PLCSIM Advanced No Accessible Devices: ESXi Network Fix

1. Problem Definition

The "No accessible devices" result returned by the TIA Portal "Accessible nodes" / "Accessible devices" search when the engineering station cannot reach an instance of S7-PLCSIM Advanced running on a VMware ESXi virtual machine is a Layer 2/3 reachability problem, not a TIA Portal bug. The error manifests when the TIA Portal V15.1 (or later) online interface selection cannot find any S7-1500 / ET 200SP instance even though the PLCSIM Advanced instance is started and the VM appears reachable from a command-line ping.

Typical configuration reported in the field:

• Hypervisor: VMware ESXi (managed by vCenter or standalone)
• VM operating system: Windows 7 Enterprise SP1 64-bit, Windows 10, or Windows 11
• PLCSIM Advanced: V2.0 SP1 (corresponds to TIA Portal V15.1) up to V6.0 (corresponds to TIA Portal V18)
• Engineering station: separate laptop with Windows 10 (build 1809) or Windows 11, TIA Portal V15.1 or later
• Symptom: ping <VM IP> succeeds from the laptop, but "Accessible devices" returns no targets

The root cause is almost always one of four failure modes: wrong ESXi virtual switch / port group type, missing or disabled PLCSIM Virtual Ethernet Adapter, Windows Defender Firewall on the VM blocking TCP/102 and Softbus, or TIA Portal scanning the wrong network interface. Each is addressed below.

2. PLCSIM Advanced Network Architecture

S7-PLCSIM Advanced simulates an S7-1500 CPU or ET 200SP station as a Windows process. Unlike S7-PLCSIM (the classic V5.x simulator), PLCSIM Advanced binds a real TCP/IP stack to a virtual Ethernet adapter so that standard engineering tools, OPC UA clients, and even third-party S7 drivers can talk to the simulation as if it were a physical CPU on the network. The architecture is described in the S7-PLCSIM Advanced Function Manual on the Siemens support portal (S7-PLCSIM Advanced V6.0 system documentation).

The PLCSIM Virtual Ethernet Adapter is a Microsoft KM-TEST loopback adapter that is installed by the PLCSIM Advanced setup. Each simulated CPU is bound to an IP address on that adapter (or on any other physical/virtual NIC inside the VM). The TIA Portal uses the standard S7 discovery protocol (broadcast over UDP 34964 plus a TCP/102 connection attempt) to enumerate the instances. If a single link in this chain is broken, "Accessible devices" returns nothing even though the VM is otherwise reachable.

3. Root Cause Matrix

4. ESXi Virtual Machine Network Adapter Configuration

For a laptop on a separate physical network to reach a PLCSIM instance running in an ESXi VM, the VM must have a virtual NIC attached to a vSwitch port group that bridges to a physical uplink (or that the laptop can reach via a routed network). The four common ESXi networking modes and their suitability are listed below.

Open the VM's network adapter properties in the vSphere Client (Edit Settings → Network Adapter 1) and apply the following settings:

1. Adapter type: VMXNET3 (preferred for Windows 10/11 VMs) or E1000E for Windows 7 VMs. Avoid the flexible adapter for PLCSIM Advanced because the simulated S7-1500 sends 1500+ byte frames on online diagnostics.
2. MAC address: Automatic unless the laptop is on a network with strict port security — in that case assign a static MAC and allow that MAC on the access port.
3. Connected: ticked, Connect at power on: ticked.
4. Network label: a port group that bridges to an uplink reachable by the laptop.

On the ESXi side, edit the port group security policy: vSphere → Networking → Port group → Edit Settings → Security and set Promiscuous mode = Accept and MAC address changes = Accept. These are required only if the VM is running on a non-VLAN-aware access port and the simulated CPU uses a different MAC than the VM's primary NIC. Refer to the VMware vSphere Networking documentation for port group security details.

5. PLCSIM Virtual Ethernet Adapter Setup

Each PLCSIM Advanced instance needs a host IP address on the VM. The cleanest way is to install the Siemens PLCSIM Virtual Ethernet Adapter (a Microsoft KM-TEST loopback) and bind the simulated CPU to an IP on that adapter. This isolates simulation traffic from any corporate network the VM is bridged to and prevents IP conflicts.

1. Open ncpa.cpl on the VM. Look for "Siemens PLCSIM Virtual Ethernet Adapter". If it is missing, the PLCSIM Advanced setup ran in a mode that did not install it. Re-run the setup (e.g., S7-PLCSIM_Advanced_V20_SP1.exe) as Administrator, choose Custom, and ensure the "PLCSIM Virtual Ethernet Adapter" feature is enabled.
2. Assign a static IP on the loopback adapter — for example, 192.168.0.10 / 255.255.255.0. Use a subnet that is not in use by the production LAN to avoid routing conflicts.
3. Start PLCSIM Advanced and create a new instance. In the instance wizard, set the PLCSIM Virtual Ethernet IP to 192.168.0.10. The instance will respond to S7 discovery on that address.
4. Verify from the VM command line:

   ipconfig /all
   :: Confirm that "Siemens PLCSIM Virtual Ethernet Adapter" shows 192.168.0.10
   netstat -ano | findstr :102
   :: Should list the PLCSIM process bound to 0.0.0.0:102 (all interfaces) or 192.168.0.10:102

For multiple instances on one VM, increment the third octet: 192.168.0.10, 192.168.0.11, 192.168.0.12, etc. The S7-PLCSIM Advanced manual (S7-PLCSIM Advanced V6.0 documentation) shows the same scheme under "Working with PLCSIM instances".

6. Windows Firewall Configuration

Default Windows Defender Firewall rules block inbound TCP/102 and the Softbus UDP ports, so the laptop's discovery probes are dropped at the VM. PLCSIM Advanced installs firewall rules during setup, but they are sometimes lost when the setup is run in a non-elevated context, when Group Policy overrides local rules, or after a Windows feature update.

From an elevated PowerShell on the VM, run:

# Check whether PLCSIM rules are present
Get-NetFirewallRule | Where-Object {$_.DisplayName -like "*PLCSIM*" -or $_.DisplayName -like "*S7*"} | Format-Table DisplayName, Enabled, Direction, Action

# Allow inbound TCP 102 (S7ONLINE)
New-NetFirewallRule -DisplayName "PLCSIM Advanced S7ONLINE TCP 102" -Direction Inbound -Protocol TCP -LocalPort 102 -Action Allow -Profile Any

# Allow inbound UDP Softbus ports
New-NetFirewallRule -DisplayName "PLCSIM Advanced Softbus UDP" -Direction Inbound -Protocol UDP -LocalPort 34964-34966 -Action Allow -Profile Any

# Verify the rules
Get-NetFirewallRule -DisplayName "PLCSIM Advanced*" | Format-Table

On the laptop side, allow outbound TCP/102 and UDP/34964 to the VM subnet. On Windows 10 1809 and Windows 11 24H2 the default outbound policy is Allow, but third-party antivirus suites (Symantec, McAfee, Trend Micro, Sophos) frequently install host-based firewalls that block S7 traffic. Temporarily disable the third-party firewall to confirm, then re-enable with explicit rules for the PLCSIM subnet.

From the laptop, validate end-to-end reachability with PowerShell:

# Replace 192.168.0.10 with the PLCSIM instance IP
Test-NetConnection -ComputerName 192.168.0.10 -Port 102
# Expect: TcpTestSucceeded : True

# Softbus discovery is UDP — Test-NetConnection uses ICMP and TCP, so use a UDP-specific test
# (just confirm the laptop can resolve and reach the VM with ping)
Test-Connection -ComputerName 192.168.0.10 -Count 4

If Test-NetConnection -Port 102 returns TcpTestSucceeded : True but TIA Portal still shows "No accessible devices", the S7ONLINE connection is fine and the issue is at the Softbus layer (UDP 34964) or the TIA Portal interface selection.

7. TIA Portal "Accessible Devices" Configuration

The "Online → Accessible nodes" / "Accessible devices" function in TIA Portal enumerates devices using the network interface configured in the S7ONLINE access point. When a laptop has multiple NICs (wired, Wi-Fi, VPN, Hyper-V switch, WSL vEthernet), the wrong interface is often selected and the search silently returns nothing.

1. Open the "Set PG/PC Interface" dialog (Control Panel on older Windows, or Start menu search on Windows 10/11). Select S7ONLINE (STEP 7) → TCP/IP <NIC that routes to the VM>.
2. Confirm the access point is also the one used in the TIA Portal project: Project tree → Online access → [interface selected above].
3. Open Online → Accessible nodes. The TIA Portal status bar shows the local IP from which the broadcast was sent — confirm it is the IP that can route to the PLCSIM subnet.
4. If the PLCSIM instance is on a different subnet, the S7 discovery broadcast does not propagate across routers. Either add a static route on the laptop that points the PLCSIM subnet to the gateway that bridges to the VM, or use a direct /30 connection.

When the broadcast is not enough (multiple subnets, ACLs in the path), use the direct entry method: Online → Accessible nodes → Type the IP address of the accessible node… and enter the PLCSIM Virtual Ethernet IP (e.g., 192.168.0.10). TIA Portal attempts a direct TCP/102 connection to that address. If this succeeds where the broadcast does not, the broadcast is being dropped at the switch or firewall — a common occurrence on enterprise networks with IGMP / broadcast suppression enabled.

8. Softbus and Port Verification

The Softbus daemon inside PLCSIM Advanced handles instance discovery, instance-to-instance routing, and the routing of the simulated PROFINET / S7 traffic. The Softbus process is Siemens.Simatic.PlcSim.Advanced.Softbus.exe on V5.0 and later. A failure of this process produces the exact "No accessible devices" symptom in the source issue.

Check the Softbus status from the VM:

# Is the Softbus process running?
Get-Process -Name "Siemens*" | Format-Table Name, Id, StartTime

# Is anything listening on the Softbus ports?
netstat -anob | findstr ":34964"
netstat -anob | findstr ":102"

# Test a Softbus discovery packet from the laptop using the Siemens tool
# (PLCSIM Advanced installation includes a Softbus utility)
"C:\Program Files\Siemens\Automation\PLCSIM Advanced\Tools\Siemens.Simatic.PlcSim.Advanced.Softbus.Discoverer.exe"
:: Or use the Softbus-Explorer shipped with newer versions

If Softbus is not running, start the Windows service "S7-PLCSIM Advanced Softbus" or restart the PLCSIM Advanced instance. If the service is set to Manual and the engineering station rebooted, Softbus does not start and the simulator appears silent to TIA Portal. Set it to Automatic (Delayed Start).

9. S7-PLCSIM Advanced V6.0 Event Viewer Diagnostics

Newer PLCSIM Advanced versions (V5.0, V6.0) have stricter runtime requirements than V2.0 SP1. A common failure mode on Windows 11 24H2 (build 26100) is that the PLCSIM Advanced main window never appears and no error is shown to the user, but the Event Viewer logs a sequence of .NET runtime, Visual C++ runtime, and application errors.

Procedure to capture and interpret the failure:

1. Open eventvwr.msc on the VM as Administrator.
2. Navigate to Windows Logs → Application and clear the log.
3. Launch PLCSIM Advanced. Wait 60 seconds.
4. Re-open the Application log and filter by Source = .NET Runtime, Application Error, SideBySide.
5. Record the Faulting Module Name, Exception Code, and Assembly Identity. Typical entries on Windows 11 24H2 include: Faulting module name: KERNELBASE.dll, Exception code: 0xe0434352 (managed code exception) followed by an entry indicating that Microsoft.WindowsDesktop.App.Ref or Microsoft.AspNetCore.App runtime 6.0 / 8.0 is missing.

Remediation steps for V6.0 on Windows 11 24H2:

1. Install the latest Microsoft Visual C++ 2015-2022 Redistributable (x64) with both x86 and x64 packages.
2. Install the .NET Desktop Runtime 6.0 (LTS) and .NET Desktop Runtime 8.0 (LTS).
3. Install the .NET Desktop Runtime 3.1 if the TIA Portal V18 installation in use depends on it.
4. Set the PLCSIM Advanced install directory exclusion in Windows Defender (the AV scan on startup can race the JIT compiler and surface as a missing-dll error). Reference: Microsoft Defender exclusion documentation.
5. Right-click the PLCSIM Advanced shortcut → Properties → Compatibility → Run this program as administrator. The Softbus service and the KM-TEST loopback adapter installation require elevation.

The Siemens support entry 109802840 ("S7-PLCSIM Advanced V6.0 readme") lists the supported Windows builds and required redistributables. The V6.0 readme confirms Windows 11 22H2 and 23H2 as supported; 24H2 (build 26100) is partially supported with the runtime fixes above.

10. Verification Procedure

Run the following checklist end-to-end. Each step must pass before moving to the next.

1. L2 reachability: ping <VM IP> from the laptop returns replies. If not, fix the ESXi port group / VLAN first.
2. TCP/102 reachability: Test-NetConnection -ComputerName <VM IP> -Port 102 returns TcpTestSucceeded : True. If false, the VM firewall is the issue.
3. PLCSIM instance listed locally on the VM: open PLCSIM Advanced on the VM, the instance appears in the instance list with a green status indicator and the correct IP.
4. Softbus reachability: from the laptop, run the Softbus discoverer tool (if installed). The PLCSIM instance IP appears. If not, the UDP 34964 path is blocked or the wrong subnet is in use.
5. TIA Portal sees the instance: Online → Accessible nodes in TIA Portal V15.1 lists the simulated S7-1500 / ET 200SP with the PLCSIM Virtual Ethernet IP. The MAC address reported is the virtual MAC assigned by PLCSIM Advanced, not the VM's physical NIC MAC.
6. Online connection: double-click the instance in the "Accessible nodes" view → "Go online" succeeds and the TIA Portal shows the simulated CPU in RUN / STOP with the project configuration.

If step 6 fails but step 5 succeeds, the TIA Portal project may have a different IP configured for the CPU than the running instance. Open the project device view, set the CPU's PROFINET interface IP to the PLCSIM Virtual Ethernet IP, recompile (Hardware → Compile), and re-go online.

11. Extended Troubleshooting Matrix