Resolving WinCC Sm@rtServer Remote Access Failures on TP700

Problem Description

A SIMATIC TP700 Comfort panel running the WinCC Sm@rtServer option responds normally to engineering and HMI-to-PLC traffic on its local subnet, but it is unreachable from any host that is not directly connected to the same physical switch. The Sm@rtClient viewer cannot establish a session, ICMP echo requests (ping) time out, and the panel does not appear in the WinCC Sm@rtClient browser list. S7-1200 and S7-1500 CPUs in the same machine network continue to respond to ping, PG routing, and online diagnostics without issue.

The fault pattern is therefore specifically:

• Sm@rtServer visible and operable on the local engineering port (X1 / X2 directly connected).
• No ICMP response from the panel IP from any off-subnet host.
• S7-1200 / S7-1500 in the same rack respond to ICMP, HMI variables, and TIA Portal online functions from the same remote network.
• Connecting the panel's LAN port directly to a router/firewall (instead of chaining through a PLC or industrial switch) restores ICMP but Sm@rtClient still cannot establish a VNC-style session.

This symptom set is a classic cross-subnet reachability problem compounded by the fact that the SIMATIC HMI panels do not act as IP routers, and that Sm@rtServer uses the fixed TCP port 5900 which must be permitted end-to-end.

Root Cause Analysis

Four layered root causes are observed in the field, in order of frequency:

1. Missing default gateway on the panel. The TP700 Comfort has a valid IP address and subnet mask, but no gateway entry. Packets destined for off-subnet hosts are silently dropped because the panel's TCP/IP stack has no next-hop route.
2. Routing through the PLC. Installers frequently daisy-chain the panel off the S7-1200/1500 PROFINET port because it is convenient, and rely on the PLC to forward traffic. S7-1200/1500 CPUs do not perform general IP routing. They pass S7 routing frames and TIA transfer frames, but ICMP, VNC/Sm@rtServer, HTTP, and any other IP traffic is dropped at the PROFINET interface.
3. Sm@rtServer disabled, restricted, or listening on a non-standard port. The server option must be enabled in the panel project, the operator password (if used) must be known, and the listening TCP port must match what Sm@rtClient is dialing.
4. Firewall / managed switch ACL on TCP 5900. The Sm@rtServer uses VNC protocol semantics and binds TCP port 5900 by default. Industrial firewalls, VLAN ACLs, and managed switches (SCALANCE, Cisco IE, Hirschmann RSP) frequently block this port when the engineering and operations VLANs are segregated.

Network Topology Constraints

Two topologies are common in the field, and only one is correct for remote Sm@rtServer access.

Configuring the Default Gateway on the TP700 Comfort

The TP700 Comfort panel accepts a single IPv4 default gateway in the Control Panel. The entry is project-controlled (offline via TIA Portal) or runtime-controlled (online via the panel's Control Panel under Network and Internet → Network Connections → PROFINET → Properties → Internet Protocol Version 4).

1. Open the TIA Portal project containing the TP700 Comfort device.
2. In the project tree, select the panel and open Devices & Networks.
3. Open the panel's Properties → General → PROFINET interface [X1] (or X2, depending on the port used).
4. Set the IP address and subnet mask to match the production subnet that is reachable from the engineering network. For example, panel IP 192.168.10.20, mask 255.255.255.0.
5. In the same dialog, expand IP protocol → Router and enter the IP of the next-hop router for that subnet. For example, router 192.168.10.1.
6. Compile and download the panel project. Verify on the panel Control Panel that the gateway entry is populated.

Enabling Sm@rtServer and Confirming the Listening Port

The WinCC Sm@rtServer option must be activated in the HMI project and, where applicable, in the runtime settings.

1. Select the TP700 Comfort in the TIA Portal project tree.
2. Open Runtime settings → Services → Sm@rtServer (Comfort Panels) or Remote access → Sm@rtServer (Unified).
3. Enable Sm@rtServer.
4. Set the port. The default is 5900. Change the port only if port 5900 is in use by another service on the same panel IP.
5. Configure an operator password if access control is required.
6. Compile the HMI project and transfer it to the panel.

After download, on the panel runtime, the Sm@rtServer icon (a globe with a blue arrow) appears in the task bar. The icon's colour indicates server state: blue = active, grey = inactive, red = error.

To confirm the listening port from an engineering host, perform a TCP port scan (nmap, Advanced Port Scanner, or PowerShell Test-NetConnection):

A successful result returns TcpTestSucceeded : True. A failure means the server is not started, the port is filtered, or the panel is on a subnet the host cannot route to.

Sm@rtClient Connection Options

Three client variants are available, all of which speak VNC over TCP 5900 to the Sm@rtServer:

Connection string format: <panel_ip>[:<port>]. For example, 192.168.10.20 or 192.168.10.20:5900 if a non-default port is configured. The credential prompt that follows requests the password defined in the Sm@rtServer runtime settings; if no password is set, the connection is anonymous.

S7-1500 IP Routing (Firmware 2.8 and TIA V16+)

Starting with S7-1500 firmware V2.8 and TIA Portal V16, the CPU supports IP routing between its PROFINET interfaces without an external router. This is the only Siemens-approved method of reaching an HMI chained off an S7-1500 PROFINET port from a different subnet.

1. Confirm firmware: Online → Accessible nodes → [CPU] → Online & diagnostics → General. The firmware version must read 2.8.x or higher.
2. Confirm TIA Portal version: Help → About must show V16 or later.
3. In the CPU properties, open Properties → General → PROFINET interface [X1] / [X2].
4. Activate the IP routing option for each interface that needs to forward traffic.
5. Assign the CPU an IP address in each subnet it routes between, and ensure the panel's gateway is the IP of the CPU interface in the panel's subnet.

Subnet Planning Reference

Use the following template when planning a multi-subnet installation that includes remote Sm@rtServer access.

Step-by-Step Diagnostic Procedure

Run these checks in order. Each step isolates one layer of the stack.

1. Confirm panel IP from the panel itself. On the TP700, open Control Panel → Network and Internet → Network Connections → PROFINET. Record the IP, mask, and gateway shown.
2. Confirm local ping. From a laptop connected to the same physical switch as the panel, ping the panel IP. If this fails, the issue is layer 1/2 — check cable, switch port, VLAN.
3. Confirm remote ping. From a host on the engineering network that must reach the panel remotely, ping the panel IP. If local works and remote fails, the panel is missing a gateway, or the inter-subnet router is missing a return route.
4. Check the gateway on the panel. If empty, set it per the subnet plan above and re-test.
5. Check the routing on the engineering host. route print on Windows, ip route on Linux. Confirm there is a route to the panel subnet via the engineering gateway.
6. Confirm Sm@rtServer is enabled. On the panel, observe the Sm@rtServer icon in the task bar. Blue = active.
7. Test TCP 5900. From the remote host: Test-NetConnection -ComputerName <panel_ip> -Port 5900. A pass means the server is reachable at the application layer; a fail means the port is filtered or the server is down.
8. Check firewall / ACL. On the router or managed switch, confirm TCP 5900 is permitted from the engineering source network to the panel destination IP. Add an explicit allow rule if needed.
9. Launch Sm@rtClient. Enter the panel IP, supply the configured operator password, and confirm the live screen is mirrored.

Troubleshooting Matrix

Security and Hardening Notes

• Always set an operator password on the Sm@rtServer when the panel is reachable from any network beyond the local machine.
• Restrict TCP 5900 in the firewall to the specific engineering source subnets that legitimately require remote access.
• For Internet-facing access, terminate Sm@rtClient inside a VPN or jump host. Direct exposure of port 5900 to the Internet is not supported by Siemens and is a security exposure.
• Use the X2 interface on the TP700 Comfort to keep the engineering/remote-access network separate from the PROFINET automation network, preserving determinism on X1.

Frequently Asked Questions