Remote Accessing S7-300 and S7-300 / S7-200: Engineering Reference

Remote service for SIMATIC S7-300 stations (CPU 314, CPU 315-2DP) and S7-200 stations (CPU 226) over hundreds of kilometers is a routine field requirement. This reference consolidates the three industrial-grade access topologies: site-to-site VPN, cellular (GPRS/3G/EDGE) gateway, and ISDN/analog TeleService. It also resolves the recurring CP343-1 Lean vs. CP343-1 IT selection, defines the S7-200 Ethernet bring-up path, and gives the S7 connection configuration parameters required to program both sides of the link.

1. Network Topology Overview

Three topologies meet the requirement. Selection is driven by the on-site Ethernet capability of each CPU, the customer's existing WAN infrastructure, and the acceptable OPEX (recurring SIM/data costs) versus CAPEX (router hardware).

2. Option 1 — Site VPN with Static Public IP (Recommended Default)

2.1 Hardware Prerequisites

• S7-300 CPU 315-2DP: already has an MPI/DP interface; add CP 343-1 Lean or CP 343-1 IT for Ethernet. The CPU 315-2DP does not embed PROFINET.
• S7-300 CPU 314 (6ES7 314-1AG14-0AB0 and similar): no integrated Ethernet, requires CP 343-1 Lean (6GK7 343-1CX10-0XE0) minimum.
• S7-200 CPU 226 (6ES7 216-2AD23-0XB0): no integrated Ethernet. Add CP 243-1 IT (6GK7 243-1GX00-0XE0) or CP 243-1 (6GK7 243-1EX00-0XE0) Ethernet module.
• Industrial 5-port unmanaged switch (e.g., Westermo SDW-550 or equivalent DIN-rail switch).
• Customer firewall / SOHO router capable of site-to-site IPsec or OpenVPN.
• Static public IPv4 address (or a DynDNS hostname pointing at a near-static IP).

2.2 IP Addressing Plan

2.3 Firewall / Port Forwarding

The customer router must forward TCP 102 (ISO-on-TCP / RFC 1006) to the engineering VLAN. Siemens S7 communication uses ISO Transport over TCP port 102 exclusively.

• TCP 102 — S7 communication (STEP 7 ↔ PLC, HMI ↔ PLC, S7 PUT/GET).
• UDP 161/162 — optional, only if SNMP-based network management is in use.
• TCP 500, UDP 500, UDP 4500 (IPsec NAT-T) — required for the IPsec tunnel to the engineering office.

2.4 STEP 7 (TIA Portal / STEP 7 V5.x) Configuration

1. Open the project in STEP 7 (or TIA Portal).
2. In HW Config, double-click the CP 343-1 and assign the IP address from the table above. Set the subnet mask and router address.
3. In NetPro, create an S7 connection for each remote CPU. The S7 connection is configured on both sides (client and server) — see Siemens application note "S7 Communication over Industrial Ethernet".
4. Set the partner IP to the public (WAN) address of the remote site for the engineering interface, or to the LAN address of the target PLC if accessing from inside the same routed domain.
5. Download the hardware configuration to the CP 343-1.

3. Option 2 — Cellular (GPRS / 3G / EDGE) Gateway

Use this topology when the customer has no wired internet at the machine site (rural plant, mobile skid, or shared building without IT infrastructure). A rugged industrial cellular router with Ethernet LAN bridges into the CP 343-1 and the CP 243-1 (on the S7-200).

3.1 Hardware Selection

3.2 Engineering-Office End

The engineering office must run a VPN concentrator (a second router, a software endpoint such as OpenVPN Access Server, or the firewall's built-in IPsec server). The cellular router initiates the IPsec tunnel outbound to the concentrator, which means no inbound public IP is needed at either end and the firewall posture is the same as Option 1 from the inside.

3.3 Bandwidth and Latency Notes

• GPRS typical downlink: 30-50 kbit/s; EDGE: 100-200 kbit/s; HSPA: 1-5 Mbit/s.
• S7-300 online services over TCP 102 function reliably on EDGE and above. GPRS is acceptable for short PUT/GET data blocks (≤ 200 bytes) and for STEP 7 online diagnostics, but program download over GPRS is not recommended.
• Add an IP-filter on the cellular router to drop unsolicited inbound traffic; allow only the IPsec UDP 500 / UDP 4500 and ICMP to the engineering peer.

4. Option 3 — TeleService (TS Adapter / TS Module)

SIMATIC TeleService predates the wide availability of broadband internet and remains a valid option where the customer cannot or will not expose Ethernet, or where the existing CPU has no CP module.

4.1 Components

• TS Adapter II (6ES7 972-0CA00-0XA0) — for S7-300 stations on MPI/PROFIBUS.
• TS Module for S7-200 (6ES7 240-1AA00) — connects to the PPI/MPI port of the CPU 226.
• Modem — ISDN terminal adapter (most common in EU installations) or analog PSTN modem. The TS Adapter supports both ISDN and analog interfaces; the TS Module for S7-200 supports analog only.

4.2 Configuration

1. Install the TeleService software component (add-on to STEP 7 V5.x).
2. Create a TeleService object in the project; assign the phone number of the engineering office and the callback number of the customer site.
3. Configure the TS Adapter via its integrated web interface: set MPI address, MPI baud rate (default 187.5 kbit/s), and the dial-in parameters.
4. From the engineering office, the engineer dials in; the TS Adapter auto-answers and bridges the call to the S7-300 MPI bus.

5. CP 343-1 Lean vs. CP 343-1 IT — Decision Matrix

This is the most common selection question for S7-300 Ethernet. Both modules are physically similar and plug into the S7-300 backplane. The decision is driven by the protocols the application requires.

Selection rule for this customer: If the requirement is only S7 communication and STEP 7 remote access, the CP 343-1 Lean is sufficient and lower cost. The CP 343-1 IT adds value when the customer wants the S7-300 to send e-mail on alarm, host a small diagnostic web page, or push archive files by FTP — features that materially improve 24/7 serviceability.

6. S7-200 Ethernet Bring-Up

The S7-200 CPU 226 does not have an integrated Ethernet port. The CP 243-1 (or CP 243-1 IT) is required. The CP 243-1 IT is the more capable variant; the CP 243-1 is the basic S7-communication module.

6.1 S7-200 + CP 243-1 IT Configuration with STEP 7-Micro/WIN

1. In STEP 7-Micro/WIN, open the Ethernet Wizard.
2. Select module position (slot 0 of the S7-200 expansion bus).
3. Assign the IP address 192.168.10.21, mask 255.255.255.0, gateway 192.168.10.1.
4. Configure the number of S7 connections (max 8 for CP 243-1, max 16 for CP 243-1 IT). Each connection is either a client (PUT/GET initiated by the S7-200) or a server (partner initiates).
5. Select the connection to TSAP (Transport Service Access Point) partner; this is the same hex TSAP used by the S7-300 NetPro S7 connection.
6. Generate the program blocks the wizard creates (ETHx_CTRL, ETHx_CFG) and download them with the project.

PG connection mode is supported; STEP 7-Micro/WIN can program the S7-200 across the Ethernet by using the CP 243-1 as the PG interface. See the S7-200 device communication parameters reference for connection and TSAP mapping.

7. S7 Connection Configuration (Client ↔ Server)

An S7 connection is configured on both partners; the parameters on both sides must match exactly or the connection refuses to come up.

7.1 Parameter Mapping (CPU 315-2DP client → CPU 226 / CP 243-1 server)

For a CPU 226, the default TSAP is 03.00. The S7-300 side is configured as the active partner; the S7-200 side is passive. Both sides must reference the same rack/slot TSAPs. Refer to the Siemens S7 Communication over Industrial Ethernet application note for the complete TSAP rules and the PUT/GET block parameter layout.

8. PG Mode for Online Access

For STEP 7 V5.x and STEP 7-Micro/WIN to program the PLCs over the remote link, the engineering PG needs a route to the public IP (or VPN virtual IP) of the customer site. The route is automatic if the engineering office is the IPsec peer.

1. In STEP 7, choose Options → Set PG/PC Interface; select TCP/IP with the office's Ethernet adapter.
2. Use Accessible Nodes to scan; the three S7-300 stations and the S7-200 (via CP 243-1) should appear in the list.
3. Double-click to open online; the same diagnostics view is available as on-site.

9. Commissioning and Verification

After installing the hardware, perform the following sequence before declaring the link in service.

1. Layer 1/2 check: link LEDs on switch, CP 343-1, CP 243-1, and router. Pings between the PG, the office firewall, and the LAN side of the customer router succeed.
2. IPsec tunnel up: on the customer router's status page, confirm the tunnel is established and the negotiated SA lifetime is non-zero.
3. PG online scan: all four PLCs appear in Accessible Nodes.
4. S7 connection status: in NetPro, right-click the S7 connection and check status. A green check indicates the connection is established; a red X with diagnostic buffer entry 0x4A, 0x4B, or 0x4C indicates a parameter mismatch (TSAP / IP), a connection refused, or a partner unreachable.
5. PUT/GET smoke test: from the S7-300 trigger a small block PUT to the S7-200 and verify the data on the S7-200 side using a status table in Micro/WIN.
6. Latency check: ping the remote PLC 100 times; median should be under 100 ms on a VPN, under 500 ms on EDGE.
7. Failover test: disconnect the WAN link and confirm the engineering office is notified (e.g., via a watchdog e-mail from the CP 343-1 IT).

10. Troubleshooting Matrix

11. Security Hardening Checklist

• Restrict the IPsec peer list to the engineering office's static IP; reject dynamic peers.
• Enable the S7 CP's "Access protection" (password / CPU protect) on every S7-300 and the S7-200.
• Disable the S7-200's PPI/MPI port if remote access is the only path (CP 243-1 keeps the bus active via Ethernet).
• Set the cellular router to firewall-off all inbound ports; allow only IPsec.
• Rotate the STEP 7 project password at every service contract renewal.
• Log every engineering access (VPN concentrator log + STEP 7 audit trail if enabled).

12. FAQ