S7-300 PN: Changing IP Address from a Different Subnet in STEP 7

1. Problem Definition and Scope

An S7-300 station equipped with a PROFINET interface — typically a CPU 315-2 PN/DP (6ES7315-2EH14-0AB0), CPU 317-2 PN/DP (6ES7317-2EK14-0AB0), CPU 319-3 PN/DP (6ES7319-3FP00-0AB0), or a PROFINET-capable CP (CP 343-1, 6GK7343-1EX30-0XE0 and successors) — is normally commissioned with a fixed IPv4 address and a 255.255.255.0 (or coarser) subnet mask. When the same station is later moved into a plant network whose IP range is incompatible with the original configuration, the engineering station (PG/PC) can no longer establish an S7 connection, open the diagnostic buffers, or use the SIMATIC Manager's "Accessible Nodes" browser.

This article describes three field-proven procedures to re-address the PN interface from a different subnet:

1. The native STEP 7 / NCM Edit Ethernet Node workflow (DCP-based, project-independent)
2. Placing the PG/PC temporarily inside the CPU's existing subnet (or using the PG as a gateway)
3. Routing the request through an intermediate S7-1500 / SCALANCE device that supports IP forwarding

All three methods rely on the DCP (Discovery and Configuration Protocol, IEC 61784-2) multicast frames that every PROFINET device is required to answer, regardless of its currently configured IPv4 address. As long as Layer 2 connectivity is intact, the IP layer is irrelevant for the address-assignment step.

2. Prerequisites

3. PROFINET IP/Subnet Reference Data

Before re-addressing the CPU, the new IPv4 address and subnet mask must be chosen so that the PROFINET IO Controller, all IO Devices, and the engineering station can coexist in a single broadcast domain. The PROFINET commissioning rule (PROFINET Installation Guide, edition 2021) recommends a dedicated subnet for automation traffic; the following table summarises the supported IPv4 ranges.

For the Edit Ethernet Node procedure the destination subnet mask is supplied as four decimal octets, e.g. 255.255.255.0. The router address is optional for layer-2 PROFINET IO; it becomes mandatory when S7 communication must traverse an L3 boundary (Section 6).

4. Method 1 — STEP 7 "Edit Ethernet Node" (NCM S7)

This is the canonical Siemens procedure and works for every SIMATIC S7 PN/CP target reachable at layer 2, independent of the current IP configuration.

4.1 Menu path in STEP 7 V5.x

1. Open SIMATIC Manager.
2. Choose PLC → Edit Ethernet Node… (German: PLC → Ethernet-Teilnehmer bearbeiten…).
3. NCM S7 Initialise launches and opens the Edit Ethernet Node dialog.
4. Click Browse… to start the DCP multicast search.
5. After a few seconds every reachable PROFINET node appears with its MAC address, current IP, current subnet, and device type (e.g. S7-300 CPU 315-2 PN/DP).
6. Select the desired entry, type the new IP address, the new Subnet mask, and optionally a Router address.
7. Click Assign IP Configuration. The CPU writes the parameters non-volatile to its flash and acknowledges the DCP Set request.

4.2 Equivalent path in TIA Portal

1. Open the project (or the "Project view" with no project tree entry for the target).
2. From the menu choose Online → Online & Diagnostics.
3. In the Online access tree, expand the active network adapter and click Accessible nodes — the same DCP browse result is displayed.
4. Right-click the discovered CPU and select Assign IP address….
5. Enter the new IP / subnet / router values and confirm with Assign.

For a CPU that is not yet in the project, the Online & Diagnostics view additionally allows a full Reset to factory settings which restores IP 0.0.0.0, no PROFINET device name, and no project — useful when the original addressing is unknown.

4.3 What the procedure writes

The DCP Set command updates the following entries inside the CPU's PROFINET interface block:

• PN-IO interface IP (tag IPSuite[1] in the system data)
• PN-IO subnet mask (IPSuite[2])
• Default router address (IPSuite[3]) — only if the optional field is filled
• PROFINET device name (only if the field is changed)

All four values are stored in the load memory and survive power-off / STOP-RUN transitions.

5. Method 2 — Place the PG in the CPU's Subnet (Direct Path)

When the engineering station must perform a full upload, firmware update, or project download, the PG needs a routable IP inside the same broadcast domain as the CPU. The fastest field workflow is to temporarily re-IP the PG:

1. Read the current CPU IP from the front-cover label or from the NCM browse.
2. Set the PG's Ethernet adapter to a static address inside the same /24, e.g. CPU 192.168.0.10 → PG 192.168.0.20 / 255.255.255.0.
3. Open SIMATIC Manager, run PLC → Accessible Nodes — the CPU should now appear in green.
4. From here the standard Edit Ethernet Node (Section 4) or Assign IP address from the Online & Diagnostics view can be used to push the new plant range.
5. Restore the PG to its normal network address when finished.

5.1 PG as Gateway (workaround when subnet change is restricted)

When the operator has been told "do not touch the plant network" but the CPU cannot be moved out of its existing subnet, the PG can be configured to use the CPU's own IP as its default gateway on a virtual or secondary adapter. This is rarely needed on S7-300 but is sometimes used to drive a temporary HMI panel through a wireless bridge. Document the procedure locally as it is not officially endorsed by Siemens for routine commissioning.

6. Method 3 — IP Forwarding via S7-1500 / SCALANCE

For plants where the S7-300 sits on a layer-2 segment that is physically separated from the engineering VLAN, an intermediate S7-1500 CPU (or SCALANCE XC/M switch with routing) can forward the DCP frames. The forwarder must support the IP forwarding feature described in the TIA Portal documentation: TIA Portal V21 — Configuring IP Forwarding.

Configure the S7-1500 in TIA Portal as follows:

1. Open Device & Networks and add the S7-1500.
2. Activate the Use router option on the PN interface facing the S7-300 and enter the S7-1500's address on that subnet as the router.
3. Repeat for the PN interface facing the engineering VLAN.
4. Compile and download. The CPU now transparently relays DCP Set / Identify requests.

Once the route is active, the engineering station can run the same Edit Ethernet Node procedure as in Section 4 — the DCP frames are encapsulated in IPv4/UDP and reach the S7-300 across the L3 boundary.

7. PROFINET Device Name and Name Assignment

Changing the IPv4 address does not change the PROFINET device name (the string the IO Controller uses to identify the IO Device via LLDP/DCP). If the station must participate in a different PROFINET IO system, assign a new name as well:

1. In STEP 7 V5.x: PLC → Ethernet → Edit Ethernet Node → Browse → select CPU → Modify PROFINET device name.
2. In TIA Portal: Online & Diagnostics → Functions → Assign PROFINET device name.
3. Confirm with Assign Name. The new name is written to the non-volatile PROFINET name store of the CPU.

Note that the S7-300 CPU is itself typically a PROFINET IO Controller and not an IO Device, so a name assignment is normally only relevant for an attached CP 343-1 or for a CP 343-1 Advanced acting as IO Device.

8. Verification Procedure

1. After the new IP has been written, cycle the CPU power (STOP → MRES → RUN) or, alternatively, execute the Restart OB100. The new address is only read on cold restart when the CPU is in the factory state; on warm restart the existing values are kept.
2. Open PLC → Accessible Nodes in SIMATIC Manager (or Online → Accessible nodes in TIA Portal) and confirm the CPU appears with the new IP.
3. Open PLC → Diagnostic / Setting → Module Information and check the diagnostic buffer — a successful DCP Set is logged as event ID 0x04A4 "Parameter assignment of PN-IO interface".
4. Initiate a small Upload Station to PG test to validate full S7 read/write across the new subnet.

9. Troubleshooting Matrix

10. Security and Access Considerations

From firmware V3.x onwards the S7-300 PN CPU supports Access protection with up to three password levels (read, write, HMI). The DCP Set command itself is not protected by a password — it is part of the underlying PROFINET commissioning contract — but subsequent project downloads and online configuration changes are. Always:

• Document the previous and new IP/subnet/router triple in the plant's PROFINET addressing register.
• Update the engineering project's Properties → Ethernet interface block so the offline configuration matches the new online configuration; otherwise the next download will reset the IP back to the old value.
• Re-export the SIMATIC project archive so the new addressing is preserved in the AS backup.

11. Firmware and Software Compatibility

On CPs that are themselves a PROFINET IO Device, the IP can additionally be written from the S7-300 user program by calling SFB 104 IP_CONF (background DB instance) — useful for serial commissioning of identical machines whose final plant IP is assigned by the master controller at start-up.

12. Field-Proven Commissioning Checklist

1. Print the MAC list of every CPU / CP that must be re-addressed.
2. Verify physical connectivity (link LED green, no SFP errors).
3. Set the PG to Obtain IP automatically.
4. Run Edit Ethernet Node → Browse and confirm visibility.
5. Assign the new IPv4 address, subnet mask, and (if needed) router address.
6. Assign a new PROFINET device name if the IO Controller expects a different name.
7. Power-cycle the CPU to lock the parameters in non-volatile memory.
8. Restore the PG's normal IP and re-test the S7 connection.
9. Update the offline project and re-archive the station.
10. Document the change in the plant PROFINET address register.