Configuring Siemens WinCC 7.3 WebUX Server for Mobile Browser Access

This procedure documents the end-to-end deployment of a Siemens SIMATIC WinCC 7.3 (classic WinCC Explorer) WebUX server so an iPad, Android tablet, or phone can render the live SCADA graphics over HTTPS through a standard Chromium-based or Safari browser. The instructions assume a single engineering PC acting as both the WinCC Runtime server and the WebUX/IIS host, plus a small Wi-Fi access point (AP) that bridges mobile clients onto the same subnet as the server. Where WinCC version numbers, service packs, or licensing terms affect behavior, those specifics are called out explicitly.

1. Architectural Overview

WebUX is the successor product to WinCC WebNavigator in the classic WinCC product line. It ships a responsive HTML5/WebSocket runtime that does not require an ActiveX control or a dedicated client installation. The server-side architecture has three components that must all be present on the engineering/runtime PC:

1. WinCC Runtime with at least one graphics-enabled process picture.
2. WebUX Runtime / Server installed as a WinCC option.
3. Microsoft Internet Information Services (IIS) hosting the WebUX website and providing the HTTPS endpoint.

Per Siemens entry ID 109794201 - Configuring the WebUX website (SIMATIC HMI WinCC), the WebUX Configurator is the utility that publishes the WebUX Website to IIS and binds the HTTPS listener. The same configuration pattern applies to TIA Portal's WinCC RT Professional, which is documented separately at Configuring the WebUX website (RT Professional).

1.1 Component topology

2. Prerequisites

Confirm every item below before starting the configuration. Missing prerequisites are the single largest cause of "blank page" or "connection refused" errors during commissioning.

3. Installing IIS and the WebUX Option

3.1 Install IIS

Open Control Panel → Programs and Features → Turn Windows features on or off. Under Internet Information Services enable:

• Web Management Tools → IIS Management Console
• World Wide Web Services → Application Development Features → ASP.NET 4.x
• World Wide Web Services → Security → Windows Authentication
• World Wide Web Services → Common HTTP Features (default)

Click OK and let Windows complete the install. Verify by browsing http://localhost on the WinCC PC; the default IIS splash page must appear.

3.2 Install the WebUX Runtime

Insert the WinCC 7.3 installation media or mount the corresponding ISO. From the setup launcher choose Install → Components → WebUX. When prompted, the installer registers the WebUX website automatically; the WebUX Configuration Manager is added under Start → Siemens Automation → WebUX Configurator. For TIA Portal RT Professional users, follow Installing the WebUX server (RT Professional).

4. Enabling WebUX in the WinCC Project

Open the WinCC Explorer with the target project active. In the project tree, right-click Webcenter or Web Navigator (WinCC 7.3 menu wording) and open WebUX → Activate. Confirm the activation dialog and the WinCC project is rebuilt.

4.1 Configure the start screen and user administration

1. In WinCC Explorer open User Administrator.
2. Create at least one operator account (for example operator) and assign a password. WebUX uses the same user database as the WinCC Runtime.
3. Set the language and authorization level for that user (e.g. level 100 = operator).
4. In Webcenter → WebUX, pick the picture that should be loaded as the start screen (typically Start.pdl).

5. Configuring the WebUX Website with the WebUX Configurator

Launch Start → Siemens Automation → WebUX Configurator. The Configurator is the same utility referenced by Siemens support entry 109794201 for the TIA Portal variant; on WinCC 7.3 it has identical fields.

1. Select the project — point the Configurator at the activated WinCC project directory.
2. Port — accept the default TCP 1986 or specify a custom HTTPS port. Avoid well-known ports (443, 80) if other IIS sites already bind them.
3. Certificate — the WebUX Configurator generates a self-signed certificate during first-time setup. For production use, replace it with a certificate issued by your internal CA; otherwise browsers will display a privacy warning each session.
4. Apply configuration — click Apply / Publish. The Configurator creates the IIS application pool and web site named WinCCWebUX (default).

5.1 Verify the IIS web site

Open IIS Manager (inetmgr). Under Sites confirm the WebUX site is in Started state. Right-click → Edit Bindings... and verify the HTTPS entry on the chosen port.

6. Static IP Address Configuration

Before mobile clients can resolve the server reliably, the WinCC PC must have a static IPv4 address on the same subnet as the Wi-Fi AP.

1. Control Panel → Network and Sharing Center → Change adapter settings.
2. Right-click the wired Ethernet adapter → Properties → Internet Protocol Version 4.
3. Set IP to a free address outside the DHCP pool of the AP, for example 192.168.1.10.
4. Subnet mask 255.255.255.0.
5. Default gateway 192.168.1.1 (the AP LAN address).
6. Preferred DNS: 127.0.0.1 if no internet is required; otherwise the AP address or your internal DNS.

Disable IPv6 on the adapter if the router does not route it. WebUX does not require IPv6 but mixed stacks occasionally confuse mobile browsers when reverse-looking up hostnames.

7. Windows Firewall Configuration

This is the section most engineers struggle with. A correctly authored inbound rule is required for the WebUX HTTPS port.

7.1 Create the inbound rule

1. Control Panel → Windows Defender Firewall → Advanced settings.
2. Inbound Rules → New Rule....
3. Rule type: Port.
4. Protocols and ports: TCP, specific local port 1986.
5. Action: Allow the connection.
6. Profile: Domain, Private (uncheck Public if the AP network is trusted).
7. Name: WinCC WebUX 1986.

7.2 Verify the rule is active

From the AP or from a mobile client:

curl -k -v https://192.168.1.10:1986

A successful TLS handshake with HTTP 401 (authentication required) confirms the rule and the IIS binding both work. If the connection is reset, the firewall is still blocking; if a connection refused appears, IIS is not listening on the port.

8. Router / Access Point Configuration

For a single-subnet mobile-only deployment any consumer-grade AP will suffice. Recommended settings:

9. Mobile / Tablet Client Configuration

1. Connect the device to the AP Wi-Fi SSID.
2. Set a static IP on the device (e.g. 192.168.1.21 / 24, gateway 192.168.1.1) or rely on DHCP and note the assigned address.
3. From the device, ping the server to confirm L3 reachability: ping 192.168.1.10.
4. Open Chrome or Safari and navigate to https://192.168.1.10:1986.
5. Accept the self-signed certificate warning (or install the CA root on the device for production).
6. Log in with the WinCC credentials created in section 4.

10. Verification Procedure

Run these checks in order to confirm a healthy deployment.

1. Local browser test on the server: open https://localhost:1986 on the WinCC PC. The login screen must appear.
2. Network ping test: from the mobile device, ping 192.168.1.10 returns < 5 ms on a local AP.
3. TCP port test: tcping 192.168.1.10 1986 (Windows) or nc -vz 192.168.1.10 1986 (Linux/macOS) reports the port as open.
4. TLS handshake: openssl s_client -connect 192.168.1.10:1986 -servername 192.168.1.10 completes without alert.
5. Login and picture load: log in on the mobile browser and confirm the start picture renders within 3 seconds.
6. Live update test: trigger a tag change in WinCC and confirm the value updates in the browser without page refresh.

11. Troubleshooting Matrix

12. Security Hardening Checklist

WebUX exposes the live SCADA to any device that knows the URL and credentials. Apply these controls before production sign-off.

• Replace self-signed certificate with a CA-issued one and enforce HTTPS-only (no HTTP fallback).
• Restrict the inbound firewall rule to the Wi-Fi AP subnet (192.168.1.0/24) rather than Any.
• Use strong WinCC passwords and per-operator authorization levels; never share the Administrator account.
• Disable WebUX when not needed: Webcenter → WebUX → Deactivate.
• Consider a reverse proxy (IIS ARR or nginx) if exposing WebUX outside the plant network; place it in a DMZ and never expose the WinCC PC directly.
• Audit login events via WinCC Alarm Logging or Windows Event Viewer (security log).

13. Operating-System and WinCC Version Compatibility Notes

For deployments migrating from WinCC 7.3 to TIA Portal V17+ RT Professional, the configuration steps described in this article remain valid; only the location of the WebUX Configurator changes (it is integrated into the TIA Portal project tree). See Configuring the WebUX website (RT Professional) for the equivalent TIA Portal workflow.

14. Field-Proven Commissioning Sequence

Use this ordered checklist during on-site commissioning to avoid the most common re-work loops.

1. Install WinCC and confirm Runtime starts locally.
2. Install WebUX option and confirm license is recognized in Authorizations.
3. Activate WebUX in the project, set start picture, create users.
4. Install IIS with ASP.NET and Windows Authentication.
5. Run WebUX Configurator, accept defaults, apply.
6. Verify https://localhost:1986 on the server itself.
7. Assign static IP to the server NIC.
8. Add firewall inbound rule for the chosen port.
9. Configure AP, disable isolation, set DHCP pool outside the server IP.
10. Connect mobile client, set static IP, ping the server.
11. Browse to https://<server-ip>:<port>, log in, confirm picture render.
12. Validate tag updates and alarms flow end-to-end.
13. Document the URL, port, and credentials in the plant OT asset register.

FAQ