Siemens CP343-1 Online Access on S7-300: ISO-on-TCP, Port 102, and PG/PC Interface Configuration

Connecting a programming device (PG) to a SIMATIC S7-300 via the CP 343-1 communications processor is a routine task, but the layering between Industrial Ethernet, ISO-on-TCP, the S7 protocol, MAC addressing, and the role of the CP versus the CPU often generates confusion. This reference consolidates the architecture, the catalog-level variants, the STEP 7 V5.x and TIA Portal configuration paths, and the field-proven commissioning checks required to bring a CPU 31x online reliably through a CP 343-1 (catalog 6GK7 343-1EX11-0XE0, firmware V2.0 and above).

1. System Architecture: CPU 31x and CP 343-1 in a SIMATIC S7-300

The CP 343-1 is a communications processor that lives in the S7-300 backplane and is configured as if it were an I/O slot occupant from the project perspective. The CPU still owns the user program; the CP is a transport engine that converts between the S7-300 backplane (K-bus / MPI/DP backplane) and an external Industrial Ethernet network. The CP does not execute user logic and does not have its own program. It is functionally equivalent to the internal PROFINET interface of a CPU 31x-2 PN/DP, except that it is a separate module on the rail and supports a different set of services.

Logical topology used in this reference:

• CPU 31x at Rack 0, Slot 2 — runs the STEP 7 user program, holds the S7 connection endpoints.
• CP 343-1 6GK7 343-1EX11-0XE0 V2.0 at Rack 0, Slot 4 — terminates Industrial Ethernet, exposes ISO-on-TCP, TCP, UDP, S7 communication, and (from a given firmware onward) PROFINET IO Device on top of the backplane CPU.
• External Ethernet segment — a switch, a Wi-Fi access point, or a direct cross-over to a programming PC. The PC IP is in the same subnet as the CP (e.g. CP 192.168.1.11, PC 192.168.1.20, mask 255.255.255.0, router 192.168.1.1).

Conceptual topology

From an OSI perspective, when STEP 7 V5.x or TIA Portal establishes an online connection, the S7 protocol rides on top of ISO-on-TCP (RFC 1006), which rides on top of TCP/IP. The default S7 communications port is TCP 102. The CP 343-1 implements the TCP/IP and ISO-on-TCP layers; the CPU implements the S7 application layer. This is why the CP must be configured with at least a valid IP address and the appropriate transport protocol enabled for any Ethernet-based engineering access to succeed.

2. CP 343-1 Catalog Variants Relevant to Online Access

The CP 343-1 family spans several catalog numbers, and online-access behaviour depends on the firmware and the feature set. The variant referenced in the source is the standard CP 343-1 with catalog number 6GK7 343-1EX11-0XE0, firmware V2.0.

Confirm the exact catalog number on the front of the module (e.g. 6GK7 343-1EX11-0XE0 printed on the lower label area) before downloading the GSD file, the device description, or the firmware. Substitute a Lean variant with the standard CP only after verifying that the S7 connection count in your project is within the Lean limits (the Lean typically tops out at 4 S7 connections; the standard supports more).

3. Protocol Stack: ISO-on-TCP, Port 102, TSAP, and Why MAC Alone Is Insufficient

Online access in STEP 7 is always an S7 connection (PUT/GET or programming functions) terminated by the CPU. The S7 connection uses the S7 protocol on top of ISO Transport (Class 4) on top of TCP. The default TCP destination port is 102, and the S7 endpoint is identified at the transport layer by a Transport Service Access Point (TSAP) rather than by IP or MAC address alone.

Protocol layer diagram

MAC addressing is an OSI Layer 2 mechanism. ISO-on-TCP is a Layer 4 / Layer 5 mechanism that uses an IP and a TSAP. As soon as an S7 connection is involved, MAC alone cannot identify the destination endpoint; an IP and a TSAP are required. This is the root cause of the symptom in the source: STEP 7 Accessible Nodes over ISO (which uses broadcast MAC discovery over the local LAN) shows the CP, but the S7 connection does not progress because the ISO transport on the PC side is not bound to the right network interface, or because the CP is not configured to accept incoming S7 connections on the appropriate TSAP.

4. The CPU Is the Online Target — Not the CP

From STEP 7's perspective the CP is a transparent transport; the device you bring online is the CPU. The CP has its own diagnostics Web server (on Advanced variants) and its own firmware, but the Online → Accessible Nodes dialog and the PLC → Download / Monitor / Upload menus target the S7 endpoint that is owned by the CPU.

This is true regardless of which interface you reach the CPU from:

• MPI/DP — via the CPU's X1 MPI/DP port or an external CP 342-5.
• Internal PN — via the CPU 31x-2 PN/DP's X2 PN port.
• External PN/IE — via the CP 343-1 (the scenario in the source).

When you click Online → Accessible Nodes over Industrial Ethernet, STEP 7 sends an S7 broadcast (or uses DCP/ARP for the Show accessible nodes functionality) on the configured PG/PC interface. Any device on the local LAN that responds — including the CP 343-1 — appears in the list. The CP 343-1 will answer with its own MP (Module Plug) identifier, not with the CPU's. If the PG/PC interface is set to ISO, the PG then attempts to build an S7 connection to the responding module. If the S7 connection resources or TSAP on the CP do not match, the connection fails or the values you read are stale.

5. STEP 7 V5.x PG/PC Interface Configuration

The PG/PC interface setting determines which Windows network adapter STEP 7 uses and which transport it binds to. For a CP 343-1 on a standard Ethernet, the recommended binding is the laptop's TCP/IP stack pointed at the Ethernet card (e.g. Intel(R) Ethernet Connection — TCP/IP), with the access point set to S7ONLINE.

Procedure in SIMATIC Manager (STEP 7 V5.x):

1. Open Start → SIMATIC → STEP 7 → Set PG/PC Interface (or the system control panel applet Set PG/PC Interface).
2. In Access Path, select S7ONLINE as the access point of the application.
3. Under Interface Parameter Assignment Used, select the entry that matches the physical Ethernet adapter. For Intel/Realtek/Intel-based laptop NICs, the typical entry is Intel(R) ... TCP/IP or Broadcom NetXtreme ... TCP/IP. For the S7 Online connection over ISO on the same NIC, choose the ... ISO Ind. Ethernet entry, but only if the rest of the configuration supports ISO transport (most third-party NICs and access points do not pass ISO-on-TCP correctly; see Section 8).
4. Click Diagnostics → Test to confirm that the PG can reach itself, and use ping from a Windows command prompt to validate Layer 3 to the CP (ping 192.168.1.11).

6. CP 343-1 IP, Subnet, Router, and ISO Transport Configuration

The CP is configured in two locations: the Ethernet interface parameters (Layer 3) and the protocol selection (which transport the CP terminates). The settings in the source — 192.168.1.11 / 255.255.255.0 / 192.168.1.1 with ISO protocol enabled — are correct for a CP 343-1 that should accept ISO-on-TCP engineering traffic.

Configuration procedure in STEP 7 V5.x (HW Config):

1. In SIMATIC Manager, open the S7-300 station and double-click Hardware.
2. Click the CP 343-1 in slot 4 and double-click it to open the properties dialog.
3. On the General tab → Properties — Ethernet Interface, set:
   • IP address: 192.168.1.11
   • Subnet mask: 255.255.255.0
   • Use router: checked, 192.168.1.1
4. Switch to the Properties — Ethernet tab. Set the MAC address if you want a fixed address: 08-00-06-01-00-01. Confirm the Use ISO Protocol option is enabled (default).
5. Open the Options tab. Confirm at least one S7 connection resource is reserved for PG/PC online access. Default: 0 reserved, 1 for OP, 0–10 for S7 connections. The CPU itself owns the S7 connection resources, not the CP — but the CP must forward the connection to the CPU via the backplane.
6. Compile and download the hardware configuration. The CP will accept its configuration only after a power cycle or CP STOP/RUN transition; in some firmware versions a manual restart is required.

For a TIA Portal project, the same settings are reached via Devices & Networks → CP 343-1 → Properties → Ethernet addresses and Properties → Protocol settings. When the CP is used as a PROFINET iDevice, the protocol role is changed on the PROFINET interface tab as described in the Siemens support document 109744406.

7. Going Online over TCP/IP (Recommended Path)

For most field installations — especially when the network involves third-party switches, access points, or Wi-Fi bridges — use TCP/IP as the PG/PC transport and resolve the CPU by IP address. This path uses the IP that the CP advertises, requires no ISO encapsulation, and is the most predictable across heterogeneous Ethernet hardware.

Procedure:

1. Set the PG/PC interface to the laptop NIC with TCP/IP (see Section 5).
2. Confirm the laptop can reach the CP: from a command prompt run ping 192.168.1.11. A reply means Layer 3 is healthy.
3. In SIMATIC Manager → PLC → Ethernet Node → Browse, or PLC → Accessible Nodes, the CP 343-1 should appear with its MAC and IP. Selecting it brings the PG online to the CPU at the configured rack/slot.
4. Set the rack/slot of the CPU (default 0, 2 in this reference) in PLC → Properties before clicking Go Online.
5. Verify with Online → Monitor / Modify on a tag or a DB. Values must update in real time once the S7 connection is established.

If Accessible Nodes still does not list the CP, run the S7 diagnostic tool Start → SIMATIC → STEP 7 → NCM S7 → Diagnostics and inspect the connection state. A red status on TCP 102 with the CP usually means either the CP's IP is on a different subnet from the PC, the firewall is dropping 102/TCP, or the CP is in STOP due to a configuration error.

8. Going Online over ISO — Why Direct ISO Often Fails and How to Make It Work

ISO transport (ISO-on-TCP, RFC 1006) is the historical Siemens Industrial Ethernet transport. It is more deterministic than plain TCP for S7 messaging on dedicated plant networks, but it requires the full ISO encapsulation to be end-to-end. Many third-party access points, Wi-Fi bridges, and even some managed switches either block the ISO transport frames, strip the priority bits, or — in the case of the consumer Wi-Fi access point in the source — cannot pass the ISO multicast/broadcast used by Accessible Nodes.

Field-proven conditions for ISO to work end-to-end:

1. The PG/PC interface in STEP 7 is set to the ISO Ind. Ethernet entry of the same physical NIC used to ping the CP. Using the TCP/IP entry while expecting ISO behaviour will silently fail.
2. The PG and the CP are in the same Layer 2 broadcast domain. Routers, even simple home routers, do not forward ISO transport multicasts.
3. No Wi-Fi link is in the path. ISO on Wi-Fi is not guaranteed, and the source confirms this in the discussion.
4. No port-based VLAN tagging is mismatched between PG and CP.
5. On the CP, Use ISO Protocol is checked (default) and the MAC address is set to a valid value (the example in the source uses 08-00-06-01-00-01).
6. The S7 connection resource count on the CPU has not been exhausted. Each online PG or HMI panel consumes one S7 connection from the CPU's pool.

If the Accessible Nodes list shows the CP (because the ISO discovery worked) but monitoring returns no value / values not updated, the most likely cause is a half-open S7 connection: the discovery phase succeeded, but the S7 endpoint on the CPU either rejected the connection or did not have a free S7 connection resource. Open PLC → Diagnose/Set → Module Information on the CPU and inspect the Communication tab; the Connection overview shows the TSAPs in use and the free S7 connection count.

If the source's PG/PC does not have a Siemens CP (e.g. CP 1613, CP 1623) installed, use the standard Intel/Realtek NIC with the ISO Ind. Ethernet access point and verify the NIC driver supports 802.1Q tagging (it usually does, but disable any energy-efficient Ethernet or Large Send Offload v2 features that can interfere with the ISO multicast timing). For a more reliable ISO path, install a Siemens CP 1613 A2 in the PG — but this is rarely necessary on modern hardware.

9. S7 Connection Parameters and TSAPs

An S7 connection is identified by a local TSAP and a remote TSAP. The TSAP is a 2-byte value often printed in dotted notation. For a PG → CPU online connection over a CP 343-1, the default TSAPs used by STEP 7 are:

If the CPU is in a non-default slot, change the remote TSAP slot byte accordingly. When routing through a CP, the remote TSAP the PG dials is still the CPU's slot byte, not the CP's slot byte, because the CP is the transport, not the destination.

For non-STEP 7 clients — for example an OPC UA server on a SCADA node, a Home Assistant ha-s7plc integration, or an Ignition gateway using the S7-300 driver — the same TSAP rules apply. The client must dial 03.01 (or the CPU's slot-specific TSAP) on TCP 102 against the CP's IP. The CP will forward the S7 connection to the CPU. If the SCADA node cannot reach the CPU via the CP, the typical diagnosis path is to set the TSAP explicitly on the client side, confirm that the IP matches the CP, and that an S7 connection resource is free on the CPU.

10. Online Access Through the CP for HMI / SCADA / OPC Clients

The CP 343-1 is often used as the gateway between the S7-300 and a higher-level system — for example an HMI panel, a SCADA server, or an OPC UA gateway. The PG is just one of many S7 clients. Each client consumes an S7 connection resource from the CPU. The CPU's S7 connection budget must be sized to include the PG, all HMIs, all OPC clients, and any open user-defined S7 connections (e.g. PUT/GET between two CPUs).

Connection budget for a CPU 31x (typical values, firmware-dependent):

11. Commissioning Verification Matrix

Walk through the following checks in order. Each step confirms one layer of the protocol stack and isolates where the online connection is failing.

12. Common Pitfalls and Field-Proven Caveats

• IP on the wrong interface: The PC has a wired Ethernet on 192.168.1.20 and a Wi-Fi on a different range. STEP 7 must be bound to the wired adapter, not the default route.
• Firewall blocks TCP 102 / UDP 6000/6001: Windows Defender Firewall with default profile silently drops ISO-on-TCP during the first connection attempt. Add a rule for %SystemRoot%\System32\s7epasve.exe or open TCP 102 inbound and outbound.
• CP in STOP due to configuration mismatch: The CP rejects the loaded HW Config if the Ethernet type (PN vs IE) does not match. Recompile and re-download the station, then cycle the CP.
• MAC discovery works but ISO transport fails on the first TCP/3-way: ISO-on-TCP requires the full handshake (SYN/SYN-ACK/ACK and the TPDU exchange). A consumer Wi-Fi AP that proxies Layer 3 but strips ISO multicast will not break the ping but will break the discovery.
• CPU connection budget exhausted: The S7 connection limit on the CPU is hit by the HMI panels and SCADA clients. The PG is then denied. Reduce the OP/PG reservation and use PUT/GET instead of an S7 connection for the SCADA traffic if possible.
• CP 343-1 Lean substitution: Replacing a standard CP 343-1 with a Lean variant (CX10) reduces the S7 connection count. The PG may still work, but the HMI may no longer be able to connect.
• Wrong TSAP slot byte: If the CPU is moved from slot 2 to slot 3, the remote TSAP changes from 03.01 to 03.02. SCADA clients hard-coded to 03.01 will silently fail.
• VLAN mismatch: The PG port and the CP port must be in the same VLAN, or the switch must be configured for VLAN trunking with the correct PVID on both ends. ISO-on-TCP discovery uses multicast; a missing VLAN tag suppresses the response.

13. Firmware, Replacement, and Lifecycle Notes

The catalog number 6GK7 343-1EX11-0XE0 has been superseded in the Siemens product lifecycle. The current standard successor is the CP 343-1 (6GK7 343-1EX30-0XE0) and the Lean successor is the CP 343-1 Lean (6GK7 343-1CX10-0XE0). Configuration and online-access behaviour are identical from the STEP 7 perspective; only the firmware, the diagnostic Web server capability, and the integrated switch count differ. When migrating a project to TIA Portal, confirm the device description is available in the TIA Hardware Catalog — for older CPs, install the HSP (Hardware Support Package) that matches the catalog number before adding the module to the device configuration.

For PROFINET IO Device functionality on a CP 343-1, refer to the Siemens support article Configure CP 343-1 as a PROFINET IO device in STEP 7 (TIA Portal) (109744406), which documents the iDevice role assignment and the GSD-based integration path in TIA Portal V15 and later.