Configuring S7-300 to S7-1200 VPN Communication in TIA Portal V13

Overview

The most common failure mode when connecting a Siemens S7-300 CPU to a S7-1200 (or S7-1212C) across an internet-bound VPN tunnel is not the tunnel itself — it is the IP routing inside TIA Portal V13. When the two controllers live on different IP subnets (for example, the factory LAN at 192.168.1.0/24 and the office LAN at 192.168.20.0/24), the PUT / GET instructions on the S7-300 cannot resolve the remote partner unless a router (default gateway) is bound to the PROFINET interface of the CPU and the partner IP belongs to a different subnet that the gateway can reach through the VPN.

This reference walks through the exact IP, gateway, and connection configuration required in TIA Portal V13 so that an S7-315-2PN/DP can perform PUT / GET data exchange with a remote S7-1212C fronted by an S7-1243-1 communications module, across a router that terminates a site-to-site VPN.

System Architecture and Address Plan

Before opening TIA Portal V13, freeze the IP plan. The architecture is point-to-point across a VPN, so only two endpoints exist on the S7 side.

Both routers must terminate the same VPN (IPsec site-to-site, IKEv1/IKEv2, or SSL VPN depending on hardware). The VPN must present both LAN segments as if they were bridged; usually the VPN is configured to pass traffic between 192.168.1.0/24 and 192.168.20.0/24.

Prerequisites

• TIA Portal V13 (V13 SP1 or V13 SP2 strongly recommended) with the matching CPU support packages for S7-300 and S7-1200. See the Siemens TIA Portal V13 release notes.
• STEP 7 V13 (included in TIA Portal V13) installed with the S7-300 HSP (Hardware Support Package) for the exact MLFB of the S7-315-2PN/DP being used.
• Working IPsec / SSL VPN tunnel between the two site routers, with the inside LAN ranges listed above (or equivalents) routed across it.
• Each router's LAN-side address known and pingable from the engineering station.
• Engineering station that can reach both subnets at the same time (typically by being on one of them, or by adding a route to the other via the appropriate gateway).

Step 1 — Create the TIA Portal Project and Add Both Devices

1. Open TIA Portal V13 and choose Project > New. Create a single project that contains both CPUs; this lets the connection editor manage partners across the project.
2. In the project tree choose Add new device > SIMATIC S7-1200 > CPU > CPU 1212C DC/DC/DC (or the exact order number of the installed module).
3. Add a second device: Add new device > SIMATIC S7-300 > CPU > CPU 315-2 PN/DP > 6ES7 315-2EH14-0AB0 (or whatever MLFB is installed). TIA Portal V13 ships with the S7-300 catalog, but specific MLFBs may require an HSP — verify via HSP download for TIA Portal V13.
4. Right-click the S7-1212C and choose Properties > Ethernet addresses on the PROFINET interface. Enter 192.168.1.10, subnet mask 255.255.255.0, and tick Use router. Enter the factory router address 192.168.1.1.
5. Right-click the S7-315-2PN/DP PROFINET interface and enter 192.168.20.10, subnet mask 255.255.255.0, default router 192.168.20.1.

Step 2 — Configure the IP Route in the CPU Interface

This is the step that is most often missed. Each S7 CPU's PROFINET interface accepts one static default router (gateway), and any traffic destined to a subnet different from its own is forwarded to that gateway. The TIA Portal default screen sometimes hides the gateway field on S7-300 devices, depending on firmware.

1. Select the S7-315-2PN/DP in the project tree.
2. Open Properties > PROFINET interface [X2] > Ethernet addresses.
3. Tick Use IPv4 router and enter 192.168.20.1. Without this, the CPU will ARP for the remote partner IP directly on the local LAN and the request will never reach the VPN.
4. Repeat on the S7-1212C with the factory router address.

Step 3 — Create the S7 Connection in the Connection Editor

TIA Portal V13's Connections editor is where the S7 connection is associated with a partner. The S7-300 initiates PUT / GET, so the connection is configured on the S7-315-2PN/DP side.

1. Select the S7-315-2PN/DP in the project tree.
2. Double-click Connections.
3. Click the empty row to add a new connection. In the dropdown Type, choose S7 connection.
4. In the Partner column, choose the S7-1212C from the same project. The connection becomes project-internal and the local ID / partner ID are assigned automatically.
5. Open the connection's properties. In the Address details section, verify the Partner address field shows 192.168.1.10 (the S7-1212C). If the field is greyed out, click the "..." button to force the address entry.

Step 4 — Enable PUT/GET on the S7-1200 Partner

The S7-1200 (firmware V4.x, the version contemporary with TIA Portal V13) blocks PUT / GET by default. Without enabling it, the S7-315 will receive error 0x0001 (resource problem) or 0x8081 (connection refused) on every PUT / GET call.

1. Select the S7-1212C in the project tree.
2. Open Properties > General > Protection & Security > Connection mechanisms.
3. Tick Permit access with PUT/GET communication from remote partner.
4. Download the configuration to the S7-1212C.

Step 5 — Program PUT and GET on the S7-315-2PN/DP

The S7-300 uses the standard blocks from the Standard Library > Communication Blocks. In TIA Portal V13 they are under Instructions > Communication > S7 Communication when the S7-300 program is being edited.

PUT call (S7-300 writes to S7-1200):

// SCL example for S7-315-2PN/DP (TIA V13)
// Connection ID 1 = VPN_to_Factory_S7_1200
// Write 10 bytes from DB100 to the S7-1200's DB200 starting at byte 0

#REQ        := TRUE;                    // rising edge triggers PUT
#ID         := 1;                       // local connection ID from editor
#DONE       := #statPutDone;
#ERROR      := #statPutError;
#STATUS     := #statPutStatus;
#SD_1       := P#DB100.DBX0.0 BYTE 10;  // ANY pointer, local source
#ADDR_1     := P#DB200.DBX0.0 BYTE 10;  // ANY pointer, remote destination

GET call (S7-300 reads from S7-1200):

// SCL example for S7-315-2PN/DP (TIA V13)
#REQ        := TRUE;
#ID         := 1;
#DONE       := #statGetDone;
#ERROR      := #statGetError;
#STATUS     := #statGetStatus;
#RD_1       := P#DB101.DBX0.0 BYTE 20;  // local receive buffer
#ADDR_1     := P#DB201.DBX0.0 BYTE 20;  // remote source on S7-1200

Wire the REQ inputs to a periodic 1-Hz clock from a timer or system clock. The STATUS word gives detailed diagnostics — see the table in the troubleshooting section below.

Step 6 — Configure the VPN Routers (Network Layer)

TIA Portal handles only the S7 side. The router side is what makes the IP packets routable. The two routers must:

1. Have an IPsec / SSL VPN tunnel with the remote site's public IP as the peer.
2. Place the inside LANs of the two sites into the same routed domain (e.g., add the local LAN and the remote LAN as VPN-protected subnets).
3. Allow TCP/UDP port 102 (ISO-on-TCP / TPKT, used by S7 communication) and, if using S7 communication with the Send/Receive variants over TCP, port 2000–2002. S7 connection block PUT/GET uses ISO-on-TCP, so port 102 is the primary requirement.
4. Apply no NAT between the two inside LANs (1:1 route or no-NAT policy).
5. Allow ICMP between the inside addresses for ping-based testing.

On common industrial routers (Siemens SCALANCE, Hirschmann, Phoenix, Cisco), this is a "tunneled routes" or "VPN protected networks" list. Refer to the router's official manual for the exact menu.

Step 7 — Compile and Download

1. Right-click the S7-315-2PN/DP project and choose Compile > Hardware and Software (rebuild all). TIA Portal V13 will surface any partner resolution errors — fix them before continuing.
2. Connect the engineering PC to the office LAN (where the S7-315 lives) and download to the S7-315-2PN/DP. Use the reachable interface that maps to 192.168.20.10.
3. Connect to the factory LAN and download to the S7-1212C. Repeat the download — the PUT/GET permission must be on the S7-1200 to allow the connection.

Step 8 — Verification

Work through these checks in order; do not skip a step.

1. Local ping: From the engineering PC, ping the S7-1212C at 192.168.1.10 via the VPN. Expect reply. If it fails, the VPN is broken; fix the tunnel before debugging S7.
2. Local ping: From the engineering PC, ping the S7-315-2PN/DP at 192.168.20.10. Expect reply.
3. Cross-subnet ping: From the S7-300's online diagnostics (TIA Portal V13: Online > Online & Diagnostics > PROFINET interface > Ping), ping the S7-1212C. If this fails but the engineering PC can ping it, the CPU's default gateway is not set or is wrong.
4. Connection status: Open the S7-315-2PN/DP online and view Connections. The connection should show established. If it shows "not established" or keeps cycling, see the error code table below.
5. Data verification: In the S7-315, monitor the SCL PUT / GET block's STATUS. A value of 0000 on DONE means success; any non-zero value is the error code listed in the table below.

Troubleshooting Matrix

Alternative Path — Use the S7-1243-1 as a Router

If the S7-1243-1 communications module is installed on the S7-1200 side, it can act as a router. The S7-1243-1 has its own PROFINET interface that is independent of the S7-1212C's built-in PROFINET port. The configuration is the same as for the S7-1200: assign a separate IP (e.g., 192.168.1.20), separate subnet, and a default gateway that points to the factory router. The S7-300 then talks to 192.168.1.20 instead of 192.168.1.10; the S7-1243-1 is the partner in the connection editor.

This is the right architecture when the S7-1212C is isolated from the plant LAN and only the S7-1243-1 has internet connectivity, which is common in greenfield deployments.

Performance and Timing Notes

Security Considerations

PUT/GET is an unauthenticated S7 protocol designed for trusted networks. Several layers of defense are appropriate when carrying it across an internet VPN:

1. Use a managed VPN with strong ciphers (AES-256/SHA-256 or better). Do not rely on the PLC's own security for this transport.
2. Disable direct internet access on the inside interfaces of the routers. The PLCs should only be reachable from the other side of the tunnel.
3. Block TCP/102 on any interface that is not the inside LAN or the VPN tunnel.
4. For S7-300 firmware that supports it, enable CPU access protection with a password and require the password for online access; this does not protect the data transfer itself but it prevents unauthorized programming access.
5. On S7-1200 firmware V4.x, prefer to keep PUT/GET permission off by default and enable it only when this connection is required, to reduce blast radius if a misconfiguration exposes the PLC.

For higher-security deployments, replace PUT/GET with S7 Communication using BSEND/BRCV (when both sides are S7-300) or with Open User Communication on the S7-1200 side, both of which can be wrapped in TLS-capable transports depending on the module.

Glossary of TIA Portal V13 Connection-Editor Terms

FAQ