Fixing LOGO! SoftComfort VPN Remote Access Password Prompt

Problem Description

When a service PC connects to a Siemens LOGO! 8 (FS4) base module through a routed site-to-site or SSTP remote-access VPN, two symptoms appear simultaneously:

• The PC can ping the LOGO! base module successfully (e.g. 192.168.2.x subnet).
• LOGO! SoftComfort (LSC) opens the Remote Access Password prompt immediately on Tools → Transfer → PC ↔ LOGO!, even though the PC and the LOGO! are on the same logical subnet (e.g. 192.168.2.0/24).

The base module then refuses any project upload/download until the operator enters the remote-access password. Operators frequently assume the remote-access password is broken, while the real cause is how LSC classifies the target as "remote" instead of "local" when the network path crosses a VPN tunnel or when the wrong Windows network adapter is selected for the transfer.

Field-reported symptom snapshot:

• Site topology: 4G cellular radio → directional antenna → 15 km backhaul to nearest LTE tower → 2500 km geographic distance between service PC and site.
• PC IP on the LOGO! subnet: 192.168.2.254 (a static address outside the router DHCP pool).
• LOGO! SoftComfort version: V8.2.0 (2017-10-24).
• LOGO! 8.FS4 hardware (for example 6ED1052-1MD08-0BA1 / 6ED1052-2MD08-0BA1, firmware release FS4).

Root Cause Analysis

LOGO! SoftComfort does not use the TCP/IP subnet alone to decide whether a target LOGO! is "local" or "remote". The classification is the product of three independent checks:

1. Source IP / destination IP subnet match. LSC first compares the IP address assigned to the active Windows network adapter against the IP address of the discovered LOGO!. If they do not fall in the same /24 (or whatever subnet mask is configured on the LOGO!), the device is treated as remote.
2. ICMP round-trip latency. LSC measures the response time of its initial discovery packet. If the round-trip exceeds an internal threshold (typically observed around 30–50 ms for in-LAN use), LSC promotes the target to "remote" even if the subnet check passed.
3. Adapter binding. LSC binds its UDP/TCP transfer socket to whichever Windows network adapter is currently selected as the route to the destination. If more than one adapter is enabled (e.g. Ethernet + Wi-Fi + 4G LTE), Windows chooses the wrong source IP, and LSC opens the password dialog.

In an SSTP VPN scenario, all three checks typically fail at the same time:

• The SSTP virtual adapter is assigned a 192.168.2.254 address that does belong to the same /24 as the LOGO! — so the subnet check alone does not trigger the prompt.
• The radio + 4G + cellular backhaul adds tens to hundreds of milliseconds of latency, pushing the round-trip past the LSC threshold.
• The service PC usually still has its wired Ethernet, Wi-Fi, or cellular modem enabled, so LSC binds to the wrong adapter and cannot reach the LOGO! via the tunnel.
Why the prompt is correct behaviour: from LOGO! 8 firmware FS4 onwards, every project write to a remote base module is gated by the operator knowing the remote-access password. The prompt is not a bug — it is a safety interlock Siemens added to prevent accidental parameter writes across WAN links. The troubleshooting task is to make LSC legitimately classify the device as remote and authenticate, or to flatten latency so it reclassifies as local.

Affected Versions and Hardware

Component	Affected versions	Notes
LOGO! SoftComfort	V8.0 – V8.2 (and newer 8.3/8.4 builds)	Remote password prompt introduced in V8.0 for FS4 targets.
LOGO! Base Module (BM)	6ED1052-1xx08-0BA1 / 6ED1052-2xx08-0BA1 / 6ED1052-1xx08-0BA2 (FS4 / FS5 / FS6)	Any BM with FS4 firmware or later triggers the prompt.
LOGO! Communication Interface Module (CIM)	LOGO! CIM (6GK7142-7BX00-0Ax0) for Ethernet	Recommended VPN endpoint for secure remote access.
Operating system	Windows 10 / Windows 11 / Windows Server 2016 / 2019 / 2022	SSTP client built into all supported Windows editions.
VPN protocol	SSTP (TCP 443), IKEv2, L2TP/IPsec, WireGuard	Behaviour is identical for any tunneled transport that adds >30 ms latency.

Network Configuration Verification

Before changing anything, capture a baseline of the live tunnel state on the service PC. Run the following from an elevated cmd or PowerShell prompt:

ipconfig /all
route print
ping -n 20 192.168.2.1
tracert -d -h 15 192.168.2.1

Confirm four facts:

1. The SSTP/RAS adapter carries an address in the 192.168.2.0/24 range (here 192.168.2.254).
2. No other enabled adapter also carries a 192.168.2.x address. A duplicate address on two interfaces is the most common reason LSC binds to the wrong NIC.
3. The persistent route to 192.168.2.0/24 goes through the VPN interface, not through the physical Ethernet/Wi-Fi gateway. Inspect with route print 192.168.2.0 mask 255.255.255.0.
4. The average ICMP round-trip to the LOGO! base module is stable. Note the average and the max — if the max swings by more than 50 ms, the cellular link is unstable and the password prompt will reappear on every transfer attempt.

Solution

Step 1 — Disable unused network adapters before launching LSC

1. Open Control Panel → Network and Sharing Center → Change adapter settings.
2. Right-click every adapter that is not the SSTP/RAS tunnel — Ethernet, Wi-Fi, Hyper-V virtual switches, VPN clients, TAP-Win adapters — and select Disable.
3. Confirm only the SSTP adapter is enabled. ipconfig /all should show a single active interface with the 192.168.2.254 address.
4. Start LOGO! SoftComfort only after the disabled state is in place. LSC enumerates the adapter list once at startup; changing adapters later will not retroactively rebind existing sockets.

This single change resolves the majority of "phantom" remote-password prompts because LSC finally binds its discovery/transfer socket to the adapter that actually reaches the LOGO!.

Step 2 — Force the correct interface inside the LSC Transfer dialog

If disabling adapters is operationally inconvenient (the PC needs Internet at the same time), use the in-product network selector:

1. In LSC, open Tools → Transfer → PC ↔ LOGO!.
2. In the Network Interface dropdown, pick the SSTP/RAS adapter — never "All" or "Auto-detect".
3. Tick Use remote access password only if you intend to write parameters; leave it blank for read-only diagnostics.
4. Click Detect LOGO!. The base module should appear in the list within a couple of seconds without re-prompting.

Step 3 — Reduce VPN-induced latency where possible

The LSC classification logic is satisfied faster if the tunnel round-trip is below ~30 ms. Practical steps:

• Move the SSTP endpoint from a remote RRAS server to one that is geographically closer. SSTP TCP-in-TCP encapsulation doubles the ACK latency compared to a native IPsec tunnel.
• Replace 4G LTE cellular backhaul with a wired fibre link or a directional 5 GHz PtP radio at both ends.
• Enable SSTP connection compression only if the RRAS server is CPU-bound; on cellular backhaul the savings are dwarfed by the radio's own latency.
• Use IKEv2 with MOBIKE instead of SSTP where the RRAS gateway supports it — IKEv2 is UDP-based and avoids the TCP-in-TCP meltdown over lossy radio links.

Step 4 — Provide the remote-access password

When the link is genuinely remote, accept the prompt and authenticate. The default factory password is:

LOGO

Change it from Tools → Options → Remote Access on the BM (or via the LOGO! web UI on http://192.168.2.1). Siemens recommends a password of at least 8 characters with mixed case.

The remote-access password is stored on the base module in plain text. Treat it like any other administrative credential — rotate it on commissioning, on personnel changes, and on any incident that touches the VPN gateway.

Windows Server SSTP Connection Limits

SSTP on Windows Server 2016/2019/2022 RRAS has a hard cap on the number of concurrent WAN miniports that the SSTP listener will accept. With the default RAS configuration the listener shows only two SSTP WAN miniports in Routing and Remote Access → Ports. Once both are busy, additional dial-in attempts receive error 0x80072740 ("WSAECONNRESET") and the VPN silently fails to connect.

To raise the cap:

1. Open Routing and Remote Access (rrasmgr.msc).
2. Right-click the server → Properties → tab Ports.
3. Select SSTP, click Configure, and raise Maximum number of ports from 2 to a value matching the simultaneous users (typical: 5–10 for a service team).
4. Apply and restart the RRAS service.

If the gateway is Windows Server 2019 Essentials, the SKU caps RRAS at 50 concurrent connections in total; the per-protocol cap still applies. Plan service-team VPN capacity accordingly. Reference: Microsoft Q&A thread "Windows servers 2019 Essentials RRAS/VPN (SSTP) max two connections".

LOGO! CIM and the Official Siemens VPN Reference

For sites that require permanent encrypted access, Siemens documents a full reference architecture using a LOGO! Communication Interface Module (LOGO! CIM) as the VPN endpoint, terminating an IPsec tunnel from a service PC. The CIM acts as an Ethernet-to-LOGO! gateway, isolates the BM on a private subnet, and exposes only the CIM-facing TCP/UDP ports.

Key elements of the Siemens reference setup (entry ID 109747067):

• LOGO! CIM (6GK7142-7BX00-0Ax0) is installed on the left side of the LOGO! 8 base module and powered from it.
• An IPsec site-to-site tunnel is established between the service PC and the CIM's WAN IP.
• The CIM exposes a single IP to the corporate side and proxies the LOGO! discovery / transfer UDP frames to the BM on its private Ethernet port.
• Certificates (X.509) issued by the company CA authenticate both ends, removing the need for a pre-shared key.
• Firewall rules permit only UDP/TCP 8443 (LOGO! web UI) and the discovery UDP port to reach the CIM; everything else is denied.

Full step-by-step: Siemens Support entry 109747067 — "Setting up a Secure VPN Connection between a PC and LOGO! 8".

Verification

After applying the fixes, validate that LSC now performs a transfer without the remote-password prompt (or with the password accepted):

1. Start LSC and open Tools → Transfer → PC ↔ LOGO!.
2. Select the SSTP adapter as the network interface.
3. Click Detect. The base module appears within 2–5 seconds.
4. Click Upload. The project (LSC program + parameter table) downloads without prompting for the remote password if the latency stays below the threshold; otherwise, enter the password and confirm.
5. Re-enable the previously disabled adapters after the transfer completes. LSC does not need to remain exclusively on the VPN adapter once the data is on the local disk.

Repeat the ping -n 50 192.168.2.1 command and verify the average round-trip is now under 50 ms with a max under 100 ms. If the cellular radio continues to swing the latency, address that before relying on unattended remote programming.

Troubleshooting Matrix

Symptom	Likely cause	Action
Password prompt, ping succeeds	Wrong network adapter bound; LSC sees the device as remote.	Disable all non-VPN adapters; restart LSC; pick the SSTP interface in Transfer dialog.
Password prompt, ping > 100 ms	Cellular / radio latency above LSC threshold.	Switch VPN protocol to IKEv2; replace 4G backhaul; reduce hops.
No password prompt, transfer hangs at 0%	Firewall on RRAS or remote site blocks UDP discovery.	Open UDP/TCP ports used by LOGO! SoftComfort (default UDP 10005, TCP 8443).
VPN drops after 2 connections	SSTP WAN miniport limit on Windows Server RRAS.	Raise Maximum number of ports in RRAS → Properties → Ports → SSTP → Configure.
Password prompt, ping fails intermittently	Radio link flapping; duplicate IP on a second adapter.	Audit DHCP/static bindings; verify only one adapter carries a 192.168.2.x address.
Prompt reappears after Windows update	Adapter enumeration order changed; new NIC added.	Re-disable the new adapter and re-pin the SSTP interface in LSC.
LOG message: 0x80072740	SSTP listener refused the new connection (port exhaustion).	Apply the SSTP WAN miniport fix above.

Preventive Recommendations

• One adapter, one program. For service PCs dedicated to remote commissioning, write a small PowerShell script that disables Wi-Fi and cellular modems and brings only the SSTP/RAS interface up before launching LSC. Restore them afterwards.
• Document the remote-access password in the site's machine logbook, not on a sticky note.
• Use the LOGO! CIM for permanent installations instead of bridging the BM directly to the corporate LAN. The CIM is purpose-built for secure remote access and survives LOGO! firmware updates better than a hand-rolled IPsec tunnel.
• Prefer IKEv2 over SSTP for cellular backhaul to avoid TCP-in-TCP collapse.
• Monitor latency, not just uptime. A cellular link can stay "up" while its RTT drifts from 60 ms to 400 ms at peak hours; the LOGO! will then suddenly start demanding the remote password at every transfer.

FAQ

Why does LOGO! SoftComfort ask for a remote-access password when my PC and the LOGO! are on the same subnet?

LSC classifies the target as remote when either the source-IP/subnet check fails, the ICMP round-trip exceeds its internal threshold (~30–50 ms), or it binds to the wrong Windows network adapter. Even on the same /24, a VPN tunnel with high latency or a multi-homed PC triggers the prompt. Disable unused adapters and force the SSTP interface in the Transfer dialog.

What is the default remote-access password on a LOGO! 8?

The factory default is LOGO. Change it from Tools → Options → Remote Access on the base module or via the LOGO! web UI. Siemens recommends at least 8 characters with mixed case, and rotation on personnel changes.

How do I raise the SSTP connection limit on Windows Server RRAS?

Open rrasmgr.msc, right-click the server → Properties → Ports → select SSTP → Configure, and raise Maximum number of ports from the default 2 to the desired count. Restart the RRAS service. Reference: Microsoft Q&A thread on the two-connection cap.

Should I use SSTP or IKEv2 for a LOGO! 8 remote-access tunnel?

Both work, but IKEv2 is preferred over cellular or radio backhaul because it is UDP-based and avoids the TCP-in-TCP latency penalty of SSTP. SSTP remains a good choice when the only outbound port available is TCP 443.

Where can I find the official Siemens guide for VPN access to a LOGO! 8?

Siemens Support entry ID 109747067 — "Setting up a Secure VPN Connection between a PC and LOGO! 8" — covers the LOGO! CIM reference architecture with IPsec, certificates, and firewall rules.