SCALANCE M873 STEP 7 Gateway: Configuring Ethernet vs SIM IP

SCALANCE M873 STEP 7 Router Address: Ethernet Port vs SIM IP

When commissioning a Siemens SCALANCE M873 UMTS router in a SIMATIC STEP 7 or TIA Portal project, the most common configuration error is entering the wrong address in the Use router field of the CPU's PROFINET/Ethernet interface. The address must always point to the M873's local Ethernet (LAN) port, not the IP address assigned by the cellular carrier to the SIM card. This reference explains the underlying IP routing logic, walks through the correct STEP 7 and TIA Portal configuration, and documents the LAN/APN subnet overlap trap that most first-time field engineers run into.

The behaviour described here applies to all SCALANCE M873 variants with HSDPA and current firmware. For authoritative command and menu references, always cross-check the official SCALANCE M873 operating instructions (BA_SCALANCEM873_76.pdf) and the configuration manual at BA_SCALANCE-M873_76.pdf on the Siemens Industry Online Support portal. The exact WBM layout shifts slightly across firmware versions, but the underlying routing logic does not.

1. Problem Overview

During STEP 7 hardware configuration, the question of which IP address belongs in the Use router column of the S7 CPU's PROFINET/Ethernet interface is a recurring commissioning-time confusion. Three candidates typically exist on site:

• The CPU's own IP address (192.168.0.20 in the example used below)
• The SCALANCE M873's local Ethernet port (192.168.0.29, factory default 192.168.1.1)
• The IP address assigned to the SIM card by the cellular APN (192.168.0.10)

Only one of these is valid for the gateway field. Configuring the wrong one produces either a STEP 7 validation error at compile time, a silent routing failure at runtime, or asymmetric traffic that works intermittently and then fails in the field at the worst possible moment - usually three weeks after the commissioning engineer has left site.

Visible symptoms of misconfiguration include:

• STEP 7 rejects the Use router field with a subnet violation warning.
• The CPU is online locally but cannot reach any host outside the LAN.
• The cellular link is up (LED green, WBM shows connected), but the remote Teleservice PC never sees the CPU.
• S7 connections succeed for some PG operations (which use broadcast / ARP) and fail for others (which go via routing).

2. SCALANCE M873 Hardware and Interface Model

The SCALANCE M873 is a member of the SIMATIC NET SCALANCE M family of industrial cellular routers. The official operating instructions describe it as a UMTS router with HSDPA that provides a wireless connection to the Internet or to a private network.

From an IP perspective the M873 exposes two distinct Layer-3 interfaces:

Hardware layout, in addition to the Ethernet and cellular interfaces:

• SIM slot: standard mini-SIM (2FF) under a screw-down cover on the front panel. Some variants use micro-SIM; check the variant label on the device.
• Antenna connectors: two SMA female ports for the UMTS main and diversity antennas. Diversity antenna improves throughput on UMTS/HSPA in marginal coverage.
• Power: 24 V DC via the removable terminal block on the bottom. Typical operating range 19.2 - 28.8 V DC, with a brief brownout tolerance of 10 ms typical. Reverse-polarity protection is built in.
• Digital I/O: one digital input and one digital output on the bottom terminal block, usable for link-watchdog wiring or alarm output to the PLC.
• Grounding: functional earth terminal on the back; must be bonded to the cabinet ground for EMC compliance.

The LAN side faces the SIMATIC automation network. The WAN side connects through the inserted SIM card to the cellular carrier's APN. The M873 performs IP routing, NAT (enabled by default), stateful firewalling, and optionally VPN termination between the two. The cellular-side IP is handed out by the APN and is generally dynamic; it only stays static for closed/private APNs that explicitly bind a fixed address to a SIM.

3. What the "Use Router" Field Means in STEP 7

In STEP 7 V5.x (HW Config) and in TIA Portal (device view > Properties > Ethernet addresses), every PROFINET/Ethernet interface on the CPU has a property dialog containing the following fields:

• IP address: the CPU's own address on this subnet
• Subnet mask: typically 255.255.255.0 for a /24
• Use router: checkbox, plus Router address: field

The Router address field tells the CPU firmware the next-hop IPv4 address to use when a packet's destination is outside the directly-connected subnet. Internally this populates the CPU's IPv4 routing table as the default route (0.0.0.0/0).

The hard constraint enforced by STEP 7 (and by IP itself) is:

(Router address) AND (Subnet mask) == (CPU IP) AND (Subnet mask)

In words: the router address must lie in the same subnet as the CPU's own IP address. If the two are on different subnets, STEP 7 raises a validation error when you OK the dialog, and the CPU will not be able to ARP for the gateway at runtime.

In STEP 7 V5.x, the dialog is reached by double-clicking the CPU > Properties > Ethernet Addresses. In TIA Portal, it is in the device view under the PROFINET interface > Properties > Ethernet addresses. For CPUs with multiple PROFINET interfaces (for example the S7-1500 with X1 and X2), the router is configured per interface - the X1 router does not apply to traffic on X2.

4. Topology and Routing Diagram

The following topology illustrates the relationship between the CPU, the SCALANCE M873, and the cellular APN, and shows where the routing decisions happen:

The diagram highlights the architectural fact: from the CPU's perspective, the only device it can ARP for on the Ethernet cable is the M873's LAN port. Everything beyond that point (including the SIM IP and any remote peer) is reachable only through the M873 as a Layer-3 hop.

5. Correct Gateway Address Selection

The gateway in STEP 7 must always be the IP address of the SCALANCE M873's local Ethernet port. In a typical commissioning scenario:

Enter 192.168.1.29 in the Router address field. Do not enter the SIM/APN IP; that address is not reachable directly via the Ethernet cable and will either be rejected by STEP 7 or cause ARP failures at runtime.

The factory-default LAN IP is 192.168.1.1, but any RFC1918 private address that does not overlap with your APN or downstream plant network is acceptable. Re-number the LAN through the WBM under Layer 3 > LAN.

6. Why the SIM/APN IP Is Wrong

The cellular-side IP assigned to the SIM card is reachable only from inside the cellular network (or from a private APN peer). It is not on the same Ethernet broadcast domain as the CPU. From the CPU's perspective, the only device reachable on the cable is the M873's LAN port. The M873 then forwards traffic through the cellular modem to the APN, where it reaches the SIM's assigned address (and beyond).

Reasons not to use the SIM IP as the STEP 7 gateway:

1. Dynamic addressing: The cellular IP is typically dynamic and changes on every cellular session, unless a private APN explicitly binds a static address to the SIM. Configuring a moving address as a gateway creates routing instability and CPU ARP-cache churn.
2. Subnet violation: The SIM-side IP usually lies in a public or APN-private address space that is not on the same subnet as the CPU. STEP 7 rejects the configuration outright when you OK the dialog.
3. ARP impossibility: Even when the SIM-side IP happens to be numerically on the same /24 (192.168.0.0/24 in a naive configuration), it sits on a different broadcast domain. The CPU cannot send an ARP request for it on the Ethernet cable, so resolution fails immediately.
4. Asymmetric path: In NAT'd setups the cellular IP is the carrier-side address, not an addressable host on the LAN side. Putting it as the gateway tells the CPU to send packets to a destination that is not on its wire.

7. LAN/APN Subnet Overlap Trap

A subtle but common design error is configuring the M873 LAN and the cellular APN on numerically identical subnets. The Layer-3 router on the M873 cannot then distinguish local from remote destinations in the overlapping range.

Symptoms:

• The CPU cannot tell whether a packet to the overlapping /24 is destined for a local device or for the cellular side.
• The M873 cannot route correctly between its two interfaces because both interfaces claim the same destination prefix.
• Routing becomes asymmetric: requests go out one path, replies try to come back another.
• ARP tables on the CPU get confused because the same destination address is reachable (in theory) via two completely different paths.
• When NAT is active, return packets may not match the connection tracker and get dropped silently.

Detection: from the CPU's PG, run tracert <remote-host> or pathping <remote-host>. If the first hop is not the M873 LAN IP, the routing is wrong. From the M873 WBM, look at the routing table under Layer 3 > Routing; you should see exactly one default route pointing out the WAN interface.

8. Step-by-Step Configuration in STEP 7 and TIA Portal

Procedure for STEP 7 V5.x (HW Config):

1. Open the SIMATIC Manager and the S7 project.
2. Open the hardware configuration (HW Config) for the station.
3. In the hardware catalog, locate SIMATIC NET > SCALANCE M and drag the M873 into the PROFINET/Ethernet subnet of the station (or place it on the same Ethernet subnet as the CPU so STEP 7 can do the topology checks).
4. Double-click the SCALANCE M873 and assign its Ethernet IP (for example, 192.168.1.29 / 255.255.255.0).
5. Double-click the CPU's PROFINET/PN-IO interface to open the property dialog.
6. Open the Properties > Ethernet Addresses dialog.
7. Set CPU IP: 192.168.1.20, Subnet: 255.255.255.0.
8. Tick Use router and enter 192.168.1.29 as the router address.
9. Click OK. If STEP 7 shows an error about the router being outside the subnet, the addresses are inconsistent - re-check that the M873 LAN IP is in the same /24 as the CPU IP.
10. Save, compile (Station > Check Consistency), and download the hardware configuration to the CPU.

Procedure for TIA Portal (device view):

1. Open the project and switch to the device view of the CPU.
2. Select the PROFINET interface > Properties > Ethernet addresses.
3. Set IP protocol > IP address: 192.168.1.20
4. Set Subnet mask: 255.255.255.0
5. Expand Ethernet addresses > tick Use router and enter 192.168.1.29.
6. Compile and download the device configuration to the CPU.

If your CPU is an S7-1200 or S7-1500, the same dialog exists under Properties > PROFINET interface [X1] > Ethernet addresses. For S7-300/400 CPUs with separate CP modules (for example CP343-1), configure the router on the CP's Ethernet interface rather than on the CPU's MPI/DP interface.

Validation rules that STEP 7 enforces when you click OK:

• The router address must parse as a valid IPv4 address.
• The router address must not be a network address or broadcast address within the CPU's subnet.
• The router address must not equal the CPU's own IP address.
• If the router address falls outside the CPU's subnet, STEP 7 pops a warning but lets you proceed in some firmware versions; newer STEP 7 builds refuse the entry.

9. SCALANCE M873 Cellular-Side Web Configuration

The cellular side of the M873 is configured through its Web-Based Management (WBM). Access the WBM by pointing a browser at https://<M873 LAN IP> (for example https://192.168.1.29). Default credentials are documented in the M873 operating instructions (typically admin / admin on first login, with a forced password change on first access).

WBM menu map (varies slightly by firmware version):

9.1 APN Configuration

Under Layer 3 > Mobile, enter the APN name exactly as provided by your carrier (for example internet for public Internet, or your private APN name for closed networks). Select the authentication method (typically CHAP or PAP for private APNs, none for some public APNs). Enter the dial number if your carrier requires one (default *99# for UMTS in most regions).

9.2 NAT and Firewall

NAT should be enabled for most topologies where the M873 is the gateway for the LAN and the LAN uses RFC1918 addresses. This allows the LAN devices (CPU, HMI) to share a single public IP on the WAN side. For private APN topologies where the APN provides routable addresses to the LAN devices, NAT can be disabled - but then each LAN device needs its own APN-side address, which is usually not practical.

The firewall is stateful and blocks all inbound traffic from WAN to LAN by default. Open only the ports you need: TCP/102 for S7 communication, TCP/443 for HMI web access, and so on.

9.3 DNS and NTP

Under System > DNS, configure the DNS servers provided by the carrier or your private APN. Under System > Time, configure NTP servers; for cellular deployments behind a private APN, the corporate NTP server is usually reachable through the VPN tunnel.

10. Teleservice, VPN, and Remote Access

For remote Teleservice scenarios (connecting an S7-1200 or S7-1500 station behind the M873 back to a TIA Portal at the office), the typical pattern is:

1. Configure an IPsec or OpenVPN tunnel on the M873 to a central VPN concentrator.
2. The CPU on the LAN side does not need any routing changes - it routes its default gateway to the M873 LAN IP, and the M873 encapsulates the traffic.
3. From the central TIA Portal, the remote CPU appears as if it were on the office LAN.

IPsec vs OpenVPN on the M873:

For a pure Teleservice use case where the M873 connects out to a fixed central endpoint (for example a SCALANCE SC646 or a third-party VPN concentrator at the office), IPsec IKEv2 with a pre-shared key is the standard recommendation. For dynamic central endpoints, OpenVPN with a hostname-based configuration is easier to maintain.

For remote access without VPN, the M873 supports port forwarding under Security > Firewall > Port Forwarding. Forward the public APN-side port to a LAN-side IP and port (for example, external TCP/1020 -> internal 192.168.1.20:102 for S7 access). This is functional but exposes the S7 service directly to the Internet and is only suitable for testing - production deployments should always use VPN.

11. Verification and Commissioning Checks

After downloading the STEP 7 / TIA Portal configuration and setting up the M873 WBM, verify in this order:

1. Local link (PG to M873): From the PG/PC connected to the M873 LAN, ping the M873 LAN IP (192.168.1.29). Should respond.
2. Local link (PG to CPU): Ping the CPU IP (192.168.1.20). Should respond.
3. Gateway reachability from CPU: In TIA Portal Online & diagnostics, or in STEP 7 Accessible nodes, verify the CPU can reach its configured gateway.
4. Mobile link: Open the M873 WBM > Information > Mobile. Status should show Connected with a session IP, APN name, and a signal strength.
5. Signal quality: For UMTS, target RSSI > -95 dBm and a positive EC/IO. Lower than -100 dBm is unstable; lower than -105 dBm will flap. RSCP (Received Signal Code Power) gives a more accurate picture of UMTS signal strength than RSSI alone.
6. End-to-end: From a remote peer on the cellular APN (or via VPN at the central site), attempt to ping the SIM-side address or open an S7 connection to the CPU on TCP/102.
7. STEP 7 routing check: In HW Config, right-click the CPU interface and select Object properties. The router address field should still read the M873 LAN IP with no warning.
8. S7 routing check (advanced): If downstream stations are reachable via the M873, validate S7 routing in HW Config > CPU > Properties > S7 routing.

A pre-commissioning checklist suitable for site sign-off:

• M873 LAN IP configured and reachable from PG.
• CPU IP configured with M873 LAN IP as gateway; STEP 7 / TIA Portal accepts the configuration.
• SIM inserted, APN configured, cellular session up.
• Signal strength meets the -95 dBm RSSI target.
• VPN tunnel established to central site (if used).
• End-to-end S7 connection test passes.
• Configuration exported from WBM and stored with project documentation.

12. Troubleshooting Matrix, Maintenance, and Security

12.1 Symptom-to-Cause Matrix

12.2 Firmware Updates

Check the current M873 firmware release on the Siemens Industry Online Support portal. Firmware files are downloaded as *.upd packages and applied through the WBM under System > Firmware. Always read the release notes before applying; firmware updates on a cellular router in production should be scheduled during a planned maintenance window because the device reboots and loses the cellular session for 30-60 seconds.

12.3 Security Hardening

• Change the default admin password immediately after first login.
• Disable unused services: Telnet (always), HTTP (in favour of HTTPS), SNMPv1/v2 (in favour of SNMPv3).
• Use strong SNMPv3 community strings with authentication and privacy.
• Restrict WBM access to the LAN side; do not expose HTTPS on the WAN interface.
• Enable the stateful firewall; close all ports by default and open only what is needed.
• For S7 Teleservice, always use VPN rather than exposing TCP/102 directly to the Internet.

12.4 Backup and Restore

The M873 WBM supports configuration export under System > Backup. Export the configuration after every commissioning and store the file with the project documentation. The same file can be imported to restore a bricked device or to clone the configuration to a spare.

12.5 Related Configuration Notes

• S7 routing through the M873: If a downstream CPU is reachable through the M873, set up S7 routing in HW Config / TIA Portal so that S7 connections traverse the M873 correctly. On the CPU's PROFINET interface, tick Use S7 routing.
• Antenna selection: UMTS/HSDPA operates in the 900 and 2100 MHz bands in most regions. Use antennas approved in the M873 manual; otherwise the RSSI may be marginal and the link will flap under load. For outdoor deployments, mount the antenna high and clear of metal mass.
• Watchdog / keep-alive: For unattended stations, configure the M873's link-watchdog to reboot the cellular modem if the session drops for more than N minutes, or to send an SMS alarm via System > Events.
• Dual-SIM scenarios: If you need cellular redundancy, consider the SCALANCE M874 or M875 (LTE variants), which support dual SIM slots with active/standby failover. The M873 has a single SIM slot.

For authoritative interface, command, and feature details, always cross-reference the official SCALANCE M873 operating instructions (BA_SCALANCEM873_76.pdf) and the configuration manual at BA_SCALANCE-M873_76.pdf on the Siemens Industry Online Support portal.

FAQ