Resolving STEP 7 Accessible Nodes Error with CP443-1 in Hyper-V

1. Problem Statement: CP443-1 Invisible Under Accessible Nodes Inside a Hyper-V VM

When a SIMATIC engineering workstation is virtualized on Microsoft Hyper-V, a frequent failure mode is that STEP 7 (V5.x or the TIA Portal) successfully resolves PLC stations through ping, but the Accessible Nodes view (PLC → Accessible Nodes or Online → Accessible Nodes) reports the S7-400 / S7-300 stations as missing, and the right-hand column remains empty. The accompanying COMMS message typically reads "No accessible nodes found" or "The node could not be reached."

The behavior presents three diagnostic fingerprints:

• Layer 3 (IP) is healthy: ping <CP443-1 IP> returns sub-millisecond replies; tracert shows a single hop.
• Layer 7 (S7 communication) is partially healthy: the user program can be brought Online on the configured connection, meaning the configured S7 connection is functional.
• Layer 2 (DCP discovery) is broken: Accessible Nodes cannot enumerate the CP443-1, and Upload Station to PG also fails when launched with the default S7ONLINE access point.

This contradiction — IP works, S7-Online works, DCP discovery does not — is the diagnostic signature of a Layer 2 isolation problem between the VM and the PROFINET/Ethernet segment, not a STEP 7 configuration defect.

2. Root Cause: DCP, MAC Discovery, and the OSI Layer 2 Boundary

Siemens Accessible Nodes is not a TCP/IP feature — it is implemented through Discovery and Configuration Protocol (DCP), a Layer 2 multicast protocol that was originally defined for PROFINET (IEC 61784-2) and adopted by SIMATIC NET for station identification. The mechanism operates as follows:

1. The engineering station transmits a DCP Identify request as an Ethernet multicast frame: destination MAC 01:0E:CF:00:00:00, Ethertype 0x8892 (PROFINET). See the PROFINET specification at PROFINET specification (PI).
2. Each CP443-1 (or any PROFINET device) on the same broadcast domain replies with a DCP Identify Response that contains the device name, IP address, MAC address, vendor ID, and device role.
3. STEP 7 parses those responses and populates the Accessible Nodes pane. Only S7 devices that respond to the multicast appear in the list — regardless of whether the engineering station can route IP packets to them.

Because DCP frames are non-routable Layer 2 multicasts, they are bound to the broadcast domain of the interface that emits them. In a physical workstation, that domain is the local Ethernet segment. In a Hyper-V VM, the broadcast domain is determined by the virtual switch type bound to the VM network adapter.

Hyper-V ships three virtual switch topologies, each with different Layer 2 reach:

The CP443-1 cannot be discovered in Accessible Nodes if the VM is attached to a switch that does not forward the DCP multicast — most commonly a NAT virtual switch, an Internal switch whose parent host has no path to the CP443-1, or an External switch with VLAN tagging that excludes the CP443-1 segment. This is the most likely cause of the original symptom and is the first item to verify.

3. Confirming the Diagnosis Before Changing Anything

Before reconfiguring Hyper-V, gather evidence. The following steps are non-destructive and take less than five minutes.

3.1 Verify IP reachability

From the VM command line:

ping <CP443-1 IP>
tracert <CP443-1 IP>
ipconfig /all

Confirm the VM's primary IP is in the same IP subnet as the CP443-1. A common error is the VM residing on a 192.168.x.x NAT range while the CP443-1 is on a 10.x.x.x or 172.16.x.x plant segment. DCP will not work across IP routers, only across the Layer 2 broadcast domain.

3.2 Verify Layer 2 with ARP

If ping succeeds, verify the MAC address in the ARP cache:

arp -a <CP443-1 IP>

Compare the resolved MAC against the label on the front of the CP443-1 (MAC is printed on the housing under "MAC:"). A mismatch indicates a proxy-ARP or NAT translation is in the path — strong evidence that the virtual switch is not bridged.

3.3 Capture DCP traffic

Install Wireshark on the VM and capture on the active interface. Filter for the PROFINET DCP multicast:

eth.addr == 01:0E:CF:00:00:00 || ethertype == 0x8892

Start the capture, then run Accessible Nodes → Update in STEP 7. You should see DCP Identify Request frames leaving the VM. If no frames are emitted, the S7ONLINE access point is misconfigured (Section 7). If frames leave but no responses return, the virtual switch is dropping the multicast (Section 5).

3.4 Check the S7ONLINE access point

From the Windows Control Panel → Set PG/PC Interface, confirm the access point S7ONLINE is bound to the correct network adapter for the plant. In a VM there may be two TCP/IP adapters: the Hyper-V virtual adapter and a management adapter. The wrong binding is the most common reason DCP frames are never transmitted at all.

4. Hyper-V Virtual Switch Configuration: The Primary Fix

For a SIMATIC engineering VM that must discover PROFINET/S7 stations, the recommended virtual switch type is External, bound to the host's physical NIC that connects to the plant network.

4.1 Create an External Virtual Switch (Hyper-V Manager)

1. Open Hyper-V Manager on the host (not inside the VM).
2. Select the host → Virtual Switch Manager.
3. Choose New virtual network switch → External → Create Virtual Switch.
4. Name the switch (e.g. PROFINET_Plant).
5. Under Connection type, select the physical NIC that physically connects to the plant switch — not the management/Wi-Fi NIC.
6. Allow management operating system to share this network adapter: enable only if the host itself also needs to reach the plant network. If enabled, VLAN tagging on the host may interfere with PROFINET DCP; disable it when the host is on a separate management VLAN.
7. Apply. Hyper-V briefly drops the host's physical connection.

4.2 Bind the VM to the new switch

1. Shut down the VM.
2. Open the VM's Settings → Network Adapter.
3. Set Virtual switch to the new External switch.
4. Disable Enable virtual LAN identification unless the plant network uses 802.1Q VLAN tagging and the VLAN ID is known.
5. Start the VM.

Once the VM is on the External switch, DCP multicast frames are bridged to the physical segment. STEP 7 Accessible Nodes should now enumerate the CP443-1 within a few seconds of Update.

For background on Hyper-V networking, see Hyper-V Virtual Switch overview (Microsoft Learn) and Hyper-V on Windows Server (Microsoft Learn).

5. Firewall and Security Software Configuration

Windows Firewall (and most enterprise endpoint-protection suites) block the DCP multicast Ethertype by default when the network category is Public. This is the second most common cause of silent DCP failure.

5.1 Set the network profile to Private

1. In the VM, open Settings → Network & Internet → Ethernet (or Wi-Fi if wireless).
2. Under the connected interface, ensure the network profile is set to Private, not Public.

From PowerShell (admin):

Get-NetConnectionProfile | Set-NetConnectionProfile -NetworkCategory Private

5.2 Allow DCP and S7ONLINE ports

Siemens uses the following ports on the engineering station. They must be inbound/outbound enabled in Windows Firewall for the plant network profile.

Create an inbound rule in wf.msc (Windows Defender Firewall with Advanced Security):

Name:    Siemens STEP 7 - S7ONLINE
Action:  Allow
Protocol: TCP
Local port: 102
Remote port: Any
Profile:  Private, Domain
Direction: Inbound

Repeat with Outbound for the same parameters. For PROFINET DCP and LLDP, allow inbound/outbound UDP and the appropriate Ethertypes — or, more practically, set the network profile to Private which opens multicast by default.

Reference: SIMATIC NET Commissioning PC — List of manuals and the STEP 7 installation notes at Siemens Industry Online Support.

6. CP443-1-Specific Settings to Verify

The CP443-1 itself must be configured to participate in DCP. The default is enabled, but commissioning tools sometimes disable it during security hardening.

6.1 Confirm DCP is enabled on the CP443-1

In STEP 7 (or TIA Portal) hardware configuration, open the CP443-1 properties → PROFINET Interface → Operating Mode. The options are:

• PROFINET IO Device
• PROFINET IO Controller
• PROFINET device with no PROFINET functionality

Any of the first two enables DCP. The third option disables DCP and the device will not appear in Accessible Nodes regardless of network topology. This is a hidden anti-pattern that occasionally appears in projects imported from third-party engineering tools.

6.2 Confirm the CP443-1 firmware supports DCP

DCP was first supported on CP443-1 with firmware V2.0 (6GK7 443-1EX20 series) and on all CP443-1 Adv. variants (6GK7 443-1GX20, -1HX00, -1HX10, -1PX00, etc.) from firmware V1.0. The earliest CP443-1 (6GK7 443-1EX10) does not support DCP and will never appear in Accessible Nodes regardless of network configuration. Reference the device manual at SIMATIC CP 443-1 product page (Siemens) for the firmware-to-article mapping.

6.3 Confirm MAC address visibility

From the VM, after DCP is confirmed working, run:

wireshark -k -Y "ethertype == 0x8892" -i <interface index>

The CP443-1 should respond with DCP Identify Response frames containing its name (e.g. plc-cp443-1), IP, MAC, vendor ID (0x002A = Siemens AG), and device role (0x0001 = IO Controller or 0x0002 = IO Device).

7. The "Upload Station to PG" Workaround

When re-creating the virtual switch is operationally inconvenient — for example in a production VM that cannot be reconfigured mid-shift — STEP 7's Upload Station to PG function can be coerced into a DCP-equivalent path by selecting the correct network adapter explicitly in the upload dialog.

1. In STEP 7 Manager, create a new empty project. Do not open an existing project with pre-bound connections — they will inherit the wrong access point.
2. From the menu bar, select PLC → Upload Station to PG.
3. In the Upload Station to PG dialog, the dropdown RACK defaults to 0 and SLOT defaults to 3 (this is the CPU slot in an S7-400). For an S7-300, set SLOT to 2.
4. Open Set PG/PC Interface from the same dialog. Select the access point corresponding to the Hyper-V virtual network adapter — e.g. Microsoft Hyper-V Network Adapter.TCPIP.1 — not the management TCPIP access point.
5. Click Update accessible nodes. The CP443-1 will appear with its IP address because the upload dialog routes DCP discovery through the explicitly bound interface.
6. Select the CP443-1 and click OK. STEP 7 uploads the S7 user program from the PLC into the empty project.

This workaround is a useful triage tool because it isolates the S7ONLINE access-point binding as the root cause when Accessible Nodes still fails after the virtual switch has been corrected. The fact that Upload Station to PG succeeds when the access point is bound to the Hyper-V adapter — but Accessible Nodes from the menu still shows nothing — indicates a stale S7ONLINE binding in the existing project's configuration, not a network fault.

To permanently clear the stale binding, in the project view select Options → Set PG/PC Interface → S7ONLINE → Properties and rebind to the correct adapter, then re-run Accessible Nodes → Update.

8. Step-by-Step Resolution Procedure

The following procedure resolves the symptom in >95% of cases. It assumes the symptom triad from Section 1 has been confirmed.

1. Stop the STEP 7 project from issuing further DCP attempts; close all open STEP 7 instances inside the VM.
2. On the Hyper-V host, open Virtual Switch Manager and confirm the VM is attached to an External switch bound to the physical NIC that connects to the plant. If not, create one and rebind the VM (Section 4).
3. Inside the VM, set the active network profile to Private (Section 5.1). Disable any third-party endpoint-protection firewall temporarily as a test.
4. Rebind S7ONLINE in Set PG/PC Interface to the Hyper-V virtual network adapter (Section 7 step 4).
5. Verify DCP frames leave the VM with Wireshark (Section 3.3). Filter ethertype == 0x8892 and click Accessible Nodes → Update. Identify Request frames should appear, followed by Identify Response from each CP443-1 within two seconds.
6. Confirm the CP443-1 appears in Accessible Nodes. Right-click and select Online → Open Online Window to confirm S7 communication is healthy in both directions.
7. Re-open the original project and re-test Accessible Nodes. If the issue returns, the project has a stale PC-interface binding — rebind per Section 7 and re-save the project.
8. Document the corrected S7ONLINE binding, virtual switch name, and physical NIC in a project README so the next commissioning engineer does not re-introduce the fault.

9. Verification Matrix

Use this matrix to confirm each subsystem is functional before declaring the issue resolved.

10. Edge Cases and Common Pitfalls

10.1 Multiple NICs in the VM

If the VM has more than one virtual network adapter, the S7ONLINE binding may target the wrong interface. Confirm in Set PG/PC Interface that the adapter bound to the plant network is selected. Disable or remove adapters that are not in use.

10.2 VLAN tagging on the plant switch

Plant networks frequently segment PROFINET traffic onto a dedicated VLAN (commonly VLAN 1 or a tagged VLAN such as 100). If the VM's virtual switch is not configured with the matching VLAN ID, the External switch will not pass the CP443-1 traffic. Set VLAN ID in the VM network adapter settings, or configure the physical NIC as a VLAN trunk and use a Hyper-V virtual switch in trunk mode.

10.3 Promiscuous mode required by some diagnostic tools

Tools such as Proneta, Wire Shark with PROFINET dissector, or the SIMATIC Automation Tool require the VM network adapter to operate in promiscuous mode. In Hyper-V, this is enabled by Advanced Features → Enable MAC address spoofing in the VM network adapter settings. Without it, the VM may see no PROFINET frames at all even though the host's physical NIC sees them.

10.4 IPv6 interference

Some Hyper-V default configurations enable IPv6 on every interface. DCP is IPv4-only, but IPv6 router solicitation can cause the VM to mark the network as Public. Disable IPv6 on the plant-bound adapter or bind the network profile to Private explicitly.

10.5 VPN client interference

Corporate VPN clients (Cisco AnyConnect, FortiClient, Zscaler) often inject routes and firewall rules that block multicast on the plant-bound adapter. Suspend the VPN client while commissioning. If the plant network is reachable only through a VPN, the VPN must be configured to pass the DCP multicast — which most consumer-grade VPN clients do not support.

10.6 WLC / Wi-Fi bridging to PROFINET

Connecting the engineering VM via Wi-Fi introduces variability. Wireless links do not guarantee DCP delivery, and most enterprise WLCs strip 0x8892 frames. For commissioning, always use a wired connection to the plant switch.

10.7 Virtualization platform differences

The root cause is identical on every platform: NAT and host-only topologies do not pass the DCP multicast.

11. Long-Term Recommendations for Virtualized SIMATIC Engineering Workstations

1. Standardize on External virtual switches. Document the physical NIC and VLAN ID in the VM template.
2. Pre-configure the S7ONLINE access point in the VM template so that every clone of the engineering VM boots with the correct binding.
3. Set the network profile to Private in the VM template's unattend.xml or via Group Policy.
4. Use a dedicated physical NIC on the host for plant network access, separate from the management/Wi-Fi NIC. USB-Ethernet adapters are a low-cost way to add a second NIC.
5. Maintain a baseline DCP capture in Wireshark from a known-good commissioning session, and compare against any new session that fails Accessible Nodes.
6. For multi-site deployments, use a separate VM image per plant network, since re-binding network adapters across subnets is error-prone.
7. Document CP443-1 firmware versions per site. The DCP behavior of CP443-1 modules has been stable since firmware V2.0; site-specific firmware notes should be kept in a CSV alongside the project.

For the official catalog of CP443-1 variants and their manuals, see the SIMATIC CP 443-1 product page (Siemens Industry Online Support). For STEP 7 / TIA Portal installation and configuration documentation, refer to Siemens Industry Online Support and the entry-level SIMATIC NET Commissioning PC manuals.

12. Summary of the Fix in Five Lines

1. Bind the Hyper-V VM network adapter to an External virtual switch on the plant-facing physical NIC.
2. Set the network profile to Private; allow TCP/102 inbound/outbound in the firewall.
3. Bind the S7ONLINE access point to that Hyper-V virtual adapter in Set PG/PC Interface.
4. Confirm the CP443-1 firmware is ≥ V2.0 and the PROFINET interface is set to a non-disabled operating mode.
5. Re-run Accessible Nodes → Update in STEP 7 / TIA Portal; the CP443-1 should now be enumerated.

If the symptom persists after the five steps above, the issue is almost certainly a project-bound S7ONLINE reference (re-create the project, or re-bind the access point) or a CP443-1 firmware that pre-dates DCP support (replace the module).