Remote Access to TP700 Comfort Sm@rtServer, VPN, and Mobile

1. Overview: Remote Access Architecture for SIMATIC TP700 Comfort

The SIMATIC TP700 Comfort (6AV2 124-1GC01-0AX0) is a 7-inch widescreen HMI panel from the SIMATIC HMI Comfort family. It integrates an embedded Sm@rtServer that exposes the runtime screen via VNC-derived protocol, enabling remote visualization and operator control from a PC running the Sm@rtClient application, from the Sm@rtClient mobile app, or from any generic VNC viewer that supports port 5900.

The panel supports up to three concurrent Sm@rtClient sessions, so a single TP700 can serve one PC operator, one tablet, and one smartphone simultaneously without license changes. Remote access has two distinct layers:

• Display/control layer – Sm@rtServer inside the panel, Sm@rtClient on PC or Android/iOS.
• Transport layer – LAN, port-forwarded WAN, or routed VPN (OpenVPN, IPsec, Ewon Talk2M).

This reference covers the full commissioning path: enabling the Sm@rtServer in TIA Portal, configuring WinCC Internet Settings on the panel, opening TCP/UDP 5900 in the firewall, and bridging the panel across the internet with either port forwarding or a hardened VPN tunnel.

2. Prerequisites

3. Enabling the Sm@rtServer in TIA Portal V16

1. Open the TIA Portal project that contains the TP700 Comfort device.
2. Select the HMI device in the project tree and open Device Configuration.
3. Navigate to Properties → General → Sm@rtServer.
4. Check "Activate Sm@rtServer". This single flag turns on the embedded VNC-compatible server.
5. Set the port (default 5900). Port 5900 is the IANA-registered VNC display port and must remain open for any third-party VNC viewer to attach.
6. Configure password protection. Always set a strong operator password; without it the panel screen is exposed in clear text once port 5900 is reachable.
7. Optionally enable HTTP/HTTPS web server (separate setting) for read-only HTML page access.
8. Compile the HMI project and download to the TP700 Comfort.

After download, the panel boots with the Sm@rtServer active in the background. The Sm@rtServer is independent of the active runtime – it remains available even when the panel is in transfer mode or showing a system diagnostic screen.

4. Configuring WinCC Internet Settings on the Panel

Once the project is loaded, the panel side needs a small adjustment to the network and authentication layer. From the Start Center:

1. Tap Settings (the gear icon) on the Start Center.
2. Open Control Panel → WinCC Internet Settings (also called "Internet Settings" in the system control).
3. Verify the panel's IP address, subnet mask, and default gateway match the network where the Sm@rtClient will connect.
4. Confirm the Sm@rtServer port (5900) is set as compiled.
5. Set the automatic logoff for idle Sm@rtClient sessions (default 30 min – reduces exposure).
6. Save and reboot the panel if the firmware prompts for it.

The reference Siemens application note "Remote Access to SIMATIC HMI Comfort Panels" (109476153) documents this procedure with screenshots and also covers the HTTP-based web server, which is a different feature and is not required for Sm@rtClient display mirroring.

5. Sm@rtClient for PC – Local and Remote Operation

Sm@rtClient is a thin viewer installed alongside TIA Portal (Start → Siemens Automation → Sm@rtClient) or as a standalone MSI. To start a remote session:

1. Launch Sm@rtClient on the Windows PC.
2. Choose Connection → New Connection.
3. Enter the IP address of the TP700 (LAN: 192.168.0.x; WAN: public IP or DDNS hostname).
4. Leave the port at 5900 unless changed in TIA Portal.
5. Enter the operator password defined in the Sm@rtServer settings.
6. Select the operating mode: View only (read-only mirroring) or Operate (full keyboard, touch, and function-key control).
7. Click Connect. The panel's runtime screen is mirrored in a resizable window, and mouse/keyboard input is forwarded back to the panel.

6. Sm@rtClient Mobile App (Android / iOS)

The Sm@rtClient app is published as "Siemens Sm@rtClient" in the Google Play Store and Apple App Store. Configuration is identical to the PC client:

1. Install Siemens Sm@rtClient from the store.
2. Add a new connection: panel IP/hostname, port 5900, password.
3. Save the connection as a bookmark; the app supports up to 16 bookmarks.
4. Tap the bookmark to start a session. The panel screen is rendered at the device's native resolution; pinch-to-zoom and double-tap are supported.

The mobile app supports portrait and landscape, but on small screens below 5 inches a VNC navigation helper (right-click emulation, scroll wheel) improves usability because TIA Portal HMI screens are designed for 7" or larger panels.

7. Bridging the Panel to the Internet

Reaching the TP700 from outside the local network requires either port forwarding (insecure) or a VPN tunnel (recommended). Both options are covered in the following subsections.

7.1 Port-Forwarded WAN (Quick Test, Not for Production)

The simplest path to validate the end-to-end flow is to open TCP 5900 on the ISP router to the panel's private IP. This is suitable for bench testing only; the VNC protocol has no transport encryption, and credentials travel in clear text.

1. Assign the TP700 a static DHCP lease on the ISP router (e.g. 192.168.1.50).
2. Create a port-forwarding rule: external 5900 → 192.168.1.50:5900, TCP.
3. From a mobile device on 4G/5G, open the Sm@rtClient app and connect to the public IP of the ISP router (retrieve it from a "what is my IP" service).
4. Authenticate with the operator password. The session establishes in 1-3 seconds on a typical LTE link.

7.2 OpenVPN on an ASUS Router (Free, Self-Hosted)

For installations where the customer already owns an ASUS RT-AX or RT-AC router, the MerlinWRT or stock ASUSWRT-Merlin firmware includes an OpenVPN server. This produces a routed tunnel that the Sm@rtClient uses as if it were on the LAN.

1. In the ASUS admin UI, enable VPN → OpenVPN Server. Choose UDP/1194 for best performance.
2. Export the .ovpn client profile and load it into the OpenVPN client on the remote PC or phone (OpenVPN Connect app).
3. Connect the remote device; it receives a 10.8.0.x address and can reach the TP700 at its LAN IP (e.g. 192.168.1.50:5900).
4. If the TP700 and the S7-1214C live on a second LAN behind an additional router, add a static route on the ASUS router so the 10.8.0.0/24 VPN clients can reach the second subnet.

7.3 Ewon Cosy (Industrial-Grade VPN, Recommended for Plant Networks)

The Ewon Cosy 131 (EW50020) is an industrial VPN router designed for remote maintenance of Siemens equipment. It uses the Ewon Talk2M cloud broker, removing the need for static public IPs or DDNS.

1. Mount the Ewon Cosy in the control cabinet and connect its WAN port to the ISP router and its LAN port to the TP700 / S7-1214C.
2. Create a free Talk2M account at talk2m.com and claim the Cosy using its Device ID and Connectivity key (printed on the device label).
3. Define VPN users and their access rights in the Talk2M portal.
4. From the remote PC, run eCatcher (Ewon client) and connect to Talk2M. The PC becomes a virtual host on the plant LAN.
5. Launch Sm@rtClient on the PC and connect to the TP700's LAN IP (e.g. 192.168.1.50:5900) – the traffic is encapsulated in the IPsec tunnel.

The same tunnel also allows TIA Portal online access to the S7-1214C for programming or diagnosis (port 102), which is the typical use case in remote service. No paid service is required for the basic Cosy + Talk2M Free+ tier; a Talk2M Pro subscription is needed only for higher device counts or advanced features like Ewon Flexy with data logging.

8. Commissioning Procedure (End-to-End)

1. Compile and download the HMI project with Sm@rtServer enabled.
2. Verify the panel IP with ping <panel_IP> from a PC on the same VLAN.
3. Run Sm@rtClient locally; confirm a mirrored image appears within 2 seconds.
4. From a phone on Wi-Fi (same VLAN), launch the mobile app and confirm a third concurrent session works (panel supports three).
5. Choose a WAN strategy (port forward, OpenVPN, Ewon). Configure and test from a 4G phone outside the LAN.
6. Document the public hostname, port, and credentials in a controlled location; rotate the Sm@rtServer password quarterly.

9. Verification Checklist

10. Troubleshooting Matrix

11. Security Hardening Recommendations

• Always set a strong operator password (12+ chars, mixed case, digits, symbols) on the Sm@rtServer.
• Do not expose TCP 5900 directly to the public internet. Use a VPN or at minimum restrict the source IP range in the firewall.
• Disable Sm@rtServer when the machine is in a long-term idle state; re-enable only for scheduled remote sessions.
• Pair the Sm@rtServer password with the Comfort Panel user administration so that operator rights on the remote screen match the rights on the physical panel.
• Use the panel's audit trail to record Sm@rtClient logon/logoff events; export the log for compliance reviews.
• For multi-tenant plants, isolate the HMI subnet with a Dedicated VLAN and a stateful firewall between the office and the OT network.

12. Performance Tuning

Remote HMI mirroring is bandwidth-sensitive. A static 7" Comfort screen at full color consumes roughly 200-400 kbit/s of VNC traffic at 10 fps. To keep the link healthy on constrained uplinks:

• Reduce the panel's color depth in the HMI project to 16-bit if visual fidelity allows.
• Set the panel runtime to disable screen savers and animations on the operator pages used for remote viewing; complex animated graphics double the bitrate.
• Configure Sm@rtClient to use 8-bit color and JPEG compression in advanced settings.
• For VPN tunnels, set the MTU to 1400 to avoid fragmentation on PPPoE ISP links.

13. Frequently Asked Questions