SCALANCE M874-3 IPsec VPN Setup for S7 CPU Data Exchange

When two S7 controllers must exchange process data over a cellular link, two SCALANCE M874-3 GPRS/UMTS routers can be bridged by an IPsec VPN tunnel running across a Private APN. The cellular layer (modem, SIM, APN) only carries the encrypted IP packets; the application layer is plain ISO-on-TCP (S7) or S7-communication, exactly as if both controllers were on the same Layer 2 LAN. This article is the field-reference walk-through: hardware, addressing, IPsec phase 1/phase 2 parameters, S7 communication, diagnostics, and a fault matrix.

1. Hardware and Firmware Baseline

2. Reference Topology

Site A and Site B each run one S7 controller and one M874-3. The router WAN IP is the fixed SIM IP supplied by the mobile operator on the Private APN. The LAN IP of the router is the default gateway for the S7 CPU at that site.

3. Prerequisites

1. Both M874-3 units have a working GPRS/UMTS link with signal level ≥ -85 dBm (check via WBM » Information » Mobile). RSCP / Ec/Io must be acceptable to the operator.
2. Each SIM is provisioned with a fixed IP on the same Private APN (or with globally routable static IPs). Confirm by pinging both public IPs from each M874-3 CLI.
3. The two S7 CPUs are in different /24 LANs (recommended) so routing does not collide. Example: Site A 192.168.1.0/24, Site B 192.168.2.0/24.
4. The NTP server (or operator NTP) is reachable, because IPsec lifetime calculation depends on a correct wall clock.
5. The pre-shared key (PSK) string is at least 32 characters and shared via an out-of-band channel.
6. Local PC for WBM access with a static IP in the same subnet as the LAN port (192.168.1.0/24 default).

4. IPsec VPN Concepts for M874-3

The M874-3 supports IPsec in tunnel mode. Frames from the S7 CPU are encapsulated by ESP (Encapsulating Security Payload) and forwarded to the peer WAN IP. Authentication is by Pre-Shared Key (PSK) or by X.509 certificates; for two-unit brownfield deployments PSK is the field default.

5. Step-by-Step Configuration via Web-Based Management

Connect a service PC to the M874-3 LAN port, assign it a static IP such as 192.168.1.99/24, and open https://192.168.1.1. Default credentials are admin / admin. Apply the procedure on Site A, then mirror on Site B (swap the role of Local/Remote).

5.1 WAN interface and APN

1. WBM » Interfaces » Mobile.
2. Set APN to the value supplied by the mobile operator (Private APN string, e.g. siemens.m2m.private).
3. Authentication: CHAP (preferred) or PAP. Enter user/password if the SIM requires them.
4. PDP type: IPv4.
5. Click Save and Load. The router dials the APN; the WBM status page must show a non-zero WAN IP.

5.2 LAN interface

1. WBM » Interfaces » Ethernet P1.
2. Site A: IP 192.168.1.1, mask 255.255.255.0.
3. Site B: IP 192.168.2.1, mask 255.255.255.0.
4. Disable DHCP on P1 (S7 controllers must have static IPs).

5.3 Firewall - allow S7 traffic

Before the tunnel can carry S7 traffic the firewall must permit ESP, IKE, NAT-T, and outbound ISO-on-TCP (TCP/102) from the S7 CPU.

5.4 IPsec Phase 1 (IKE_SA)

1. WBM » Security » IPsec VPN » Phase 1.
2. Name: S7_SiteB.
3. Remote endpoint: 10.50.1.6 (Site B fixed SIM IP).
4. IKE version: IKEv2.
5. Authentication: Pre-Shared Key. PSK: minimum 32 chars, e.g. 7Hf!9xLq2pVb#rT4zYc&Mn8BwQe6DsUa.
6. Local ID: 10.50.1.5; Remote ID: 10.50.1.6 (or FQDN if cert-based).
7. Encryption: AES-256-CBC; Integrity: SHA-256; DH group: 14.
8. Lifetime: 28800 s. DPD: on, 30 s / 5 retries.
9. Save.

5.5 IPsec Phase 2 (CHILD_SA)

1. WBM » Security » IPsec VPN » Phase 2.
2. Bind to Phase 1 S7_SiteB.
3. Mode: Tunnel.
4. Local subnet: 192.168.1.0/24; Remote subnet: 192.168.2.0/24.
5. Transform: ESP-AES-256-CBC + ESP-SHA256-HMAC (or AES-256-GCM if combined-mode is supported by the firmware).
6. PFS group: 14.
7. Lifetime: 3600 s.
8. Save and activate.

Official reference for the IPsec VPN menu tree and parameter meanings on SCALANCE X/W/M routers (which share the WBM structure with M874-3) is the Siemens TIA Portal Cloud documentation: Configuring IPsec VPN on SCALANCE X/W/M.

5.6 Default route and policy routing

The M874-3 default route points to the cellular interface for Internet-bound traffic. S7 traffic destined for the remote LAN must be steered into the IPsec tunnel via a policy route: WBM » Layer 3 » Static Routes » add route 192.168.2.0/24 via IPsec tunnel S7_SiteB.

6. S7 CPU-to-CPU Communication

Once the IPsec tunnel is up and the firewall permits TCP/102, the two S7 controllers behave as if they were on the same LAN. Choose the protocol family by controller generation:

6.1 S7-1200 / S7-1500 (TIA Portal)

1. In the device properties of the partner CPU, tick "Permit access with PUT/GET communication from remote partner (PLC, HMI, OPC, ...)" under Connection mechanisms. Without this flag the CPU rejects all PUT/GET requests, regardless of VPN.
2. Open Instructions » Communication » S7 Communication and drag the PUT / GET block into the active program.
3. Sample call on Site A (SCL):

   // Site A pulls 16 bytes from Site B DB10 starting at byte 0
   "GET_DB"(REQ := TRUE,
            ID   := 1,
            ADDR := P#DB10.DBX0.0 BYTE 16,
            RD_I := "rxBuf",
            DONE => #done,
            BUSY => #busy,
            ERROR => #err,
            STATUS => #status);
   

4. Configure the connection in the block header: partner IP 192.168.2.10, local TSAP 01.01, partner TSAP 01.01, connection type S7.

6.2 S7-300 / S7-400 (STEP 7 V5)

1. Insert an S7 connection in NetPro with partner IP 192.168.2.10 and TSAPs matching both CP configurations.
2. Use blocks FB15 PUT / FB14 GET from the standard library, or FB12 BSEND / FB13 BRCV for larger payloads (> 32 KB on S7-400).
3. CP343-1 / CP443-1: enable S7 communication in the CP properties; otherwise the CP blocks ISO-on-TCP at port 102 even with VPN up.

7. Verification

1. Tunnel up? WBM » Information » IPsec shows the SAs active. Status: ESTABLISHED for Phase 1, INSTALLED for Phase 2.
2. Encrypted ping? From a service PC on Site A, ping the Site B S7 CPU (192.168.2.10). If the IPsec tunnel is up the ping succeeds. Run tracert 192.168.2.10 on Windows or traceroute on the M874-3 CLI to confirm the path goes through the IPsec interface.
3. S7 online? TIA Portal » Online » Accessible nodes must list the remote CPU under its LAN IP.
4. Application data? Trigger PUT/GET; monitor DONE rising edge once per request and STATUS = 0000h.
5. Tunnel counters: WBM » Information » Statistics » IPsec shows the byte counter monotonically increasing in both directions.

8. IPsec State Machine (Simplified)

9. Troubleshooting Matrix

10. Security Hardening Notes

• Replace default admin password on first commissioning (WBM » System » Passwords). Empty default admin/admin allows anyone on the LAN to reconfigure the tunnel.
• Disable HTTP, enable HTTPS only, and restrict WBM access to the LAN port (WBM » System » HTTP).
• Restrict management to a single trusted source IP if the LAN has more than the S7 CPU.
• Rotate PSK every 12 months or after any operator change. Treat the SIM APN password with the same care.
• Enable syslog forwarding to a central log host for IPsec NEGOTIATION events (WBM » Diagnostics » Syslog).

11. Field-Proven Caveats

• Two M874-3 units on the same Private APN with the same /30 from the operator will ping even without IPsec. Do not mistake that for a working S7 path; without tunnel encapsulation, public-routable SIMs expose the CPUs to anyone else on the APN.
• If the operator issues IPv6 PDP, set the IPsec phase 2 to IPv4 only and route IPv6 separately; mixed stacks double the failure modes.
• Some operators strip ESP. If you see the tunnel come up and immediately drop with ESP_NOT_SUPPORTED, switch to NAT-T (UDP/4500) transport.
• For S7-1200 firmware < V4.0 the GET/PUT blocks have a bug that aborts on transient GPRS drop. Update the CPU firmware.
• DPD interval below 10 s burns cellular data budget on keepalives; do not go below 30 s in production.

12. FAQ