Configuring Siemens IPC227E Dual Ethernet Static IP for PLC

Overview

The SIMATIC IPC227E is the base hardware platform for the Siemens Industrial Edge (IE) architecture. The unit ships with two independent Gigabit Ethernet interfaces on the front panel (labelled X1 and X2) that are logically partitioned between the Industrial Edge Management (IEM) plane and the field/OT plane. By default, X1 is claimed by the Edge Management tunnel that connects the box to the IEM, and X2 boots with DHCP enabled for commissioning convenience. Production deployments almost always require a deterministic static address on the second port so that the IPC can talk directly to a SIMATIC S7-1500, ET 200SP CPU, SINAMICS drive, or a third-party PLC over PROFINET, S7 Communication, Modbus TCP, or EtherNet/IP.

Configuring that second port is a two-stage problem: the operator must (a) be on Industrial Edge Device (IED) firmware V1.2.0 or later, which exposes network settings through the device UI under Settings > Connectivity > LAN Network, and (b) optionally bind a Layer 2 (L2) network access profile to a containerized IE App so the application inherits the correct VLAN, IP, and routing context.

Hardware Identification

Before changing any network state, confirm the platform variant. The IPC227E is a fanless Nano Box PC built around an Intel Celeron N2930 SoC with two Intel-managed Gigabit Ethernet ports. The ports are surfaced to the IED runtime Linux image as eno1 (front-panel X1) and eno2 (front-panel X2). This naming is preserved across the IE firmware images, so any field note or script that references eno2 maps 1:1 to the physical X2 connector.

Both ports auto-negotiate 10/100/1000 Mbps and support 802.1Q tagging, which becomes relevant when the OT switch expects tagged PROFINET or EtherNet/IP frames.

Industrial Edge Runtime Architecture

Understanding the runtime explains why the two ports are segregated. The IED firmware layers a managed Docker engine on top of a hardened Linux base. Three logical networks exist inside the box:

• Management plane — physical eno1, carries the mTLS tunnel to the IEM tenant. The tunnel is the only path the IEM uses to push firmware, deploy apps, and pull telemetry.
• OT plane — physical eno2, carries traffic to PLCs, drives, and field I/O. By default it is on the operator's LAN with DHCP.
• Container plane — internal Docker bridge used by IE Apps that do not bind to an L2 profile. Apps on the bridge cannot reach the OT plane at all.

An IE App only gains access to eno2 when an L2 Network Access profile is created and the app is bound to that profile. The profile attaches a macvlan interface inside the container namespace, so the app's traffic leaves the IPC on the physical eno2 port with its own MAC and IP.

Prerequisites

• SIMATIC IPC227E with the Industrial Edge Device runtime image installed and registered against an IEM.
• IED firmware V1.2.0 or later on the target box. Earlier versions do not expose the connectivity UI.
• IEM admin user with rights to push firmware and to edit device-level network settings.
• Static IP plan for the OT network, including IP, subnet mask, optional gateway, and DNS (typically none for direct PLC links).
• MAC address of the IED's X2 port — read from the front-panel label or from Settings > Connectivity > LAN Network before the change.
• Out-of-band console access (HDMI + USB keyboard) as a recovery path, in case the new IP strands the management tunnel.

Firmware Gate: Why IED V1.2.0 Matters

Before IED firmware V1.2.0, the local network manager on the IPC227E runs in a locked profile. The Settings pane is read-only for network objects, and edits are only honored during the onboarding flow at first boot. Once the device is registered against the IEM, the IEM owns the port-binding policy. This is a deliberate design choice to keep a fleet of edge boxes manageable from a single pane, but it surprises integrators who expect a Windows-style adapter dialog.

From V1.2.0 onward, the IED exposes a writable Settings > Connectivity > LAN Network tab. The same firmware also introduces the Layer 2 (L2) for Applications view, which lets an administrator bind a containerized IE App to a specific physical interface, VLAN, and IP range. The two views are coupled: changing the IP on the LAN side does not automatically push that change into the L2 application binding — both must be edited.

How to update to V1.2.0+

1. Open the IEM web UI as an administrator.
2. Navigate to Admin Panel > Device Catalog.
3. Search for Industrial Edge Device and download the latest IED firmware image (for example, V1.2.0 or newer).
4. Wait for the catalog item to transition to Available in the local IEM catalog.
5. Open My Edge Devices, select the target IPC227E, and trigger Update Firmware.
6. Confirm the IED reboot. The new UI is only visible after the post-update reboot completes.

Step-by-Step: Configure the Second Ethernet Port

The procedure below assumes IED firmware V1.2.0 or later is installed and the device is online in the IEM.

1. From the IEM, open the IPC227E's detail page by selecting it under My Edge Devices.
2. Open the device UI by clicking the device name or the Open Device UI link.
3. In the left navigation, click Settings.
4. Click Connectivity > LAN Network. The page shows both eno1 (X1) and eno2 (X2) with their current addressing mode, MAC, and link state.
5. Locate the row for eno2. Confirm the link state is UP. If the link is DOWN, the port is unplugged or the far-end switch port is administratively shut.
6. Click the edit (pencil) icon on the eno2 row.
7. Change the addressing mode from DHCP to Static.
8. Enter the OT network parameters:
   • IP address: e.g., 192.168.10.50
   • Subnet mask: e.g., 255.255.255.0 (/24)
   • Default gateway: only if traffic must leave the OT subnet. Direct PLC links typically have no gateway — leave blank if the PLC is on the same L2 segment.
9. Click Save. The IED applies the change via NetworkManager. The connection drops for ~3-5 seconds while the interface bounces. Open TCP sessions on eno2 terminate, but the IEM tunnel on eno1 stays up.
10. Re-verify the link by pinging the PLC's IP from the IED's Diagnostics > Ping tool, or by SSHing into the IED and running ip -4 addr show eno2.

Inline topology diagram

Layer 2 Network Access for Applications

Setting a static IP on eno2 only configures the host. To let an IE App (a containerized PLC connector, OPC UA server, or custom data service) actually use that port, the application must be bound to a Layer 2 (L2) network access profile. Without this binding, the app's network namespace stays inside the default Docker bridge and cannot reach the OT network at all. The official Industrial Edge documentation — Network and Layer 2 network access walks through this exact flow.

1. In the device UI, navigate to Settings > Connectivity > L2 Network Access.
2. Click New L2 Network Access.
3. Assign a name — for example, PLC_LINE_A.
4. Select the physical interface eno2.
5. Optionally set a VLAN ID (1-4094) if the OT switch is tagging the PLC traffic.
6. Optionally set an IP whitelist — only IE Apps whose container IP is in the whitelist may use this profile.
7. Click Save.

To attach an existing IE App to the new profile:

1. Open the app's detail page in the IEM catalog.
2. Edit the app's instance configuration.
3. In the Network section, select the PLC_LINE_A L2 profile.
4. Deploy the app. The container is re-created with a macvlan interface attached to eno2 and an IP from the configured range.

State machine for the LAN address change

Verification

1. From the IED UI: Settings > Connectivity > LAN Network shows eno2 with the new static IP and link state UP.
2. From the IED UI: Diagnostics > Ping reaches the PLC's IP with < 5 ms latency on copper GbE.
3. From the IED shell (SSH): ip -4 route show dev eno2 lists the directly-connected subnet.
4. From the IED shell: ip -4 addr show eno2 shows the static inet line with no dynamic flag.
5. From the IED shell: ip link show eno2 confirms the interface state is UP and the MAC matches the front-panel label.
6. From the PLC side: ping the IED's eno2 address. The PLC's PROFINET or S7 diagnostic buffer logs an "arrive" event for the new partner.
7. From the IE App: container logs show a successful TCP connect to the PLC's port (e.g., 102 for S7, 502 for Modbus TCP, 44818 for EtherNet/IP).

PLC Connectivity Profile Examples

Concrete address plans that fit the IPC227E on a small machine network. Adjust to suit your OT design.

Security and VLAN Hardening

Leaving eno2 on a flat OT subnet is convenient but exposes the IPC to every other device on that subnet. Recommended hardening, all of which is supported by the L2 profile view in the IED UI:

• Enable a strict IP whitelist on the L2 profile so only authorized container IPs may bind to eno2.
• Tag the OT traffic with a VLAN ID (1-4094) on the L2 profile and match it on the access switch port.
• Keep the management port eno1 on a physically or logically separate network from eno2. Do not bridge them.
• Disable unused services on the IED (SSH from outside the IEM tunnel, ICMP to the management plane).
• Deploy a PROFINET or EtherNet/IP-aware firewall in the IE App so anomalous packets are dropped before they reach the PLC.

Per the official Industrial Edge documentation, the L2 profile is always edited from the device UI rather than from inside the container, because the UI writes a managed configuration that survives container redeployments and firmware updates.

Troubleshooting Matrix

Recovery: Re-onboarding After a Wrong IP

If a bad static IP on eno2 blocks the device UI, recovery is still possible because the management tunnel rides on eno1, not eno2. SSH into the IED via the IEM remote shell, then:

nmcli connection show
nmcli connection modify eno2 ipv4.method auto
nmcli connection modify eno2 ipv4.addresses ""
nmcli connection up eno2

If even the IEM tunnel is broken — for example, the operator accidentally edited eno1 — use the out-of-band HDMI+USB keyboard path. The IED firmware image boots into a recovery shell that lets you reset both interfaces. As a last resort, re-flash the IPC227E with the IED image via USB stick; this returns the unit to factory state and removes the device from the IEM tenant, after which it can be re-onboarded cleanly.

FAQ