PLC IP Address Configuration for OPC UA Server Communication

PLC IP Address Configuration for OPC UA Server Communication

This reference consolidates the engineering rules for assigning IP addresses to a PLC, connecting an engineering station or OPC UA client to that controller, and avoiding the most common failure modes that surface when the controller IP is changed at runtime. It is written for commissioning engineers and SCADA integrators working with SIMATIC S7-1500/S7-1200 controllers and equivalent EtherNet/IP- or Modbus TCP-capable PLCs that expose an OPC UA server endpoint.

1. IP Address Assignment Methods

Every PLC Ethernet interface requires an IPv4 address from one of three sources. The selection depends on commissioning phase, network policy, and whether the controller has a display or vendor discovery tool.

For an OPC UA server, the IP must be deterministic. A SCADA client that resolves the endpoint through DNS still depends on the DNS A-record being kept in sync; the deterministic approach is to assign a static IP and either publish an A-record or store the IP directly in the OPC UA client configuration.

2. Direct PC-to-PLC Connection: Auto-MDIX

Modern PLC Ethernet PHYs implement Auto-MDIX (Automatic Medium-Dependent Interface Crossover) defined in IEEE 802.3ab. The PHY detects the TX/RX pair polarity on the connected device and automatically configures the internal crossover, so a straight-through Cat 5e/Cat 6 patch cable works in every case.

Procedure for a one-to-one link with a SIMATIC S7-1500 CPU:

1. Connect the engineering PC NIC directly to the CPU PROFINET port (X1 or X2) using a standard straight-through patch cable.
2. Set the PC NIC to an IP address in the same subnet (for example, controller 192.168.0.1 / 24, PC 192.168.0.2 / 24).
3. Open TIA Portal, select Online > Accessible nodes. The CPU appears in the list once it responds to the DCP identify broadcast.
4. If the CPU is not in the list, disable any active VPN client and Windows firewall rules on the private profile, then repeat the scan.

3. Switched Network Topology

When an Ethernet switch sits between the engineering PC and the PLC, the link on every segment is between a DTE (PC or PLC) and a DTE-class switch port. Both segments therefore use straight-through cabling. Mixing crossover in a switched plant is a frequent commissioning fault that produces "link up / no L2 traffic" symptoms.

Industrial managed switches (SCALANCE XC/XB/XR, Stratix 5700/5400, Hirschmann RS20/RS30) add PROFINET prioritization, LLDP topology discovery, and port-level diagnostics. These are recommended for any segment that carries an OPC UA session because the QoS classification keeps the OPC UA publish/subscribe traffic from being delayed by bursty PROFINET real-time frames.

4. Vendor Engineering Tools for IP Discovery and Assignment

If the controller IP is unknown, every major vendor ships a discovery tool that locates the device via DCP (PROFINET), CIP (EtherNet/IP), or a vendor multicast beacon. Always use the tool that matches the controller's native protocol, not a generic Windows network scanner.

PRONETA is the recommended tool when you have no DNS, no DHCP, and the controller IP is unknown. It performs a Layer-2 multicast scan, lists every PROFINET device on the segment, and lets you assign a new IP without opening the TIA Portal project.

5. OPC UA Server IP Configuration on SIMATIC S7-1500

The OPC UA server on a SIMATIC S7-1500 is activated per project in TIA Portal under CPU properties > OPC UA > Server. The server listens on TCP port 4840 by default; the URL exposed to clients is constructed as:

For a CPU at 192.168.178.151 on the 192.168.178.0/24 subnet, the client uses:

Configuration steps in TIA Portal:

1. Open the CPU device configuration and select the PROFINET interface X1 (or X2 if the OPC UA server is bound to that subnet).
2. Set IP address and Subnet mask on the Ethernet addresses page. Note the value — it will become the OPC UA endpoint.
3. Under OPC UA > Server > General, enable Activate OPC UA Server.
4. Set Port (default 4840). If a firewall sits between the SCADA server and the PLC, open TCP 4840 (or the chosen port) bidirectionally.
5. Under OPC UA > Server > Security, select the security policy (None, Basic128Rsa15, Basic256Sha256, Aes128Sha256RsaOaep, Aes256Sha256RsaPss). Anonymous authentication is permitted only if explicitly enabled.
6. Under OPC UA > Server > User authentication, configure the certificate trust list and the user/password mapping that the SCADA client will use.
7. Compile and download the project. The server endpoint is then reachable at the configured IP.

6. Network Stack Reset on IP Change

When the IP address of a SIMATIC CPU is changed in TIA Portal (or via PRONETA / SIMATIC Automation Tool) and the change is downloaded to the controller, the PROFINET stack reinitializes. Every active TCP socket on that interface is closed: OPC UA sessions, S7 communication PUT/GET, open Modbus TCP connections, and HMI connections.

Recovery sequence after a planned IP change:

1. Stop the SCADA / OPC UA client. The pending session timeout will release the certificate trust entry on the next reconnect.
2. Update the OPC UA endpoint URL in the SCADA client configuration (e.g., Ignition, WinCC, Kepware) to the new IP.
3. Download the IP change. The CPU restarts the PROFINET stack — this is observable as a brief link-down/link-up on the switch port.
4. Restart the SCADA client. It opens a new TCP connection on port 4840 and re-handshakes the OPC UA session.
5. Verify the client shows the server certificate as Trusted. If the certificate was bound to the old IP, accept the new certificate and rotate the trust list.

7. DHCP and BOOTP Service for Initial Commissioning

The Siemens BOOTP-DHCP-Server tool (or the equivalent Rockwell BOOTP-DHCP server for EtherNet/IP controllers) lets you map a MAC address to a fixed IP at first power-up. This is the standard approach for a rack of controllers where every PLC ships from the factory with a default link-local address and needs a deterministic address before the OPC UA client is configured.

Procedure with the Siemens BOOTP-DHCP-Server:

1. Install S7BOOTP from the Siemens support site. Run as administrator.
2. Connect the PC directly to the PROFINET network segment that contains the unconfigured CPU.
3. Click Start to begin the broadcast listener. The CPU appears with its MAC address once it powers up and issues a BOOTP request.
4. Double-click the entry, assign an IP and subnet mask, then click Apply. The server sends a DHCP ACK with the static mapping.
5. Click Stop to end the broadcast listener — leaving it running will conflict with any production DHCP server.
6. Verify in TIA Portal Online > Accessible nodes that the CPU is now reachable on the assigned address.

8. Subnetting and OPC UA Reachability

OPC UA TCP traffic is unicast and IP-routable. If the SCADA server sits on a different subnet from the PLC, a router or Layer-3 switch must forward TCP port 4840 (or the configured port) between the two. Validate the path with the following checks before commissioning the OPC UA client:

1. From the SCADA server, ping the PLC IP. A successful ICMP reply confirms the L3 path is open; OPC UA failure is then a TCP/credential issue, not a routing one.
2. Run Test-NetConnection -ComputerName 192.168.178.151 -Port 4840 (PowerShell) or nc -vz 192.168.178.151 4840 (Linux) to confirm the port is reachable.
3. Confirm the PLC default gateway is set if the SCADA client is on a different subnet. Without a gateway, the CPU will not accept TCP from outside its own subnet even if the cable is connected.
4. Confirm the SCADA host firewall permits outbound TCP 4840. Windows Defender Firewall with the Domain or Private profile active will silently drop the SYN.

9. Troubleshooting Matrix

10. Commissioning Verification Checklist

Run this checklist before handing the cell over to operations.

1. PLC has a static IP documented in the as-built drawing and in the OPC UA client endpoint URL.
2. The OPC UA server is activated in the TIA Portal project and downloaded to the CPU.
3. Port 4840 (or the configured port) is open in any firewall between the SCADA server and the PLC subnet.
4. The SCADA client can browse the OPC UA address space and the published tags appear with the correct data type.
5. A read of a known tag returns Good quality and the current PLC value.
6. The server certificate is trusted on the client and a backup copy is stored in the project archive.
7. A forced IP change (e.g., from PRONETA) is performed once to verify the recovery procedure; the SCADA client reconnects automatically after the endpoint URL is updated.
8. The PLC, switch, and SCADA server are all referenced in the network diagram with IP, mask, gateway, and VLAN ID.

11. Notes on Vendor-Specific Behavior

SIMATIC S7-1500 / S7-1200: OPC UA server is a project option that must be activated in the device configuration. The endpoint is bound to the PROFINET interface IP. The CPU allows up to 40 OPC UA sessions (varies by CPU type, see CPU manual for exact limit).

ET 200SP CPU / IM: The OPC UA server is available on the PROFINET interface of the CPU or the IM 155-6 PN with firmware V4.2 and later. Use the same endpoint URL rule.

Third-party OPC UA stacks (Unified Automation, Matrikon, Kepware): When the OPC UA server is hosted on a non-Siemens gateway, the endpoint URL is built the same way: opc.tcp://<gateway-IP>:<port>. The gateway device is the device whose IP must be static and whose port must be reachable.

SCADA clients (WinCC Unified, Ignition, FactoryTalk Optix): All three read the endpoint URL from a configuration page and rebuild the OPC UA session on every reconnect. Updating the URL and restarting the client service is sufficient after an IP change — no certificate rotation is needed unless the server-side certificate SAN contains the IP.

12. FAQ