Siemens CP343-1 Remote Access via VPN, SCALANCE S, and Port Forwarding

Remote access to a SIMATIC S7-300 station equipped with a CP343-1 communications processor is a routine requirement for OEMs deploying machines across multiple customer sites. The engineering question is not whether remote access is possible, but which transport mechanism satisfies three competing constraints: latency for STEP 7 online functions, plant-side IT policy on the customer network, and the IT security of the public Internet path between the OEM and the machine.

This reference documents the three practical approaches used in the field for a CP343-1 attached to a CPU 315-PN/DP, fronted by a SCALANCE X005 switch, and accessed from a SIMATIC MP370 HMI plus a STEP 7 V5.x engineering station. The CP343-1's Use Router property, the S7 communication port 102, and the SCALANCE S security module family are covered with configuration steps, parameter tables, and verification commands.

1. System Architecture Overview

The reference machine has the following topology at each customer site:

• SIMATIC S7-300 with CPU 315-2 PN/DP and a CP343-1 communications processor in the backplane.
• SCALANCE X005 unmanaged switch (5 x RJ45 10/100 Mbit/s) connecting the CPU PN port, the CP343-1, the MP370, and the customer LAN uplink.
• SIMATIC MP370 12" Touch Panel running ProTool/Pro RT or WinCC flexible with the Smart Service remote option.
• Customer site router providing the public IP for the OEM link.
• OEM remote station running STEP 7 V5.5 / V5.6 with a CP 5611 / CP 1623 or Softnet IE PG interface.

2. CP343-1 Communication Fundamentals

The CP343-1 (order numbers 6GK7343-1EX30-0XE0 for the Lean variant, 6GK7343-1CX10-0XE0 for the Advanced, and the later 6GK7343-1FX00-0XE0 with Gigabit uplink) provides the S7-300 station with the following services relevant to remote access:

3. The "Use Router" Property - What It Does and Does Not Do

The Use Router setting lives on the CP343-1's S7 connection in NetPro (STEP 7 V5.x) and is found under Properties > Address Details of the S7 connection. In the TIA Portal the equivalent is the Router address field on the S7 connection's address details. The parameter accepts a single IPv4 address.

Semantically, Use Router tells the CP343-1 (acting as an S7 routing node) which next-hop IP to populate in the S7 routing table entry for the remote end of the S7 connection. The CP then forwards the ISO-on-TCP frames out of its Ethernet interface toward that router IP, which is responsible for forwarding the packet to the next subnet.

What it does not do:

• It does not set a default gateway on the CP itself. The CP's own IP stack uses the gateway defined in the CP's Properties > Ethernet Interface > IP Parameters field "Router" independently.
• It does not provide NAT traversal. A public IP cannot be entered into the Use Router field on the engineering side and magically appear as a reachable address on the CP side; the path in both directions must be routable.
• It does not authenticate, encrypt, or compress traffic. It is a pure L3 hint to the S7 routing layer.

3.1 Configuration Procedure (STEP 7 V5.x NetPro)

1. Open the SIMATIC 300 station in NetPro.
2. Right-click the CP343-1 > Insert New Connection > S7 Connection.
3. Select the partner: choose Unspecified for a remote PG, or pick a known partner station.
4. Open Properties > Address Details.
5. Enter the partner IP (the public IP of the customer site as seen from the OEM, or the customer's internal IP if traversing VPN).
6. Enter the Router address if the partner is in a different subnet from the CP. If the OEM's PG/PC interface uses a private VPN subnet and the CP is in a separate private subnet, the Use Router entry is the VPN tunnel endpoint / internal router address of the CP side.
7. Download the connection configuration to the CP via PLC > Download to Target Station.

For a TIA Portal S7-300 station the path is Devices & Networks > Network view > select S7 connection > Properties > Address details > Router address.

3.2 What "Use Router" Buys You on a Static PG/PC Interface

When the OEM engineering station has a static IP assigned in the PG/PC interface, STEP 7 uses that single IP as the source for S7 connections. The Use Router parameter on the remote CP determines where the CP sends replies, so the S7 routing is consistent. The constraint is that the OEM PG must have a routable path back to the CP's subnet, which in practice means a tunnel or a routed network - which is why plain Internet port forwarding is insufficient for the S7 path even when the field wiring is correct.

4. Remote Access Mechanism Comparison

For S7-300 stations where the OEM does not control the customer network, the SCALANCE S family is the Siemens-recommended solution. For the MP370 HMI remote control, Smart Service (port 5800/5900) is the lightweight option that does not require STEP 7 online at all.

5. SCALANCE S Configuration for CP343-1 Remote Access

The SCALANCE S612 (6GK5612-0BA10-2AA3) and SCALANCE S623 (6GK5623-0BA10-2AA3) are IPsec-based security modules that sit in line between the machine LAN and the customer WAN router. They form a permanent VPN tunnel to a peer SCALANCE S, to a SINEMA RC server, or to a third-party IPsec gateway.

5.1 Network Position

The S612/S623 has two physical interfaces: the internal port connects to the SCALANCE X005 (and therefore to the CP343-1, MP370, and CPU), and the external port connects to the customer router / public Internet. The S module performs stateful firewalling on the external port and only permits IPsec-protected traffic to enter the internal segment.

5.2 IPsec Tunnel Parameters

5.3 Step-by-Step SCALANCE S Configuration

1. Install the Security Configuration Tool (SCT) on the engineering station (part of the SCALANCE S package, see Siemens Industry Online Support).
2. Open SCT, create a new project, and add an S612/S623 device.
3. Configure the internal interface IP (e.g., 192.168.10.1) and external interface IP (assigned by the customer router, e.g., 192.168.0.50 on the WAN side).
4. Define the IPsec VPN tunnel: choose Tunnel > New, enter the peer public IP, the PSK, and the local/remote subnets (192.168.10.0/24 and OEM subnet 192.168.20.0/24).
5. Configure the firewall: under Firewall > Rules, add an explicit allow for TCP src-port any dst-port 102 from OEM subnet to 192.168.10.0/24, and the reverse direction for the S7 reply traffic.
6. Save the configuration to the S module via HTTPS or via the local RS232 console port.
7. Power-cycle the S module and confirm the IPsec SA is established (LED VPN green, log entry IKE_SA established).
8. From the OEM PG, ping 192.168.10.2 (the CP343-1) through the tunnel. Then open STEP 7 and use Accessible Nodes over the tunnel - the CP should appear.

6. Pure Port Forwarding: Why It Is Not Sufficient for S7

A common question from OEMs is whether simply setting the customer router to forward public-IP:102 to the CP343-1's private-IP:102 is enough. The answer depends on the topology:

6.1 If the OEM PG has a public IP and the customer is willing to accept inbound TCP 102

This works at the network layer. The OEM PG opens a TCP 102 connection to the customer's public IP. NAT on the customer router rewrites the destination to the CP343-1's private IP. S7 online functions, PG upload, and program download all function. The caveats are security-related:

• TCP 102 is exposed to the entire Internet. Attackers can issue S7 Read/Write requests to the CP, including STOP CPU, write to DBs, or modify FB parameters.
• There is no authentication beyond the S7 password protection (CPU protect level), which is a 1-4 character password by default.
• Many corporate security policies forbid inbound TCP 102 to plant networks.

6.2 If the OEM PG is behind a corporate NAT or firewall

Outbound TCP 102 from the OEM LAN will typically be blocked. Even if it is allowed, the CP343-1 will not be able to reach the OEM PG's IP because the OEM PG is on a private RFC 1918 address. The Use Router parameter on the CP side expects a routable IP, not a private one that the customer router cannot return traffic to. This is the case that the original engineer was hitting.

6.3 Mitigation: Outbound-initiated reverse tunnel

The CP343-1 does not support outbound VPN initiation. The reverse tunnel must be established by a router on the customer side - either the customer firewall (Cisco ASA, Fortigate, Palo Alto) configured as an IPsec client, or a SCALANCE S. The OEM side then needs a matching VPN endpoint.

7. HMI Remote Access (MP370 Smart Service) - The Simple Case

The Smart Service option of the MP370 is a VNC-derived remote control server that listens on TCP 5800 (HTTP/Web viewer) and TCP 5900 (RFB protocol). It is intended for HMI-only access, not STEP 7 online.

7.1 Port Forwarding Rule for Smart Service

On the customer router, add a port-forward rule:

7.2 Client Configuration

From the OEM, install the Smart Client (or any VNC viewer), enter 203.0.113.10:5800 as the address, and the Smart Service password configured on the MP370. The MP370 desktop is then visible and operable.

This is the right tool for the following tasks:

• Viewing process screens and alarms when no engineering change is required.
• Acknowledging faults from a remote location.
• Verifying that the HMI application is running when the OEM cannot reach the PLC.

It is the wrong tool for: downloading a new STEP 7 program, modifying FB/DB code online, modifying the CP's connection configuration, or firmware updates. Those require S7 online, which means TCP 102 via VPN.

8. Alternative Transport: Third-Party Cellular / Industrial Routers

When the customer has no IT infrastructure to accept an IPsec tunnel, an industrial cellular router placed in line with the SCALANCE X005 is an option. Devices from vendors such as HMS Networks (Anybus, Ewon, Netbiter), Siemens (SCALANCE MUM856, M876), or Phoenix Contact (TC Cloud Client) provide:

• 4G/LTE or LAN uplink.
• OpenVPN or WireGuard client to a hosted relay (Talk2M, Sinema RC, or self-hosted).
• Firewalling that closes inbound ports from the public Internet.
• Optional local web HMI proxy for diagnostics.

This is the practical approach for OEM machines deployed at small customers with locked-down IT. The router initiates the outbound tunnel; the OEM dials into a hosted relay; the relay bridges the OEM to the CP343-1's internal IP.

9. Verification Procedure

After any of the above setups, verify the path from the OEM to the CP343-1 with the following checks:

1. Layer 3 reachability: From the OEM PG, ping the CP's tunnel-side IP. Expect < 5% packet loss and stable RTT.
2. TCP 102 reachability: From a command prompt run telnet 192.168.10.2 102 (or PowerShell Test-NetConnection 192.168.10.2 -Port 102). Expect a successful TCP open.
3. STEP 7 Accessible Nodes: In STEP 7 V5.x, choose PLC > Display Accessible Nodes with the PG/PC interface set to the tunnel-side NIC. The CP343-1 should appear with its MPI/Profibus or Ethernet address.
4. Online connection: Open the S7 project offline, then PLC > Connect to Target System > Online. Confirm the online view of the block container matches the offline view.
5. SCALANCE S log: On the S module, retrieve the IPsec log via the web interface (System > Log) and confirm the SAs are present and the byte counters are advancing.
6. MP370 Smart Service: From a browser, open http://<public-IP>:5800. The MP370 desktop should render.

10. Troubleshooting Matrix

11. Security Checklist

• Set CPU protect level to Write-protect or Read/write protect with password in HW Config.
• Disable the CP's web server if not used (CP343-1 Advanced+).
• Disable SNMP on the external interface of any SCALANCE S or M-series device.
• Use a PSK of at least 32 random characters for IPsec, or move to X.509 certificates for multi-site fleets.
• Restrict the S7 connection's local and partner endpoints in NetPro / TIA Portal to specific IP addresses; do not leave the partner endpoint as 0.0.0.0.
• Enable the S module's stateful firewall with deny-by-default.
• Log all access attempts; review the SCALANCE S log weekly.
• Apply the latest CP343-1 firmware (the 6GK7343-1EX30-0XE0 family has had multiple security advisories; see the Siemens ProductCERT advisories).

12. Recommended Architecture for an OEM with Worldwide Installations

For a fleet of machines that mix MP370 HMI remote control and full S7 engineering access, the recommended topology is:

1. Each machine is fronted by a SCALANCE S623 (or SCALANCE MUM856 for cellular-equipped sites).
2. Each S module maintains a permanent IPsec tunnel to a central SINEMA RC Server hosted by the OEM (or by a service provider).
3. The OEM PG connects to the SINEMA RC server over the OEM corporate VPN; SINEMA RC brokers the connection into the appropriate machine's internal subnet.
4. The PG/PC interface on the OEM station is bound to the SINEMA RC virtual NIC.
5. MP370 Smart Service is exposed only on the internal port of the S module; OEM accesses HMI via the same tunnel using a Smart Client or VNC viewer against the CP343-1's bridged internal address.

This design satisfies the OEM requirement of "no VPN client on the customer side" while keeping TCP 102 off the public Internet. The customer IT only sees outbound IPsec to a known server IP, which is much easier to approve than an inbound IPsec termination on the plant LAN.

13. Field Notes and Caveats

• The CP343-1 Lean variant (6GK7343-1EX30-0XE0) supports a maximum of 4 S7 connections for PG/OP plus 4 for S7 communication. Remote PG access consumes one of these slots.
• If a CP343-1 Advanced (6GK7343-1CX10-0XE0) is used, the web server should be disabled or restricted to the internal side; Siemens documented multiple CVEs against older firmware versions of this web server.
• The Use Router field in NetPro is per-connection, not per-station. If multiple remote PGs need to reach the CP via different routers, define multiple S7 connections with different router addresses.
• SCALANCE X005 is unmanaged. If a managed switch is required (e.g., for VLAN segmentation of the S module external port), use SCALANCE XC-200 or XR-300 series instead.
• For deployments in regions with strict data-residency rules, consider a regionally hosted SINEMA RC server rather than routing all traffic to a single home region.