S7 PLC Accessible Nodes Not Found via Ethernet: Troubleshooting

Problem Definition

The symptom described is narrow but very specific: a Siemens SIMATIC S7 controller (S7-300, S7-400, S7-1200, or S7-1500) accepts a project download from STEP 7 or the TIA Portal over the Ethernet interface, yet the same engineering station cannot list the controller under Online > Accessible Nodes (STEP 7 V5.x) or Online > Accessible devices (TIA Portal). A second symptom frequently accompanies the first: Edit Ethernet Node in STEP 7 V5.x returns an empty result list, even though the PLC has been confirmed reachable from the same PC via ping. Communication over MPI or PROFIBUS still works without change.

This pattern almost always indicates a configuration mismatch between the PG/PC interface assignment, the S7 routing mechanism (broadcast vs. directed), and the Windows firewall profile. The download path succeeds because TIA Portal / STEP 7 opens a directed TCP connection to a known IP address configured in the project, while Accessible Nodes depends on layer-2 MAC broadcast (S7-300/400) or S7 discovery frames (S7-1200/1500) that may be filtered by switches, anti-virus software, or a Windows firewall rule that was silently enabled.

Affected Platforms and Firmware

Root Cause Matrix

Five independent failure paths produce this symptom. Each must be ruled out before assuming a hardware fault on the CPU, because S7 controllers do not have replaceable Ethernet PHYs in the field-replaceable sense, and CPU replacement is expensive.

Prerequisites

• STEP 7 V5.5 SP4 (or later) / STEP 7 V5.6, or TIA Portal V15.1 (or later) installed on the engineering station.
• Administrator rights on the engineering PC to install/set the PG/PC interface and modify firewall rules.
• Direct Ethernet cable (patch) plus known-good switch port, or a cross-over cable for direct PC-to-CPU link.
• CPU IP address, subnet mask, and MAC address (printed on the front label of every S7 CPU).
• cmd.exe with ping, arp -a, and netsh advfirewall available.

Step 1 - Verify the Physical Layer and TCP/IP Reachability

Before opening STEP 7, confirm that the PC and the S7 CPU exchange IP packets. This isolates the fault from the SIMATIC software stack.

1. Connect the engineering PC directly to the CPU PROFINET port (X1) with a Cat5e or better patch cable. For older S7-300 CPUs (e.g., 315-2 PN/DP, 6ES7315-2EH14-0AB0) use port X2 if X1 is configured for PROFIBUS-only.
2. On the CPU, read the configured IP address from Display > Settings > IP Address (S7-300/400) or from Online & Diagnostics > IP Address (S7-1200/1500). Default addresses are typically 192.168.0.1 for S7-1200/1500 and unassigned for S7-300/400 until configured.
3. On the PC, assign a static IP in the same subnet, e.g. 192.168.0.10 / 255.255.255.0. Do not rely on DHCP for commissioning.
4. From cmd.exe, run ping 192.168.0.1 -n 4. A successful reply confirms layer-1, layer-2, and IP forwarding.
5. Run arp -a and verify that the CPU's MAC address (printed on the CPU front) appears in the table with the assigned IP. No MAC entry means ARP is being blocked (RC-2 or RC-5).

Step 2 - Assign the Correct PG/PC Interface

This is the single most common cause of the symptom. The PG/PC interface must be set to TCP/IP <-> ISO on TCP bound to the same physical NIC that connects to the PLC.

For STEP 7 V5.x

1. Open Control Panel > Set PG/PC Interface (32-bit application; on 64-bit Windows it resides under C:\Program Files (x86)\Siemens\Automation\Simatic Manager\S7PCTP32.exe or is launched through Start menu).
2. Select the entry matching the wired Ethernet adapter, e.g. TCP/IP (Auto) -> Intel(R) I211 Gigabit [MAC address]. Do not select Wi-Fi.
3. Click Properties. Confirm that TCP/IP (Auto) is selected, not ISO alone (ISO-only is for non-routable LANs) and not TCP/IP (RFC 1006) with a hard-coded IP unless the CPU is on a remote subnet.
4. Click OK and acknowledge the warning that the assignment applies system-wide. Restart SIMATIC Manager if it was open.

The procedure is documented in the Siemens Support article Setting the PG/PC interface in STEP 7 V5.x.

For TIA Portal V15 and later

1. Open the project. From the menu, choose Online > Online access.
2. Locate the wired Ethernet adapter under Network interface cards. If multiple cards are listed, identify the correct one by MAC address (compare with ipconfig /all).
3. Double-click the entry to mark it as the active online access path. A small "X" or check appears next to it.
4. Choose Online > Accessible devices. The portal should now broadcast on the selected NIC.

Step 3 - Verify S7 Broadcast Reachability

The Accessible Nodes function uses two protocols depending on the CPU class:

Verify broadcast traffic with Wireshark (display filter udp.port == 34964 || udp.port == 34963) on the engineering PC. If the PC sends the discovery packet but receives no reply, the CPU is reachable (ping works) but the broadcast is being filtered.

Enable Broadcast on S7-1500 (FW 2.6 and Later)

Beginning with S7-1500 firmware V2.6, Siemens disabled the S7 broadcast listener by default to harden the controller against unsolicited discovery on shared networks. To re-enable broadcast for an engineering network:

1. In TIA Portal, open the device configuration of the S7-1500 CPU.
2. Navigate to Properties > General > PROFINET interface [X1] > Ethernet addresses.
3. Clear the option "Enable S7 broadcast" if present, or in newer firmware versions, ensure "Accessible via S7 routing" is unchecked and "Support device discovery without S7 routing" is checked.
4. Recompile the hardware configuration and download to the CPU.

Step 4 - Configure Windows Firewall for SIMATIC Communications

From Windows 7 onward, the default firewall profile blocks inbound replies on UDP 34964 and TCP 102. STEP 7 and TIA Portal install firewall rules during setup, but these rules can be lost if an installer runs elevated in a different account context, or if a non-default security policy is applied.

1. Open Windows Defender Firewall with Advanced Security (wf.msc).
2. Inspect Inbound Rules for entries beginning with SIMATIC, S7DOS, PNIO, or Siemens. The expected rules are:
   • SIMATIC Discovery Service (S7DOS) UDP-In – UDP 34964, profile Private/Domain
   • SIMATIC S7DOS TCP-In – TCP 102
   • Siemens TIA Portal – any
3. Ensure each rule is enabled and bound to the Private profile at minimum. Public profile typically remains blocked.
4. Classify the engineering network as Private: Settings > Network & Internet > Ethernet > Network profile type.
5. If rules are missing, reinstall them from the TIA Portal installation media under Support\Firewall or download the latest SIMATIC Security Configuration Tool from Siemens Support.

For deeper guidance on Siemens-specific firewall requirements and recent CVEs affecting SIMATIC communications, see SIMATIC S7-1200/1500 Security Advisories.

Step 5 - Switch and Network Infrastructure

Managed switches frequently disable broadcast or filter DCP multicast by default. Symptoms of switch-induced filtering:

• Direct PC-to-CPU link works (accessible nodes found).
• Through any managed switch, accessible nodes is empty even though ping succeeds.

To diagnose, issue the following on the switch CLI (examples for SCALANCE XC-200):

This filters the MAC-address table for PROFINET MACs (vendor OUI 01:0E:CF). If the CPU's MAC is missing, broadcast is being filtered or the port is in a wrong VLAN. Adjust as follows:

• Enable broadcast storm control only above a sensible threshold, e.g. storm-control broadcast level 20 (SCALANCE command). Do not enable per-port broadcast blocking on the PLC port.
• Disable IGMP snooping on the PLC VLAN, or add a static MAC entry for the CPU.
• Allow PROFINET multicast MAC 01:0E:CF:00:00:00 through any filtering ACL.

Step 6 - Anti-virus and TDI/WFP Filters

Endpoint security suites from Symantec Endpoint Protection, McAfee Endpoint Security, Kaspersky, and Trend Micro install Windows Filtering Platform (WFP) callouts that drop S7 discovery frames silently. To test:

1. Disable the AV real-time scan temporarily.
2. Reopen STEP 7 and run Accessible Nodes.
3. If nodes appear, configure an AV exclusion for the SIMATIC executable directory (default C:\Program Files\Siemens\Automation) and for UDP ports 34963/34964.

Note that some AV products also insert TDI drivers that cannot be excluded cleanly. In such cases, uninstall the AV on the engineering station, since S7 commissioning is not a use case supported under those products.

Step 7 - Directed IP Routing as a Permanent Fix

Broadcast-based discovery is fragile. For production environments, configure the engineering station with a static list of accessible devices using the Online access table in TIA Portal or by adding the PLC's IP under PG/PC interface > TCP/IP > Properties > IP address in STEP 7 V5.x.

The procedural reference is Why is the S7 station not displayed under "Accessible nodes" in STEP 7 or TIA Portal?, which describes both broadcast and directed-routing modes. The companion manual is the S7-1500 communication function manual available from the Siemens Support entry S7-1500 Communication.

Verification Procedure

1. Open Set PG/PC Interface and verify the wired Ethernet adapter is selected with the MAC that matches ipconfig /all.
2. From the project in STEP 7 / TIA Portal, choose Online > Accessible Nodes. The CPU must appear with its IP and MAC within 5 seconds on a local subnet.
3. Right-click the CPU and select Online & Diagnostics. The diagnostic buffer must download without error and report the firmware version and order number (e.g., 6ES7 515-2AM02-0AB0 / V2.9.7).
4. Run Compile and download to confirm a full project download still succeeds. If accessible nodes appears but download fails, jump to error code 33:16621 in the diagnostic buffer.

Diagnostic Checklist

When to Replace Hardware

If all seven checks pass but accessible nodes is still empty, the CPU PROFINET port may have a hardware fault. Confirm by connecting a second known-good CPU of the same order number; if that CPU is also undiscoverable on the same cable and PC, the cable, NIC, or Windows image is at fault. If the second CPU is discoverable, the original CPU is suspect and should be RMA'd through Siemens Industry Online Support with the diagnostic buffer export attached.