Configuring SCALANCE XM408-8C: Initial IP Setup and WBM Access

Overview of the SCALANCE XM408-8C

The SCALANCE XM408-8C (Siemens order number 6GK5408-8GS00-2AM2) belongs to the SCALANCE XM-400 family of managed industrial Ethernet switches. Devices in this family are designed for installation in control cabinets on the plant floor and are characterized by:

• Conformance with PROFINET and EtherNet/IP standards for industrial Ethernet.
• Web-Based Management (WBM) and a command-line interface (CLI) as native management surfaces.
• Support for layer 2 features (VLAN, IGMP snooping, QoS, redundancy protocols such as MRP/HRP) and, depending on firmware and licensing, layer 3 features (static routing).
• Robustness for industrial environments, including extended temperature ranges and conformal coating variants.

Unlike unmanaged switches, the XM408-8C ships without a configured IP address. The factory default for the management interface is 0.0.0.0, which means that out of the box the device will not respond to IP-based management requests until an initial address has been assigned. This article is the field-tested procedure for that first-commissioning step and for reaching the WBM in a supported browser.

Prerequisites

Before starting, verify that you have the following items available.

• Engineering PC with Windows 10 or Windows 11, administrator rights, and a free Ethernet port. Disable any VPN client during commissioning because split-tunnel routing will break link-local discovery.
• Patch cable (Cat 5e or higher, RJ45) to connect the PC directly to one of the switch's Ethernet ports. A crossover cable is not required; the XM408-8C has Auto-MDI/MDIX on every copper port.
• Management IP plan with at least one free IPv4 address in the management subnet, subnet mask, and default gateway.
• Browser compatible with the firmware load installed on the switch. Internet Explorer 11 is supported only on legacy firmware; recent firmware loads expect Edge (Chromium), Firefox ESR, or Chrome. JavaScript and cookies must be enabled, and the browser must trust the switch's self-signed certificate (or accept the security exception on first contact).
• Optional tool: one of SINEC Proneta, TIA Portal, STEP 7 (Classic), or PST (Primary Setup Tool). Without one of these, the very first IP must come from DHCP or from the on-board CLI over the serial console.

Hardware Front-Panel Reference

Although the exact layout depends on the variant (e.g., fiber vs. copper port mix), the front panel of the XM408-8C family includes the following elements that you will reference during commissioning.

Default Configuration

The XM408-8C ships with the following parameters. Verify against the manual for your specific firmware load, because Siemens has tightened several defaults over successive releases.

Restoring Factory Defaults

If a previous engineer has configured the device and the IP address or password is no longer known, restore the factory configuration before continuing. This step is destructive and clears the IP, all VLAN/ACL/QoS settings, certificates, and locally stored logs.

1. Disconnect the switch from the production network. The reset will briefly flap every port and will cause the connected PROFINET controller (if any) to report station failure.
2. Power off the switch.
3. Press and hold the recessed reset button on the front panel. Keep it held.
4. Re-apply power while continuing to hold the reset button.
5. Hold the reset button for at least 10 seconds (some firmware loads require longer; verify against the manual). The MAINT LED will change pattern to indicate that the reset sequence has been recognized.
6. Release the button. The switch reboots with factory defaults.

Choosing an Initial IP Assignment Method

The XM408-8C supports five documented paths for the very first IP assignment. Pick the path that matches the tooling available on the engineering station.

Method 1 - DHCP

Correct DHCP configuration reduces the amount of maintenance required for IP networks and increases their robustness and performance. When the factory-default DHCP client is enabled, the XM408-8C will request an address automatically.

1. Connect any Ethernet port of the switch to a network segment where a DHCP server is reachable.
2. Power up the switch and wait 60-90 seconds for the DHCP DISCOVER/OFFER/REQUEST/ACK exchange to complete.
3. Read the lease table on the DHCP server:
   • Windows DHCP server: PowerShell Get-DhcpServerv4Lease -ScopeId <scope>
   • SCALANCE layer-3 device: Information > DHCP > Leases
   • Linux/ISC DHCP: cat /var/lib/dhcp/dhcpd.leases
4. Identify the lease associated with the switch's MAC address (printed on the front label).
5. Note the assigned IPv4 address and subnet mask.
6. Open a browser on the engineering PC and navigate to the assigned address.

For advanced deployments that include PROFINET device-name assignment via DHCP option 82, refer to the Siemens industry support knowledge base on the product page.

Method 2 - TIA Portal / STEP 7

This is the most common method in plants already running TIA Portal. STEP 7 (Classic) and TIA Portal share the same underlying PROFINET DCP mechanism, so the steps are nearly identical.

1. Connect the engineering PC's Ethernet port to any port of the XM408-8C using a patch cable.
2. Set the PC's IPv4 address to a free address in the same subnet you intend to use for the switch. For example, if you plan to assign 192.168.1.1/24 to the switch, set the PC to 192.168.1.100/24.
3. Open TIA Portal and switch to the project view.
4. In the Project tree, choose "Online > Accessible nodes" (German UI: "Online > Erreichbare Teilnehmer").
5. TIA Portal broadcasts a PROFINET DCP discovery packet and lists every device it sees, including the XM408-8C. The entry shows MAC address, device type, and the current IP address (0.0.0.0 if the switch is at factory state).
6. Select the XM408-8C entry and click "Assign PROFINET device name" or "Assign IP address" in the toolbar.
7. Enter the IP address, subnet mask, and (optionally) the PROFINET device name.
8. Confirm the dialog. TIA Portal writes the parameters to non-volatile memory and verifies the assignment.

Method 3 - SINEC Proneta

Proneta is the recommended path when TIA Portal is not available. It is a free-of-charge tool from Siemens for network analysis and pre-commissioning.

1. Download Proneta from the official Siemens support site. Install it on the engineering PC.
2. Connect the engineering PC directly to the XM408-8C with a patch cable.
3. Set the PC IP to the same subnet you intend to use for the switch.
4. Launch Proneta and switch to the "Network analysis" tab.
5. Click "Start scan". The XM408-8C appears with its MAC address, device type, and current IP.
6. Right-click the device and choose "Assign IP address". Enter the management IP and subnet mask.
7. Optionally assign a PROFINET name in the same dialog if the switch will be integrated with a PROFINET controller.
8. Click "Apply". Proneta confirms the assignment and shows a green status icon next to the device.

Proneta also performs basic cable diagnostics and reports port status, so it is well suited to verifying that the physical layer is healthy before commissioning the controller.

Method 4 - Primary Setup Tool (PST)

PST is the legacy tool that ships with older STEP 7 installations. It still supports the SCALANCE family and is a viable fallback if neither Proneta nor TIA Portal is installed.

1. Launch PST and verify that the correct Ethernet adapter is selected under "Settings > Network adapter".
2. Click "Network > Browse" or press F5. The XM408-8C appears in the device list as "Unconfigured" (or with its previously assigned IP).
3. Select the entry and click "Configure".
4. Enter the management IP, subnet mask, default gateway, and (optionally) PROFINET device name.
5. Click "Assign" to write the configuration to the device.
6. Wait for PST to confirm the transfer before disconnecting.

Method 5 - On-board CLI (Serial Console)

The CLI is the only path that does not require IP connectivity to the switch. It is used for out-of-band commissioning and for scripted batch setup.

1. Identify the console port on the front panel. Depending on variant, this is an RJ-232 jack or a USB-C port. Use the matching cable (Siemens offers both as accessories).
2. Connect the cable to the engineering PC. On modern PCs without a serial port, use a USB-to-RS232 adapter or the USB-C variant directly.
3. Open a terminal emulator (PuTTY, Tera Term, or the Siemens PUTTY bundle) at 115200 baud, 8 data bits, no parity, 1 stop bit (8N1). Flow control off.
4. Power up the switch and press <Enter> within the first 5 seconds to enter the CLI prompt.
5. Log in with the default credentials (admin/admin on legacy firmware; on newer firmware the first login forces a password change).
6. Enter the configuration context and assign the IP:

   enable
   configure terminal
   interface vlan 1
   ip address 192.168.1.1 255.255.255.0
   exit
   ip default-gateway 192.168.1.254
   end
   write memory
   

7. Confirm with show ip interface brief. The output should list VLAN 1 with the new address and mask.
8. Type exit to leave the CLI.

Common CLI Commands Reference

The following commands cover the most common commissioning tasks once you have CLI access. Always cross-check against the version-specific command reference in the manual.

Reaching WBM in a Browser

Once the switch has a valid IP address and the engineering PC is on the same subnet, open a browser and enter:

https://<IP-address-of-XM408-8C>

WBM is served over HTTPS on TCP port 443 by default. On recent firmware versions plain HTTP is disabled; trying to reach the switch on port 80 returns a redirect to HTTPS or simply does not respond.

Browser Compatibility Matrix

Diagnosing the "Siemens Page" Symptom in Internet Explorer

When the HTTPS handshake to the XM408-8C fails for any reason, Internet Explorer often displays a generic Siemens landing or error page instead of the WBM login. The most common root causes are listed below.

Step-by-Step WBM First-Login Configuration

After successful login to WBM, perform the following configuration steps. The exact menu labels depend on the firmware load; the structure below matches current SCALANCE XM-400 firmware.

1. Change the default password. The first login enforces a complexity policy. Use a password that meets the plant's credential policy and store it in the password vault.
2. Set identifying fields. Navigate to "System > Configuration". Enter hostname, location, and contact. These populate SNMP sysName, sysLocation, and sysContact and make the device identifiable in the NMS.
3. Configure time synchronization. Go to "System > Time > NTP". Configure at least two internal NTP sources and the correct UTC offset. Without accurate time, certificates and audit logs become unreliable.
4. Configure the management VLAN. Under "Layer 2 > VLAN", verify VLAN 1 carries the management IP. If your plant uses a dedicated management VLAN (recommended), create it, move the management IP to the new SVI, and remove VLAN 1 from all ports.
5. Configure user accounts. Under "Security > User Accounts", create named accounts for each operator. Disable the default admin account for daily use and store the admin password in a sealed envelope in the cabinet.
6. Configure SNMP. Under "System > SNMP", set the read and write community strings (or better, configure SNMPv3 with authentication and privacy) and add the NMS IP.
7. Configure redundancy. If the switch participates in an MRP ring, navigate to "Layer 2 > Redundancy > MRP" and assign the correct ring role (Manager or Client) and ring ports.
8. Save the configuration. Click the disk icon or navigate to "System > Save Configuration". The change is written to non-volatile memory. A reboot is not required for the change to take effect.

PROFINET Integration

If the XM408-8C will be used as a PROFINET device (for example, to be monitored by a PROFINET controller), additional steps are required.

1. Assign a PROFINET device name through TIA Portal, Proneta, or WBM (System > PROFINET). The name must match the controller's project.
2. Export the GSDML file from the device (WBM: System > PROFINET > Export GSDML) and import it into the TIA Portal project if it is not already available.
3. Drag the device into the PROFINET topology in TIA Portal and connect the ports.
4. Compile and download the hardware configuration. The controller will establish a PROFINET AR (Application Relationship) to the switch and report diagnostics through the standard PROFINET alarm model.

Layer 3 Features (License-Dependent)

On XM-400 devices with a Layer 3 license, static routing can be configured to interconnect VLANs without an external router. Use the following WBM paths as a starting point, and verify the exact menu structure against your firmware load.

• Layer 3 > Static Routes: define a destination network, subnet mask, and next-hop IP.
• Layer 3 > Interfaces: assign an IP address to a VLAN SVI (router-on-a-stick topology).
• Layer 3 > DHCP Relay: forward DHCP requests from clients to a centralized DHCP server across subnet boundaries.

Network Redundancy Protocols

Industrial plants typically require sub-500 ms recovery from a single link failure. The XM408-8C supports the following protocols; select based on the existing topology.

QoS and Traffic Prioritization

PROFINET real-time traffic must take precedence over FTP, HTTP, and other best-effort traffic to meet cycle-time guarantees. Configure QoS on the XM408-8C as follows.

1. Open "Layer 2 > QoS > Trust Mode" and select the appropriate trust boundary (typically "DSCP").
2. Map DSCP values to the four egress queues:
   • Queue 7 (highest): PROFINET RT class 3 / DSCP CS7 (EF)
   • Queue 6: PROFINET RT class 2 / DSCP AF46
   • Queue 5: Voice / DSCP EF
   • Queue 0 (lowest): Best-effort / DSCP BE
3. Apply the queue mapping to every switch port in the production VLAN.
4. Verify in WBM under "Information > QoS > Statistics" that real-time traffic is using the high-priority queues.

Port Configuration Best Practices

• Access ports: assign a single VLAN as untagged; disable Spanning Tree on access ports that connect to single end devices (or enable BPDU guard).
• Trunk ports: tag all VLANs that need to traverse the link; configure the native VLAN to an unused VLAN ID rather than VLAN 1.
• Uplink ports: configure at line speed; disable Energy Efficient Ethernet (EEE) if jitter-sensitive traffic traverses the port.
• Unused ports: shut them down and assign them to a blackhole VLAN with no SVI. This prevents rogue devices from gaining network access.

Verification

After every change, perform the following checks before handing the switch over to operations.

• Layer 2: ping <switch-IP> from the engineering PC returns <1 ms on a directly connected port. The WBM shows a green link indicator on every connected port.
• Layer 3: (if applicable) traceroute from the switch to a known off-subnet destination traverses the configured default gateway without loss.
• PROFINET: (if applicable) The controller transitions from "Station failure" to "Station OK" and the switch's PROFINET diagnostics are visible in TIA Portal's "Online > Diagnostics".
• WBM: Force-reload (Ctrl+F5) the WBM URL to confirm that the latest parameters are persisted.
• Backup: Export the running configuration through WBM (System > Backup). Save the file with a clear naming convention, e.g., XM408-8C_V2.4.0_2024-05-12.cfg, and archive it in the plant's network documentation system.
• Firmware: Confirm that the running firmware matches the approved version for the plant. Note the version under "Information > Start Page".

Configuration Backup and Restore

The XM408-8C supports multiple ways to back up and restore the configuration. Use them as part of every change-management cycle.

Firmware Management

Firmware updates on managed industrial switches are sensitive operations. Apply them only during planned maintenance windows and follow this sequence.

1. Export a configuration backup before the update.
2. Download the target firmware image from the official Siemens product support page for 6GK5408-8GS00-2AM2. Verify the file checksum against the value published by Siemens.
3. In WBM, navigate to "System > Firmware". Upload the new firmware image.
4. Activate the firmware and reboot the switch.
5. After reboot, verify the running version under "Information > Start Page".
6. Restore the configuration if the firmware update wiped it. (Most XM-400 firmware updates preserve configuration, but always verify.)

Security Hardening Checklist

Beyond changing the default password, the following hardening steps should be applied to every XM408-8C before it goes into production.

• Disable unused services: Telnet, HTTP, SNMPv1/v2c, FTP, TFTP.
• Use SNMPv3 with authentication and privacy instead of community strings.
• Restrict management access (WBM, SSH, SNMP) to a dedicated management VLAN or to specific source IPs through an ACL.
• Enable syslog forwarding to a central log server and configure the switch to log authentication, configuration changes, and link state changes.
• Replace the self-signed HTTPS certificate with one issued by the plant's internal CA, or import a CA-signed certificate so browsers do not show certificate errors.
• Configure port security on access ports to prevent unauthorized devices from being plugged in.
• Enable BPDU guard and root guard on access ports to protect spanning-tree topology.

Comprehensive Troubleshooting Matrix

FAQ