Remote Access for Siemens S7-300 CPU317 via Teleservice Adapter

David Krause12 min read
S7-300SiemensTutorial / How-to
Licensed PE Working through this on a live machine? A Maine-licensed engineer can take it from here — included with IMD hardware, by the hour for everything else. Book an engineer

Overview

Remote access to a Siemens SIMATIC S7-300 CPU 317 lets a vendor or system integrator perform diagnostics, program changes, and firmware updates from a remote location without travelling to the plant. The CPU 317 family (for example 6ES7317-2AK14-0AB0 and 6ES7317-2EK14-0AB0) does not have a built-in WAN interface, so an external communications processor or teleservice gateway is required. This article describes the classic Teleservice Adapter II path (dial-up or leased-line), the modern IP-based path through SINEMA Remote Connect, and the secure configuration steps required for each.

Three fundamental remote-access paths are available on the S7-300 platform:

  1. Remote MPI/PROFIBUS over a dial-up or leased-line modem using the Teleservice Adapter II.
  2. Remote Ethernet (TCP/IP) using a CP 343-1 communications processor combined with a SINEMA Remote Connect client, OpenVPN tunnel, or IPsec gateway.
  3. Remote cellular (UMTS/LTE) using a SCALANCE M industrial router as the WAN front-end, terminated to SINEMA Remote Connect or a customer VPN concentrator.

Each path uses the same STEP 7 / TIA Portal programming interface on the engineering side; the difference is the physical and security layer beneath it.

Prerequisites

Item Specification
PLC SIMATIC S7-300 with CPU 317-2 DP (6ES7317-2AJ10-0AB0 or later) or CPU 317-2 PN/DP (6ES7317-2EK14-0AB0 or later)
Firmware (CPU) ≥ V2.6 for CPU 317-2 DP; ≥ V3.3 for CPU 317-2 PN/DP (firmware updates via SIMATIC Memory Card)
STEP 7 version STEP 7 V5.5 + SP2 (or later) for classic Teleservice; TIA Portal V14+ for SINEMA Remote Connect configuration
Hardware for classic path TS Adapter II (6ES7972-0EA02-0XA0) + standard RS-232 modem or ISDN terminal adapter
Hardware for IP path CP 343-1 (6GK7343-1EX30-0XE0) or CP 343-1 Advanced, plus SCALANCE S/M router or SINEMA Remote Connect server
Power supply PS 307 5A or PS 305 (24 V DC for TS Adapter II)
Cabling RS-232 null-modem cable to modem; PROFIBUS cable with 9-pin sub-D to TS Adapter II; Ethernet Cat 5e or higher to CP 343-1
Security PG/PC password, CPU read/write protection (Level 1–3), VPN or SINEMA RC for any IP path
Never expose the S7-300 MPI/PROFIBUS or PROFINET interface directly to the public internet. The S7-300 has no firewall and a successful brute-force on the STEP 7 password allows full project download, including program logic, passwords, and HMI tags.

Communication Path Options Compared

Path Physical layer Typical bandwidth Latency Security Best use
TS Adapter II + analog modem PSTN, RS-232 33.6 kbit/s 200–600 ms Dial-back, password Legacy sites without IP infrastructure
TS Adapter II + ISDN ISDN (S0), RS-232 64 kbit/s 50–150 ms Dial-back, password Legacy sites with ISDN still available
CP 343-1 + SINEMA RC Ethernet, TLS 1–100 Mbit/s 20–80 ms TLS 1.2, certificates, ACL Modern brownfield, multi-user remote support
SCALANCE M + cellular LTE/UMTS 7–150 Mbit/s 40–200 ms IPsec, SINEMA RC Machines without fixed-line internet
CP 343-1 + customer VPN Ethernet, IPsec/OpenVPN Site WAN Site WAN Customer policy Sites with corporate VPN concentrator

Option 1 — Classic Teleservice Adapter II (MPI/PROFIBUS over Modem)

The TS Adapter II (Siemens catalog number 6ES7972-0EA02-0XA0) is a DIN-rail-mounted gateway that bridges the PLC's MPI or PROFIBUS interface to an external RS-232 modem. Documentation is published on the Siemens Industry Online Support entry for the TS Adapter II. The adapter powers from 24 V DC, exposes a 9-pin sub-D female connector to the PLC, and a DB-9 male connector to the modem.

Hardware Wiring

  1. Snap the TS Adapter II onto a 35 mm DIN rail next to the S7-300 rack.
  2. Connect the PROFIBUS connector (shipped with the adapter) from the adapter's PLC port to the CPU 317's MPI/DP port.
  3. Wire 24 V DC to terminals L+ and M on the adapter. The RDY LED must light steady green.
  4. Connect a null-modem cable from the adapter's MODEM port to the analog or ISDN modem.
  5. Configure the modem with a fixed DTE rate of 57 600 bit/s, hardware flow control (RTS/CTS) disabled, and 8N1 framing. The TS Adapter II negotiates the line speed automatically.

STEP 7 (V5.5) Configuration

  1. Open SIMATIC Manager > Options > Set PG/PC Interface. Select Remote Service (Teleservice) as the access point.
  2. Open Options > Teleservice > Configure Teleservice.
  3. Add a new Remote Partner: enter the dial-up phone number of the plant's modem, set protocol to TS Adapter II, and assign a partner MPI address that is not used by any local station (for example, MPI 31).
  4. Enable Dial-back (recommended). The TS Adapter II will hang up and call back the engineering station's pre-stored number, which prevents unauthorized access through a compromised modem line.
  5. Set the CPU 317's MPI address to a unique value (default 2) and confirm the maximum MPI address is 31.
  6. Set the bus baud rate to 187.5 kbit/s for the MPI segment, which is the highest rate supported by the TS Adapter II.

Establishing the Connection

  1. From the engineering PG, open Accessible Nodes (Ctrl-A) and the S7-300 will appear in the list once the dial-up handshake completes.
  2. Online functions available: Upload to PG, Download to CPU, Monitor/Modify, CPU operating mode change, and Firmware update.
  3. For project download the CPU must be in STOP; commissioning tests can run in RUN-P.
Total session time is limited by telephone tariffs. A 1 MB STEP 7 project typically takes 4–6 minutes at 33.6 kbit/s modem speed. Increase line baud rate or migrate to an IP-based path if the vendor needs to download full projects frequently.

Option 2 — IP-based Remote Access with CP 343-1 and SINEMA Remote Connect

Newer installations use an Industrial Ethernet CP and a Siemens SINEMA Remote Connect server. SINEMA RC is a VPN management platform (server license 6GK1720-1AH01-0BV0 for the standard edition) that establishes a TLS-encrypted tunnel between the engineering PG and the CP 343-1 without requiring inbound port forwarding in the plant firewall.

Architecture

The engineering PG runs the SINEMA RC client, authenticates against the central SINEMA RC server, and is then mapped to a virtual IP inside the plant subnet. The CP 343-1 at the plant acts as the SINEMA RC OpenVPN client and pulls the tunnel outbound — meaning the plant firewall can keep all WAN ports closed.

CP 343-1 Configuration in STEP 7

  1. Insert the CP 343-1 (6GK7343-1EX30-0XE0 or 6GK7343-1GX31-0XE0 for the Advanced variant) into the S7-300 hardware catalog. Slot 4 is conventional but not required.
  2. Open the CP properties and assign an IP address, subnet mask, and router address that matches the plant network. Default CP firmware is V3.0 or later; firmware is updated using the SIMATIC Automation Tool or by Web firmware loader.
  3. Under PROFINET / Ethernet > Time-of-day synchronization enable NTP if the CPU 317 needs a time-stamped diagnostic buffer.
  4. Enable Security > OpenVPN client (only on the Advanced variant; otherwise use the SCALANCE M/S as the OpenVPN endpoint) and import the OpenVPN configuration profile exported from the SINEMA RC server.
  5. Set the Security > Access protection > PG/PC and HMI access list to allow only the SINEMA RC virtual subnet. Block all other remote IP ranges.

SINEMA Remote Connect Server Configuration

  1. Install SINEMA Remote Connect Server on a hardened Windows Server 2019/2022 VM, or run the appliance image on a SCALANCE SC-600.
  2. Create a Device Group for the plant, then add the CP 343-1 MAC address as a member device.
  3. Upload the device certificate (X.509) issued by the SINEMA RC internal CA to the CP 343-1 using the Web-Based Management page (https://<CP-IP>/).
  4. Create a User Group for the vendor, assign a strong password policy (12+ chars, 90-day rotation), and link it to the plant's device group.
  5. Distribute the OpenVPN client to the engineering PG, plus the user certificate (PKCS#12).

Engineering PG Operation

  1. Start the SINEMA RC client, log in with the issued user certificate.
  2. The client displays the assigned virtual IP (for example 10.55.20.7). All S7 traffic to 10.55.20.1 (CP 343-1 LAN IP) is now tunneled.
  3. Set the PG/PC interface to TCP/IP (Auto); the S7-300 will be discoverable as if you were on the local plant network.

Option 3 — Cellular Remote Access with SCALANCE M

For machines in locations without fixed-line internet, fit a SCALANCE M874-3 or M876-4 cellular router. The SCALANCE M is a 4G/LTE router with an integrated OpenVPN client, IPsec, and a SINEMA RC agent. Configuration is done through the Web-Based Management (https://192.168.0.1) and stored on a removable C-PLUG / KEY-PLUG for secure replacement.

  1. Insert a SIM card with a private APN. Public SIMs are technically possible but expose the modem NAT to the carrier's network.
  2. Enable IPsec > SINEMA RC client and paste the SINEMA RC server URL plus group password.
  3. Connect the SCALANCE M LAN port to the CP 343-1 or to a managed SCALANCE X switch serving the S7-300.
  4. Set the Firewall > Stateful Inspection policy to drop all WAN-initiated traffic. Only the SINEMA RC tunnel is allowed to bring traffic in.

Security Hardening Checklist

Control Configuration Notes
CPU password STEP 7 > CPU > Protection > Password, level 3 (read/write) Required for any remote programming
Know-how protection Block-list of blocks > all OB/FB/FC that contain IP Even with CPU password, blocks are unreadable
Operator panel access Disable unless TP/OP is on site Reduces the remote attack surface
Firewall Stateful, deny inbound from WAN SCALANCE, CP 343-1 Advanced, or customer firewall
VPN TLS 1.2+ or IPsec IKEv2 No PPTP, no L2TP without IPsec
Account management Per-user X.509 + password, MFA optional SINEMA RC supports LDAP/RADIUS
Session log SINEMA RC syslog to SIEM Tracks who connected and which CP was reached
Firmware Latest CP 343-1 firmware (≥ V3.0.14) Closes CVE-2017-12741 / -12742 (DoS, info disclosure)
Physical Lock cabinet, disable USB on engineering PG Blocks local password theft

Verification

  1. From the engineering PG, open STEP 7 > Accessible Nodes. The CPU 317 must appear with its configured MPI/PROFINET address and firmware version.
  2. Online > Diagnostics > Module Information: confirm the diagnostic buffer shows the latest session start and stop with the engineering PG's user name.
  3. From a second vendor account on the SINEMA RC server, attempt to reach the plant and confirm the access-control list (ACL) denies the connection.
  4. Penetration test from the public internet: port 102 (ISO-TSAP), 500 (IKE), 1723 (PPTP) must be unreachable. Run nmap -Pn -p 102,443,500,1723 <public-IP>.
  5. Functional test: force a fault (for example, remove a PROFIBUS connector) and verify the engineering PG can read the diagnostic buffer in real time over the remote link.

Troubleshooting Matrix

Symptom Likely cause Action
TS Adapter II RDY LED flashing red 24 V missing or MPI cable fault Check L+/M polarity; verify PLC port LED; replace PROFIBUS cable
Modem handshake fails after 30 s Modem DTE rate mismatch or missing AT commands Set modem to 57 600 bit/s, 8N1, no flow control; reset to factory defaults
PG finds CPU 317 but cannot go online CPU password unknown or level 3 protection active Read password from the offline project; enter at the prompt; verify the operator does not have the same level access
SINEMA RC client shows "Tunnel up" but no CPU visible CP 343-1 ACL blocks the virtual IP Open CP Web-Based Management > Security > Access list > add SINEMA RC subnet
SCALANCE M signal LED yellow (RSSI < -95 dBm) Antenna alignment or SIM APN issue Re-aim external antenna; check RSSI in Web UI; switch to a higher-gain antenna
Latency > 500 ms, online functions time out Satellite or congested cellular link Reduce PG online update rate to 2 s; enable S7 compression in STEP 7 settings
CPU 317 reports SF (system fault) after remote download Incompatible firmware or memory reset Check diagnostic buffer event ID W#16#0131 / 0132; reload project from PG

Remote Desktop as a Supplementary Tool

In some architectures the engineering PG itself is located in the plant, and the vendor connects to the PG first. In that case, an out-of-band remote-desktop session is sufficient. Two mainstream options are:

Remote-desktop access still requires the S7 path to be reachable from the engineering PG. Use a VPN for that hop — never expose STEP 7 / TIA Portal directly to the internet.

Choosing the Right Architecture

Use the TS Adapter II path when the site has no IP infrastructure, no IT support, and the project does not exceed a few hundred KB. Use the SINEMA Remote Connect path for new installations, multi-vendor support, and any site that needs certificate-based, auditable access. Use the SCALANCE M cellular path for skid-mounted machines, mobile equipment, or remote pump stations. For multi-vendor, multi-site fleets, combine SINEMA RC with a SCALANCE M edge and centralize firewall rules on the SINEMA RC server.

Whichever path is selected, never disable CPU protection. The S7-300 has no revocation list for compromised passwords; once an attacker has the STEP 7 project password, they own the controller.

Which Siemens hardware lets me remote-access a CPU 317 over the internet?

The supported IP path is a CP 343-1 Advanced (6GK7343-1GX31-0XE0) or any CP 343-1 paired with a SCALANCE S/M router acting as the OpenVPN / IPsec endpoint, managed by a SINEMA Remote Connect server. Direct exposure of the S7-300 port 102 to the internet is not supported and must never be done.

Is the Teleservice Adapter II still available for new installations?

Yes, the TS Adapter II is in maintenance status under article number 6ES7972-0EA02-0XA0. Siemens recommends migrating to SINEMA Remote Connect for new projects, but the adapter remains supported for existing sites that still use dial-up or ISDN.

Can I use a standard 4G router (consumer-grade) instead of a SCALANCE M?

Technically yes, but consumer routers typically lack DIN-rail mounting, 24 V DC power, hardened firewall rules, and C-PLUG security. For industrial control, use a SCALANCE M or an equivalent industrial router that supports SINEMA RC, IPsec, and a stateful firewall.

What is the maximum MPI baud rate over the TS Adapter II?

The TS Adapter II supports MPI/PROFIBUS up to 1.5 Mbit/s, but the modem-side line rate (33.6 kbit/s analog, 64 kbit/s ISDN) is the actual bottleneck. For routine online monitoring 187.5 kbit/s is the most reliable plant-side setting.

How do I reset the CPU 317 password if I lose it?

There is no back door. You must perform a factory reset (MRES) which erases the user program and password. The offline STEP 7 project is the only recovery path — keep a current backup on a SIMATIC Memory Card and in version control.

David KrauseIndustrial Controls Specialist – Siemens Platforms

Industrial controls specialist focused on Siemens SIMATIC S7 platform, from the S7-300/400 series through the latest S7-1200/1500 controllers. Expert in TIA Portal configuration and WinCC SCADA integration.

Planning your next automation project? Explore IMD panel PCs and touch monitors.

Back to blog

Related Articles

S7-300 Encoder Pulse Timing: Measure Period with OB40 Counters
18 min read
S7-300Siemens
More on this topic: S7-300Siemens

Latest Knowledge Base Articles