclically at the configured refresh rate.
4. To write a value, click the cell in the "Modify value" column, type the new value, and press Enter. STEP 7 sends a single S7 write PDU; the CP forwards it to the CPU which writes to the DB.

This method requires the STEP 7 project to match the CPU's offline/online block consistency. If the CPU's online program differs from the project (e.g., a download happened at site), use "PLC → Upload to PG" first to refresh the offline view.

Path 2 — Custom HTML Pages on the CP 343-1 Advanced

The CP 343-1 Advanced IT variant can host user-defined HTML pages that read and write DBs directly. The pages are stored on the CP's file system (FTP accessible at ftp://192.168.100.10) and use Siemens' HTML scripting syntax. This is the only way to expose a DB view to a regular browser without STEP 7 installed on the client.

1. Enable the web server in CP properties → Web. Assign an HTML user with read-only or read/write rights.
2. Author HTML pages with <!-- AWP_ ... --> tags binding variables to DB addresses, e.g., <!-- AWP_Out_Variable Name='"DB100.DBD0"' --> for a DWORD read, or <!-- AWP_In_Variable Name='"DB100.DBX4.0"' --> for a BOOL input.
3. Upload via FTP to the CP, then browse to http://myplant.dyndns.org/awp/<page>.html (port-forwarding case) or directly via the private IP on VPN.

For the public-internet case, expose the CP's HTTP port (default 80, configurable) on the DSL router with the same source-IP filtering rules used for TCP/102. HTML user pages are read/write-capable but do not authenticate against STEP 7 user lists; use the CP's per-page password protection.

Path 3 — S7 PUT/GET from a Second Station or OPC

If the office already runs SIMATIC NET OPC server or a WinCC station, define a S7 connection from that PC to the CP 343-1 with the public IP as target (port-forwarding) or the private IP (VPN). Expose the DB items in the OPC namespace and read/write them from any OPC client. This path also requires PUT/GET to be enabled on the CP (see parameter table above).

Verification and Diagnostics

After commissioning, run the following checks in order. Each one isolates a layer of the stack.

1. L3 reachability (VPN only): from the office PC, ping 192.168.100.10. A reply confirms the IPsec tunnel and routing.
2. TCP reachability: Test-NetConnection myplant.dyndns.org -Port 102 (PowerShell) or nc -vz myplant.dyndns.org 102 (Linux). A successful SYN/ACK confirms port forwarding and any firewall rule.
3. S7 connection: STEP 7 → PLC → Accessible Nodes. The CP 343-1 and CPU 315-2 DP must appear. Double-clicking the CPU opens the online view of the station.
4. DB read test: open a known DB (e.g., DB100) or a VAT, switch to Monitor, confirm that a value known to be running at site (e.g., a process variable) updates.
5. DB write test: write a test bit, read it back, then clear it. Watch the PLC's diagnostic buffer for "Status of operating mode change" or "Write request from PG" entries — these confirm the CP saw and forwarded the S7 PDU.
6. CP diagnostic buffer: in STEP 7, PLC → Diagnostics → Module Information on the CP 343-1. Look for "Connection established" / "Connection terminated" events with the office IP as the partner.

Troubleshooting Matrix

Frequently Asked Questions