Remote Access to S7-300 PLC via CP 343-1 Lean: VPN Setup

Overview

Remote access to a Siemens SIMATIC S7-300 station equipped with a CPU 313C-2DP and a CP 343-1 Lean communication processor is a common requirement for international support, predictive maintenance, and on-call service. The reference architecture is a factory LAN behind an industrial firewall/VPN gateway, accessed from a service PC over the public internet using IPsec or OpenVPN tunnels. Direct exposure of the CP 343-1 Lean to the internet is not supported by Siemens and violates the device's intended use; the documented path is to terminate the VPN on a security appliance such as SCALANCE S (e.g. S615, S623, SC632, SC636) or the SINEMA Remote Connect server.

This article consolidates the engineering decisions, hardware catalog numbers, IP planning, and verification steps required to put a maintenance engineer on the plant network from a home office, hotel, or customer site. It targets STEP 7 V5.5 / V5.6 (classic) and TIA Portal V16+ environments.

Prerequisites

1. PLC hardware (reference configuration):
   • CPU 313C-2DP, e.g. 6ES7313-6CE00-0AB0 (firmware V3.3) or earlier 6ES7313-5BG04-0AB0 (V2.6). Both expose one MPI/DP interface on the X2 connector; PROFINET is on the CP, not the CPU.
   • CP 343-1 Lean, e.g. 6GK7343-1CX10-0XE0 (Firmware V3.0) or the original 6GK7343-1CX00-0XE0 (V2.x). The Lean variant has 1× RJ45 10/100 Mbit, no Gigabit, no ISO/TCP routing.
   • 24 VDC power supply (PS 305 or PS 307) and a properly grounded DIN-rail installation per S7-300 Automation System Manual.
2. Network infrastructure:
   • Industrial Ethernet switch (e.g. SCALANCE XC-206, 6GK5206-0BA10-2AA3) in the control cabinet.
   • Security appliance: SCALANCE S615 (6GK5615-0AA00-2AA0) for small sites, or SCALANCE SC636 (6GK5636-2BA00-2AA0) for cellular/wired redundancy. Both support IPsec and OpenVPN as of firmware V6.3.
   • ISP router with a fixed public IPv4 address, a DynDNS account (No-IP, dyndns.org) or a 4G/5G router with a static SIM APN.
3. Engineering software on the remote PC:
   • STEP 7 V5.5 + SP4 (or V5.6) for classic S7-300 commissioning.
   • TIA Portal V16 / V17 / V18 if the project is portal-based.
   • SINEC NMS V1.0 SP3 or higher for centralized SCALANCE management (optional).
4. Firewall and policy: Written authorization from the plant owner, change-management ticket, and a defined maintenance window. The maintenance VLAN must be isolated from the corporate office network by an L3 boundary.

Architectural Options

There are three production-grade paths to access the S7-300 from outside the plant. Each has different cost, complexity, and security profiles.

IP Planning and VLAN Segmentation

Before commissioning, freeze the IP plan. The CP 343-1 Lean default IP out-of-the-box is 0.0.0.0 (DHCP disabled). Plan three subnets:

• Plant automation LAN: 192.168.10.0/24 — CP 343-1 Lean = 192.168.10.10, SCALANCE inside interface = 192.168.10.1.
• DMZ (optional): 192.168.20.0/24 — SCALANCE outside interface = 192.168.20.1, ISP router = 192.168.20.254.
• Remote engineer tunnel pool: 10.8.0.0/24 — assigned by SCALANCE OpenVPN DHCP or by the SINEMA RC server.

Add the CP 343-1 Lean to the STEP 7 hardware configuration. In NetPro (STEP 7 V5.5) or Devices & Networks (TIA Portal), create an S7 connection with:

• Local TSAP: 01.01 (default for S7-300 stations)
• Partner TSAP: 03.02 or 03.0x matching the target CPU slot
• Connection type: S7 connection (ISO on TCP)

Step-by-Step: SCALANCE S615 IPsec VPN Configuration

1. Initial access to the SCALANCE. Connect a service PC to the inside port of the S615 (192.168.10.1/24 default). Browse to https://192.168.10.1. Accept the self-signed certificate. The default user is admin with password admin — change this immediately under System > Passwords.
2. Set the IP plan. Layer 3 > Subnets: define the inside VLAN (192.168.10.0/24) and the outside interface. Disable any unused services (Telnet, HTTP) and keep HTTPS, SSH, and SNMPv3 only.
3. Configure the WAN interface. If the ISP provides a static public IP, set the outside port to static mode. If dynamic, register a DynDNS host (e.g. plc-yourcompany.dyndns.org) on the SCALANCE under System > DNS.
4. Build the IPsec tunnel. Security > IPsec > Phase 1 / Phase 2:
   • Phase 1: IKEv2, AES-256, SHA-256, DH group 14, lifetime 28800 s.
   • Phase 2: ESP tunnel, AES-256-GCM, PFS group 14, lifetime 3600 s.
   • Authentication: RSA certificates issued by an internal CA. Avoid pre-shared keys longer than 30 days.
5. Define firewall rules. Allow UDP 500/4500 (IKE/NAT-T) and ESP protocol 50 from the remote peer. Reject all other inbound traffic. Outbound: allow the inside LAN to reach only the remote tunnel IP pool.
6. Import certificates. On the SCALANCE: Security > Certificates, load the device certificate (sc615.cer) and the CA chain. On the remote PC, install the matching .pfx in the Windows certificate store under Computer > Personal.
7. Build the Windows client. Use the SINEMA RC Client (download from Siemens Support, entry ID 109749990) or a native Windows 10/11 IKEv2 connection. The remote PC terminates the tunnel at the SCALANCE public IP / DNS name and receives an IP from the 10.8.0.0/24 pool.
8. Add a static route on the remote PC. route add 192.168.10.0 mask 255.255.255.0 10.8.0.1 so STEP 7 reaches the CP through the tunnel, not the default gateway.
9. Configure STEP 7. In Set PG/PC Interface, select S7ONLINE > TCP/IP (Auto) > Virtual Ethernet adapter. In Accessible Nodes, the CP should appear as 192.168.10.10. Open the project, download the hardware, and go online.

Alternative: SINEMA Remote Connect

For OEM service organizations servicing many customer sites, Siemens recommends the SINEMA Remote Connect server (Entry ID 109749990). The server acts as a broker: the remote engineer authenticates once, the server opens the IPsec tunnel to the specific SCALANCE on the customer site based on policy, and disconnects when the session ends. No inbound ports on the customer firewall need to be opened, which dramatically simplifies audit and change management.

Topology in this case:

Remote PC (SINEMA RC Client)
        │
        ▼  TLS / OpenVPN
SINEMA Remote Connect Server (on-prem or AWS)
        │
        ▼  IPsec
SCALANCE S615 (customer site) ── CP 343-1 Lean ── S7-300 CPU 313C-2DP

Alternative: Jump Host with RDP / VNC

If a service PC inside the plant already has STEP 7 installed, the lowest-cost solution is a VPN to that PC and remote desktop. Two practical caveats:

• Disable Windows hibernation and configure the PC BIOS to recover from power loss.
• Run TightVNC (5900/TCP) or RDP (3389/TCP) over the same IPsec tunnel, never directly on the public interface.

Configuration Parameters (Reference Table)

Verification

1. Tunnel up. From the remote PC, ping the SCALANCE inside IP 192.168.10.1. A reply confirms Phase 2 SA is established.
2. CP reachable. Ping 192.168.10.10. ICMP is normally permitted on the SCALANCE inside interface; if not, enable it under Security > Firewall > ICMP.
3. STEP 7 online. In SIMATIC Manager, PLC > Accessible Nodes. The CP 343-1 Lean should appear with its MAC address. A double-click establishes the S7 connection and brings up the online view of the CPU 313C-2DP.
4. Test upload/download. Upload the hardware configuration to the remote PC and compare it against the offline project. A clean match confirms bidirectional S7 communication on TSAP 01.01.
5. Read diagnostics. Open PLC > Diagnostics/Settings > Module Information on the CP. Check that the Connection Diagnostics tab shows the active S7 connection with zero errors and that the CP firmware is at the expected version.
6. Latency check. From a PowerShell prompt, Test-NetConnection 192.168.10.10 -Port 102 should return TcpTestSucceeded: True with RTT < 250 ms for a healthy transatlantic link. Latency above 500 ms will cause STEP 7 to time out during a full program download — switch to a delta download or increase the STEP 7 timeout under Options > Settings > PG/PC.

Troubleshooting Matrix

Security Checklist

• ✓ Disable the CP 343-1 Lean web server if not needed: Properties > Web > Enable Web Server = No. Older firmwares expose diagnostic HTML pages that bypass STEP 7 password protection.
• ✓ Set the S7 CPU protection level to Write protection or Read/write protection with password under CPU > Protection. Never leave the CPU in No protection with a remote VPN open.
• ✓ Rotate the STEP 7 project password every 90 days. Store the SHA-256 hash in a managed password vault.
• ✓ Enable security logging on the SCALANCE (System > Syslog > Remote Server) and forward to a SIEM. Tune the rule set to alert on repeated IKE_AUTH failures.
• ✓ Apply Siemens security advisories: subscribe to Siemens CERT feeds. CP 343-1 Lean advisories include SSA-892412 (denial of service via crafted S7 packets) — affected versions are V2.x prior to V2.6.7.
• ✓ Define a maximum session duration on the SCALANCE (e.g. 4 hours) so forgotten tunnels terminate automatically.

Field-Proven Caveats

• NAT traversal requires UDP 4500. If the ISP router performs carrier-grade NAT (CGNAT), the SCALANCE will see a private address and the tunnel will fail. Order a static public IP from the ISP or move to a 4G/5G cellular router with a public SIM.
• CP 343-1 Lean does not route. The Lean variant has no integrated router. If the maintenance VLAN is on a different subnet from the CP (for example, 192.168.10.0/24 PLC vs. 192.168.30.0/24 SCADA server), a Layer-3 switch or SCALANCE routing function is required.
• IPv6 considerations. Newer SCALANCE firmware (V6.4+) prefers IPv6 IKE. If the remote PC only has IPv4, force the SCALANCE to IPv4 only in the IPsec phase 1 settings.
• Cellular fallback. For unmanned sites, pair the SCALANCE S615 with the SCALANCE MUM856 (5G router). The SCALANCE supports cellular as a fallback WAN; OpenVPN remains the simplest client on the remote side.