Integrating Siemens PLCs with NMS via OPC Server and SNMP

Network Management Systems (NMS) in IT-centric monitoring environments almost universally expect SNMP as the southbound protocol. Siemens SIMATIC PLCs, however, do not expose a native SNMP agent for process tags, so an OPC server must be inserted as the protocol converter between the S7/PROFINET fieldbus and the NMS. This reference covers the architecture, the SIMATIC NET OPC option, third-party bridges such as KEPServerEX with its SNMP Agent plug-in and Matrikon's OPC SNMP Agent, the SIMATIC IPC hardware targets (notably the IPC227D), and the commissioning steps that produce a stable SNMP-visible tag set.

1. Architecture Overview

The data path has four logical layers:

1. Field layer – SIMATIC S7-300/400/1200/1500 (or ET 200SP) controllers with PROFINET or classic MPI/PROFIBUS.
2. Edge layer – SIMATIC IPC (IPC227D, IPC227G, IPC847E or IPC BX-39A) running Windows Embedded or Windows 10 IoT. The OPC server and the SNMP agent co-reside on this box.
3. Translation layer – OPC DA/UA server (Siemens SIMATIC NET, KEPServerEX or Matrikon) speaking S7, S7-Plus, SEND/RECEIVE, PROFINET IO or OPC UA to the controller.
4. Northbound layer – SNMP Agent (KEPServerEX SNMP Agent, Matrikon OPC SNMP Agent or SIMATIC NET SNMP plug-in) that publishes tag values as OIDs to the NMS via UDP/161 (poll) and UDP/162 (trap).

2. SIMATIC NET OPC Server – Native Siemens Path

The SIMATIC NET OPC server is the native Siemens product line and ships with the SIMATIC NET PC software suite. It provides a single S7- or PROFINET-facing interface on the IPC and exposes data through multiple OPC specifications:

Underlying S7 transport options for Industrial Ethernet are:

• S7 communication – Optimised, connection-oriented access to DBs, Merkers, Inputs/Outputs (PUT/GET).
• Open communication (SEND/RECEIVE) – Datagram-based, used for TSAP-based custom protocols.
• PROFINET – Real-time IO and supervisory PN-IO controller mode.

SIMATIC NET also embeds an SNMP option in the OPC server. According to the Siemens Industry Online Support documentation, after selecting the OPC server in the configuration tool and opening Properties, the SNMP Protocol tab is exposed with a dedicated Configuration button for defining read communities, trap destinations and the OID space that maps each OPC tag. The behaviour is described in the Siemens support whitepaper "Diagnostics and configuration with SNMP" – the SNMP OPC server can poll any SNMP-capable device on the Industrial Ethernet, including managed switches, and exchange diagnostics with the SIMATIC controllers.

3. KEPServerEX with SNMP Agent Plug-in

When licensing, multi-vendor support or installation footprint are the priority, KEPServerEX from Kepware (now PTC Kepware) is the de-facto third-party choice. It consists of two cooperating components:

1. Server Core – Connects to SIMATIC S7-300/400/1200/1500 controllers through the Siemens TCP/IP Ethernet driver or the newer Siemens S7 Plus driver, which provides optimised symbol browsing via the TIA Portal export.
2. SNMP Agent – Plug-in that maps KEPServerEX tag values into an in-process SNMP agent, exposing them on UDP/161 to the NMS and emitting traps on UDP/162.

Key configuration fields in the SNMP Agent plug-in:

A trial build is available from the Kepware download portal and the help file is bundled with the install. For ~10 process tags per site, a runtime licence is in the lowest price tier, making it attractive for multi-site NMS rollouts.

4. Matrikon OPC SNMP Agent

Matrikon (now part of Honeywell Forge) supplies an OPC to SNMP Agent that performs the same function as the Kepware plug-in. It reads tags from any registered OPC DA 2.0/3.0 server on the same host and re-publishes them via SNMP. The advantage is interoperability: it can attach to SIMATIC NET OPC, KEPServerEX or any third-party OPC DA server, which simplifies mixed estates. The architectural caveat is identical to KEPServerEX – only OID-mapped scalar values are exposed; array and string tags require a custom OID mapping table.

5. SIMATIC IPC Hardware Targets

The IPC is the consolidating edge node. For ~10 tags the smaller form factors are adequate:

6. Installation Order on the IPC

Field commissioning consistently shows a clean install order is required. The sequence on a Windows Embedded image is:

1. Update the legacy InstallShield runtime. XP Embedded SP3 ships a pre-WPF version that fails on the OPC server installer; a current InstallShield 2012 R2 (or newer) is a prerequisite for SIMATIC NET V14 and KEPServerEX V6.x.
2. Install the SIMATIC NET PC software (or skip if using KEPServerEX only).
3. Install KEPServerEX core. Apply a runtime licence (it is hardware-bound to the IPC MAC).
4. Install the Siemens TCP/IP Ethernet driver inside KEPServerEX. Add a channel with the PROFINET interface address and create devices for each PLC.
5. Import the TIA Portal symbol table (XML export) or hand-map the DB addresses (e.g., DB100.DBD0 for a REAL, DB100.DBX4.0 for a BOOL).
6. Install the SNMP Agent plug-in. Configure listen address, community strings, and trap destination.
7. Install the OPC Core Components Redistributable (x86/x64) matching the OPC server architecture.
8. Set Windows services to Automatic (Delayed Start) and configure the firewall to allow UDP/161 inbound (poll) and UDP/162 outbound (trap).

7. S7-1200/1500 Connectivity Requirements

S7-1200/1500 controllers enforce PUT/GET protection and optimised block access. To allow KEPServerEX or SIMATIC NET to read process data:

1. In TIA Portal, open the PLC Properties → Protection & Security → Connection mechanisms.
2. Enable Permit access with PUT/GET communication from remote partner.
3. For data-block access, in the DB properties uncheck Optimised block access for any DB that must be read by an external OPC server (or, preferred, expose the data via the S7 Plus driver which understands optimised blocks and symbol names).
4. Open the ISO-on-TCP port 102 in the Windows Firewall on the IPC.

For S7-300/400 the steps above are reduced to enabling the S7 connection in NetPro and ensuring the rack/slot pair is correctly entered in the OPC channel configuration (rack 0, slot 2 for S7-300; rack 0, slot 3 for S7-400).

8. SNMP Mapping Details

Each process tag is exposed under a private enterprise OID. A clean OID tree is:

1.3.6.1.4.1.<enterprise>.<siteId>.<plcId>.<tagId>

Example for site 10, PLC 1, tag 3:
1.3.6.1.4.1.99999.10.1.3.0  -- scalar instance

SNMP data types are limited to INTEGER, Counter32/64, Gauge32, OctetString and TimeTicks. Booleans are mapped to INTEGER {0,1}, REAL to INTEGER with implied scaling, and strings to OctetString. Document the conversion in a lookup table attached to the NMS dashboard so that on-call engineers can decode values without re-deriving them.

Trap templates are typically defined in the SNMP Agent plug-in. The trap OID root is the same enterprise number, with a sub-identifier for severity (1=info, 2=warning, 3=critical). KEPServerEX and Matrikon both allow per-tag thresholding to trigger a trap when the value crosses a configured high/low limit.

9. Verification Procedure

After the install, run the following checks before going to site:

1. From the NMS host, execute snmpwalk -v2c -c public <IPC_IP> 1.3.6.1.4.1.<enterprise> and confirm the expected tag count.
2. Use snmpget -v2c -c public <IPC_IP> 1.3.6.1.4.1.<enterprise>.10.1.3.0 against a known tag and compare with the value shown in TIA Portal online watch.
3. Force a value change in the PLC (set/reset a bit) and re-query within one scan interval to verify the SNMP agent is updating.
4. Configure a test trap destination (e.g., a free SNMP trap receiver on the engineering laptop) and cross the threshold; confirm the trap arrives with the correct varbind list.
5. Restart the IPC and confirm the KEPServerEX Windows service restarts automatically, the SNMP agent re-binds to UDP/161 and the NMS can poll within 30 s of boot.

10. Troubleshooting Matrix

11. Performance and Sizing Notes

For ~10 tags per site the data volume is trivial: a full 10-tag poll at 30 s intervals is approximately 0.5 kbit/s per direction. The bottleneck is the OPC server scan rate, not the network. On an IPC227G the recommended KEPServerEX scan rate is 1000 ms, which gives a worst-case 10 ms CPU load for the channel. Reducing to 100 ms is possible but typically unnecessary when the NMS itself polls at multi-second intervals.

On IPC227D, co-resident SIMATIC NET, KEPServerEX and Matrikon produce noticeable boot-time CPU saturation (Atom E620, 1 GB RAM). Field installations report the system stabilises within 3–5 minutes after boot, but the SNMP service may be late to bind to UDP/161. Configure the NMS for a 60 s warm-up after any IPC restart and increase the initial poll retries to 5.

12. Security Considerations

Default deployments use SNMP v2c with community string public. For an internet-facing NMS this is unacceptable. Recommended hardening:

• SNMP v3 with authPriv: SHA-1 for authentication, AES-128 for privacy.
• Unique Engine ID per IPC, generated at install time and stored in the agent's configuration file.
• Windows Firewall restricted to NMS source IP range (e.g., 10.20.0.0/24).
• Disable the public community and any write community.
• For multi-tenant NMS, deploy a separate SNMP Agent instance per customer with a private OID branch.

Where the customer is bound by IEC 62443, run the OPC/SNMP stack on a dedicated VLAN, isolate the IPC from the IT network with a stateful firewall, and require signed firmware on the IPC (SIMATIC IPC supports TPM 2.0 on IPC227G and newer).

13. SNMP Activation on the SIMATIC ET 200 and S7 Side

The S7/ET 200 station itself can also be an SNMP agent for its own diagnostic data, independent of the OPC server. The activation procedure is documented in the SIMATIC ET 200SP / ET 200clean communication function manuals: under Communications Services → SNMP the user activates the SNMP service, defines the read community and the trap targets, and reloads the device configuration. The same procedure applies to SCALANCE switches, which can be polled by SIMATIC NET to surface network diagnostics inside the same OPC tree. See Activating and deactivating SNMP for the parameter set.

14. Reference Paths and Official Documentation

• SIMATIC NET OPC Servers – Siemens electronic catalog
• Diagnostics and configuration with SNMP (PDF)
• Activating and deactivating SNMP – TIA documentation
• SNMP-OPC server – Siemens Industry Online Support entry

When commissioning a multi-site rollout, the typical OID enterprise number is registered as a private enterprise number with IANA (e.g., 1.3.6.1.4.1.99999). Reserve 10 sub-IDs per site (site, PLC, tag group) and document the assignment in a master spreadsheet before the first install.