Resolving SCALANCE X408-2 Web GUI Access: PST & Port Guide

Problem Details

The SCALANCE X408-2 (Siemens 6GK5 408-2AS00-2AM2 and the 6GK5 408-2AS00-0AM2 variant for the 24 V DC supply range) is a modular, managed Industrial Ethernet switch used on PROFINET and standard Ethernet plant networks. Field engineers frequently report that after first-time power-up they can ping the device, configure an IP address via the Command Line Interface (CLI) through a serial console, or detect the device with the Primary Setup Tool (PST), yet the Web-Based Management (WBM) GUI refuses to load in the browser. Typical symptoms are:

• Browser times out when navigating to https://<switch-ip> or http://<switch-ip>.
• "Page cannot be displayed" despite correct IP and subnet mask on the engineering station.
• PST V3.2 reports "No device detected on network" during a network scan, even when the laptop NIC and the switch are on the same subnet.
• STEP 7 / TIA Portal "Accessible Nodes" table shows no entry, or the entry is greyed out and DCP flash fails.
• WBM page returns "Java applet not loaded" or an SSL certificate error in modern browsers.

These failure modes are almost always caused by a single, recurring root cause: the engineering station is plugged into an out-of-band (management) port instead of an in-band (network) port, or the management plane is administratively disabled. A second, equally common cause is the absence of a route or default gateway when the WBM is accessed across subnet boundaries.

SCALANCE X408-2 Hardware Overview

Understanding the physical port map is essential before troubleshooting. The X408-2 is a 19" rack-mount modular switch with the following fixed and modular interfaces (refer to the SCALANCE X408-2 product release entry and the SCALANCE X-300/X-400 Operating Instructions):

The out-of-band management port on the X408-2 has its own IP stack, separate MAC, and is intended for isolated service access. If the engineering PC is connected to that port but the WBM URL targets the in-band management IP (or vice-versa), the GUI will not load. The two management planes are independent and must be addressed separately.

Root Cause Analysis

Three primary root causes account for the majority of "I cannot open the WBM" cases on a brand-new or recently re-flashed X408-2:

1. Plugged Into the Out-of-Band / Service Port

The X408-2 carries a dedicated service / management interface. The out-of-band port uses an IP address from a separate, often undocumented, management VLAN. If the laptop NIC is configured for the in-band IP of the switch and is patched into the service port, no L3 path exists between the laptop and the WBM HTTP daemon. The browser request silently drops, the switch does not respond, and PST returns "No device detected on network" because DCP multicast is filtered to the in-band VLAN only.

2. WBM Not Enabled or Wrong IP Family

WBM and Telnet/SSH are configurable under Layer 3 > Management Interfaces in the CLI. If the administrator has set the management access to off for HTTP/HTTPS, the only remaining path is CLI. The CLI command to verify is:

show ip interface
show running-config | include http
show running-config | include ssh

If the output reads no http server or no https server, the WBM is administratively disabled and must be re-enabled with http server or https server in configuration mode.

3. Tool / Firmware Mismatch

PST V3.2 cannot reliably discover X408-2 firmware ≥ 3.x because DCP discovery, TLV encoding, and PROFINET conformance class B have been updated. PST V4.0 and the successor tool PRONETA / SINEC NMS handle the new DCP frames correctly. Conversely, a V4.0 PST installation on a switch running pre-3.0 firmware may fail to read the device name and IP because the legacy device uses a different DCP device ID block. Aligning tool and firmware versions is mandatory.

Solution: Step-by-Step Recovery

The following procedure restores GUI access in a deterministic order. Total time: approximately 15 minutes on a healthy switch.

Step 1 – Confirm Cabling and Physical Layer

1. Disconnect the patch cable from the engineering PC.
2. Identify the out-of-band / service port on the X408-2 front panel. It is typically labelled with a wrench icon, a key icon, or a separate colour-coding on the silk-screen.
3. Plug the RJ-45 patch cable into any of the in-band ports 1 – 8 (or a modular media-module port) that is not a ring port. If a ring exists, pick a port that is administratively set to forwarding.
4. Verify the green Link LED is lit solid on both the PC NIC and the switch port.

Step 2 – Configure the Engineering PC IP Address

1. On the laptop, set a fixed IP in the same subnet as the switch (default factory IP is 192.168.1.1 / 255.255.255.0 for the in-band interface).

   IPv4 Address: 192.168.1.100
   Subnet Mask: 255.255.255.0
   Default Gateway: 192.168.1.1

2. Disable any secondary NIC, Wi-Fi, and VPN client to prevent asymmetric routing.
3. Ping the switch: ping 192.168.1.1. The reply must come back in < 2 ms for a direct connection.

Step 3 – Verify Management Plane via PST

1. Install Primary Setup Tool V4.0 (or newer) from the Siemens support site. V3.2 is end-of-life and does not support X408-2 firmware ≥ 3.0 reliably.
2. Launch PST > Network > Browse. The X408-2 should appear in the device list with its MAC address and PROFINET device name.
3. If the device is shown with a yellow warning triangle, right-click > Assign IP address and confirm the subnet mask.
4. If the device does not appear at all, the PC is still on the out-of-band port or the wrong subnet. Repeat Step 1.

Step 4 – Confirm HTTP/HTTPS Service Is Enabled

Connect to the CLI over the serial console (RJ-11 to DB-9 cable, 115 200 8N1) or via Telnet/SSH if already enabled, then verify:

enable
configure terminal
show ip http server status
show ip https server status

If the output shows disabled, enable the service:

http server
https server
write memory

Step 5 – Open the WBM in a Supported Browser

1. Use a browser that still supports the Java-based WBM of the X408-2. The legacy WBM relies on a Java applet; Java Runtime Environment 8 (JRE 8u351 or older "32-bit" build) is required. Modern Java 9+ blocks the applet and the WBM will hang on "Loading Java applet...".
2. Add the switch IP to the Java Security exception list: Control Panel > Java > Security > Edit Site List > Add → http://192.168.1.1 and https://192.168.1.1.
3. Navigate to http://192.168.1.1. The default credentials are admin / admin (Siemens strongly recommends changing these on first login).

Step 6 – Optional: Switch to TIA Portal / STEP 7

If WBM is not required, the X408-2 can be configured from inside STEP 7 V5.5 or TIA Portal. In TIA Portal:

1. Open the project > Devices & Networks.
2. Drag the SCALANCE X408-2 from the hardware catalog (path: Network components > Industrial Ethernet Switches > SCALANCE X-300/X-400 > X408-2).
3. Right-click > Online & Diagnostics > Assign IP address.
4. Tick Use DCP to assign IP and click Assign.

Firmware and Tool Compatibility Matrix

When upgrading to V4.1.7 (per the SCALANCE X-300/X408-2 V4.1.7 release notes) the WBM is converted to a pure HTML5 interface, eliminating the Java dependency. The same firmware package also supports the X414-3E (V3.10.2). The upgrade file is delivered as a signed .upd image and can be applied through the WBM under System > Load & Save > Firmware Update or via TIA Portal > Online & Diagnostics > Firmware Update.

CLI Reference for Management Plane Recovery

The following commands are valid on X408-2 firmware ≥ 3.0.0 and can be entered either via the serial console or via SSH.

! --- Show all IP interfaces (in-band + out-of-band)
show ip interface

! --- Show running config with focus on management
show running-config | section management

! --- Assign a static IP to the in-band VLAN 1 interface
configure terminal
interface vlan 1
 ip address 192.168.1.1 255.255.255.0
 no shutdown
exit

! --- Enable WBM services
http server
https server

! --- Save configuration
write memory

! --- Verify reachability
show ip http server status
show ip https server status
show arp

Troubleshooting Matrix

Verification

1. From the engineering PC, open a browser and navigate to http://<switch-ip>. The WBM login page must load within 3 seconds.
2. Log in with the configured credentials. The System > Information page must show the correct firmware version (e.g., V4.1.7), the in-band IP, and a current uptime of > 0 d 0 h 0 m.
3. In the CLI (serial or SSH), run show running-config | include http and confirm http server is present.
4. From a second station on the same VLAN, ping the management IP. A reply < 1 ms confirms full L3 reachability.
5. From TIA Portal > Online & Diagnostics, perform a DCP flash test. The switch's port LEDs must blink in sequence for 3 s.

Preventive Configuration

• Always label in-band and out-of-band patch fields on the front panel during commissioning. Use Siemens SIMATIC Graph port-name conventions or simple colour-coded cable boots.
• Disable unused management services (Telnet, HTTP) in production. Keep only HTTPS + SSH and restrict by ACL.
• Apply the latest firmware (V4.1.7 for the X408-2 line) before the first customer handover. The HTML5 WBM removes the Java dependency and all known SSL vulnerabilities in the applet layer.
• Document the management IP, the management VLAN, and the default gateway in the plant network plan; store a copy in PRONETA / SINEC NMS for offline inventory.
• Use PRONETA 3.x (or SINEC NMS) as the standard configuration and topology tool. Both are available free of charge from the Siemens support site and replace the legacy PST for X408-2 deployments.

Reset to Factory Defaults (Last Resort)

If the password is lost and serial CLI access is impossible, perform a factory reset:

1. Power off the switch.
2. Press and hold the SELECT / SET button on the front panel (or the F button on the display-less version).
3. Apply power while holding the button for ≥ 10 s, until all port LEDs flash once.
4. Release the button. The switch boots with IP 192.168.1.1 / 24, default credentials admin / admin, and all configuration erased.

FAQ