Configuring S7 Routing Between X1 and X2 on S7-1516-3 PN/DP

Configuring S7 Routing Between X1 and X2 PROFINET Ports on the S7-1516-3 PN/DP

The SIMATIC S7-1516-3 PN/DP is a high-end CPU in the S7-1500 family equipped with two physically isolated PROFINET interfaces (X1 and X2) plus a PROFIBUS interface. The dual PROFINET architecture allows the CPU to simultaneously participate in two distinct IP subnetworks: an automation/PROFINET network on X1 and a plant IT, MES, or office network on X2. A frequent engineering question is whether nodes on the X2 side (PC, HMI engineering station, MES server) can reach PROFINET devices behind X1 (ET 200 stations, frequency inverters, Comfort Panels, Keyence vision systems) using the CPU as a router.

This reference documents the routing capabilities of the CPU 1516-3 PN/DP (6ES7516-3AP03-0AB0 and predecessor 6ES7516-3AN01-0AB0), explains the difference between S7 routing and IP routing, and provides the exact TIA Portal configuration required so that a PC connected to X2 can transparently access ET 200, HMI, and third-party PROFINET devices on X1.

1. Hardware and Interface Overview

The CPU 1516-3 PN/DP exposes the following physical and logical interfaces:

Both X1 and X2 are full PROFINET interfaces with their own MAC address, IP address, and device name. The interfaces are logically independent IP nodes – they can sit on different IP subnets without any routing logic in the CPU. For the CPU 1516-3 PN/DP variant 6ES7516-3AP03-0AB0, both interfaces support PROFINET with IRT, MRP, and S2 redundancy. Detailed interface specifications are documented in the S7-1500 CPU 1516-3 PN/DP System Manual.

2. S7 Routing vs. IP Routing – What the CPU Actually Does

It is critical to understand that the S7-1500 CPU is an S7 router, not an IP router. According to the Siemens manual S7-1500, ET 200MP, ET 200SP, ET 200AL Communication (12/2014 A5E03735815-AD), Chapter 9.1 "Routing":

• S7 Routing – The CPU forwards S7 protocol frames (S7 communication, programming/online, HMI protocol, Web server) between subnets. This works only for S7-aware endpoints (PC with TIA Portal, HMI panels, S7-300/400/1200/1500 stations, ET 200 stations with S7 routing capability).
• IP Routing – Not available on S7-1500 CPUs. ICMP (ping), generic TCP/UDP, HTTP from a browser to a field device, OPC UA client connections, etc. are not forwarded across X1 ↔ X2 by the CPU.

This is why a PC connected to X2 can download the TIA Portal project from the CPU, but cannot simply ping 85.16.84.50 (an ET 200 on X1). The ping will fail, and that is expected behavior, not a configuration error.

3. Prerequisites for S7 Routing Across X1 / X2

Before configuring the routing path, the following conditions must be met:

1. Both interfaces configured in TIA Portal – X1 and X2 each have an IP address, subnet mask, and (if applicable) router address assigned in the device configuration of the CPU. They must be on different IP subnets.
2. PROFINET device names assigned – All ET 200 stations, Comfort Panels, and third-party PROFINET devices must have a PROFINET name that matches the TIA Portal project. S7 routing uses PROFINET names, not IP addresses.
3. Engineering PG/PC on X2 with correct access path – In TIA Portal, the online access path must include the CPU as an S7 router. This is configured in the project tree under Online & Diagnostics → Online access.
4. Gateway address set on every PROFINET node on X1 – Each ET 200, HMI, SEW inverter, and Keyence vision system on X1 must use the CPU's X1 IP as its default gateway so that return S7 routing frames are routed back through the CPU.
5. No IP-level firewall blocking S7 ports (TCP 102) – If an external firewall or layer-3 switch sits between X2 and the engineering PC, TCP port 102 (ISO-on-TCP / TSAP) must be permitted.
6. CPU firmware ≥ V2.0 – S7 routing between two PROFINET interfaces of the same CPU requires firmware V2.0 or higher. CPU 1516-3 PN/DP variants 6ES7516-3AN01-0AB0 and 6ES7516-3AP03-0AB0 both satisfy this requirement.

4. Step-by-Step TIA Portal Configuration

4.1 Configure the Two Interfaces on the CPU

Open the device view of the CPU 1516-3 PN/DP in the TIA Portal project and assign each PROFINET port:

In the PROFINET interface properties under Layer 3 → Router address, leave the router address at 0.0.0.0 on both interfaces – the CPU does not need a default gateway for S7 routing to function.

4.2 Assign PROFINET Names to Field Devices

For each ET 200 station and HMI on X1, assign a PROFINET name from the project. Online assignment can be performed via Online & Diagnostics → Assign PROFINET device name. The name is what the S7 router uses to forward frames; IP addressing alone is not sufficient.

4.3 Configure the Standard PC Placeholder

Add a PC station (or a generic "Standard PC" device) in the Devices & Networks view. This represents the engineering PG/PC that will be physically connected to X2. Configure its PROFINET interface with:

• IP address: 192.168.1.50 (or whatever PC IP is used on X2)
• Subnet mask: 255.255.255.0
• Router / Gateway: 192.168.1.10 (the X2 IP of the CPU)

Connect the Standard PC subnet to the same subnet as X2 of the CPU. The Standard PC placeholder is not strictly required for the routing to function at runtime, but TIA Portal uses it for compiling the online access path and validating the topology during project engineering.

4.4 Configure the Engineering PC's Online Access Path

On the physical PC connected to X2:

1. Set the Ethernet adapter IP to 192.168.1.50 / 255.255.255.0.
2. Set the default gateway to 192.168.1.10 (CPU X2). This gateway setting is what tells the PC "to reach 85.16.84.x, send the frame to the CPU" – the PC does not need an actual IP route to the 85.16.84.x subnet; the CPU will use S7 routing for the S7 frames it receives.
3. In TIA Portal, expand Online access → [your network adapter]. The CPU should appear as a S7-1500 station.
4. Right-click the CPU and select Go online. This establishes the S7 routing path.

4.5 Configure PROFINET Device Gateway Settings

Each PROFINET device on X1 must be told that the CPU is its gateway. In the device properties of each ET 200 / HMI:

• PROFINET interface → Layer 3 → Use router: Yes
• Router address: 85.16.84.1 (CPU X1 IP)

Without this setting, response frames from the ET 200 will be sent to its default IP gateway, which by default points nowhere – and the routing will silently fail. The symptom is that the CPU itself can be reached from X2, but devices downstream on X1 cannot.

5. HMI Online Access Path – Special Case

Comfort Panels and other WinCC-based HMIs require the CPU to be set as their online gateway so the HMI can be downloaded from a TIA Portal instance on X2. In the HMI device configuration:

1. Open the HMI device configuration (e.g. KTP1500 Comfort, TP700 Comfort, TP1900 Comfort).
2. Navigate to Online & Diagnostics → Online access or in the connection table, set the PLC connection to use the CPU as the gateway.
3. On the PROFINET interface of the HMI, set Use router = Yes and Router address = 85.16.84.1.
4. Compile and download the HMI project from a PC on X2; the TIA Portal will route the download through the CPU down to the HMI on X1.

6. SEW Inverters and Third-Party PROFINET Devices

SEW-Eurodrive MOVILINK / MOVIPRO / MOVIFIT inverters using the DF PROFINET gateway behave like standard PROFINET slaves with respect to S7 routing. The procedure is identical:

1. Assign the SEW gateway a PROFINET name that matches the project.
2. Configure the SEW gateway with a router address of 85.16.84.1.
3. Verify that the SEW device is in the topology of X1 (not X2) in TIA Portal.
4. Test connectivity from a PC on X2 using TIA Portal Online & Diagnostics on the inverter node.

Keyence vision systems (CV-X series, XG-X series) with PROFINET support behave the same way once the PROFINET name and IP gateway are configured. For older Keyence systems that expose only Ethernet TCP, S7 routing will not work – a direct Ethernet connection to the same physical subnet is required.

7. Verification Procedure

After the configuration has been compiled and downloaded to the CPU, perform the following sequence to verify the routing path:

1. Local CPU reachability: From the PC on X2, open TIA Portal Online → Accessible nodes. The CPU 1516-3 PN/DP must appear with its X2 IP address.
2. Go online to CPU: Right-click the CPU device and select Go online. The orange "online" indicator must turn solid green.
3. Online to X1 PROFINET device: Select any ET 200 or HMI in the project tree on X1 and Go online. The S7 router mechanism in the CPU must forward the connection establishment. Verify the device's PROFINET name is shown correctly.
4. HMI download test: From the same PC on X2, perform a "Compile and download to device" on the Comfort Panel. Confirm the download completes without timeout.
5. Diagnostic buffer: Open Online & Diagnostics → Diagnostics buffer on the CPU and on each downstream device. No "routing error" or "timeout" entries should be present.

8. Troubleshooting Matrix

9. Common Configuration Mistakes

The following issues are encountered frequently in commissioning and must be checked:

• Same subnet on X1 and X2 – If both interfaces are assigned addresses in the same IP subnet (e.g. both in 192.168.1.x), the routing behavior becomes undefined because the OS will not be able to distinguish return paths. Always place X1 and X2 in different subnets.
• Standard PC not configured – Some TIA Portal versions refuse to compile a valid routing topology if the engineering PC is not represented as a device in the network view.
• PROFINET device name vs IP – S7 routing uses the PROFINET name, not the IP address, to identify the target. An ET 200 with a correct IP but wrong name will not be reachable.
• HMI gateway not set – The Comfort Panel must be told that the CPU is its routing gateway, otherwise the panel's responses to engineering PCs on X2 will be sent to its (empty) default gateway.
• PROFINET cable on wrong port – The X1 and X2 LEDs on the CPU front panel are labeled; if a field device is plugged into X2 by mistake, the routing path will be inverted and the engineering PC will not see it.
• Wrong S7 connection in WinCC – If the HMI's PLC connection is statically bound to the CPU's X1 IP instead of using the CPU as a routing gateway, the connection will fail when initiated from X2.

10. When S7 Routing Is Not Enough – Alternatives

If the application requires true IP-layer connectivity between the two networks (e.g. SCADA OPC UA polling of all field devices, remote desktop to HMI, VNC, video streams from cameras), one of the following architectures must be deployed instead of relying on S7 routing:

Adding a CP 1543-1 (6GK7543-1WX00-0XE0) to the S7-1500 rack gives the CPU a third IP interface with built-in stateful firewall, IP routing, and VPN capability. This is the Siemens-recommended approach when the customer requires genuine IP-level segmentation between the automation and IT networks.

11. Sizing and Performance Notes

S7 routing does not impose significant CPU load, but there are limits worth understanding:

• Concurrent S7 routing connections: The CPU 1516-3 PN/DP supports up to 32 PG/OP connections per PROFINET interface by default; this can be increased in the protection / connection configuration up to the CPU resource limit (typically 64 for the 1516 class).
• S7 routing latency: Each S7 routing hop adds approximately 1–3 ms latency. The CPU itself is a single hop, so a X2 → CPU → X1 path is typically < 5 ms round-trip, acceptable for engineering and HMI traffic but not for hard real-time control.
• Web server: The integrated web server of the S7-1500 is reachable on both X1 and X2 IP addresses; it does not require S7 routing.
• Bandwidth: PROFINET IRT traffic on X1 is not affected by S7 routing load on X2; the two interfaces have independent MAC and PHY.

12. Safety and IT-Security Considerations

Routing an office IT network (X2) into the automation network (X1) creates an inherent attack surface. The following minimum controls are recommended:

1. Enable the CPU's integrated access protection (Security → Access protection) with a password for each protection level.
2. Restrict PUT/GET communication if not explicitly required by the HMI.
3. Disable unused services on the CPU (Web server, SNMP, OPC UA server) or restrict them via IP ACL.
4. If using a CP 1543-1, enable the stateful firewall with explicit allow rules for known sources.
5. Document every cross-subnet access in the network security plan and review with the customer's CISO.

13. Reference Documentation

Authoritative sources for the configuration described above:

• CPU 1516-3 PN/DP (6ES7516-3AP03-0AB0) – Device-specific Information – TIA Portal Manual Collection
• S7-1500 CPU 1516-3 PN/DP System Manual (PDF) – Configuration, installation, wiring, commissioning
• Siemens manual S7-1500, ET 200MP, ET 200SP, ET 200AL Communication, edition 12/2014, article number A5E03735815-AD, Chapter 9.1 "Routing" – S7 routing mechanism and gateway configuration