Resolving S7-1200 Ethernet Connection Failures in TIA Portal

Problem Overview: S7-1200 Not Discoverable in TIA Portal

When an S7-1200 CPU is connected to the engineering station's Ethernet adapter and the PLC does not appear under "Accessible devices" in TIA Portal, the failure almost always traces to one of three layers:

1. Physical/link layer (cable, switch port, link LED, duplex mismatch)
2. IP/subnet layer (PG/PC interface selection, IP address, subnet mask, gateway)
3. Application/security layer (Windows firewall, S7-1200 protection, wrong port blocked, TIA Portal project offline/online mismatch)

Symptoms typically reported:

• "Accessible nodes" or "Online & Diagnostics" returns an empty list, even though ping to the CPU's IP succeeds from the same adapter.
• Only one network shows in the PG/PC interface selection drop-down, regardless of how many NICs are installed.
• CPU link LED is on, but TIA Portal reports "No device found" or "The device is not responding."

Root Cause Analysis

The S7-1200 PROFINET interface uses TCP/UDP on a fixed set of well-known ports defined in the SIMATIC S7-1200 manual collection. If the engineering PC's Windows Firewall (or a corporate endpoint protection product) blocks those ports, TIA Portal cannot complete the S7 handshake even though ICMP echo (ping) is allowed.

Reference: Communication protocols and ports used by Ethernet communication.

The most common root causes seen in field service:

1. Wrong PG/PC interface selected. TIA Portal must be bound to the physical NIC connected to the S7-1200's PROFINET port, not the Wi-Fi adapter or a virtual Hyper-V/VPN interface.
2. CPU IP address not in the same subnet. S7-1200 default IP is 0.0.0.0 (unconfigured) until you set it via TIA, the CPU's display (S7-1200 V4+), or a DHCP server on the network.
3. Windows Defender Firewall private/public profile. TIA Portal must be permitted on the active profile. Disabling the firewall entirely is not required and is not recommended on production networks.
4. Project vs. real CPU IP mismatch. If the offline project in TIA was configured for a different IP than the actual CPU, "Go online" will fail with "The IP address of the configured device does not match the IP address of the accessible device."
5. CPU access protection enabled. From TIA V15.1 onward, the CPU's "Connection mechanisms" can be set to "Allow only PUT/GET" or fully protected, which blocks PG read/write.

Prerequisites Before Troubleshooting

• Windows 10/11 with TIA Portal V15.1 or later (V17 / V18 recommended for current S7-1200 firmware 4.6.x).
• PG/PC Ethernet adapter confirmed functional (ipconfig /all shows link up, no media disconnected state).
• Direct Ethernet cable (Cat 5e or better) or a managed switch. Avoid daisy-chaining through unmanaged consumer routers during commissioning.
• S7-1200 CPU with known MAC address (printed on the front label, format 00-0E-8C-xx-xx-xx, or visible via display menu "PLC > Information > Identification").
• Administrative rights on the engineering PC to modify firewall rules and PG/PC interface settings.

Step-by-Step Resolution Procedure

Step 1: Validate the Physical Connection

1. Connect a Cat 5e/6 patch cable between the PC's Ethernet port and the S7-1200's PROFINET (X1) port.
2. Observe the CPU's LK1/LK2 LEDs. Solid green = link up. Flashing = traffic.
3. From an elevated command prompt on the PC, run ping 192.168.0.1 (or whatever IP is configured on the CPU). If ping fails, the IP is wrong; ping is not required for TIA discovery, but it isolates Layer 1/3 issues quickly.

Step 2: Assign the PG/PC Interface

1. Open TIA Portal → Online → Online & Diagnostics.
2. In the project tree, select the project, then choose Project view → Online → Accessible devices.
3. Click the PG/PC interface drop-down. If only one network is listed, Windows is reporting only one active NIC. Verify with ncpa.cpl and disable any virtual adapters (Hyper-V, VirtualBox, VPN TAP, VMware) you are not using.
4. Select the physical Intel/Realtek/Broadcom Ethernet adapter. DO NOT select any adapter whose description contains "Virtual", "TAP", or "Hyper-V Virtual Ethernet Adapter".

Step 3: Discover the S7-1200 and Assign an IP

1. In TIA Portal: Online → Accessible devices → Project with target device unknown.
2. Click Start search. The PROFINET DCP discovery uses UDP/34964 and will list every S7 device on the broadcast domain along with its MAC, IP, and device name.
3. Select the discovered S7-1200 (identified by MAC address label) and click Show to flash the CPU's LED. This is the most reliable confirmation that you are targeting the correct hardware.
4. If the device appears with IP 0.0.0.0, click Online & Diagnostics → Assign IP address, enter an IP in the same subnet as your PC (e.g. PC 192.168.0.10/24, CPU 192.168.0.1/24), and apply.

Step 4: Configure Windows Firewall Correctly

Disabling the firewall entirely is a workaround, not a fix. Configure an inbound rule that allows the Siemens application suite instead.

1. Open Windows Defender Firewall with Advanced Security (wf.msc).
2. Inbound Rules → New Rule → Program → browse to C:\Program Files\Siemens\Automation\Portal V18\bin\Siemens.Automation.Portal.exe (path varies by TIA version).
3. Allow the connection, check Domain, Private, and Public (the latter only on isolated commissioning networks).
4. Repeat for S7WNDASx.exe and any Siemens.TIA.* service executable used by the discovery service.
5. If third-party endpoint protection is installed (Symantec Endpoint Protection, McAfee, CrowdStrike, etc.), add the same executables to its application allow-list. Siemens S7-1200 discovery will silently fail if a third-party product strips broadcast UDP/34964 frames.

Step 5: Match the Project IP and Go Online

1. Open the device configuration in the TIA project. Double-click PROFINET interface [X1].
2. Under Ethernet addresses, set the IP address to the actual CPU IP, not the offline default.
3. Compile the project (Project → Compile → All) so the device description in the project matches the physical target.
4. Right-click the device → Go online. Select PN/IE as the type and the correct PG/PC interface.

Step 6: Validate CPU Access Protection

On S7-1200 firmware V4.4 and later, the CPU ships with full access protection enabled. To commission from TIA:

1. Connect with the CPU's display (S7-1200 V4+) or the TIA Online & Diagnostics → Security → Connection mechanisms panel.
2. Select Permit access with PUT/GET communication from remote partner if the project will use PUT/GET.
3. Enter the configured password. Without it, "Go online" returns "Access to the device is denied".

Verification Checklist

Network Topology Reference

The diagram below shows the recommended commissioning topology. A direct PC-to-CPU link (point-to-point, no switch) eliminates spanning-tree, IGMP, and DHCP variables.

Protocol Stack: What TIA Actually Sends

When you click "Start search", TIA Portal emits a PROFINET DCP "IdentifyAll" multicast on the local subnet. The S7-1200 replies with its station name, MAC, and IP via UDP/34964. After you select the device and click "Go online", TIA opens an ISO-on-TCP connection on TCP/102 to the CPU and runs an S7Comm "Setup Communication" exchange. If TCP/102 is filtered, TIA reports the device in the search list (UDP discovery worked) but cannot go online (TCP/102 blocked). This split behavior is the diagnostic signature of a firewall problem.

Field-Proven Diagnostic Matrix

EtherNet/IP Adapter Mode

If the S7-1200 has been configured as an EtherNet/IP adapter (firmware V4.2+ with the EtherNet/IP adapter option enabled), it is still a PROFINET device for TIA programming. The EtherNet/IP adapter functionality is documented in the EtherNet/IP Adapter for SIMATIC manual. Programming traffic still flows over TCP/102 and UDP/34964; the EtherNet/IP CIP connection uses TCP/44818 and UDP/2222 in parallel and does not interfere with PG online.

Factory Reset and Recovery

If the CPU's IP and password are unknown:

1. Power off the CPU.
2. Insert a SIMATIC memory card with a project containing the desired configuration, or
3. Perform a factory reset from the CPU display (S7-1200 V4+): Settings → Reset → Factory settings. This clears the IP and the access password.
4. On S7-1200 V2/V3 without a display, a factory reset requires an empty SIMATIC memory card inserted at power-up, or use TIA's Online & Diagnostics → Reset to factory settings.

Safety and Operational Notes

When commissioning, follow IEC 61131-3 and IEC 61784 for industrial network segregation. The PROFINET commissioning guideline (PROFINET installation guideline document on profibus.com) recommends a dedicated VLAN or physical isolation between OT and IT traffic.