S7 Teleservice Without PSTN: Ethernet and VPN Alternatives

1. Problem Overview

A common commissioning scenario: a vendor specified Siemens Teleservice remote-dialup access for an S7 PLC, but the customer delivered an Ethernet drop to the control cabinet instead of an analog POTS line. Local telco service is unavailable for two years or longer, and the facility's only outbound WAN is a routed Ethernet connection through the plant server.

This document catalogs the four engineering-acceptable workarounds and provides a decision matrix so the controls engineer can pick the path that matches the available network policy, the S7 hardware generation in the cabinet, and the customer's security posture.

2. Siemens Teleservice Architecture Reference

Siemens Teleservice originally assumed a dial-up model: an engineering station dials the remote site, the call terminates on a TS Adapter connected to the PLC's MPI/PROFIBUS port, and STEP 7 / TIA Portal establishes an online session over the modem link.

The Teleservice concept uses ISO-on-TCP (RFC 1006) and the S7 Communication protocol. Once those protocols traverse an Ethernet path instead of a dial-up modem, the engineering toolset is unchanged. The decision tree below shows whether you can skip the analog stack entirely.

3. Solution Matrix Overview

4. Solution 1 - ATA Devices (Ethernet-to-POTS Conversion)

An Analog Telephone Adapter (ATA) terminates SIP/VoIP on the WAN side and presents an FXS (foreign exchange station) RJ-11 jack on the local side. The TS Adapter II then sees what looks like a normal POTS line with dial tone, DTMF, and 33.6 kbps modem handshaking.

4.1 Grandstream HandyTone HT-486 Field Notes

• WAN port is 10BASE-T only. Do not use the LAN port for general traffic; expect ~10 Mbps ceiling on any bridged device.
• Supports T.30 fax relay, which is the strongest indicator that V.21/V.22/V.34 modem handshakes will pass without transcoding artifacts.
• SIP-only; Skype does NOT accept inbound SIP. You need a real SIP account (free or paid).
• Distributor default config may ship unprovisioned; the integrated IVR/web UI must be touched before first use.
• PSTN passthrough feature (selectable with a *00 prefix) lets the same device fall back to a land line if SIP fails - useful during commissioning when WAN is intermittent.

4.2 ATA Commissioning Steps

1. Connect the HT-486 WAN port to the cabinet Ethernet drop. Assign a static IP or DHCP reservation.
2. From a laptop, browse to https://<ATA-IP> and accept the self-signed certificate.
3. Under Account 1, enter the SIP registrar, user ID, and password from your SIP provider (OvisLink, VoIP.ms, Flowroute, etc.).
4. Set Preferred Vocoder to G.711u or G.711a. Avoid G.729 for modem traffic - the 30 ms look-ahead breaks V.34 handshakes.
5. Disable Echo Cancellation, Silence Suppression, and Jitter Buffer > 60 ms on the FXS port.
6. Plug a POTS cord from the HT-486 phone jack to the TS Adapter II's LINE jack.
7. From the engineering station (also behind a matching ATA), dial the SIP DID number assigned to the cabinet ATA.
8. Watch the TS Adapter II's RD/SD LEDs; a carrier detect within 30 seconds indicates modem negotiation succeeded.

5. Solution 2 - Direct Ethernet Access via VPN

The cleanest engineering answer. If the S7 PLC has an Ethernet CP (CP 343-1, CP 443-1, integrated PROFINET on S7-1200/1500), or if you can drop in a TS Adapter IE, you bypass the analog stack entirely. A site-to-site VPN from the engineering office to the plant server gives STEP 7 / TIA Portal a flat L3 path to the PLC.

5.1 Why VPN Wins

• 33.6 kbps analog → 100 Mbps Ethernet. Project upload times drop from minutes to seconds.
• No SIP provider, no DID number, no FXS cabling.
• Native S7 Communication uses ISO-on-TCP port 102 - one firewall rule to maintain.
• Multiproject upload, HMI tag browse, and trace recording all work the same way they do locally.

5.2 Prerequisites

• S7 CPU or CP with Ethernet port and a configured IP address.
• Plant server with static public IP, or dynamic DNS (DDNS) endpoint.
• VPN concentrator (OpenVPN, WireGuard, IPsec, or an enterprise firewall such as FortiGate / Palo Alto / Sophos).
• Firewall rules allowing UDP/TCP for the VPN tunnel and TCP/102 to the S7 subnet.

5.3 Step-by-Step VPN Bring-Up

1. Assign the S7 CP a fixed IP inside the plant LAN (e.g. 10.20.30.40/24).
2. On the plant firewall, create a VLAN or zone named PLCSUBNET and place the S7 CP inside it.
3. Configure the VPN concentrator with a site-to-site tunnel to the engineering office. Use IKEv2 + AES-256-GCM where supported.
4. Push routes so the office subnet (e.g. 10.10.0.0/16) reaches 10.20.30.0/24.
5. Open only TCP/102 from PLCSUBNET to the office; deny everything else by default.
6. From TIA Portal, choose Online → Accessible nodes. The S7 CPU should appear within 5 seconds.
7. Run Online → Diagnostics; confirm the connection type reads TCP/IP and not Modem.

5.4 TIA Portal Address Parameters for Native Ethernet

6. Solution 3 - Ethernet-to-Fieldbus Gateways

If the S7 PLC has no Ethernet port and you cannot replace the CPU, an Ethernet-to-MPI/PROFIBUS gateway replicates the TS Adapter II's job but on a routable transport. Common choices include:

• Helmholz NETLink PRO - Ethernet to MPI/PROFIBUS, supports S7 Routing.
• Softing PROFIBUS-INspektor or profinet-INspektor - diagnostic gateways.
• Innuvis OPC Router or IBHsoftec S7-OPC for older S7-200 with no Ethernet.

Each gateway runs an internal S7 routing engine and exposes the PLC's MPI/PROFIBUS nodes as if they were locally attached. The gateway gets a fixed IP, sits in the cabinet, and the VPN tunnel terminates on a small industrial router (Phoenix Contact mGuard, Cisco IE3400, Siemens SCALANCE) inside the plant.

6.1 When to Choose a Gateway vs. CPU Upgrade

7. Solution 4 - Hosted VoIP Services as a Stand-In

When the engineering office is willing to accept a consumer-grade path, hosted VoIP providers supply a DID number that rings an ATA at the cabinet.

The advantage: minimal configuration, no firewall changes. The disadvantage: you trust a third party with a remote-maintenance channel into a control cabinet. Do not use this path in safety-rated (SIL/PL) or process-critical systems without explicit customer sign-off in writing.

8. Network Security Considerations

• VLAN separation - Put the S7 CP in its own VLAN with no inter-VLAN routing by default.
• Layered firewall - Hardware firewall in front of the ATA / S7 CP, software firewall on the server, ACL on the VPN tunnel.
• Per-vendor ACL - Permit only the office VPN subnet to reach TCP/102 of the S7 CP; deny all other sources.
• Mutual TLS or IPsec - If using a third-party SIP provider for ATA path, mandate SRTP + TLS on the SIP leg.
• Audit logging - Log every TCP/102 connection attempt and every SIP INVITE for forensics.
• Patch cadence - Keep ATA firmware current; Grandstream releases CVE patches quarterly.

9. Cable and Infrastructure Notes

The "use whatever the wire will support" principle still applies when the telco POTS cable was pulled but never lit:

If the existing cable is two-pair telco (24 or 26 AWG), it will carry 10BASE-T or 100BASE-TX over 100 m as long as the pairs are not split. Test with a cable certifier before commissioning; crosstalk between un-twisted pairs will fail Gigabit.

10. Decision Workflow

1. Inventory the S7 hardware. Confirm CPU type, presence of Ethernet CP, and the fieldbus in use.
2. Confirm plant network policy. Will IT allow a site-to-site VPN? Can the cabinet sit on the plant VLAN?
3. Match to the matrix in Section 3. If VPN + native Ethernet is allowed and the PLC has Ethernet, stop - that's the answer.
4. If VPN is forbidden, fall back to ATA + SIP. Order the ATA with a SIP DID that supports modem traffic (avoid Skype and free consumer VoIP).
5. If no Ethernet CP exists, install a gateway or a TS Adapter IE; the latter also lets you keep a POTS fallback for emergency dial-in.
6. Document the chosen path in the project's Network Architecture deliverable so the next vendor doesn't re-open the question.

11. Verification Checklist

12. Common Pitfalls

• Using Skype as the SIP trunk. Skype consumer clients reject inbound SIP. Use a real SIP provider.
• Forcing G.729 vocoder. Breaks V.34 modem; force G.711 on the FXS port of the ATA.
• Terminating the VPN on the same firewall that hosts the plant business network. Use a dedicated security appliance or a separate firewall context.
• Relying on a 10BASE-T-only ATA for general web surfing. The HT-486 saturates quickly; keep it for the modem path only.
• Leaving the SIP credentials at factory default. Several ATA models ship with admin/admin; change before the cabinet ships.
• Skipping the cross-vendor firewall review. Siemens, the SIP provider, and the plant IT each have recommended hardening settings; reconcile all three before going live.

13. FAQ