SCALANCE XC-206 Service Bridge: Fieldbus Access Troubleshooting
1. Problem Overview
After configuring a SCALANCE XC-206 as a Service Bridge per the official Siemens application example, the engineering station (ES) loses the ability to reach downstream fieldbus devices. The switch itself appears in SINEC NMS, but child nodes report "Unreachable" status, and direct browser access to the Web Based Management (WBM) of devices behind the Service Bridge fails even when the ES is physically connected to the plantbus port of the SCALANCE XC-206. Typical symptom stack observed in the field:- Engineering station has two IPv4 addresses on a single physical NIC or on two NICs:
192.168.0.200(plantbus) and192.168.1.200(fieldbus). - SCALANCE XC-206 Port 1 is wired to the plantbus network; Port 2 connects to a downstream device at
192.168.1.14. - SINEC NMS topology scan marks the fieldbus device as "Not reachable" even though the SCALANCE XC-206 responds.
- WBM login on the downstream device times out.
- ICMP ping from the plantbus IP of the ES to
192.168.1.14fails, while pinging the SCALANCE XC-206 management IP succeeds.
Source documentation: The Service Bridge pattern is defined in Siemens Support entry 109747975 – Service Bridge – Setup and Configuration. The associated PDF attachment PCS7_ServiceBridge_DOC_V1_7_3_en.pdf contains the canonical VLAN, ACL, and firewall rule set used here.
2. Service Bridge Architecture
The Service Bridge is a Siemens-provisioned configuration pattern for PCS 7 and similar plant networks in which the plantbus (terminal/engineering network) and the fieldbus (automation/cell network) must remain logically separated for operational reasons but must allow temporary, protocol-filtered access from the plantbus to a single fieldbus device for diagnostics, firmware updates, or commissioning. Key architectural rules:- Default deny. The Service Bridge permits no traffic between plantbus and fieldbus VLANs unless an explicit firewall rule allows it.
- VLAN separation. Plantbus and fieldbus belong to different VLAN IDs. The SCALANCE XC-206 enforces isolation through VLAN tagging, not through physical port separation alone.
- One-way bias. Permitted traffic flows primarily from plantbus to fieldbus. Return traffic for established connections is allowed via stateful inspection.
- Protocol allowlist. Only specific TCP/UDP ports are opened (typically HTTPS 443, S7 communication 102, HTTP 80 for older devices, SNMP 161/162, and SINEC NMS multicast groups).
3. SCALANCE XC-206 Hardware and Firmware Baseline
The SCALANCE XC-206 is a managed Layer 2 industrial Ethernet switch in the SCALANCE XC-200 family, with six 10/100/1000 Mbps RJ45 ports, DIN-rail mounting, and an integrated firewall function. Configuration access is available through:- Web Based Management (WBM) over HTTPS
- Command Line Interface (CLI) over SSH or serial
- TIA Portal HSP / SINEC NMS / PRONETA for commissioning
| Firmware branch | Recommended for Service Bridge | Notes |
|---|---|---|
| SCALANCE XC-200 prior to V1.4 | Not recommended | Firewall ACL behavior differs; some IGMP snooping options missing. |
| SCALANCE XC-200 V1.4 – V2.x | Validated against application example 109747975 | Supports per-VLAN PVID, ACL with stateful rules, IGMP/MLD snooping. |
| SCALANCE XC-200 V3.x and later | Verified compatible | CLI grammar for ACL was extended; legacy CLI scripts from older PDFs may require adjustment. |
Always confirm the firmware version under Information > Versions in WBM before applying Service Bridge rules. The configuration script shipped with the 109747975 application example targets firmware V1.x through V2.x syntax. On V3.x and later, the ACL editor in WBM and the SINEC NMS configuration export are the preferred authoring tools.
4. Root Cause Analysis
The "unreachable fieldbus" symptom in this topology has five recurring root causes, listed in descending probability based on field deployments:4.1 PVID Mismatch on the Fieldbus Port
The SCALANCE XC-206 port that connects to the fieldbus device must be assigned the fieldbus VLAN as its Port VLAN ID (PVID) and configured in access mode (untagged egress). If the port remains on the default VLAN 1 with no PVID override, untagged frames from the fieldbus device are placed in VLAN 1. The plantbus-side ES then has no path into VLAN 1 because the upstream plantbus traffic enters on a different PVID. Symptom: SINEC NMS sees the SCALANCE XC-206 but cannot discover any device beyond it. WBM login to the downstream device times out because the firewall cannot match traffic to a known VLAN interface.4.2 Missing or Wrong Firewall Rules
The Service Bridge firewall is a default-deny ACL with explicit allow rules. If the rule list omits the protocol required for SINEC NMS discovery (typically ICMP for ping, UDP 161 for SNMP polling, and the SINEC NMS multicast group239.255.255.0/24 for topology discovery), the fieldbus device appears unreachable even though L2 forwarding works.
Required minimum rule set:
| Rule # | Action | Source | Destination | Service | Purpose |
|---|---|---|---|---|---|
| 10 | Permit | Plantbus subnet 192.168.0.0/24 | Fieldbus subnet 192.168.1.0/24 | ICMP echo-request / echo-reply | Reachability test from ES |
| 20 | Permit | Plantbus ES (192.168.0.200) | Fieldbus device (192.168.1.14) | TCP 443 (HTTPS) | WBM access |
| 30 | Permit | Plantbus ES (192.168.0.200) | Fieldbus device (192.168.1.14) | TCP 102 (ISO-on-TCP / S7) | TIA / STEP 7 download |
| 40 | Permit | SINEC NMS server | Fieldbus subnet 192.168.1.0/24 | UDP 161 (SNMP) | NMS polling |
| 50 | Permit | Plantbus subnet | 239.255.255.0/24 | UDP (multicast) | SINEC NMS discovery |
| 999 | Deny | any | any | any | Default deny |
4.3 Multicast Filtering (IGMP/MLD Snooping)
SINEC NMS uses LLDP and multicast-based discovery on UDP port 49152–49154 (Siemens-proprietary NMS discovery range). If IGMP snooping on the SCALANCE XC-206 is enabled but the multicast group entries have aged out, or if a static IGMP querier is not configured on the fieldbus VLAN, the multicast traffic never reaches the downstream device port. Devices then appear in SINEC NMS as "Unknown" or "Unreachable."4.4 Dual-IP Engineering Station Routing Confusion
When the engineering station holds two IPv4 addresses on one NIC (or on two NICs but bound to the same physical link), Windows routing table metrics decide which source IP is used for outbound traffic. The default metric on a Windows interface is automatic; if the fieldbus IP192.168.1.200 has lower metric, ES traffic destined to 192.168.1.14 leaves on the fieldbus NIC and never traverses the SCALANCE XC-206, making the fieldbus device unreachable through the Service Bridge but reachable through the direct NIC. If the plantbus IP is used (which is the Service Bridge intent), the traffic must traverse the switch and pass the firewall.
Verification:
route print on Windows should show 192.168.0.0/24 bound to the plantbus interface and 192.168.1.0/24 bound to the fieldbus interface, with persistent static routes or interface metrics that prevent crossover.
4.5 Promiscuous Port Setting
SCALANCE XC-200 supports a "Promiscuous Port" mode used in PCS 7 to allow mirrored VLAN traffic for diagnostics. If Promiscuous mode is enabled on Port 1 but Port 2 is in strict access mode, asymmetric forwarding can occur and the firewall's stateful inspection may drop return traffic because the reverse path enters on a port not in the same VLAN membership.5. Prerequisites
- SCALANCE XC-206 with firmware V1.4 or later (V2.x recommended for direct alignment with the V1.7.3 application document).
- TIA Portal, SINEC NMS, or PRONETA on the engineering station with admin rights to import/export switch configuration.
- Engineering station with two IP addresses (plantbus and fieldbus) on separate NICs, or a single NIC with both addresses and verified Windows routing metrics.
- Plantbus and fieldbus subnets documented, including default gateways if any.
- List of TCP/UDP ports required for the specific downstream device (HTTPS 443, S7 102, PROFINET IO, etc.).
Operational warning: The Service Bridge temporarily weakens the plantbus/fieldbus separation. Apply it only when an active service task is in progress. After the task, restore the default-deny state and disable any unused VLAN memberships.
6. Step-by-Step Service Bridge Configuration
6.1 Define VLAN Plan
| VLAN ID | Name | Subnet | Member ports (SCALANCE XC-206) | Mode |
|---|---|---|---|---|
| 1 | Management default | (disable unused) | None | n/a |
| 10 | Plantbus | 192.168.0.0/24 | Port 1 (untagged, PVID 10) | Access |
| 20 | Fieldbus | 192.168.1.0/24 | Port 2 (untagged, PVID 20) | Access |
| 99 | Service-Mgmt | (optional, for SCALANCE mgmt) | CPU/mgmt interface | Internal |
6.2 Configure Port VLAN Membership
In WBM navigate to Layer 2 > VLAN and set:- Port 1: PVID = 10, Member of VLAN 10 (untagged), not a member of VLAN 20.
- Port 2: PVID = 20, Member of VLAN 20 (untagged), not a member of VLAN 10.
- All other ports: PVID = 1, no membership in 10 or 20 (or administratively disabled).
- CPU/management interface: Member of VLAN 99 (tagged) for SCALANCE management.
6.3 Configure Firewall Rules
In WBM navigate to Security > Firewall > Rules and enter the rule set from Section 4.2 above. Apply with the explicit "any → any → deny" rule last so it acts as a fallback. CLI equivalent (for SSH access):
firewall rule 10 permit src 192.168.0.0/24 dst 192.168.1.0/24 proto icmp
firewall rule 20 permit src 192.168.0.200 dst 192.168.1.14 proto tcp dport 443
firewall rule 30 permit src 192.168.0.200 dst 192.168.1.14 proto tcp dport 102
firewall rule 40 permit src 192.168.0.50 dst 192.168.1.0/24 proto udp dport 161
firewall rule 50 permit src 192.168.0.0/24 dst 239.255.255.0/24 proto udp
firewall rule 999 deny src any dst any proto any
6.4 Enable IGMP Snooping Carefully
- Enable IGMP snooping globally in Layer 2 > Multicast.
- Set the IGMP querier on the VLAN where the SINEC NMS server resides (typically VLAN 10) so that the multicast group membership is refreshed.
- For the fieldbus VLAN, add a static multicast MAC entry for the SINEC NMS discovery group if downstream devices do not send IGMP join messages.
6.5 Configure Engineering Station Routing
If the ES uses two NICs (preferred for Service Bridge):- Plantbus NIC:
192.168.0.200/24, no default gateway, metric 10. - Fieldbus NIC:
192.168.1.200/24, no default gateway, metric 10. - Disable automatic metric:
netsh interface ip set interface "Plantbus" metric=10andnetsh interface ip set interface "Fieldbus" metric=10. - Verify with
route print: each subnet must show its direct interface.
route -p ADD 192.168.0.0 MASK 255.255.255.0 192.168.0.200 METRIC 10
route -p ADD 192.168.1.0 MASK 255.255.255.0 192.168.1.200 METRIC 10
Critical: Never add a default gateway on the fieldbus interface of the ES. Doing so causes Windows to route plant-destined traffic through the fieldbus NIC, defeating the Service Bridge.
7. Verification
7.1 L2 Reachability
- From the plantbus IP
192.168.0.200:ping 192.168.1.14should succeed. - From the fieldbus IP
192.168.1.200:ping 192.168.0.200should fail (Service Bridge is plant-to-field directional).
7.2 WBM Access
- Open browser on the ES and navigate to
https://192.168.1.14. The WBM login of the downstream device should appear. - If the WBM appears but login fails, check that the user account is permitted over HTTPS (some devices disable HTTPS by default until provisioned).
7.3 SINEC NMS Topology
- Run a topology scan in SINEC NMS. The downstream device should appear under the SCALANCE XC-206 as "Reachable."
- If the device still shows "Unreachable," inspect Information > Firewall > Log on the SCALANCE XC-206 for dropped packets and adjust the rule set.
7.4 TIA Portal Download Test
- In TIA Portal, perform an online connection to the fieldbus CPU at
192.168.1.14on Port 102. - Successful online view confirms end-to-end Service Bridge function.
8. Troubleshooting Matrix
| Symptom | Likely Cause | Diagnostic Command | Fix |
|---|---|---|---|
| SCALANCE XC-206 reachable, fieldbus device not | PVID mismatch on Port 2 | WBM > Layer 2 > VLAN > Port VLAN | Set Port 2 PVID = fieldbus VLAN ID |
| Ping fails, WBM times out | Firewall rule missing for ICMP / HTTPS | WBM > Security > Firewall > Log | Add explicit permit rule for the protocol |
| SINEC NMS shows device as Unreachable but ping works | SNMP / multicast discovery blocked | Wireshark on fieldbus port | Add permit for UDP 161 and SINEC multicast |
| WBM works, TIA Portal download fails | TCP 102 not allowed | WBM > Security > Firewall > Log | Add permit rule for ISO-on-TCP 102 |
| Device reachable only when ES connected directly to fieldbus NIC | Windows routing metric crossover | route print | Disable automatic metric on both NICs |
| Promiscuous mode enabled, asymmetric drops | Promiscuous port set on Port 1 | WBM > Layer 2 > VLAN > Promiscuous | Disable Promiscuous on Port 1 |
| Multicast groups age out | No IGMP querier | WBM > Layer 2 > Multicast | Set IGMP querier on plantbus VLAN |
| Config reverts after restart | Configuration not saved to startup | WBM > Information > Save | Click "Save" or run write memory in CLI |
9. Configuration Save and Persistence
Changes made in WBM are held in the running configuration only until saved. After completing the Service Bridge setup:- In WBM click the disk icon or navigate to Information > Save and confirm.
- In CLI run
write memoryand verify withshow startup-config. - Reboot the SCALANCE XC-206 once after initial configuration to ensure VLAN and ACL state is consistent.
10. Decommissioning the Service Bridge
After the service task is complete:- Remove the fieldbus VLAN membership from Port 2 or set PVID back to 1.
- Disable firewall rules 10–50, leaving only the default deny.
- Save the configuration and export a backup of the decommissioned state.
- Document the change in the plant network log.
Security note: The Service Bridge should never be left enabled permanently. It exists specifically for temporary diagnostic or commissioning access. Leaving it active weakens the PCS 7 zone model and may violate the plant cybersecurity policy.
11. Related Siemens Documentation
- 109747975 – Service Bridge – Setup and Configuration
- PCS7_ServiceBridge_DOC_V1_7_3_en.pdf (configuration attachment)
- SCALANCE XC-200 Operating Instructions (available on the Siemens Industry Online Support product page for the SCALANCE XC-206)
- SINEC NMS Operating Manual
12. FAQ
Why does the SCALANCE XC-206 respond to ping but downstream fieldbus devices do not?
The SCALANCE XC-206 management IP is typically in the plantbus VLAN and is reachable directly. Downstream fieldbus devices sit behind a default-deny firewall rule on the Service Bridge VLAN interface; if no allow rule matches the ICMP or TCP traffic type, packets are dropped silently. Add a permit rule for the specific protocol required, then verify with the firewall log.
Can the engineering station use a single NIC with two IP addresses for the Service Bridge?
Yes, but only if Windows interface metrics are explicitly set so that traffic to the plantbus subnet is sourced from the plantbus IP and traffic to the fieldbus subnet is sourced from the fieldbus IP. Use route print to confirm and apply persistent static routes if necessary.
Does the Service Bridge also allow fieldbus devices to initiate connections to the plantbus?
No. The canonical Service Bridge is plant-to-field directional. Return traffic for permitted connections is allowed via stateful inspection, but new connections initiated from the fieldbus are denied by the default rule. This protects the plantbus from unauthorized reachability.
What firmware on the SCALANCE XC-206 is recommended for the Service Bridge?
Firmware V1.4 or later is required. V2.x aligns most directly with the syntax in the 109747975 application document. On V3.x and later, prefer WBM or SINEC NMS for ACL editing rather than CLI scripts from older PDFs.
How do I keep the Service Bridge configuration after a power cycle?
In WBM click Information > Save, or in CLI run write memory. Verify by reloading the switch and confirming that the VLAN, ACL, and firewall settings survive the reboot. Without saving, only the running configuration is retained and resets on the next restart.