Configuring SCALANCE W788-1 Pro as a Transparent WLAN Bridge for PROFINET IO

When a single Ethernet cable between a SIMATIC S7-300 CPU and a distributed ET 200 PROFINET IO station must be replaced by a wireless link, two SCALANCE W788-1 Pro devices are a common choice. The most frequent commissioning error is to leave both devices in their default access-point / client roles and expect PROFINET IO to traverse the radio link. PROFINET IO relies on Layer-2 multicast/broadcast services (DCP, LLDP, PROFINET RT) which an AP-client association does not transparently forward. The correct topology is a point-to-point Layer-2 bridge between the two radios. This guide walks through the full configuration via Web Based Management (WBM), verification of the radio link, and PROFINET IO commissioning on top of it.

1. Problem Statement

A typical machine cell looks like this on the wire:

• SIMATIC S7-300 CPU (e.g., CPU 315-2 PN/DP) acting as PROFINET IO Controller.
• ET 200S, ET 200SP, ET 200pro or ET 200MP acting as PROFINET IO Device.
• Single shielded twisted-pair (PROFINET cable, 2 x 2 x AWG 22) connecting the two.

The user wants to remove that one cable and replace it with a wireless link using two SCALANCE W788-1 Pro devices - one mounted next to the S7-300, the other next to the ET 200. First attempt: configure device A as Access Point, device B as Client. Result: PROFINET IO does not come up. The IO controller never detects the IO device; HW Config / TIA Portal online diagnostics show no PROFINET device at the expected station address.

This is not a defect of the radios. It is a mismatch between the WLAN topology and the protocol on top of it.

2. Why Client/Access Point Mode Fails for PROFINET IO

PROFINET IO uses several Layer-2 services that must reach the IO device without filtering:

A standard 802.11 access-point / client association is a port-based infrastructure service. The client is, from the AP's perspective, a single association identified by its MAC address. Bridging between wired ports and the wireless association is allowed, but multi-station forwarding across a single SSID is handled like a normal Layer-2 switch and depends on which MACs have been learned on which side. DCP, LLDP, ARP and the multicast PROFINET record/response exchanges will only cross the radio link if the bridging engine on both sides treats the WLAN interface as a true trunk that forwards everything. Most SCALANCE W700 firmware versions implement this cleanly only when both radios are explicitly set to Bridge Point-to-Point mode (sometimes labelled Bridge PtP or Transparent Bridge) with a defined remote partner.

3. Solution: Bridge Point-to-Point Mode

Set both SCALANCE W788-1 Pro devices to Bridge Point-to-Point (transparent bridge). The two devices form a Layer-2 tunnel:

• All Ethernet frames received on the LAN port of device A are forwarded over the WLAN to device B.
• All Ethernet frames received on device B's LAN port are forwarded to device A.
• MAC learning, broadcast and multicast are passed unchanged.
• The two devices are identified to each other by MAC address (the "remote bridge partner").

This is functionally equivalent to the original Cat 5 / PROFINET cable. The rest of the article assumes this configuration.

4. Prerequisites

• Two SCALANCE W788-1 Pro (6GK5788-1ST-00AA0 or equivalent variant for the country approval required) with identical or compatible firmware. Mismatched firmware on the two bridge partners can prevent the bridge from coming up; both units should be at the same major release.
• Antennas appropriate for the environment: 6 dBi omnidirectional (e.g., ANT795-6MN) for short indoor links inside a cabinet, or directional Yagi / panel antennas (e.g., ANT795-6DC, ANT795-6MT) for outdoor line-of-sight links up to several hundred meters.
• Antenna cables with N-Connect or R-SMA connectors as specified by the W788 variant; observe the maximum permitted cable length and the resulting path loss.
• 24 V DC power supply for each device (the W788-1 has a plug-in terminal block for redundant supply). The PROFINET variant can alternatively be powered over PoE depending on the order number.
• Configuration PC with Ethernet port and a current browser (Chrome, Firefox, Edge) for WBM access.
• Reference: SCALANCE W788-x / W748-1 Operating Instructions, Siemens document 109774015 (BA_SCALANCE_W788_W748).

5. Hardware Installation

1. Mount each SCALANCE W788-1 Pro on a DIN rail or with the wall-mounting kit so that the antenna connectors face the outside of the cabinet.
2. Connect the LAN port (RJ45) of each device to the existing PROFINET segment:
   • W788 at the S7-300 side: to the PROFINET interface of the CPU, or to the switch that connects the CPU.
   • W788 at the ET 200 side: directly to the PROFINET port of the IO device.
3. Apply 24 V DC. Observe the LED indicators:
   • P (power) lit green when supply OK.
   • F (fault) off in normal operation.
   • L1/L2 signal quality LEDs of the WLAN interface.
4. Attach the antennas hand-tight (do not use pliers). For outdoor installation, weatherproof the N-Connect joints with self-amalgamating tape.

6. Initial IP Address Assignment

Out of the box, a SCALANCE W788-1 Pro typically requests an IP address via DHCP; if no DHCP server responds, it falls back to a default such as 192.168.1.1. For predictable commissioning:

1. Connect the configuration PC directly to the LAN port of one W788 (do not power the second W788 yet - this avoids address clashes during setup).
2. Set the PC to a static address on the same subnet, e.g., 192.168.1.100 / 255.255.255.0.
3. Open https://192.168.1.1 in the browser. Accept the self-signed certificate warning.
4. Log in with the default credentials as printed on the device label / documented in the manual. Change them on first login.
5. Navigate to System > IP and assign a fixed IP for this device, e.g., 192.168.1.10 / 24. Save and commit.
6. Repeat the procedure for the second device with IP 192.168.1.11 / 24. Power it on only after the first one has a stable IP.

7. Step-by-Step Configuration via Web Based Management

The two radios are configured identically except for the Bridge Partner entries, which are swapped: each device must point at the MAC address of the other.

7.1 Read Both MAC Addresses

From the WBM of each unit, navigate to System > Identification or Information > System and note the WLAN MAC address. You will need:

• MAC_A - WLAN MAC of the S7-300-side W788.
• MAC_B - WLAN MAC of the ET 200-side W788.

7.2 Configure the Operating Mode on Both Devices

1. Navigate to Layer 2 > Bridge (or WLAN > Mode, depending on firmware - the menu label is documented in the SCALANCE W788-x / W748-1 Operating Instructions).
2. Set Operating Mode = Bridge Point-to-Point.
3. Set Bridge Partner = MAC_B on device A, and Bridge Partner = MAC_A on device B.
4. Enable iPCF (Industrial Point Coordination Function) on both units. iPCF is the Siemens-proprietary Layer-2 mechanism that gives PROFINET deterministic behavior over WLAN and is required if PROFINET RT Class 2/3 is to be used.
5. Commit the change with Apply / Save.

7.3 Configure the Radio Parameters

On both devices, set the following to identical values:

7.4 Set the IP Configuration for Management

The radios still need an IP for WBM access. Set:

• Device A (S7-300 side): IP 192.168.1.10 / 24, Gateway = IP of the CPU (e.g., 192.168.0.1) if the CPU is on a different subnet.
• Device B (ET 200 side): IP 192.168.1.11 / 24, Gateway = IP of the IO controller.

7.5 Commit and Restart

Apply all changes. Most WBM pages require a separate Save / Commit action to write the configuration to non-volatile memory; otherwise changes are lost on the next power cycle. After commit, both devices will restart the WLAN interface and form the bridge.

8. Verification

8.1 Radio-Link Verification

1. Check the WBM status page of both devices: Information > WLAN > Client / Bridge. The bridge partner should be listed as Connected with a non-zero signal level.
2. Read the L1 / L2 LEDs on the front panel. Both should be lit green or yellow depending on received signal strength.
3. Ping from the configuration PC connected to device A: ping 192.168.1.11. A reply proves that the bridge is carrying IP traffic.
4. Capture on the LAN port of device B with Wireshark. A ping or ARP from the PC on the A side should appear as a normal Layer-2 frame.

8.2 PROFINET IO Verification

1. In TIA Portal, open the project containing the S7-300 station. Right-click the IO controller and select Go online > PROFINET IO devices.
2. The ET 200 device should be listed as Accessible with the assigned PROFINET name.
3. Download the PROFINET device name to the ET 200 if it has not yet been assigned (use Assign PROFINET device name with the MAC of the ET 200 port).
4. Recompile and download the hardware configuration. Monitor the diagnostics buffer; PROFINET RT frames should now flow without "Station failure" entries.
5. Force an IO module output and read it back; check the update time in the IO device properties. With iPCF enabled, deterministic PROFINET RT Class 2/3 update times in the low millisecond range are achievable.

8.3 Long-Term Stability Checks

• Monitor the WBM Information > WLAN > Statistics page over several hours. Watch for retransmits, CRC errors, and bridge reconnects.
• Log the signal strength via SNMP to a long-term historian.
• Verify that the radios' internal clock is synchronized (NTP) so that event logs from both sides can be correlated.

9. Troubleshooting Matrix

10. Notes on Lightning and Surge Protection

The SCALANCE W788-x / W748-1 Operating Instructions explicitly warn that installing the LP798-1N lightning protector between the antenna and the W788 is not adequate protection against a direct lightning strike. For outdoor installations, follow the manual's bonding and grounding requirements and provide:

• An external lightning protection / down-conductor system sized for the site.
• Equipotential bonding of the W788 housing to the cabinet ground bar with a short, low-inductance conductor.
• The LP798-1N as an additional in-line surge arrestor, not as the primary protection.

11. Operational Best Practices

• Use a fixed PROFINET station name (not auto-generated) on the ET 200 so that the IO controller can re-address it after a brief radio outage.
• Set the IO update time to a value compatible with the radio latency budget. With iPCF and good RF, 1 ms is realistic; over longer or noisy links, fall back to 4 ms or 8 ms.
• Configure SNMP traps from the W788 to a central monitoring system so that bridge partner loss generates an alarm.
• Document the channel, SSID, WPA2-PSK passphrase and bridge partner MACs in the plant documentation. Store the WBM credentials in the site password vault.

FAQ