Resolving Siemens S7 TCP Network Access Failure from Second PC

Problem Description

A Siemens S7-1200 or S7-1500 controller is programmed from PC #1 using TIA Portal. Modbus TCP polling from PC #1 with ModPull and the integrated Web server both respond normally, even after TIA Portal is closed. The moment the same ModPull instance is launched from PC #2 on the same LAN, the connection times out and the Web server is also unreachable.

Symptom matrix:

Because ping succeeds on PC #2, the failure is not a Layer-1 cable problem, not a routing/VLAN problem, and not a duplicate IP problem on the LAN. The fault sits one layer up, where Windows and TIA Portal decide how to encapsulate the TCP payload.

Root Cause: PG/PC Interface Bound to ISO-on-TCP

The Siemens PG/PC Interface assignment inside TIA Portal — and the matching Windows control-panel applet Set PG/PC Interface — selects the transport used by all Siemens engineering and runtime tools on that station. When the assignment points at S7ONLINE -> <network adapter> -<ISO>, every Siemens-aware application on the host issues ISO-on-TCP (RFC 1006) frames instead of raw TCP/IP.

The S7 CPU accepts both transports on the same Ethernet port, but the server-side connection resources are separate. When a PC opens a TCP connection using port 502 (Modbus) or port 80 (Web server) but the Siemens access point routes that socket through the ISO stack, the CPU sees a malformed TPDU and drops it silently. PC #1 works because TIA Portal left the assignment on ISO for engineering access but the application layer of ModPull and the browser bypass it. PC #2 has the default Microsoft TCP/IP stack with no Siemens binding — but in the original case the PLC side was the culprit.

Secondary Causes Worth Ruling Out

Three other failure modes produce the same symptom and should be eliminated before changing interface assignments.

1. CPU connection-resource pinning to a single remote IP

On S7-1200 (firmware V4.x and later) and S7-1500, the connection configuration in the device properties lets you declare a partner (remote) IP. When the block role is client, the PLC opens the socket to that specific IP and will not retry against a second PC. When the block role is server, declaring a remote IP is generally not required and limits who can connect.

2. Windows Defender Firewall rule

Windows ships with the rule Modbus Pull (ModPull) — Block inbound for non-domain profiles. On the first PC the rule may have been disabled manually or whitelisted during commissioning; on the second PC it is still active. Inbound rules only matter for the side acting as server — outbound is allowed by default — so confirm which side is initiating.

3. Static-IP mismatch

The first PC was likely assigned a static IP in the same /24 as the PLC. The second PC is on DHCP and received a different subnet, or a different /24 entirely. A ping from PC #2 to the PLC succeeds only if the routing is correct, so always verify with ipconfig and route print on both stations.

Architecture: How the S7 CPU Handles TCP

The CP and PROFINET interface of an S7-1200/1500 expose three independent transport listeners on the same MAC address:

The CPU's operating system demultiplexes by destination TCP port, not by source MAC or source IP. That means there is no per-IP whitelist at the Ethernet-driver level — the IP filtering, if any, is enforced by the application block (MB_SERVER, TSEND_C, Web server) or by the connection configuration in the device properties. If a PC on the LAN can ping the CPU and the CPU's PROFINET interface is in Online & Diagnostics, the network plumbing is correct and the fault is application-level.

Step-by-Step Resolution

Step 1 — Capture the diagnostic baseline

1. On PC #2, open a command prompt and run ipconfig /all. Confirm the IPv4 address, subnet mask and default gateway are in the same /24 as the PLC.
2. Run ping <PLC_IP>. Less than 1 ms with no loss confirms Layer 3 is healthy.
3. Run Test-NetConnection -ComputerName <PLC_IP> -Port 502 in PowerShell. If TcpTestSucceeded : True, the kernel allowed the SYN/ACK; the problem is in the application. If False, the firewall or the CPU listener is the issue.
4. In TIA Portal, open the PLC Online & Diagnostics, expand Ethernet interface > Connections. Establish a connection from PC #1 and observe the active connections list while PC #2 retries. A second TCP entry should appear; if only ISO connections are visible, the PC #2 traffic is being dropped before reaching the demultiplexer.

Step 2 — Reassign the PG/PC interface to TCP/IP (PN/IE)

1. Close TIA Portal on the affected PC.
2. Open the Windows Start menu, type Set PG/PC Interface and launch the Siemens applet.
3. In the Access Point dropdown, select S7ONLINE.
4. In the Interface Parameter Assignment Used list, select <network adapter>.TCP/IP.1 (labelled PN/IE in newer TIA versions).
5. Click OK. The applet writes the new assignment to the registry under HKLM\SOFTWARE\Siemens\SINEC\S7ONLINE\.
6. Relaunch TIA Portal, open the project, click Go online and confirm the Online & Diagnostics view now uses TCP/IP. The status line should show PG/PC interface: TCP/IP.

Step 3 — Clear any per-IP partner binding on the PLC

1. In the TIA project tree, expand Devices & Networks > [CPU] > Properties > Ethernet addresses > Ethernet interface > Connection configuration.
2. For every active and passive connection used by Modbus or Web server, open the partner endpoint and verify the Partner is set to Unspecified or to the correct PC #2 IP — not to the original PC #1.
3. If the project uses the MB_SERVER instruction block (S7-1200 firmware V4.0+ / S7-1500), open its instance DB and verify the CONNECT parameter is left empty or set to the unspecified TSAP structure.
4. Recompile the hardware configuration and download to the CPU.

Step 4 — Adjust Windows Firewall on PC #2

1. Open Windows Defender Firewall with Advanced Security.
2. Click Inbound Rules. Search for ModPull or javaw.exe (ModPull is Java-based).
3. If the rule Block is enabled for the Private or Domain profile, either disable the rule or create a new Allow rule scoped to the PLC's /24 subnet.
4. For the Web server, add an inbound allow rule for %SystemRoot%\System32\svchost.exe on port 80 (HTTP) and 443 (HTTPS), restricted to the same /24.
5. From an elevated prompt, run netsh advfirewall firewall show rule name=all profile=private and confirm the rules are active.

Step 5 — Verify the Web server is globally enabled

1. In TIA Portal, open Device Configuration > [CPU] > Properties > Web server.
2. Confirm Activate web server on this module is checked and that Enable access via HTTPS matches the URL scheme you test (http://<IP> vs https://<IP>).
3. Under User management, add a user with the Read right for the standard Web pages or with the right your custom pages require. Without an authorised user, the CPU returns HTTP 401 to every browser, which looks identical to a connection failure.
4. Compile and download.

Verification Procedure

After applying all four steps, run the following matrix from PC #2:

From TIA Portal on PC #1, repeat the same matrix. If both PCs succeed simultaneously, the previous failure was not a CPU-resource issue but a station-configuration issue. If PC #2 still fails, the firewall rule is the next suspect; temporarily disable Windows Firewall on PC #2 (netsh advfirewall set allprofiles state off) and re-test — then re-enable and fix the rule.

Troubleshooting Matrix

Field-Commissioning Checklist

1. Document the PG/PC interface assignment of every engineering PC in the plant folder.
2. In the PLC project, prefer Unspecified partner for any TCP server used by more than one client.
3. Reserve a /24 (or smaller) subnet exclusively for PLCs and engineering PCs; never mix with the office DHCP pool.
4. Standardise firewall rules on every PC: allow Modbus (502), S7 (102), HTTP/HTTPS (80/443) only on the PLC subnet.
5. For multi-user access, configure OPC UA on the CPU (S7-1500 firmware V2.0+) instead of multiple raw Modbus clients — the server enforces authentication and scales beyond a single TCP connection.
6. Keep a copy of Set PG/PC Interface screenshots in the project archive so future engineers can reproduce the assignment.

Standards and References

Network access, in the formal sense used in industrial-control cybersecurity, covers any user or process that reaches the system through a LAN, WAN or serial gateway, per NIST CSRC Glossary — network access. Treat every engineering PC as a network-access actor and audit its reach into the PLC just as you would an HMI or SCADA server.

The CPU-side Modbus server implements Modbus Application Protocol V1.1b3 (Modbus Organization, 2012) on top of Modbus Messaging on TCP/IP V1.0b, which specifies the port-502 listener; ISO-on-TCP is defined in RFC 1006 (ISO Transport Service on top of TCP). The Siemens Web server is proprietary but interoperable with any RFC-compliant HTTP/1.1 client.

FAQ