S7-400H CP 443-1 Access Protection: Denying Plant LAN Access

Problem Definition: Unauthorized PG/PC ONLINE Access from Plant LAN

A redundant SIMATIC S7-400H system built around the CPU 414-4H (6ES7 414-4HM14-0AB0 or later) is fitted with two CP 443-1 EX20 communications processors (order number 6GK7 443-1EX20-0XE0) configured for PROFINET / S7 communication. The two CP cards hold the IP addresses 192.168.0.81 and 192.168.0.82 on the private automation subnet 192.168.0.0/24. The same subnet carries a Real-Time Information Portal (RTIP) server that publishes plant data as web pages. The plant-wide corporate LAN uses 172.21.0.0/16 and serves approximately eight engineering / operations clients that need read-only access to the published web data.

Both networks are bridged through a 24-port manageable Layer-2 switch that sits between the 8-port unmanaged switch at the CPU rack and the corporate LAN uplink. The unintended consequence of this topology is that any client on 172.21.0.0/16 with a copy of STEP 7 V5.5 (SIMATIC Manager) installed can resolve 192.168.0.81 or 192.168.0.82, scan the MPI/TCP subnet, and open an ONLINE session against the CPU 414-4H. Because the H-CPU shares the same backplane and STEP 7 project as both redundant CPs, a single ONLINE connection from a non-authorized subnet is sufficient to download hardware configuration, force variables, modify the user program, or stop the CPU — a hard violation of IEC 62443 zone-and-conduit principles and of the typical plant security policy that separates OT and IT domains.

The remediation is delivered at two layers:

1. CP 443-1 EX20 layer: configure the IP Access Control List (ACL) inside the CP to reject PG/OP connections originating from 172.21.0.0/16.
2. Managed-switch layer: configure static ACL / port-security rules on the 24-port switch so that 172.21.x.x MAC/IP pairs cannot traverse the uplink to the automation subnet.

This article documents both layers, the verification procedure, the firmware prerequisites, and the troubleshooting matrix for the most common field failures.

CP 443-1 EX20 Hardware Identification

Confirm that the CP fitted in the S7-400H rack is the variant that supports the IP ACL feature. The relevant catalog numbers and firmware baselines are listed below.

Older CP 443-1 variants (e.g. 6GK7 443-1EX11-0XE0) require a firmware upgrade to a minimum of V2.6 before the IP ACL dialog becomes available in HW Config. Siemens published the firmware update package on the support portal under entry ID 27013555 — CP 443-1 manuals and firmware.

Security Architecture of the CP 443-1 EX20

The CP 443-1 EX20 enforces access protection through three independent mechanisms, evaluated in the order shown:

1. Port filter: blocks unused TCP/UDP ports so only S7 (port 102), PNIO (port 34962/34963), SNMP (port 161), and explicitly enabled services respond.
2. IP access control list (ACL): an explicit allow / deny table indexed by (source IP, source mask, destination IP, destination mask, protocol, port). Up to 32 entries can be configured per CP. The first matching rule wins; if no rule matches, the packet is accepted by default unless a global "Block all" rule is placed at the bottom of the table.
3. S7 password protection: protects the CPU against any ONLINE connection that has passed the ACL but lacks the configured CPU password (in HW Config → CPU → Protection).

It is critical to understand the default behavior: if no ACL rule is defined, the CP accepts every incoming connection on the allowed ports. Therefore the ACL must be configured even when the network appears "private" behind a managed switch — defense-in-depth requires that the CP itself enforce the policy.

Prerequisites

• STEP 7 V5.5 + SP4 or later installed on the engineering station.
• SIMATIC Manager project with both CP 443-1 EX20 objects present in HW Config (rack 0 / rack 1 for the H-system).
• CPU password known (write it down before starting; if the password is lost the SD card must be reformatted).
• Source IP ranges documented in CIDR notation:
  • Allowed (authorized HMI / engineering stations): 192.168.0.0/24 minus CP addresses, e.g. 192.168.0.50–192.168.0.70.
  • Denied (plant LAN): 172.21.0.0/16.
  • RTIP server (allowed): 192.168.0.100.
• Managed switch documentation (vendor / model / firmware) — typical candidates are SCALANCE XC-216, SCALANCE XR-324, Cisco IE-3300, or Hirschmann RS20/RS30.
• PG/PC interface set to TCP/IP → Intel Ethernet on the engineering station.

Network Topology — Reference Diagram

The diagram below summarizes the topology assumed by the configuration steps that follow. The 8-port unmanaged switch is replaced by a SCALANCE XB208 (managed) when defense-in-depth is required; the example below shows both layers.

+-----------------+      +----------------------+      +----------------------+
|  CPU 414-4H #0  |      |  24-port Managed     |      |   Plant LAN          |
|  (rack 0)       +------+  Switch (uplink)     +------+   172.21.0.0/16      |
|                 |      |  VLAN 10 = OT        |      |   ~ 8 clients        |
|  CP443-1 EX20   |      |  VLAN 20 = IT        |      +----------+-----------+
|  192.168.0.81   +------+  ACL: deny VLAN 20 → |                 |
+-----------------+      |  VLAN 10             |                 |
                         +----------+-----------+                 |
+-----------------+                |                             |
|  CPU 414-4H #1  |                |                             |
|  (rack 1)       |      +---------v-----------+                 |
|                 |      |  8-port switch      |                 |
|  CP443-1 EX20   +------+  (managed XB208)    |                 |
|  192.168.0.82   |      |  IP ACL on CP       |                 |
+-----------------+      +---------------------+                 |
                                    |                             |
                          +---------v--------+                    |
                          |   RTIP Server    |                    |
                          |  192.168.0.100   |                    |
                          +------------------+                    |
                                                                      
(plant LAN 172.21.x.x clients reach RTIP via L3 routing; 
 ACL on CP443-1 blocks them from 192.168.0.81 / .82 PG/OP port)

Step-by-Step: Configure the IP ACL inside the CP 443-1 EX20

1. Open SIMATIC Manager and load the S7-400H project.
2. Open HW Config and double-click the CP 443-1 EX20 in slot 4 of rack 0 (the second CP lives in slot 4 of rack 1).
3. Select the Properties dialog, then the tab Access Protection (German: Zugriffsschutz). If this tab is missing, the CP firmware is below V3.2 — perform a firmware update first.
4. In the Access Control List (ACL) table enter the rules shown below. Each rule row accepts or denies traffic based on source IP and destination IP. The "Protocol / Port" column is left at TCP / 102 for S7 ONLINE blocking.

Repeat the same set of rules for destination 192.168.0.82 (second CP in the H-rack) — duplicate the table and change the destination IP. The CP processes the ACL per destination interface, so both CPs must be configured independently.

5. Click Apply, then OK. Repeat for the second CP in rack 1.
6. Save & compile the HW Config (Station → Save and Compile).
7. Download the HW Config to the H-system. During download, both CPs reset their TCP/IP stack for approximately 5–10 s; the S7-400H keeps running because the redundancy link is unaffected.

Step-by-Step: Configure the Managed-Switch Layer

The CP-side ACL protects only S7 traffic destined for the CP. Other OT protocols (PROFINET, NTP, SNMP, DNS, HTTP to the RTIP) still flow between the subnets. Use the managed switch to restrict L2 / L3 forwarding between VLAN 10 (OT, 192.168.0.0/24) and VLAN 20 (IT, 172.21.0.0/16). The example below uses a SCALANCE XC-216; adapt the commands for Cisco / Hirschmann equivalents.

1. Create VLAN 10 (OT) and VLAN 20 (IT). Assign port 1 (uplink to plant LAN) to VLAN 20 untagged, and ports 2–8 (CP + RTIP) to VLAN 10 untagged. The trunk port (uplink to corporate core) carries both VLANs tagged.
2. Enable IP routing on the switch (Layer-3 option in SCALANCE) only for traffic that must traverse subnets — typically none if RTIP and CP are on the same VLAN 10.
3. Define an ACL that blocks TCP/102 from VLAN 20 to VLAN 10:

! SCALANCE XC-216 example (CLI)
acl 100 deny tcp 172.21.0.0 0.0.255.255 192.168.0.0 0.0.0.255 eq 102
acl 100 permit ip any any
interface gigabitethernet 0/1
  ip access-group 100 in

4. Enable 802.1X port-based authentication on the plant-LAN uplink so that only RADIUS-authorized MACs can join VLAN 20.
5. Enable storm control and BPDU guard on all access ports to prevent loop-bridge injection from the IT side.
6. Disable DTP, CDP, and LLDP-MED on ports facing the OT network (information leakage).

For Cisco IE-3300 industrial switches the equivalent access list is:

ip access-list extended OT-SEGMENT
 deny tcp 172.21.0.0 0.0.255.255 192.168.0.0 0.0.0.255 eq 102
 deny udp 172.21.0.0 0.0.255.255 host 192.168.0.81 eq snmp
 deny udp 172.21.0.0 0.0.255.255 host 192.168.0.82 eq snmp
 permit ip any any
interface GigabitEthernet1/0/1
 ip access-group OT-SEGMENT in

Password Protection and PG/OP Authorization on the CPU

The IP ACL stops the TCP connection at the CP; the CPU password stops the connection at the CPU itself. Both layers should be enabled so that a misconfigured ACL does not immediately expose the CPU.

1. HW Config → CPU 414-4H → Protection tab.
2. Set the protection level to Write-protection for F-blocks or higher. Choose level 2 ("Write-protection") for normal operation, level 3 ("Read/write protection") when the plant is in a maintenance shutdown.
3. Enter a CPU password (8 characters minimum, alphanumeric). Siemens stores the password in the SD card; a forgotten password requires card re-format and full project reload.
4. Also configure the CP 443-1 → Security tab → PG/PC access with the same password so that S7 routing from the engineering station is also authenticated.

Verification Procedure

Run the checks below before declaring the configuration complete. Each test exercises one of the protection layers.

1. Authorized ONLINE: from 192.168.0.50 open SIMATIC Manager → Accessible Nodes → confirm 192.168.0.81 and .82 appear. Open the project and force a DB variable — must succeed.
2. Unauthorized ONLINE: from 172.21.5.42 open SIMATIC Manager → Accessible Nodes. The scan must NOT return the CP IP. If the CP is still visible, the ACL on the switch is forwarding the S7-TSAP broadcast.
3. RTIP web access: from 172.21.5.42 open a browser and reach http://192.168.0.100 (RTIP web portal). The HTTP/80 path must remain open — the ACL on TCP/102 must not interfere.
4. CP diagnostics: in STEP 7 → CP443-1 → Diagnostics → Connection Statistics. The counters Denied TCP connections and ACL rejects must increment during step 2.
5. SNMP trap: enable SNMP trap on the CP for ACL-deny events; configure the SCALANCE to forward the trap to the central SIEM.

Diagnostics — Reading the CP Event Log

The CP 443-1 EX20 stores ACL-related events in its diagnostic buffer, accessible via STEP 7 → CP → Diagnostics → Diagnostic Buffer. The most relevant event IDs:

For detailed byte-level decoding refer to the CP 443-1 Diagnostics Manual in entry 27013555.

Troubleshooting Matrix

Firmware and Compatibility Notes

The IP ACL feature is firmware-version dependent. Verify the version reported under HW Config → CP → Module Information → Firmware before commissioning.

Firmware files are distributed by Siemens as *.upd packages and loaded via STEP 7 → PLC → Update Firmware. Do not downgrade from V3.2.x to V3.0.x — the ACL table is stored in a different NVM region and a downgrade will discard it.

Local Network Privacy and Modern Browsers

A side effect observed when the RTIP server is accessed from a plant-LAN client is the modern browser's Local Network Privacy (LNP) enforcement. Chrome, Edge, and Firefox block sub-resource fetches to 192.168.0.0/16 when the top-level page is served from a public or different private range, unless the browser receives a CORS Access-Control-Allow-Private-Network: true header from the RTIP server. This is unrelated to the CP access protection but often surfaces during the same troubleshooting session.

Remediation steps for the RTIP server side:

1. Add the header Access-Control-Allow-Private-Network: true on the RTIP web responses.
2. If the browser still blocks, enable the Chrome flag chrome://flags/#private-network-requests-respect-anchor-origins as a temporary measure.
3. On the engineering station running the browser, ensure the corporate firewall allows 172.21.x.x → 192.168.0.x:80,443 at L4.

Commissioning Checklist

• [ ] CP 443-1 EX20 firmware ≥ V3.2.x on both racks.
• [ ] IP ACL configured with explicit permit list for authorized PGs / RTIP.
• [ ] Default-deny rule (#99) placed at the bottom of each CP's ACL table.
• [ ] CPU 414-4H protection level ≥ 2 with non-default password.
• [ ] Managed switch ACL mirrors the CP rule (block TCP/102 from 172.21.0.0/16 to 192.168.0.0/24).
• [ ] 802.1X / port-security enabled on plant-LAN access ports.
• [ ] SNMP traps enabled for ACL-deny events, forwarded to SIEM.
• [ ] Backup of HW Config (.s7f / .s7p) stored offline.
• [ ] Verification report signed by OT and IT stakeholders.

FAQ