S7-1200 CP1243-1 GET/PUT Communication Failures: Root Cause and Field-Proven Resolution

The SIMATIC CP 1243-1 (6GK7243-1BX30-0XE0 and related order numbers) is one of the most misunderstood communications processors in the S7-1200 ecosystem. Field engineers routinely attempt to use it as a generic second PROFINET port for S7 communication, HMI, and PLC-to-PLC GET/PUT traffic, then find that those S7 services are blocked even though raw TCP connects successfully. This article explains exactly why the CP 1243-1 behaves this way, which order numbers and firmware versions actually support S7 communication, and which alternative hardware to select when the project requires a true second S7-capable Ethernet interface on an S7-1200.

1. CP 1243-1 Product Family Overview

The CP 1243-1 family is a range of communications processors that mount on the left side of an S7-1200 CPU (slot 101) and provide a single additional RJ45 Ethernet interface. The variants differ in their supported services, security features, and telecontrol protocols. Identifying the exact order number (MLFB / Article No.) of the installed module is the single most important first step in any GET/PUT troubleshooting workflow.

The Article No. is printed on the front face of the module, immediately above the RJ45 jack (for example, "6GK7 243-1BX30-0XE0"). When escalating a ticket, always quote the full MLFB including the -0XE0 suffix — Siemens documentation is keyed to that exact string. Cross-reference the order number against the technical data in the official entry list on the Siemens Industry Online Support portal to confirm which firmware supports which S7 communication services.

The base 6GK7243-1BX30-0XE0 ships with firmware V2.x or V3.x depending on the production date. Firmware V3.0 and higher introduced expanded security, TLS, and updated SINEMA RC support, but the S7 passive-server behavior (i.e., allowing a remote CPU to GET/PUT into the S7-1200's data blocks) is still bound to whether the CP has been configured for that role.

2. Why GET/PUT Fails Through the CP 1243-1

Symptom set typically reported:

• TCP connection (TCON, TSEND, TRCV) to the CP works.
• An external S7-1500 PUT/GET instruction times out with W#16#80E1 (job aborted) or W#16#8081 (no connection established).
• An HMI panel (KTP / Comfort / Unified) cannot reach the S7-1200 variables when its project is configured to talk to the CP's IP address.
• The S7 connection configuration in TIA Portal accepts the partner and CP without error, but the connection stays in status 0x0000 or 0x0200 (connecting / partner unreachable).

The root cause is a mismatch between the engineer's expectation (CP 1243-1 = second PROFINET interface) and the actual product role (CP 1243-1 = telecontrol / firewall / security module with a tightly controlled, application-defined S7 service surface).

2.1 The S7 Communications Flag in TIA Portal

In TIA Portal V13 and later, when you add a CP 1243-1 under Device configuration > Properties > Communication interfaces > Ethernet interface, there is a checkbox "Permit S7 communication" (German: S7-Kommunikation zulassen). Enabling it does not turn the CP into a full S7 server. It relaxes the firewall only for connections that match the S7 connection configuration you also create under Connections. The CP must still be configured as the connection endpoint (i.e., a PUT/GET partner entry must be defined with the CP's IP as the local endpoint, not the S7-1200 CPU's integrated PROFINET port).

If the S7 connection in TIA Portal is created with the CPU's PROFINET interface as the local endpoint and the S7-1500 as the partner, the CP is bypassed entirely. The CP will not proxy that traffic, and the S7-1500 partner will still need to reach the CPU's PROFINET IP. This is the single most common configuration mistake on this hardware.

2.2 Firewall and Connection Restrictions

The CP 1243-1 runs a stateful firewall. By default it blocks inbound S7 traffic on TCP port 102 (iso-tsap) from any IP that is not on the configured "permitted partner" list. The Open User Communication (OUC) you observed working is opened by the S7-1200 outbound from the CPU's program, then reflected by the CP — firewall asymmetry is a common source of confusion. S7 communication, by contrast, is initiated by the partner and arrives inbound at the CP, so the firewall and the explicit S7 connection table must both allow it.

3. Hardware Diagnostic: Identify the Exact Module and Firmware

Before any further troubleshooting, capture the following data points and record them. They are mandatory when opening a Siemens support ticket (SR) and essential when you cross-reference against the official documentation.

1. Order number (MLFB) — printed on the front of the CP and on the packaging label.
2. Firmware version — read with TIA Portal (online → CP → Properties → General → Firmware) or with PRONETA. A CP with V1.x firmware has none of the modern security features and is the most likely to misbehave with S7 communication from a newer S7-1500.
3. CPU order number and firmware — the S7-1200 CPU also has a minimum firmware that influences which CP firmware is supported. CPU firmware V4.2 and higher is the most reliable with CP firmware V3.x.
4. IP configuration — IP address, subnet mask, default gateway of both the CPU PROFINET interface and the CP.
5. TIA Portal version — TIA V15.1 / V16 / V17 / V18 / V19 each have a different HSP (Hardware Support Package) for CP 1243-1 features.

4. Configuration in TIA Portal — Step by Step

The following procedure is the canonical TIA Portal configuration that enables an external S7 partner (S7-1500 in this case) to perform GET/PUT on an S7-1200 via the CP 1243-1.

4.1 Prerequisites

• TIA Portal V15.1 or higher (V16+ recommended for current CP firmware).
• HSP installed for the CP 1243-1 (Options → Manage HSP → Search).
• S7-1200 CPU with firmware V4.2 or higher.
• CP 1243-1 with firmware V3.0 or higher.
• S7-1500 partner PLC with matching project.

4.2 Configuration Procedure

1. Add the CP 1243-1 to the S7-1200 device configuration. Drag it from the hardware catalog (Communications modules → CP 1243-1) to the left bus of the CPU. TIA will assign slot 101 automatically.
2. Configure the CP Ethernet interface. Open Properties → Ethernet interface of the CP. Set IP address, subnet mask, and (if required) router. Make sure this is on a different subnet than the CPU's PROFINET port; otherwise the S7-1200 routing table will not know which interface to use for traffic to the S7-1500 network.
3. Enable S7 communication on the CP. In the same properties view, under the communication settings, set "Access permissions" or "S7 communication" to Permitted. This is the flag mentioned in the original symptom report.
4. Create the S7 connection. In the project tree, right-click Device > Connections > S7 Connection and create a new S7 connection. The critical choice is the local endpoint: select the CP 1243-1 as the local interface, not the CPU PROFINET port. The partner is the S7-1500 with its interface on the same subnet as the CP.
5. Configure firewall / partner permissions. Under CP properties → Security → Firewall (or under the connection's properties), explicitly add the S7-1500 IP as a permitted partner for the S7 service. Do not rely on the default "allow from any" — most projects require the partner list to be populated.
6. Download the configuration to the S7-1200 and the CP. The CP will restart; expect a 20–40 second outage on the CP interface.
7. Verify the S7 connection status in TIA Portal: Online > Connections > S7 connections. Status should be 0x0001 (established) once the S7-1500 has downloaded its half of the project and is online.
8. Program the PUT/GET blocks on the S7-1500 side using the standard PUT and GET instructions (S7-1500: Instructions > Communication > S7 Communication > PUT / GET). Specify the connection reference created in step 4. Use at least 200 ms of timeout to tolerate the initial CP bring-up.

5. Verification Procedure

After downloading, run this verification sequence in the order shown. If any step fails, stop and resolve that step before continuing.

1. Physical layer: Both port LEDs on the CP must be solid green or flashing green. Yellow/amber = 10 Mbps only, which is fine but indicates an old switch; off = no link.
2. CP online reachable: From TIA Portal, Online → Accessible nodes. The CP IP must appear. If it does not, fix Layer 2/3 first.
3. CP diagnostics: Online → CP → Diagnostics. Look for entries under Security / Firewall and Connections. Common entries:
   • Connection establishment rejected by firewall — partner not in the permitted list.
   • S7 connection ID n: passive endpoint, awaiting partner — CP is configured, partner has not connected yet.
   • TSAP mismatch — the S7-1500 is reaching the CP, but the local TSAP (default 01.01 for the CP) does not match the connection entry.
4. S7-1500 GET/PUT status: In the S7-1500 program, evaluate PUT/GET status outputs:
   • ERROR = 0, STATUS = 0, DONE = 1 → success.
   • ERROR = 1, STATUS = W#16#80E1 → job aborted by CPU; check partner reachability.
   • ERROR = 1, STATUS = W#16#80B1 → partner not reachable (Layer 3 / firewall).
   • ERROR = 1, STATUS = W#16#80C3 → resource problem on the CP.
5. Wireshark / tcpdump capture on the partner switch port to confirm whether iso-tsap (TCP/102) SYN packets are leaving the S7-1500 toward the CP IP.

6. Common Failure Modes and Their Resolutions

6.1 The Two Independent "Permit PUT/GET" Flags

This is the single most common oversight. There are two independent settings that must both be enabled for GET/PUT to work, and they are configured on different objects in the project tree:

1. CPU-level flag: CPU > Properties > Protection & Security > Connection mechanisms > Permit access with PUT/GET from remote partner (ES, HMI, other CPU). This enables the S7-1200 CPU itself to be a passive S7 server. Without this, the integrated PROFINET port will refuse PUT/GET regardless of the CP configuration.
2. CP-level flag: CP > Properties > Ethernet interface > Permit S7 communication AND CP > Properties > Security > Firewall > S7 service > Permitted partner. This enables the CP's interface and firewall to allow the S7 traffic.

If only one of the two flags is set, the symptom is exactly the same: PUT/GET fails, and the CP is suspected. Set both.

7. When the CP 1243-1 is the Wrong Choice

There are project topologies where the CP 1243-1 is genuinely not the right hardware. The original symptom report's underlying requirement — "I want a second Ethernet interface for S7 communication and HMI" — is one of them. In that case, the correct hardware choices are:

For the specific use case in the original report (S7-1500 partner on a separate network wants to do GET/PUT into the S7-1200, while the customer only wants to expose one IP address), the most pragmatic options are:

1. CSM 1277 unmanaged switch on the existing PROFINET port, with the S7-1500 and the S7-1200 CPU on the same switched segment. Single IP, no CP needed. The S7-1500's PUT/GET traffic is S7 communication, which the CPU PROFINET port supports natively with the "Permit PUT/GET" flag enabled.
2. SCALANCE XB005 or similar managed switch if VLAN separation is required but the networks are still physically adjacent.
3. CP 1243-7 or a second S7-1200 CPU if the partner network is physically and securely separated, and a true routing boundary is required.

8. Firmware Update Procedure for the CP 1243-1

If a firmware upgrade is required to bring the CP to a level that supports the project's required S7 services, follow the sequence below. The firmware file is delivered as a UPD file from the Siemens Industry Online Support portal under the CP's entry.

1. Download the matching UPD file. Confirm that the UPD applies to the exact MLFB on the device label.
2. In TIA Portal, switch to the S7-1200 project view. Online → Accessible nodes, select the CP, and choose Online & Diagnostics → Firmware update.
3. Browse to the UPD file. TIA verifies the compatibility. If the CPU firmware is too old to accept the new CP firmware, TIA will block the update — upgrade the CPU first.
4. Trigger the update. The CP reboots (~60–120 seconds). The integrated PROFINET port of the CPU is unaffected; only the CP interface drops during reboot.
5. After reboot, re-verify with the Accessible nodes search and confirm the new firmware version under CP properties.

9. Reference: Siemens Official Documentation

The following primary sources are the authoritative references for the CP 1243-1 and its communication services. Always verify the current revision before relying on a specific behavior, because firmware updates can change default firewall behavior, S7 connection limits, and supported telecontrol protocols.

• CP 1243-1 Operating Instructions (BA_CP-1243-1) — Siemens Industry Online Support: The product manual with the full order number list, technical data, connection examples, and security configuration steps.
• Communication Compendium (78028908) — Siemens Industry Online Support: The cross-platform S7 communication reference, including chapter 21.6.5 which covers the CP 1243-1 in S7-1200 contexts. This is the document to consult when the same symptom appears across different CPU families.
• SIMATIC S7-1200 Programmable Controller — System Manual: Contains the S7-1200 communication architecture, including the rules for the integrated PROFINET interface and expansion modules.
• SIMATIC S7-1200 — Security with the CP 1243-1: Application example for firewall, IPsec, and SINEMA RC configuration on the CP 1243-1.

10. Field-Proven Caveats

• One S7 connection per partner is the default. The CP 1243-1 supports up to 16 S7 connections total, but each partner typically consumes one resource. If the project has many HMIs, count the connections explicitly during design.
• Time synchronization. The CP performs its own time sync via the configured NTP server. If the S7-1500 is sending time to the S7-1200 via PUT, do not also configure the CP for NTP — the two paths will fight and timestamps will drift.
• Diagnostic buffer of the CP is independent from the CPU. If a S7 connection is failing, the diagnostic buffer of the CP (not the CPU) is where the relevant entry will appear. Engineers accustomed to reading only the CPU buffer often miss the real cause.
• TIA Portal "Go online" uses the CPU PROFINET port by default. To read the CP online, you must explicitly target the CP IP. Use Online → Accessible nodes → target CP IP, not the CPU IP.
• PROFINET devices on the CPU port are unaffected by the CP. The PROFINET sensors and the HMI on the original report's CPU port continue to work even when the CP is misconfigured, because they talk directly to the CPU, not through the CP. This is what makes the CP failure mode so deceptive.

11. When to Escalate to Siemens Support

Escalate to Siemens Technical Support (SR ticket) when the following conditions are all met:

1. The order number, firmware, and TIA Portal version are confirmed and documented.
2. Both "Permit PUT/GET" flags (CPU and CP) are enabled.
3. The S7 connection is configured with the CP as the local endpoint, and the S7-1500 is configured as the partner.
4. A wireshark capture confirms iso-tsap SYN packets are leaving the S7-1500 toward the CP IP.
5. The CP diagnostic buffer records the connection attempt and rejects it with a non-actionable error code.

Attach the TIA Portal project (zipped, with the S7-1500 project merged or attached separately), the wireshark capture, the CP diagnostic buffer export (Online → CP → Online & Diagnostics → Diagnostic buffer → Export), and the S7-1500 PUT/GET error code readout. A support ticket without the diagnostic buffer is the single biggest reason tickets stall in the queue.

FAQ