S7-300 CPU 315 PN/DP TCP/IP Communication Loss: Restore Step 7 and WinCC Connectivity

A CPU 315-2 PN/DP that drops its S7ONLINE link to STEP 7 and WinCC, even though Accessible Nodes still shows the PLC with the correct MAC and IP, is one of the most misdiagnosed faults in the S7-300 ecosystem. The reported fingerprint is consistent: a disable/enable cycle of the network adapter immediately restores the link, while a full Windows reboot does not. That asymmetry is the diagnostic key, because it points at a corrupted TCP/IP state or a residual NDIS filter driver rather than at the CPU or the cable. This reference reconstructs the diagnostic path, lists every plausible root cause in order of statistical likelihood, and provides a permanent cure that survives reboot.

1. Problem Definition

After days of stable operation, the SIMATIC station suddenly becomes unreachable from both STEP 7 (V5.5 or V5.6) and WinCC, even though:

• The PROFINET port on the CPU shows a valid link (Link LED on, Speed LED confirming 100 Mbit/s full-duplex).
• STEP 7 Accessible Nodes still finds the CPU 315-2 PN/DP and reports the correct MAC and IP.
• PROFINET diagnostic (read through PROFINET or the secondary interface) reports no bus, station, or diagnostic interrupt error.
• The Windows firewall is disabled.
• Disabling and re-enabling the network adapter in Windows immediately restores S7ONLINE communication.
• A full Windows reboot does NOT restore communication, but toggling the NIC does.

The pattern is a fingerprint of a corrupted TCP/IP connection state, a residual packet filter driver (typically left behind by endpoint security or firewall software), or a misconfigured S7ONLINE access point. The adapter-down/adapter-up cycle flushes the Winsock catalog, the TCP control block table, the ARP cache, and any NDIS filter driver that was attached at boot time, which is why a NIC reset cures the problem but a reboot does not: the reboot keeps the filter driver load order intact, the NIC reset unloads it.

2. Affected Hardware and Software Configuration

On the CPU 315-2 PN/DP, the second PROFINET port can be used to separate the engineering network from the HMI network, which is a useful isolation technique when a residual filter driver is suspected. The PROFINET interface manual is published as Siemens entry ID 12996906.

3. Diagnostic Matrix

Run each row in order from the IPC. The first row that fails identifies the layer at which the fault lives.

In the reported scenario, rows 1-6 pass and rows 7-8 fail. ICMP and ARP both succeed, the NIC sees the CPU, and even STEP 7 finds it via the S7 broadcast, but the connection-oriented S7 session is being broken or refused at the higher layers. That signature matches one of three root causes, listed in section 4.

4. Root Cause Analysis

4.1 Residual Endpoint Security Filter Driver (most likely)

Symantec / Norton products historically install an NDIS 6.x lightweight filter driver, typically named BHDrvx86.sys or BHDrvx64.sys, and a parallel TDI / LSP filter. Even after the user-facing product is uninstalled, these drivers often remain attached to every NIC. The driver typically allows ARP and ICMP for diagnostic purposes but drops the S7 frames because they use TCP port 102 with an unusual payload shape (ISO Transport over TCP, RFC 1006). Confirm with:

sc query type= driver state= all | find /i "sym"
sc query type= driver state= all | find /i "bhd"
pnputil /enum-drivers | find /i "symantec"
pnputil /enum-drivers | find /i "norton"

If any of these commands return Symantec or Norton strings, the residual filter is the cause. The fix is in section 7.

4.2 Winsock / TCP Catalog Corruption

A common artifact on long-running industrial PCs (typical uptime of months) is Winsock catalog corruption caused by hot-patching of TCPIP.SYS, third-party LSP install/uninstall cycles, or broken Windows updates. The S7DOS service attempts to bind TCP port 102 to all interfaces; if the catalog is corrupted, the bind fails silently. Disabling/enabling the adapter rebuilds the catalog. A reboot does not, because the catalog persists in the registry at:

HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters
HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters

The full Winsock reset procedure is in section 6.

4.3 S7ONLINE Access Point Misrouting

Each install of STEP 7, WinCC, WinCC Flexible, and the S7-PCT tool can create or modify the S7ONLINE access point in the registry:

HKLM\SOFTWARE\Siemens\AUTSW\SetPGUAC\S7ONLINE -> pointing to "\Device\NPF_{GUID}"

If WinCC was installed after STEP 7, the access point may now point to the WinCC channel's logical interface name rather than the physical NIC. Both programs will then attempt to bind through a TAP or virtual adapter that no longer exists after a reboot, but that does exist if the physical NIC is cycled, because the virtual binding is reset. Reassign the access point with the Set PG/PC Interface utility, see section 5.

4.4 TCP Offload Engine Mismatch on the NIC

Many industrial motherboards (Siemens SIMATIC IPC, Beckhoff, Kontron) ship with Intel i210 / i211 / i350 or Realtek RTL8168 / 8111 NICs. The default Windows driver enables TCP Chimney Offload, RSS, and Large Send Offload v2 (LSO). S7 traffic is low-volume and high-frequency; some S7 implementations break when offload is active. The NIC advanced properties must be set per section 8.

4.5 Half-Open TCP Connections Filling the SYN Table

WinCC uses one TCP session per channel; STEP 7 uses up to 4 sessions for online / download / monitor / upload. On Windows, the default MaxUserPort is 5000 and TcpTimedWaitDelay is 4 minutes. An IPC with 90 days of uptime can accumulate thousands of TIME_WAIT entries from normal HMI polling. The S7ONLINE service may fail to allocate a new port and the symptom is identical to a filter driver. Disabling the NIC flushes the table instantly. The registry tuning is in section 9.

5. Resolution Path A - Set PG/PC Interface

1. Close STEP 7, WinCC, and any SIMATIC software.
2. Open the Windows Control Panel and launch Set PG/PC Interface (SetPGUAC.exe). The binary ships under C:\Program Files\Siemens\Automation\SIMATIC Manager\SetPGUAC.exe. STEP 7 V5.5 ships the utility in the SIMATIC Manager group; the official documentation is entry ID 92611204.
3. In the Access Point of the Application dropdown select S7ONLINE.
4. In the Interface Parameter Assignment Used list, expand the TCP/IP group and select the entry whose suffix matches the NIC used for the S7 network (for example, "TCP/IP -> Intel(R) I210 Gigabit Network Connection"). Do NOT select a TAP adapter or VMware bridge.
5. Click Properties and confirm:
   • IP address = 192.168.0.2 (static; DHCP is not recommended on an IPC).
   • Subnet mask = 255.255.255.0.
   • No proxy is enabled.
6. Click OK and then OK again to close SetPGUAC.
7. Open an elevated Command Prompt and run: reg query "HKLM\SOFTWARE\Siemens\AUTSW\SetPGUAC" /s Verify the S7ONLINE entry now points to the correct NPF device GUID.

6. Resolution Path B - Winsock and TCP/IP Stack Reset

Run the following from an elevated Command Prompt on the IPC:

netsh winsock reset
netsh int ip reset
netsh int ipv6 reset
ipconfig /flushdns
arp -d *
netsh interface set interface "Local Area Connection" admin=disable
timeout /t 5
netsh interface set interface "Local Area Connection" admin=enable

Replace Local Area Connection with the actual Windows interface name (verify with netsh interface show interface). After the reset, restart the PC. If a residual filter driver is still attached, the reset will not be sufficient and you must proceed to section 7. The Microsoft documentation for the underlying parameters is published at Microsoft KB - TCP/IP registry entries.

7. Resolution Path C - Remove Residual Norton / Symantec NDIS Drivers

The Norton Remove and Reinstall (NRT) tool is published by Broadcom / Symantec and removes the filter drivers that the regular uninstall leaves behind. The procedure is:

1. Download the latest NRT executable from https://norton.com/nrn.
2. Run the executable on the IPC with administrator rights.
3. Choose Remove. The tool will reboot the IPC during removal.
4. After reboot, open Device Manager, choose View > Show hidden devices, and delete any greyed-out entries under Network Adapters with names starting with "Symantec", "Norton", or "BHD".
5. Run the official Symantec CleanWipe tool as a second pass if BHD entries remain: cleanwipe.exe /s
6. Reboot again and confirm with: pnputil /enum-drivers | find /i "sym" The command must return no lines.

8. Resolution Path D - NIC Advanced Properties

Open Device Manager, expand Network Adapters, double-click the active NIC, switch to the Advanced tab, and set the following values. These are the values used by Siemens engineering and recommended in the SIMATIC IPC commissioning guide.

If the NIC is an Intel I210 / I211 (the de-facto standard on SIMATIC IPC2x7G and 4x7D), install the latest Intel driver package from Intel Network Adapter Driver for Windows 10 (version 27.4 or later is recommended for Windows 10 LTSC 2019). Older Intel driver revisions (12.x and 13.x) had a documented bug where TCP keep-alive on port 102 was dropped; the only documented workaround was exactly the NIC reset the engineer discovered.

9. Resolution Path E - Windows Registry Tuning for Long-Lived IPC

Back up the registry, then create the following values under HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters:

reg add "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v MaxUserPort /t REG_DWORD /d 65534 /f
reg add "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v TcpTimedWaitDelay /t REG_DWORD /d 30 /f
reg add "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v KeepAliveTime /t REG_DWORD /d 180000 /f
reg add "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v TcpMaxDataRetransmissions /t REG_DWORD /d 5 /f
reg add "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v TcpMaxConnectRetransmissions /t REG_DWORD /d 3 /f

The KeepAliveTime value of 180000 ms (3 minutes) matches the keep-alive interval that the SIMATIC S7 protocol suite uses internally. WinCC and STEP 7 expect a keep-alive to be answered within that window. The four core parameters are documented in the Microsoft KB at Microsoft KB - Registry entries that modify TCP/IP behavior.

10. Resolution Path F - S7ONLINE and S7DOS Service Restart

If the IPC has been running for more than 30 days, the S7DOS helper service (registered as s7oiehsx64.exe or s7oiehsx.exe depending on the version) may be holding a stale handle. Restart it cleanly:

net stop "s7oiehsx64"
net stop "S7DOS"
net stop "SIMATIC IEPG Help Service"
timeout /t 5
net start "s7oiehsx64"
net start "S7DOS"
net start "SIMATIC IEPG Help Service"

On WinCC V7.4 and later, the channel SIMATIC S7 PROTOCOL SUITE uses an internal pool of TCP connections, and the only way to flush the pool is to stop and start the WinCC channel services:

net stop "WinCC_CCDataMgr_$(INSTANCE)"
net stop "WinCC_CCScheduler_$(INSTANCE)"
net start "WinCC_CCDataMgr_$(INSTANCE)"
net start "WinCC_CCScheduler_$(INSTANCE)"

$(INSTANCE) is the four-digit internal name of the WinCC project (for example, WinCC_CCDataMgr_DCS01). The WinCC V7.5 Communication Manual (entry ID 109751589) documents the service architecture.

11. Verification Procedure

After every change, verify in the following order:

1. From an elevated Command Prompt: ping -t 192.168.0.1 - must return < 1 ms replies indefinitely.
2. Open STEP 7, go to PLC > Display Accessible Nodes. The CPU 315-2 PN/DP must appear with IP 192.168.0.1 and the MAC printed on the front of the CPU.
3. Open the project, go online, and read the diagnostic buffer. The buffer must show no Communication error or Connection aborted entries.
4. Start WinCC Runtime. In the S7TCP channel diagnostics (right-click channel > Diagnostic), all connections must show OK and the tag simulation must update on the screen.
5. Leave the system under load for at least 24 hours and re-run the diagnostic matrix from section 3. The IPC must not need a manual NIC reset.
6. Capture a netsh trace show scenario=NetConnection report after 24 hours of normal operation; confirm that no TCP reset was issued against the IP of the CPU 315-2 PN/DP.

12. Long-Term Hardening Checklist

13. Field-Proven Caveats

• If the CPU 315-2 PN/DP is also acting as a PROFINET IO Controller and the IPC is supposed to act as a PROFINET IO Device, the TCP/IP-based S7 communication shares the same physical port with the PROFINET real-time channel. In this case, a managed switch with IRT support is mandatory, and the Speed & Duplex setting in section 8 must be 100 Mbps Full Duplex (not Auto).
• On a SIMATIC IPC with Hyper-V enabled, the default vSwitch can hijack the S7ONLINE access point and route it to a virtual NIC. Disable Hyper-V on engineering stations that use S7ONLINE.
• If the production line has any SCALANCE switch with port security enabled, the first failed S7 login can lock the port for 5 minutes. Read the SCALANCE port statistics before assuming the IPC is the culprit.
• WinCC V7.4 SP1 introduced a new S7Plus channel that uses OPC UA over TCP. The S7ONLINE access point is not used for S7Plus. If the project was migrated, the engineer may be looking at the wrong access point.
• STEP 7 V5.7 is the last V5.x release; newer TIA Portal projects (V16 and later) handle access point configuration differently, via the TIA Portal Online & Diagnostics view rather than SetPGUAC.exe.
• If the CPU is reachable from one PC but not from another on the same switch, the problem is on the second PC, not the PLC. Validate by swapping two PCs before opening a service ticket against the CPU.

14. Related Siemens Documentation

• S7-300 CPU 315-2 PN/DP / CPU 317-2 PN/DP Manual (entry ID 12996906)
• WinCC V7.5 Communication Manual (entry ID 109751589)
• Siemens FAQ - Approved security software for SIMATIC IPC (entry ID 109767282)
• STEP 7 V5.5 - Set PG/PC Interface documentation (entry ID 92611204)
• Microsoft KB - TCP/IP registry entries that modify behavior
• Norton Remove and Reinstall tool (NRT)

FAQ