S7 Routing Through HMI Ethernet Port: Siemens PLC S7-300 Limits

David Krause7 min read
SiemensTIA PortalTroubleshooting
Licensed PE Working through this on a live machine? A Maine-licensed engineer can take it from here — included with IMD hardware, by the hour for everything else. Book an engineer

Problem: Programming an S7-300 via the HMI Ethernet Port

The original machine topology is a Siemens SIMATIC S7-300 CPU 315-2DP on PROFIBUS-DP (MPI is not present on this CPU variant), networked to a SIMATIC HMI KP700 panel. The program is authored in SIMATIC Manager (STEP 7 V5.x); the HMI project is built in TIA Portal V14. The question: can a service laptop running SIMATIC Manager be plugged into the spare Ethernet port on the KP700 and reach the S7-300 over PROFIBUS to edit the program online?

Short answer: no. The KP700 (and the entire Comfort / KTP line below it) does not implement S7 routing as a passthrough gateway, so Ethernet traffic from a PG/PC cannot be forwarded over PROFIBUS-DP through the HMI.

Root Cause: HMI Devices Are S7 Routing Endpoints, Not Routers

S7 routing is the Siemens mechanism that allows a programming device (PG) to traverse a network with a different physical medium to reach a target CPU. Routing requires a device that can act as a gateway between two subnets. Siemens documentation distinguishes two roles:

  • S7 routing-capable devices (gateways): S7-300/400 CPUs with multiple PN/IE or DP interfaces, IE/PB-Link (e.g. IE/PB Link PN IO), CP modules such as CP343-1 / CP443-1, and SCALANCE switches/routers.
  • S7 routing consumers (endpoints): HMI panels, IPCs, and PG/PC stations. These can be the destination of a routed connection, but they do not forward frames onward.

Siemens field support on PLCTalk confirms this directly: "the HMI does not support S7 Routing as a passthrough device. You can load the HMI with S7 Routing but the HMI itself cannot do S7 Routing by itself." See the related thread at PLCTalk: Connect HMI and Laptop to PLC. The same constraint is referenced in Siemens FAQ "S7 routing possibilities with WinCC flexible / TIA".

Critical: A Comfort / KTP panel is a routing endpoint only. Inserting it as the gateway in the STEP 7 "Set PG/PC Interface" or in NetPro will produce a connection error ("The partner cannot be reached", "Router could not be found") because no routing record is generated for that hop.

Topology Diagnosis for the S7-300 + KP700 Case

The 6AV2 124-1KC02-0AX0 (KP700 Comfort) ships with a single PROFINET interface; the 6GK7 343-1CX10-0XE0 (CP343-1 Lean) is the typical add-on if Ethernet is needed on the S7-300. To verify whether routing is even possible in principle, build the topology table below.

Element Order Number Interface 1 Subnet Interface 2 Subnet
S7-300 CPU 315-2DP 6ES7 315-2AG10-0AB0 DP (X2) PROFIBUS-DP, 1.5 Mbps none (no PN port)
KP700 Comfort 6AV2 124-1KC02-0AX0 PROFINET (X1) Ethernet / 192.168.0.x none
Laptop PG Ethernet 192.168.0.x

Three observations:

  1. The CPU 315-2DP variant ordered in this thread has no PROFINET port (only the -2PN/DP variants do). The only routable path to the laptop is therefore over PROFIBUS.
  2. The KP700 connects to the CPU over PROFIBUS-DP. Its Ethernet port is an isolated PROFINET interface with no PROFIBUS gateway function.
  3. NetPro will refuse to build a "S7 connection" with the HMI as a router because the HMI station is configured as a single-interface HMI station with a non-routable S7 connection to the CPU.

Workable Alternatives

Pick the option that matches the physical hardware already in the panel.

Option A — Add an IE/PB Link or CP on the S7-300 side

Install a Siemens IE/PB Link PN IO (6GK1 411-5AB00) in the S7-300 rack or attach a CP343-1 (6GK7 343-1EX30-0XE0). Configure the link in STEP 7 NetPro as a router between the PROFINET subnet and the PROFIBUS-DP subnet. Then the laptop reaches the CPU via:

Laptop (192.168.0.10) → Ethernet → IE/PB Link (192.168.0.20 / PROFIBUS addr 2) → DP → CPU315-2DP (PROFIBUS addr 2)

PG/PC interface: TCP/IP → IE/PB Link → PROFIBUS. S7 routing must be enabled on the link's PROFINET interface in HW Config (Properties → Interface → Operating Mode → "S7 routing").

Option B — Swap the S7-300 CPU for a -2PN/DP variant

CPU 315-2PN/DP (6ES7 315-2EH14-0AB0) has an integrated PROFINET port and supports S7 routing natively between PN and DP. The laptop then plugs directly into the CPU's PN port and routes over the integrated interface. Note: the integrated PN port is on X1 P1; X1 P2 is a switch port for the panel. See S7-300 CPU 315-2PN/DP manual for routing configuration steps.

Option C — Migrate the project to TIA Portal

With TIA Portal V14 (or V15, V15.1, V16, V17 — KP700 firmware < V17 requires matching TIA version), the HMI connection editor and "Devices & Networks" view can build a routed S7 connection through a CP if the panel is configured with the HMI connection type "S7 routing". The HMI remains a consumer; you still need a true router (CP or IE/PB link) to traverse media. Migration is required if you intend to use the TIA "Download to device → PG/PC interface" over Ethernet.

Option D — Replace the panel with one that has routing capability

Several newer Comfort Panels (e.g. TP700 Comfort 6AV2 124-1GC02) support S7 routing through a CP mounted in the same S7-300 station when the HMI is a passive endpoint. Routing still requires the CP; the panel does not become a router. Verify panel firmware >= V14.0.0.0 to match the TIA V14 project.

Option E — Use a PROFIBUS PC adapter (last resort)

If no Ethernet hardware can be added, plug a Siemens PC Adapter USB A2 (6GK1 571-0BA00-0AA0) into the laptop and the PROFIBUS connector on the CPU's DP port. Set the PG/PC interface to PC Adapter (PROFIBUS) Auto and use MPI/DP baudrate 1.5 Mbps. This is the simplest direct path with no routing. See PC Adapter USB A2 manual.

Verification Procedure for the Routing Setup

  1. Open STEP 7 / NetPro, select the router (IE/PB Link or CP), open Properties → Interface → Operating Mode; confirm S7 routing is checked and a unique S7 subnet ID is set for both subnets.
  2. Save and compile the project; the "S7 routing" status icon must turn green in NetPro for each interface.
  3. On the laptop, set the PG/PC interface to TCP/IP → <router PROFINET interface IP>. Use the S7 online diagnostics in STEP 7: PLC → Online → Accessible Nodes; the CPU should appear under the router's address.
  4. From TIA Portal V14, choose Online → Download to device → Select target device; the route through the panel remains disabled, the route through the IE/PB Link is shown as PG/PC interface (TCP/IP) → IE/PB Link → PROFIBUS.
  5. Confirm with a small test block: insert OB1, set a marker in VAT, and verify the laptop can read/write online without timeout. Typical timeout in STEP 7 is 30 s; if it fails, check that the firewall on the PG has TCP/UDP 102 open (default S7 port).

Firmware and Catalog References

Component Order Number Relevant Firmware Required for S7 routing
CPU 315-2PN/DP 6ES7 315-2EH14-0AB0 V3.3 or later Yes (PN ↔ DP)
CP 343-1 Lean 6GK7 343-1CX10-0XE0 V3.0 or later Yes (with S7 routing enabled)
IE/PB Link PN IO 6GK1 411-5AB00 V6.0 or later Yes
KP700 Comfort 6AV2 124-1KC02-0AX0 V14.0.0.0 or later No (routing endpoint only)
PC Adapter USB A2 6GK1 571-0BA00-0AA0 N/A (direct DP connection)

Default port: TCP 102 (ISO-on-TCP / RFC 1006). Default PROFIBUS baudrate for S7-300 systems: 1.5 Mbps. STEP 7 (SIMATIC Manager) is supported up to V5.7; migration to TIA Portal is recommended for current firmware combinations.

FAQ

Can a SIMATIC HMI panel route S7 traffic between Ethernet and PROFIBUS?

No. Comfort, KTP, and most older panels act only as S7 routing endpoints. To bridge Ethernet to PROFIBUS you need a real router such as an IE/PB Link PN IO (6GK1 411-5AB00) or a CPU with two interfaces.

What is the difference between a routing endpoint and a routing router in S7?

An endpoint terminates the S7 connection (HMI, PC, IPC); a router forwards S7 frames between two subnets. NetPro must mark the device as a router and assign S7 subnet IDs to both interfaces for routing to be active.

Which S7-300 CPU has both PROFIBUS and PROFINET for native routing?

CPU 315-2PN/DP (6ES7 315-2EH14-0AB0) and CPU 317-2PN/DP. Firmware V3.3 or later is required; TIA Portal configures S7 routing under "Devices & Networks → Interface → Operating Mode → S7 routing".

Will TIA Portal V14 allow S7 routing through the KP700?

No. The TIA "HMI connection" editor can target a routed CPU, but the panel itself is never the router. You must configure a CP or IE/PB Link in the S7-300 station as the routing device; otherwise the download fails with "Router could not be found".

Is the Siemens PC Adapter USB A2 supported in Windows 10 / 11?

Yes, the 6GK1 571-0BA00-0AA0 supports Windows 10 (32/64-bit) and Windows 11 with driver V2.x. Use PC Adapter (PROFIBUS) Auto as the PG/PC interface and 1.5 Mbps for the standard S7-300 network.

Back to blog