Configuring S7-300 CP343-1EX30-0XA0 Remote Access via Router in STEP 7 v5.5
This technical reference explains how to establish a STEP 7 v5.5 online connection from a programming PC to a SIMATIC S7-300 station that is separated from the PC by one or more IP routers. The configuration centers on the CP 343-1 Lean (order number 6GK7 343-1EX30-0XA0) communications processor, which provides the PROFINET interface on the S7-300 backplane and exposes the CPU for S7 communication, S7 routing, open communication (TCP/UDP/ISO-on-TCP), and PG functions. The article is valid for STEP 7 V5.5 + SPx and for CP firmware releases bundled with the S7-300 family up to and including the EHW 6ES7 343-1EX30-XA0 hardware revision.
1. Problem Statement and Architecture
The classic field scenario is:
- A PC with STEP 7 V5.5 has an IP address on the engineering network (or on the public internet via a corporate gateway).
- An S7-300 CPU 31x with a CP 343-1EX30-0XA0 in slot 4 (or any free slot supported by the CPU) is connected to a separate IP subnet.
- A router sits between the two subnets. The router may perform NAT (Network Address Translation), may be a DSL/4G/5G CPE, or may be a VPN endpoint of an IPsec/OpenVPN tunnel.
From the STEP 7 side, the engineer wants to perform Go Online > Accessible Nodes, download a project, run the diagnostics buffer, or use the Commissioning / Online & Diagnostics tools of the CP and the CPU. The success of these operations depends on three independent, correct configurations:
- STEP 7 V5.5 PG/PC interface assignment to the correct network adapter and protocol.
- The CP 343-1 has a valid IP address, subnet mask, default router, and a reachable S7 connection path.
- The intermediate router(s) and any firewall permit the S7 communication on TCP port 102 (and any UDP port if PROFINET discovery is used).
2. Prerequisites
| Item | Required Specification |
|---|---|
| STEP 7 V5.5 | SP2 or later, with the latest KOP/AWL/FUP Service Packs applied. The Set PG/PC Interface tool is installed. |
| CP 343-1 | 6GK7 343-1EX30-0XA0 firmware 2.x or higher. Confirm via online diagnostics: Module Information > Firmware. |
| S7-300 CPU | CPU 312, 314, 315-2 DP/PN, 317-2, or 319-3 PN/DP. The CPU must be in RUN or STOP; firmware state does not block online access. |
| IP subnet plan | PC subnet, PLC subnet, router interface IPs, and a routable summary that covers all hops. |
| Router / firewall | Capability to forward or NAT TCP/102, plus optional UDP/34964 (PROFINET discovery) and UDP/49152-65535 (DCP, optional). |
| Network reachability test | ICMP ping path from PC to CP IP, then from PC to the router WAN interface if NAT is in use. |
3. CP 343-1EX30-0XA0 Hardware Identification
The 6GK7 343-1EX30-0XA0 is the CP 343-1 Lean module. Two PROFINET ports (X1 P1, X1 P2) are integrated on the front. Key data:
| Parameter | Value |
|---|---|
| Order number (MLFB) | 6GK7 343-1EX30-0XA0 |
| Function | PROFINET IO Controller / IO Device, S7 communication, S7 routing, open user communication over TCP, UDP, ISO-on-TCP |
| Number of PROFINET ports | 2 (integrated switch) |
| Transfer rate | 10 / 100 Mbit/s full duplex, autonegotiation |
| MAC address range | Printed on the front; first octet must be even (08-00-06-xx-xx-xx for Siemens default) |
| Default IP (out of the box) | 0.0.0.0 — must be assigned before online use |
| Slot | 1 to 4 on the S7-300 rack, never slot 3 (reserved for IM) |
| Required power | 5 V DC from S7-300 backplane, typ. 220 mA |
The CP exposes the S7 CPU to the network. You do not need to insert a second, non-physical CP in the hardware configuration unless you specifically use the S7 routing function to reach a downstream PROFIBUS or PROFINET node through this CP as a gateway. Adding an unconfigured dummy CP serves no purpose and is a common source of "The configuration differs from the actual configuration" online diagnostics errors.
4. Network Architecture Patterns
Three typical topologies appear in field installations. Each affects STEP 7 V5.5 configuration differently.
4.1 Pattern A — Same Subnet, no Router
PC and CP are on the same physical/logical network (e.g., both 192.168.0.0/24). The router is irrelevant. Configure only the CP's IP in the STEP 7 project and use PG/PC Interface = TCP/IP > <your NIC>.
4.2 Pattern B — Two Subnets, IP Routable (no NAT)
PC subnet: 192.168.0.0/24 (gateway 192.168.0.1). PLC subnet: 192.168.1.0/24 (gateway on router 192.168.1.1). The router performs pure Layer-3 forwarding. Configure the CP with Use Router = yes and the router IP as the default gateway. The PC's default route must point at 192.168.0.1. No NAT is involved; from the PC, ping and S7 communication go directly to 192.168.1.x.
4.3 Pattern C — NAT / VPN / Internet
PC is on a public or remote network, CP is behind a CPE that performs NAT or terminates a VPN. The CP's private IP (e.g., 192.168.1.10) is mapped to a public IP on the router, or the PC joins the remote LAN via VPN. In this case the STEP 7 project still references the CP's logical IP that the PC can reach after NAT/VPN is established (either the public address or the VPN-tunneled address).
5. STEP 7 V5.5 PG/PC Interface Assignment
The PG/PC interface is the single most common source of "Cannot establish a connection to the target module" errors. Configure it explicitly before any project work.
- Open Start > SIMATIC > STEP 7 > Set PG/PC Interface (or Control Panel > Set PG/PC Interface).
- In the Access Point of Application dropdown, select S7ONLINE (STEP 7).
- In the Interface Parameter Assignment list, select the network adapter that is physically connected to the network segment that can route to the CP. Typical entries: TCP/IP > Intel(R) Ethernet Connection I219-LM.
- Click Properties and confirm that the IP address on this adapter matches the subnet you expect. STEP 7 will use this address as the source of all S7 connections.
- Click OK, then OK on the main dialog. Restart SIMATIC Manager if it was already open.
6. Hardware Configuration of the CP 343-1
Open the S7-300 station in SIMATIC Manager, open Hardware, and double-click the CP 343-1 in the rack. The Properties dialog has the following critical fields:
| Tab | Field | Value / Action |
|---|---|---|
| General | Name | Free text, e.g., CP343-1_SW1 |
| General | Type | CP 343-1 (6GK7 343-1EX30-0XA0) — must match the physical module |
| Properties > IP | IP Address | The static IP of the CP, e.g., 192.168.1.10 |
| Properties > IP | Subnet Mask | 255.255.255.0 (must match router interface subnet) |
| Properties > IP | Use Router | Tick Use Router and enter the router IP (default gateway) reachable from the CP's subnet, e.g., 192.168.1.1 |
| Properties > IP | MAC | Accept the MAC printed on the front, or use Set MAC address only if you have a documented reason |
| PROFINET | PROFINET IO Mode | None, Controller, or Device — leave as None if the CP is used only for PG communication |
| S7 Communication | Connection Configuration | Defaults are sufficient for PG routing |
| Time-of-Day Synchronization | Mode | Optional; not required for online access |
Compile and download the hardware configuration to the CPU (or to the CP via the CPU). The CP's IP becomes active after a power cycle of the CP or after a Restart of the CP module from the online diagnostics.
7. Router, NAT, and VPN Configuration
After STEP 7 is configured, the network path must permit the S7 communication. The S7 protocol uses TCP port 102 for the ISO-on-Transport Layer (ISO-T) connection. PROFINET discovery uses UDP 34964 (PN-DCP). Adjust the following on the router/firewall:
- Open TCP/102 from the PC source IP to the CP destination IP (the post-NAT public address, or the VPN tunnel address).
- If the PC is in a different routed subnet from the CP (Pattern B), add a static route on every router in the path covering 192.168.1.0/24 via 192.168.1.1.
- If the CP is behind NAT, configure a destination NAT (port forwarding) on the router: external TCP/102 → internal 192.168.1.10:102. The CP must be the only S7 device exposed on this external IP, because S7 uses a single port and requires address-aware handling.
- Allow ICMP Echo Request/Reply for diagnostics; S7 does not require it but the path is much easier to verify if ping works.
- Disable SIP ALG, H.323 ALG, and any application-layer gateway on consumer-grade routers — they corrupt ISO-T segments.
| Service | Protocol / Port | Direction | Purpose |
|---|---|---|---|
| S7 Communication (ISO-T) | TCP / 102 | PC → CP | Mandatory for online access, project download, diagnostics |
| PROFINET DCP | UDP / 34964 | Bidirectional, link-local | Discovery / name assignment — works only on the local L2 segment, not across routers |
| PROFINET RPC | UDP / 49152-65535 | Bidirectional | IO data, only if the CP runs as PROFINET IO Controller/Device |
| SNMP (if enabled) | UDP / 161 | PC → CP | Optional management, not required for STEP 7 |
8. S7 Routing — When to Enable It
S7 routing lets STEP 7 reach a downstream station through a CP/IE acting as a gateway. The S7-300 station is the gateway and the S7 routing function is enabled in HW Config on the CP 343-1, then STEP 7 builds a routing entry to the target subnet.
Use S7 routing only if:
- The target S7 station is on a different subnet (PROFIBUS or PROFINET) that is reachable from this S7-300 station only through the CP 343-1, and
- You cannot assign an IP to the target that is directly routable from the PC, and
- You want to use a single online entry point.
Configuration steps for S7 routing:
- In HW Config of the gateway station, open the CP 343-1, Properties > S7 Routing tab, tick Use S7 Routing.
- In STEP 7 on the PC, open NetPro (or the topology editor in TIA Portal for newer projects). Add a route: PC subnet → Gateway CP (IP of CP 343-1) → Target subnet.
- The CP 343-1 must be online; the routing function consumes a small amount of CPU resource.
If your topology is simply PC → router → CP 343-1, S7 routing is not needed and adding it can cause confusion. Configure the CP's IP directly and rely on Layer-3 routing at the network device.
9. Verification Procedure
Run the following checks in order. Stop at the first failure and resolve before proceeding.
-
Ping the CP IP from the PC command line:
ping 192.168.1.10. A response confirms Layer-3 reachability. -
Telnet the S7 port:
telnet 192.168.1.10 102. A black screen or Connected to 192.168.1.10 confirms TCP/102 is open. A Could not open connection indicates a firewall or NAT issue. - STEP 7 > Accessible Nodes: PLC > Accessible Nodes. If the CP appears with its IP and rack/slot, the S7 protocol is functional. If Accessible Nodes returns nothing and a direct IP ping works, suspect the PG/PC interface selection.
- Online & Diagnostics: right-click the CP, choose Online & Diagnostics > Diagnostics Buffer. The buffer should report the CP startup, IP assignment, and any S7 connection attempts.
- Download test: try a hardware download. The dialog reports Download to module completed successfully on success. If it stops at Establish connection..., inspect the CPU's diagnostic buffer for S7 connection rejects (event IDs 0x8A91, 0x8A92, 0x8A94).
10. Troubleshooting Matrix
| Symptom | Likely Root Cause | Action |
|---|---|---|
ping to CP times out, but ping to router works |
Router does not have a route to the CP subnet, or CP's Use Router is disabled and CP is on a different subnet | Enable Use Router in CP properties, or add a static route on the router |
ping to CP works, but STEP 7 > Accessible Nodes shows nothing |
PG/PC interface bound to wrong NIC, or firewall on PC blocks outbound TCP/102 | Re-assign S7ONLINE to the correct adapter; add Windows Firewall rule for S7DOS and SIMATIC Manager |
| Telnet to TCP/102 fails despite ping success | NAT is consuming the port, or CPE firewall drops 102 | Configure explicit destination NAT for TCP/102; disable ALG/SPI on consumer routers |
| STEP 7 reports Online: The configuration differs from the actual configuration | Extra dummy CP inserted in HW Config, or slot mismatch | Remove any unconfigured CP objects; reload the actual configuration |
| STEP 7 stops at Establish connection, then Error 0x80072EE7 | DNS resolution failure combined with proxy on PC | Disable system proxy for S7ONLINE; check Internet Options > Connections > LAN Settings |
| CPU diagnostic buffer shows STOP caused by communication error, event 0x8A91 | CP rejected a passive S7 connection; possible duplicate IP on the network | Verify uniqueness of the CP's IP; check MAC/IP pairing on the router ARP table |
| Connection succeeds, but every download fails with Function not allowed in current protection level | CPU password / access level set above Full Access (no password) | Enter the correct password in PLC > Access Protection before downloading |
| Connection succeeds intermittently, fails after 1-2 minutes | Router stateful firewall resets idle TCP sessions, or NAT table flush | Disable connection tracking on the router, or configure a keep-alive interval on the CP (Properties > S7 Communication > Keep-Alive) |
11. Field-Proven Configuration Checklist
- Confirm CP order number on the front of the physical module matches the HW Config object exactly:
6GK7 343-1EX30-0XA0. - Document the CP's MAC, IP, subnet mask, and default gateway. The default gateway must be inside the CP's own subnet, never in another subnet.
- Verify that the PC's own default route points at a router that has a route to the CP's subnet. The reverse-direction route is equally important.
- Disable any Windows Firewall profile on the PC during initial commissioning, then re-enable with the narrowest possible rule set.
- Use a single dedicated VPN tunnel for engineering traffic. Do not multiplex PG, HMI, and SCADA traffic on the same NAT port forward.
- Set the CPU access protection to Full Access (no password) during commissioning, then restore the plant password policy before handing the system back to operations.
- Keep the CP firmware current. The latest GSD/GSDML and STEP 7 component description for the 6GK7 343-1EX30-0XA0 is available on the Siemens Industry Online Support portal under entry ID 24410844 (CP 343-1 Lean product page).
12. Frequently Asked Questions
Do I need to add a second, non-physical CP in HW Config to reach my CPU through a router?
No. Configure only the physically present CP 343-1 with its real IP address, subnet mask, and default router. A second dummy CP object in the project serves no purpose unless you are explicitly using S7 routing to reach a downstream station through the CP as a gateway.
Which TCP port must be open between my PC and the CP 343-1 for STEP 7 V5.5 online access?
TCP port 102 must be permitted end-to-end. This is the S7 communication port (ISO-on-Transport Layer). PROFINET discovery uses UDP 34964 but only on the local L2 segment; it does not cross routers and is not required for a direct online session.
My ping to the router works but the PLC is unreachable. What is the first thing to check?
Verify the CP's Use Router setting in HW Config and confirm the default gateway entered there is inside the CP's own subnet and is the router's interface that faces the PLC. Then check the router's return route to the PC's subnet and any firewall rules that may be dropping ICMP or TCP/102 between the two networks.
Can I use S7 routing to reach an S7-300 station behind a NAT router from STEP 7 V5.5?
No. S7 routing works on Layer-3 within a Siemens routing topology and does not perform NAT traversal. The CP's IP that STEP 7 uses must already be routable from the PC after NAT/VPN has been resolved. If the CP is behind a CPE performing NAT, configure a destination NAT for TCP/102 or use a VPN tunnel so the CP's private IP becomes reachable.
What does the diagnostic buffer event ID 0x8A91 mean on the S7-300 CPU?
Event 0x8A91 indicates a communication error: the CPU received an S7 connection request that it rejected. Common causes are a duplicate IP address on the network, an access protection mismatch, or a passive connection configuration error on the CP. Inspect the buffer timestamp and the associated slot to confirm whether the rejection originated on the CP or the CPU.