Remotely Enable/Disable SCALANCE Ports from S7-1500 via SNMP

Overview

When a tool or machine mode in an S7-1500 program changes, the controller must be able to enable or disable specific Ethernet ports on a downstream SCALANCE managed switch without operator intervention. The PLC cannot reach the SCALANCE Web Based Management (WBM) page, and it cannot call the STEP 7 topology editor at runtime, so the only viable field-level path is SNMP. This reference explains how to send an SNMP SET to the ifAdminStatus object in the standard IF-MIB (RFC 2863) from an S7-1500 using the freely available Siemens S7-1500 SNMP library.

It covers the supported SCALANCE families, the exact OIDs and values, library installation in TIA Portal, SCL code for SET operations, verification procedures, and the typical error matrix you will see during commissioning. The same procedure applies to SCALANCE S615 security modules and SCALANCE M-800 industrial routers where a switch port must be brought down or up based on the PLC's program state.

Architecture and Prerequisites

The PLC sits in the same IP subnet as the SCALANCE management interface (or reaches it through a router). The PLC issues an SNMP SET request using UDP port 161 directed at the SCALANCE. The SCALANCE processes the request against the local MIB tree and either brings the port administratively up or administratively down. The change is persistent on the integrated switch, the S615, and the M-800 family, and survives a power cycle on every SCALANCE model that supports it.

Hardware and software prerequisites

• S7-1500 CPU (CPU 1511-1 PN or higher recommended). Firmware V2.0 or later; the SNMP library entry supports TIA Portal V15.1 through V20. CPUs older than firmware V2.0 may not have sufficient work memory or a sufficient number of Open User Communication (OUC) resources.
• TIA Portal V16, V17, V18, V19, or V20 for the corresponding project and library version. The library is delivered as .al16 through .al20; pick the one matching your installed TIA Portal.
• SCALANCE managed switch with SNMP enabled. Unmanaged variants (SCALANCE XB-100, XC-100, XF-100, X-100) do not have an SNMP agent and cannot be controlled programmatically.
• Ethernet connectivity between the S7-1500 PROFINET interface and the SCALANCE management VLAN/interface. SNMP traffic can ride on the same PROFINET network if you keep it inside a separate VLAN or use a dedicated management IP, but in PROFINET IRT networks the SNMP SET may be delayed by the reserved cycle window; for deterministic control use a separate, non-IRT connection for the SNMP path.
• Read/write credentials on the SCALANCE: SNMPv2c community string or SNMPv3 user with auth/priv keys.

Functional topology

Compatible SCALANCE Devices

Only SCALANCE devices with a built-in SNMP agent and full management firmware support ifAdminStatus SET operations. The table below summarizes device family support and notes any caveats. Always confirm the device's firmware release against the SCALANCE firmware release notes for the SNMP service before relying on the SET in production.

SNMP MIB Reference and OID Encoding

The relevant MIB is IF-MIB, defined in RFC 2863 (The Interfaces Group MIB). IF-MIB is a standard Internet MIB implemented by every conformant SCALANCE agent, so the OID for port enable/disable is identical across families. Operations on top of IF-MIB follow RFC 3416 for SNMPv2 PDUs, and security for v3 follows RFC 3414 (USM).

Object OIDs

Value encoding for ifAdminStatus

RFC 2863 lists the full enumeration, but only the values up(1) and down(2) are valid for SET. Writing testing(3) is permitted by the SYNTAX but places the port in a test mode intended for diagnostics; do not use testing(3) in a production control loop. The other values (unknown(4) through lowerLayerDown(7)) are reserved for agent-internal use and must not be SET.

Full OID walk for a 24-port SCALANCE XC-200

For a SCALANCE XC-200 with 24 ports, the SET to disable port 5 uses the OID 1.3.6.1.2.1.2.2.1.7.5 with the INTEGER value 2. Enable the same port by writing 1 to the same OID. The same OID format is used on the S615 (4 LAN ports have ifIndex 1..4) and on the M-800 family, although the WAN interface takes ifIndex 1 and the LAN switch ports start at the next available index; always run the discovery walk before the first commissioning.

Installing the S7-1500 SNMP Library

The SNMP client blocks are provided as a license-free global library in the Siemens Industry Online Support: S7-1500 SNMP library, entry 57249109. The library contains SCL function blocks, user data types, an OID helper, and a small example project. It is delivered without runtime licensing; the blocks count only against your CPU's work memory and OUC resources.

Library contents

Installation steps

1. Download the ZIP from entry 57249109. Pick the variant matching your TIA Portal: .al16 for V16, .al17 for V17, .al18 for V18, .al19 for V19, .al20 for V20.
2. Extract the ZIP to a project-readable folder. The archive contains one global library per TIA Portal version and a documentation PDF.
3. Open TIA Portal. Choose Options > Global libraries > Open library and navigate to the extracted .alXX file.
4. Open the library in the project tree, expand Types > master copies, and drag the FBs and UDTs you need into your project's Program blocks.
5. Compile. Resolve any name conflicts. The library blocks do not require a runtime license, but they do consume one Open User Communication (OUC) connection resource per active SNMP session; for a single SCALANCE in a star topology, one connection is enough.

SCALANCE SNMP Configuration

Before the PLC can SET ifAdminStatus, the SCALANCE must accept SNMP write requests from the PLC's IP. Enable the agent and either configure an SNMPv2c community string or, preferably, an SNMPv3 user with SHA authentication and AES-128 privacy.

WBM configuration path

1. Open WBM with the SCALANCE management IP.
2. Navigate to System > SNMP > General and enable SNMP.
3. For SNMPv3, navigate to System > SNMP > Users and create a user with Authentication = SHA and Privacy = AES-128. Note the user name, auth key, and priv key; the same values go into SnmpUser on the S7-1500.
4. For SNMPv2c, configure a community string under System > SNMP > Communities and limit the rights of that community to Read/Write if you intend to SET. Use a strong community string; the default public is read-only and must not be used for write operations.
5. Under Information > Log Table, ensure SNMP events are logged if you need an audit trail.

TIA Portal configuration

If the SCALANCE is already a PROFINET device in your TIA project, you can configure SNMP in the device properties under Properties > System > SNMP. The same Status > Enabled/Disabled setting under SCALANCE X / W / M > Configuring interfaces > Ethernet > Configuration is what the WBM and the SNMP SET both end up writing; using the TIA path documents the value as the project default and is useful for the initial commissioning state.

Confirming the agent is reachable

From the engineering station or from a separate diagnostic laptop, run an SNMP GET against 1.3.6.1.2.1.1.1.0 (sysDescr) to confirm that the agent responds and that your community / v3 credentials work. Only proceed to the SET step once the GET round-trip is verified.

S7-1500 Program Implementation

The program consists of a single instance DB for the SET FB, a configuration DB that holds the target IP, port, credentials, and the per-tool port table, and a small cyclic routine that evaluates the tool state and triggers a SET when it changes.

Data block layout (DB_SnmpPortControl)

SCL routine: cyclic port control

// Block: OB1 (or OB30 cyclic) - Port control dispatcher
// Purpose: For each tool, if active state changes issue a SET
// Library : S7-1500 SNMP library, entry 57249109

"DB_SnmpPortControl".bBusy  := "DB_SnmpSet".Busy;
"DB_SnmpPortControl".bDone  := "DB_SnmpSet".Done;
"DB_SnmpPortControl".bError := "DB_SnmpSet".Error;
"DB_SnmpPortControl".wErrorStatus := "DB_SnmpSet".Status;

FOR #i := 1 TO "DB_SnmpPortControl".iToolCount DO
    IF ("DB_SnmpPortControl".aPortTable[#i].bToolActive <>
        "DB_SnmpPortControl".aPortTable[#i].bLastState)
       AND NOT "DB_SnmpSet".Busy THEN

        "DB_SnmpSet".Execute := TRUE;
        "DB_SnmpSet".Server.IpAddress := "DB_SnmpPortControl".scSwitchIp;
        "DB_SnmpSet".Server.Port      := 161;
        "DB_SnmpSet".User.Version     := 3;
        "DB_SnmpSet".User.UserName    := "DB_SnmpPortControl".sSnmpUser;
        "DB_SnmpSet".User.AuthProtocol:= "DB_SnmpPortControl".iAuthProto;
        "DB_SnmpSet".User.AuthKey     := "DB_SnmpPortControl".sAuthKey;
        "DB_SnmpSet".User.PrivProtocol:= "DB_SnmpPortControl".iPrivProto;
        "DB_SnmpSet".User.PrivKey     := "DB_SnmpPortControl".sPrivKey;

        // OID = 1.3.6.1.2.1.2.2.1.7.<ifIndex>
        "DB_SnmpSet".Oid[0]  := 1;  // iso
        "DB_SnmpSet".Oid[1]  := 3;  // org
        "DB_SnmpSet".Oid[2]  := 6;  // dod
        "DB_SnmpSet".Oid[3]  := 1;  // internet
        "DB_SnmpSet".Oid[4]  := 2;  // mgmt
        "DB_SnmpSet".Oid[5]  := 1;  // mib-2
        "DB_SnmpSet".Oid[6]  := 2;  // interfaces
        "DB_SnmpSet".Oid[7]  := 2;  // ifTable
        "DB_SnmpSet".Oid[8]  := 1;  // ifEntry
        "DB_SnmpSet".Oid[9]  := 7;  // ifAdminStatus
        "DB_SnmpSet".Oid[10] := "DB_SnmpPortControl".aPortTable[#i].iIfIndex;
        "DB_SnmpSet".OidLength := 11;

        // Value: 1 = up, 2 = down
        IF "DB_SnmpPortControl".aPortTable[#i].bToolActive THEN
            "DB_SnmpSet".Value := 1;
        ELSE
            "DB_SnmpSet".Value := 2;
        END_IF;

        "DB_SnmpSet".Timeout   := T#2s;
        "DB_SnmpSet".RequestId := "DB_SnmpPortControl".dwReqId;
        "DB_SnmpPortControl".dwReqId := "DB_SnmpPortControl".dwReqId + 1;
    END_IF;
END_FOR;

IF "DB_SnmpSet".Done THEN
    IF "DB_SnmpSet".Status = 16#0 THEN
        "DB_SnmpPortControl".aPortTable[#i].bLastState :=
            "DB_SnmpPortControl".aPortTable[#i].bToolActive;
        "DB_SnmpPortControl".aPortTable[#i].bError := FALSE;
    ELSE
        "DB_SnmpPortControl".aPortTable[#i].bError := TRUE;
        "DB_SnmpPortControl".aPortTable[#i].wErrorStatus := "DB_SnmpSet".Status;
    END_IF;
    "DB_SnmpSet".Execute := FALSE;
END_IF;

Reading the result back

After each SET, issue a SnmpGetRequest on the same OID to confirm that the agent actually applied the change. Some agents may return a successful SET PDU but reject the value internally and revert; the GET-back is the only safe verification. The verification GET should be issued in a different OB cycle (for example OB1 with a 2-second slow timer) to avoid blocking the SET dispatcher.

Verification and Commissioning Checks

1. Agent reachable: Run a GET on 1.3.6.1.2.1.1.1.0 (sysDescr) from the same SnmpGetRequest block. Expect a string starting with Siemens, SCALANCE for SCALANCE devices.
2. Port table walk: Run a SnmpGetNextRequest loop on 1.3.6.1.2.1.2.2.1.2 (ifDescr) until endOfMibView is returned. Save the ifIndex-to-port-name mapping to a data block. Confirm the ifIndex numbers match the physical ports of the SCALANCE variant in your cabinet.
3. Test SET in safe state: Pick a port with no active device, write ifAdminStatus = 2 (down) and confirm the port LED extinguishes. Read back with a GET and confirm the integer is 2.
4. Test SET in active state: Plug a known device into the same port, write ifAdminStatus = 1 (up), and confirm that the link comes up within 3-5 seconds. The device's own network stack will perform a re-negotiation; this is normal.
5. Persist across reboot: Power-cycle the SCALANCE (or reload the configuration) and confirm that the last SET value is retained. SCALANCE switches persist ifAdminStatus through reboots because the value is stored in the start-up configuration; the SET is therefore safe to use as a one-time boot action.
6. Inspect ifOperStatus: Read 1.3.6.1.2.1.2.2.1.8.<ifIndex> after the SET to confirm that the operational status matches the administrative status. A mismatch (for example adminStatus=up but operStatus=down) typically indicates a physical-layer fault or that the connected device is not autonegotiating.

Troubleshooting Matrix

Security Considerations

SNMP write access on a managed switch is a powerful control surface. The following hardening rules apply to every deployment that uses this technique.

• Use SNMPv3 with SHA + AES-128 (or stronger). SNMPv1 and v2c send the community string in clear text and are vulnerable to replay and spoofing. The S7-1500 SNMP library supports SHA-256, SHA-384, SHA-512 and AES-192/256 if your SCALANCE firmware supports them; check the SCALANCE firmware release notes for the supported auth/priv list before selecting the algorithm.
• Do not use the default community public for write. The default is read-only on SCALANCE; any custom write community must be a non-guessable string of at least 12 characters.
• Restrict SNMP source IPs. In WBM under System > SNMP > General, configure an SNMP filter that allows only the S7-1500 CPU's IP. Combine with a management VLAN for the SNMP path.
• Do not store keys in plain text inside the project. Use the TIA Portal password protection on the project, and store the keys in a separate access-protected DB if you must keep them in the CPU. Consider deriving the keys from a one-time provisioning step instead of embedding them in the source.
• Audit trail. Enable the SCALANCE log for SNMP writes. The log records the source IP, community/user, OID, and value. Forward the log to a SIEM if the site has one.
• Operator visibility. Do not let the PLC silently re-enable a port that an operator has manually disabled in the WBM. Add a one-way latch: if the WBM disables a port, treat the PLC state as advisory, not authoritative. This is a defence-in-depth pattern, not a protocol-level guarantee.

FAQ