S7-1200 USB-Ethernet Adapter: TIA Portal Connection Troubleshooting

Connecting a Siemens SIMATIC S7-1200 CPU to a modern laptop that lacks a built-in RJ45 port requires a USB-to-Ethernet adapter. While generic TCP/IP traffic (browser, mail, VPN) usually works immediately after driver installation, Siemens TIA Portal uses PROFINET Discovery and Configuration Protocol (DCP) and the proprietary S7DOS helper service to enumerate online devices. These protocols do not always traverse a USB-Ethernet bridge correctly the first time, producing a state where Windows networking works, the PLC is visible in the Primary Setup Tool (PST), but the TIA Portal "Online > Accessible Devices" tree shows nothing.

This reference walks through the root cause, the exact services that must be running, the Windows network stack adjustments, the firewall rules required, and the verification procedure that confirms a clean PROFINET link over a USB-Ethernet adapter. The same procedure applies to S7-1500, ET 200SP, and ET 200MP stations that use the same PROFINET interface.

1. Problem Definition

Symptom pattern reported in the field:

• The USB-Ethernet adapter installs without error, and the Windows network icon shows "Internet access" or "Unidentified network."
• A standard ping from cmd.exe to the S7-1200 IP address (default 192.168.0.1) succeeds.
• The Primary Setup Tool or Proneta discovery finds the CPU.
• TIA Portal V17/V18/V19 "Online > Accessible Devices" returns "No accessible devices found" or hangs indefinitely.
• Download to device fails with "The device is not accessible" or "Online connection could not be established."

2. Root Cause Analysis

The S7-1200 PROFINET interface uses four traffic classes simultaneously on the same RJ45 port:

USB-Ethernet adapters with poor driver quality (especially Realtek RTL8152/RTL8153, ASIX AX88179, and several MosChip MCS78xx revisions) drop Layer 2 multicast frames or filter by Ethernet type. PROFINET DCP frames are not IP packets; they cannot be routed, and Windows does not provide a fallback. Once the frame is dropped at the NDIS miniport driver, the PLC is invisible to TIA Portal even though ping (which is IP) works fine.

Secondary causes that compound the issue:

1. S7DOS helper service stopped. s7oiehsx64.exe (x86: s7oieshx.exe) is required by TIA Portal V14 and later to open the S7DOS discovery channel.
2. Windows Defender Firewall blocking ports. Private network profile applied to the USB-Ethernet interface blocks inbound UDP 49152-49155 and TCP 102.
3. Third-party antivirus (Kaspersky, Symantec, ESET) packet inspection. Even with the firewall open, the AV driver strips DCP frames.
4. Adapter power management. Windows disables the USB-Ethernet adapter after a few seconds of "idle" to save power; DCP responses from the PLC are missed.
5. Multiple network interfaces. With both Wi-Fi and USB-Ethernet active, TIA Portal may bind to the wrong interface during discovery.

3. Prerequisites

4. Recommended USB-Ethernet Adapters

Not every USB-Ethernet adapter correctly forwards PROFINET DCP. Field-proven chipsets:

5. Step-by-Step Resolution

Step 1 — Verify Driver and Adapter State

1. Open Device Manager > Network adapters. Confirm the USB-Ethernet adapter shows without a yellow triangle.
2. Right-click the adapter > Properties > Advanced tab. Set:
   • Energy-Efficient Ethernet = Disabled
   • Green Ethernet = Disabled
   • Power Saving Mode = Disabled
   • Flow Control = Disabled
3. Open Power Options > Change plan settings > Change advanced power settings > USB settings > USB selective suspend setting = Disabled.

Step 2 — Configure the TCP/IP Stack

1. Open Control Panel > Network and Sharing Center > Change adapter settings.
2. Right-click the USB-Ethernet adapter > Properties.
3. Disable every binding except Internet Protocol Version 4 (TCP/IPv4). Disable Client for Microsoft Networks, File and Printer Sharing, Link-Layer Topology Discovery, and Internet Protocol Version 6 if not needed.
4. Configure IPv4 with a static address in the same subnet as the S7-1200. CPU default IP is 192.168.0.1 subnet mask 255.255.255.0. Use 192.168.0.10 for the PC, mask 255.255.255.0, no gateway.
5. Set the network profile to Private (not Public). PROFINET discovery is blocked on Public profile by default.

Step 3 — Verify Ping and ARP

From an elevated command prompt:

ping 192.168.0.1
arp -a | findstr 192.168.0.1

The MAC address returned by arp must match the label on the front of the S7-1200 CPU. If arp returns nothing, the L2 path is broken at the adapter driver; install the chipset-specific driver and repeat.

Step 4 — Confirm Siemens Services Are Running

The following Windows services must be in state Running with Startup type = Automatic:

Verify via services.msc or PowerShell:

Get-Service -Name 'S7DOS*','SIMATIC*','S7TrcSrv*' | Format-Table Name,Status,StartType

If any service is Stopped, start it and set the start type to Automatic (Delayed Start). Restart the PC once after changing service state so TIA Portal re-binds the helper channel.

Step 5 — Configure Windows Firewall Rules

TIA Portal needs the following rules active on the USB-Ethernet interface:

Run the firewall script as administrator:

netsh advfirewall firewall add rule name="TIA S7-Comm" dir=in action=allow protocol=TCP localport=102 profile=private
netsh advfirewall firewall add rule name="TIA S7-Comm" dir=out action=allow protocol=TCP remoteport=102 profile=private
netsh advfirewall firewall add rule name="TIA Discovery UDP" dir=out action=allow protocol=UDP remoteport=49152-49155 profile=private
netsh advfirewall firewall add rule name="PROFINET DCP" dir=out action=allow protocol=UDP localport=34964 profile=private

Step 6 — Disable Interfering Antivirus Components

1. Kaspersky: Settings > Additional > Network Settings > uncheck "Monitor specified ports" or add the ports above to exclusions.
2. Symantec Endpoint Protection: Exceptions > Windows Firewall Rules > add the four rules above.
3. ESET: Setup > Network > IDS and advanced options > disable "Enable IDS".
4. Windows Defender Antivirus with Network Protection: Settings > Virus & threat protection > Exclusions > add the TIA Portal install folder C:\Program Files\Siemens\Automation\.

As a quick triage step, temporarily disable all third-party firewall/antivirus and retest. If discovery works only with AV off, re-enable and create targeted exclusions.

Step 7 — Configure TIA Portal Online Interface

1. Open TIA Portal. From the menu bar select Online > Online & Diagnostics.
2. In the "Go online" dialog, the network adapter list now shows the USB-Ethernet interface. Select the interface whose IP matches the PC address assigned in Step 2.
3. Click Start search. The S7-1200 CPU should appear within 5-10 seconds.
4. If no devices appear, click Show all accessible devices in the same dialog. This forces TIA Portal to broadcast DCP on every active interface, useful when the adapter binding is ambiguous.

The accessible-device scan can also be invoked from the project tree: right-click the project > Go online > choose the interface > Go online.

Step 8 — Verify Project Download Path

Once the PLC appears in the accessible devices list, right-click the device > Download to device > Hardware and software (only changes). Watch the LED pattern on the CPU:

6. PROFINET DCP Discovery — Engineering Background

PROFINET DCP is defined in IEC 61784-2 and uses the Ethernet Type field 0x8892 with multicast destination MAC 01:0E:CF:00:00:00. The Identify request frame has a fixed structure:

Dst MAC:    01:0E:CF:00:00:00
Src MAC:    PC adapter MAC
Ethertype:  0x8892
DCP ID:     0xFEFE (Identify Request)
Service ID: 0x05
Service Type: 0x04 (Identify)

The S7-1200 responds with its station name, IP address, MAC, device ID, and role. TIA Portal populates the accessible-devices tree from this response. Because DCP is L2 multicast, it does not cross routers and does not require an IP stack. Windows treats 0x8892 as a raw frame and the NDIS miniport must forward it. Drivers that filter by EtherType or that operate the adapter in "promiscuous-IP-only" mode will silently drop these frames.

Use Wireshark with the USB-Ethernet adapter selected as the capture interface to confirm DCP traffic:

ip.proto == 0 && eth.type == 0x8892

If the filter returns zero frames during a TIA "Start search," the driver is dropping DCP. Switch adapters.

7. Alternative Discovery — Primary Setup Tool and Proneta

When TIA Portal fails, the Primary Setup Tool (PST) and Proneta often succeed because they use a different code path (the SIMATIC Discovery Service). To verify the L2 path independently:

1. Install Proneta V3.4 or higher.
2. Launch Proneta > Network analysis.
3. If the S7-1200 is visible here but not in TIA, the L2 path is correct and the issue is specific to TIA's S7DOS helper.
4. Re-register the S7DOS service: "C:\Program Files\Siemens\Automation\S7DOS\s7oiehsx64.exe" -regserver
5. Restart the PC.

8. Verification Procedure

After completing the steps, run the following checklist:

1. ping 192.168.0.1 returns Reply from 192.168.0.1: bytes=32 time<1ms TTL=64.
2. arp -a shows the CPU MAC address.
3. Proneta lists the CPU with correct station name and firmware version.
4. Get-Service S7DOS returns Running.
5. TIA Portal "Online > Accessible devices" lists the CPU within 10 seconds.
6. Right-click CPU > Online & Diagnostics > Diagnostic buffer opens without error.
7. Download a small test block (SET coil in OB1) to the CPU. RUN LED turns green within 3 seconds.

9. Troubleshooting Matrix

10. Long-Term Engineering Practices

• Standardize on a single approved USB-Ethernet adapter model across the maintenance fleet. Document the chipset in the maintenance procedure.
• Maintain a checklist that covers S7DOS service, firewall rules, and USB power management. Roll it into the laptop image.
• For permanent engineering workstations, install a PCIe Intel I210 NIC via a docking station. PCIe adapters do not suffer the DCP filtering problems of USB.
• For service laptops that roam between PROFINET and PROFIBUS plants, carry a Siemens CP 5711 communications processor instead of USB-Ethernet. The CP 5711 handles PROFINET, PROFIBUS-DP, and MPI in one device.
• Always lock the laptop's USB-Ethernet adapter to a static IP. Avoid DHCP over the PROFINET segment — DHCP multicast storms can interrupt cyclic I/O on adjacent stations.

11. Related Siemens Documentation

• S7-1200 Programmable Controller System Manual (06/2021)
• SIMATIC TIA Portal V18 Installation Notes
• Proneta Network Analysis Manual
• PROFINET Commissioning and Troubleshooting Guide

FAQ