Configuring Siemens S7-300 Remote Access via CP 343-1 VPN

This reference covers the engineering procedure to reach a Siemens SIMATIC S7-300 station equipped with a CP 343-1 Lean or CP 343-1 Advanced communication processor from a remote site over a public IP network using a Virtual Private Network (VPN). The article addresses the specific failure modes observed when STEP 7 cannot discover the CPU across the tunnel, broadcasts do not propagate, and the PC cannot ping the PLC even though the VPN session is established.

1. System Overview and Reference Topology

The reference installation is a SIMATIC S7-300 rack with the following components:

The CPU 315-2DP variant 6ES7315-2AH14-0AB0 provides integrated interfaces for MPI/DP only; the Ethernet connection is supplied exclusively by the CP in slot 3. The CP is configured from STEP 7 V5.5 or TIA Portal (≥ V13 SP1) using the Hardware Configuration (HW Config) and NetPro tools.

Refer to the S7-300 CPU 31xC and CPU 31x Installation Manual and the CP 343-1 Lean Manual for module-specific configuration parameters.

2. Hardware Capability Matrix: CP 343-1 Lean vs Advanced

Selecting the correct CP is the first decision. The Lean and Advanced variants share the same physical footprint and 15-pin D-sub Ethernet connector but differ substantially in firmware features.

3. Network Architecture Options

Three architectures are field-proven for S7-300 remote maintenance. Choose one based on the CP variant installed.

3.1 Architecture A — CP 343-1 Advanced as VPN endpoint

The Advanced CP establishes the IPsec tunnel directly. The PG runs the Siemens SOFTNET Security Client (or any IPsec client conforming to the CP's Siemens application note 108909919). The PLC's IP address and the PG's tunnel IP must be in the same subnet or routed by the CP's ACL.

3.2 Architecture B — External router as VPN endpoint (Lean CP)

The SCALANCE M812-1 (or M874-3, M876-3, MUM856-1) terminates IPsec. See Siemens application note 109477919 for a static-IP example. The Lean CP is configured with a private IP in the LAN; the router does the NAT and IPsec.

3.3 Architecture C — Site-to-site VPN (two routers, no client software)

For unattended permanent access, deploy a pair of SCALANCE M routers, one at the plant and one at the engineering office. The PG does not need a VPN client; it simply addresses the PLC on the plant's LAN over the persistent tunnel.

4. STEP 7 PG/PC Interface Configuration

This is the single most common cause of the failure pattern described in the field report: the VPN is up, devices on the LAN ping each other, but STEP 7 cannot find the CPU.

4.1 Select the correct access point

1. Open Control Panel → Set PG/PC Interface on the engineering station.
2. Select TCP/IP → Network card (the physical NIC bound to the VPN virtual adapter, not the wireless card used for browsing).
3. Click Properties; set the access point S7ONLINE to point at this TCP/IP entry.

4.2 Configure the CP's IP and subnet in HW Config

1. Open the STEP 7 project, expand the S7-300 station, double-click the CP 343-1.
2. Open the Properties → Ethernet Interface dialog and assign:
   • IP address: e.g. 192.168.1.10
   • Subnet mask: 255.255.255.0
   • Router address: 192.168.1.1 (the SCALANCE M internal interface)
3. Activate Use router and add the router address in the Properties → Ethernet tab.
4. Compile HW Config and download to the CPU (the CP reboots; expect an SF/BAKFL error for ~30 s during restart).

5. VPN Tunnel Construction

5.1 Phase 1 parameters (IKE)

5.2 Phase 2 parameters (ESP)

• Encapsulating Security Payload (ESP) in tunnel mode
• Encryption AES-256-CBC, authentication HMAC-SHA-256
• PFS (Perfect Forward Secrecy) enabled, group 14

5.3 Traffic selectors

Define the interesting traffic so the IPsec SA only negotiates the PLC subnet and the engineering PC's virtual address. Example:

Local subnet:  192.168.1.0/24  (PLC LAN)
Remote host:   10.10.10.50/32  (PG's tunnel IP)
Protocol:      any
Ports:         UDP 500 (IKE), UDP 4500 (NAT-T), TCP 102 (S7)

When the tunnel negotiates successfully the SCALANCE M diagnostic page (default https://192.168.1.1) shows the SA as ACTIVE with a lifetime countdown.

6. Firewall and Port Requirements

The field report notes that port 102 must be free on the router/firewall. S7 communication runs on top of ISO-on-TCP (RFC 1006) and uses TCP/102 as its transport port. The following table enumerates every port the path requires.

7. Resolving the Broadcast and MAC Discovery Issue

STEP 7 V5.5 uses DCP (Discovery and Configuration Protocol) and ISO broadcast frames (MAC FF:FF:FF:FF:FF:FF) on UDP/34964 to find reachable nodes. These broadcasts are not routed across a layer-3 IPsec tunnel because the routers on either side suppress directed broadcasts and the underlying IP packets have destination 255.255.255.255.

This is the root cause of the symptom in the source: "I cannot ping the PLC from my home through the VPN tunnel." The PC may be on the tunnel, the route may be correct, but STEP 7's auto-discovery simply cannot reach the PLC's MAC address.

7.1 Solution A — Direct IP addressing in NetPro

1. Open the STEP 7 project.
2. Select PLC → Download → to Target Station → Accessible Nodes.
3. Manually type the CP's tunnel-side IP address (e.g. 192.168.1.10) into the Target IP address field.
4. Confirm the connection: STEP 7 establishes a TCP/102 session directly, no broadcast required.

7.2 Solution B — Static ARP and S7 routing entry

For recurring access, add a permanent route on the engineering PC so the PLC subnet is reachable through the VPN virtual adapter:

route -p ADD 192.168.1.0 MASK 255.255.255.0 10.10.10.1 METRIC 1

where 10.10.10.1 is the tunnel gateway assigned to the PG by the VPN client. The -p flag persists the route across reboots.

7.3 Solution C — SINEMA Remote Connect

For multi-site fleets, deploy SINEMA Remote Connect. It brokers a TLS connection through a central server, encapsulates S7 in a tunnel that does not require the engineering PG to know the PLC's IP, and exposes a virtual MAC that mimics local broadcast. Search Siemens support for "SINEMA Remote Connect S7-300" for the current entry-level license (up to 4 tunnels free).

8. PG Routing and Multi-Subnet Access

When the engineering PG must reach not just the CPU 315-2DP but also a CP 343-1 in a sub-rack that sits behind the same router, configure a PG routing entry in NetPro → PLC → PG routing. The route allows the STEP 7 frames to pass through the S7-300 CPU's backplane into the second station.

A typical routing table for a two-station project with one Advanced CP at the plant and one Lean CP on the office network:

9. Verification Procedure

1. Tunnel up: On the SCALANCE M diagnostics page, confirm the IPsec SA state is ACTIVE; lifetime counts down from 28800 s.
2. Route check: From the engineering PC, run ipconfig /all and verify the VPN virtual adapter has an address in the 10.10.10.0/24 range. Run route print and confirm 192.168.1.0/24 points to the tunnel gateway.
3. ICMP test: ping 192.168.1.10 — expect replies with TTL reflecting two router hops (PC → SCALANCE M office → SCALANCE M plant → CP 343-1).
4. TCP/102 test: From a command prompt, telnet 192.168.1.10 102. A blank screen (no connection refused) confirms the S7 port is reachable.
5. STEP 7 online: Open SIMATIC Manager, choose PLC → Online → Accessible Nodes. The CP 343-1 must appear with its MAC address, IP, and rack/slot (rack 0, slot 3 in this example). Double-click to open the online view.
6. Project download: Perform a full download (HW Config + blocks). Verify in Module Information → Diagnostic Buffer that the CP logs Connection established, ISO-on-TCP, local TSAP 01.01, remote TSAP 01.03.

10. Troubleshooting Matrix

11. Security Hardening

1. Replace PSK with X.509 certificates once the system exceeds two engineers. Use the SCEP enrollment of the SCALANCE M against your PKI.
2. Disable ISO broadcast in the CP: in HW Config → CP 343-1 → Properties → Options, untick Enable broadcast if no WinCC station requires it.
3. Lock the S7 CPU's access protection: assign a project password and configure CP access → PG connection → permit to whitelist the engineering PC's tunnel IP only.
4. Enable the CP's ACL (Advanced only): reject all source IPs not in the engineering office's tunnel range.
5. Centralise logging: forward the SCALANCE M syslog to a SIEM, alert on repeated authentication failures (indicative of brute force on IKE PSK).

12. Field-Commissioning Checklist

• [ ] CP firmware matches the STEP 7 version in use (CP 343-1 Lean FW 3.0.x is supported by STEP 7 V5.5 SP4 and TIA V13 SP1 onward).
• [ ] Static public IP (or DDNS hostname) registered on the plant SCALANCE M.
• [ ] PSK ≥ 32 random characters, stored in a password vault.
• [ ] IKE and ESP proposals identical on both ends; PFS group 14 minimum.
• [ ] TCP 102 allowed inbound to the CP 343-1's IP; all other WAN-inbound ports denied.
• [ ] STEP 7 S7ONLINE access point bound to the VPN virtual adapter.
• [ ] Static route on PG: route -p ADD <PLC subnet> MASK <mask> <VPN gateway>.
• [ ] Backup of CP 343-1 configuration stored in the project's Station folder; commit to source control.
• [ ] Documented runbook: who owns the PSK, who can request temporary VPN access, escalation path for tunnel outages.