S7-1200 Web Server: Remote Access and Configuration Guide

The SIMATIC S7-1200 CPU family does not run a generic or third-party web server. Each CPU hosts an integrated Siemens Web Server that is part of the CPU firmware and is enabled, configured, and restricted from inside TIA Portal. The same firmware that executes the STEP 7 program also serves HTML pages, JSON status objects, and (on firmware V4.x) user-defined fragments, all from a single TCP socket on the CPU's PROFINET interface. This article answers the customer questionnaire (make/model, web server identity, database, patching, IP addressing) and gives the field-procedure to expose that web server — or, more securely, the TIA Portal project — across the public Internet.

1. Web Server Identity and Capability Matrix

The S7-1200 web server is not an Apache, nginx, or IIS instance. It is the SIMATIC firmware-resident HTTP/HTTPS service documented in the S7-1200 Programmable Controller system manual. Capability has expanded significantly across firmware generations:

Confirm the installed firmware in TIA Portal under Online > Accessible Nodes > CPU > Diagnostics, or directly from the standard web page System > Version once the server is enabled.

2. Customer Questionnaire — Direct Answers

3. Enabling and Hardening the Web Server in TIA Portal

3.1 Prerequisites

• TIA Portal V15.1 or later (V17+ recommended for V4.4+ CPUs).
• CPU firmware V4.0 or later for HTTPS — older firmware exposes HTTP only.
• CPU protection level "Full access (no protection)" or higher while writing the configuration; re-lock with password after commissioning.
• One SIMATIC Memory Card (SMC) inserted, 4 MB minimum.

3.2 Enable Procedure

1. Open the project in TIA Portal, select the CPU device.
2. Open Properties > Web Server > General.
3. Tick "Activate web server on this module".
4. Tick "Permit access only with HTTPS" (V3.0+). Do not leave HTTP enabled in production.
5. Tick "Enable user-defined Web pages" if AWP pages will be deployed (V4.0+).
6. Under User administration, create at minimum one admin account (full access) and one viewer account (read-only). Each account binds to a CPU access level: HMI, Read, or Full.
7. Compile the hardware configuration and download to the CPU. The CPU stores the web-server enable flag and the user list in retentive memory.
8. From a PC on the same subnet, browse to https://<CPU-IP>. The login page must appear.

4. Standard Web Pages Inventory

Once enabled, the CPU serves the following read-only pages by default:

• Introduction — order number, firmware, serial, slot configuration.
• CPU — operating mode (RUN/STOP), RUN/STOP switch position, LED states.
• Module Information — order number, firmware, status of central and distributed I/O.
• Diagnostic Buffer — last 50 events, time-stamped.
• Communication — live connection list (OPC UA, S7, PROFINET, TCP).
• Tag Status — live read of declared monitor tags.
• Watch Tables — only if the user has "Full" access; allows writes.
• Data Logs (V4.0+) — CSV files from DataLog DBs on the SMC; downloadable from the browser.
• User-defined Pages (V4.0+) — AWP HTML pages generated from the project.

5. User-Defined Web Pages (AWP)

Firmware V4.0 onward supports AWP (Automation Web Programming) — HTML fragments compiled by TIA Portal and pushed to the CPU. AWP variables expose DB tags:

<!-- :="myTag1" AWP_Out := "DB1."HMI".myTag1" -->
<p>Speed: <:=myTag1:> rpm</p>

<!-- :="setSpeed" AWP_In_Variable := "DB1."HMI".setSpeed" -->
<form><input type="text" name="'DB1.HMI.setSpeed'" />
<input type="submit" value="Write" /></form>

Generated HTML is stored in UserFiles\Webpages on the SMC. Each user-defined page is restricted to the access level of the logged-in web user; a user with HMI access cannot write to AWP_In_Variable tags.

6. Remote Access Topologies

The S7-1200 web server is one of two remote-touch points; the other is TIA Portal engineering download via the S7 protocol (ISO-on-TCP, port 102). The risk profile of each differs:

The source field deployment used a 3G router with a fixed-IP SIM and succeeded for both web-server browsing and TIA Portal download. This is functional but should be replaced with a VPN for production because the fixed-IP SIM is a public, routable address; the only barrier is the CPU password.

6.1 IP Address Assignment Decision Tree

• CPU PROFINET interface: assign a static RFC 1918 address from the industrial router's LAN (e.g., 192.168.10.10/24). Disable DHCP on the CPU.
• Industrial router WAN: either a public IP from the ISP/SIM operator, or DHCP if behind a customer firewall.
• DNS: register a dynamic-DNS hostname (e.g., plant-east.example.com) if the WAN IP is dynamic; fixed-IP SIMs do not need DDNS.

7. Security Hardening Checklist

1. Disable HTTP; HTTPS only.
2. Enforce minimum 8-character passwords; rotate every 90 days.
3. Set the CPU protection level to "Read/write protection" or higher. The web-server "Full" user cannot bypass CPU protection — they can only operate at the level the CPU grants.
4. Block inbound TCP 102 (ISO-on-TCP) on the router unless TIA Portal download is explicitly required; route it through a VPN.
5. Whitelist the source IP or VPN user list at the router.
6. Disable the web server when remote access is not in use (scheduled enable via PLC tag if needed).
7. Enable the CPU's "Trace" and export diagnostic buffers periodically — they record failed logins and web-side writes.

8. Step-by-Step: Public-IP SIM Router (As Deployed)

1. Insert an industrial 3G/4G router (e.g., SCALANCE M874, Moxa OnCell, eWon Cosy) and install a SIM with a fixed public IP service.
2. Configure the router LAN to 192.168.10.0/24; router LAN IP 192.168.10.1.
3. Set the S7-1200 PROFINET interface to static 192.168.10.10/24; default gateway 192.168.10.1.
4. From a laptop on the LAN, browse to https://192.168.10.10, confirm login page.
5. From a remote laptop, test the public IP (or DDNS hostname) on port 443 — the login page must appear.
6. Open TIA Portal, Online > Accessible Nodes, type the public IP, port 102. TIA Portal must list the CPU.
7. Run a program upload to verify the channel, then disconnect.

9. Step-by-Step: Sinema Remote Connect (Recommended)

1. Stand up a Sinema RC server (VM at HQ or hosted in Azure/AWS) with a publicly resolvable hostname and a valid certificate from a trusted CA.
2. Provision each S7-1200 site with a SCALANCE M87x or S615 router. Load the Sinema RC client config — generates a device certificate.
3. Engineer laptops install the Sinema RC client and an individual user certificate.
4. On the central server, pair the device cert with the user cert. Both endpoints now establish an OpenVPN-style tunnel to the relay; no inbound ports on either edge.
5. From TIA Portal, select Online > Accessible Nodes > Target device > Network adapter and pick the virtual Sinema RC adapter. The CPU is reachable on its private IP.

10. Verification Procedures

11. Troubleshooting Matrix

12. Operational Notes

• The web server keeps operating in STOP mode — useful for diagnostics when the program is faulted.
• If the CPU loses the SMC, user-defined web pages are lost; standard pages survive (they live in firmware).
• Firmware updates do not preserve the user list — export users from TIA Portal before each upgrade.
• Maximum concurrent HTTPS sessions is CPU-dependent: typically 5 on CPU 1211/1212, 10 on 1214/1215, 15 on 1217.
• JSON-RPC endpoint: https://<ip>/api/jsonrpc (V4.0+). Authenticate with HTTP Basic against the same user list.

For full firmware-level detail and screenshots, refer to the official S7-1200 manual collection on docs.tia.siemens.cloud — Web Server overview and the reference AWP example in the open documentation. A minimal AWP template is also available in the community Web-Server-Siemens-S7-1200 sample project.