Siemens S7: Connect Online by IP Without Hardware Configuration

Connecting to a Siemens S7 PLC online using only the IP address — with no hardware configuration (.hw) embedded in the project — is one of the most common field requests from commissioning and support engineers. Typical situations include receiving a customer program archive without the hardware data, taking over a site where the engineering station was wiped, or performing a quick read-only diagnostic from a laptop at the cabinet. This reference covers TIA Portal (V13 through V19/V20), classic STEP 7 V5.5/V5.6 (Simatic Manager), the integrated S7 webserver, and the PRONETA / Topology tools that let you reach a CPU with nothing more than its IP address.

1. Overview of the Available Methods

Six practical workflows are available. They differ in the CPU family they support, the software required, and the operations that can be performed once connected.

2. Prerequisites

Before attempting any of the methods below, verify the following items. Most "cannot go online" errors trace back to one of these.

1. IP reachability. The PC's Ethernet adapter must be on the same subnet as the CPU. Use ping <CPU IP> from a Windows command prompt. A failed ping is not by itself fatal — some CPUs block ICMP — but a successful ping is a strong indicator the path is open.
2. Subnet mask match. Example: CPU on 192.168.0.10 / 255.255.255.0, PC on 192.168.0.5 / 255.255.255.0. Mismatched masks often produce "Partner not reachable" errors.
3. Physical layer. Direct Ethernet cable (any standard), or a network with no managed switch blocking PROFINET / S7 traffic. Some managed switches require specific QoS rules for PROFINET to pass.
4. PG/PC interface assignment. Set once per programming environment. In TIA Portal: Options → Set PG/PC Interface. In STEP 7: Options → Set PG/PC Interface. Select S7ONLINE (STEP 7) -> <your NIC>.TCPIP.1 for S7-300/400/1200/1500 over Ethernet.
5. Windows firewall. The TIA Portal installer adds rules automatically, but corporate firewalls and third-party AV suites can still block TCP/UDP ports 102 (ISO-TSAP), 34964 (PN-DCP), 49152–65535 (PN IO data). Allow Siemens.Automation.Portal.exe and SIMATIC_S7OMWIN.exe for private networks.
6. CPU protection level. If the customer set a password, an online connection is still possible with the right access level, but writes and downloads will require entering the password.

3. Method 1 — TIA Portal: Online & Diagnostics (No Project)

The fastest way to get read-only access to an S7-1200 or S7-1500 with no project open is the Online & Diagnostics view. It does not require any project tree, hardware configuration, or CPU ordering.

1. Launch TIA Portal.
2. From the Portal view (start screen) select Online & Diagnostics in the lower-left task list. If you are already in the project view, switch via the Project > Portal view menu, or simply use Project > New to create an empty project, then return to the portal view.
3. Select the Online & Diagnostics tile. Choose your CPU family from the dropdown — typically S7-1200 / S7-1500.
4. Choose the PG/PC interface (the Ethernet adapter of the laptop).
5. Click Go online or enter the CPU's IP address directly in the IP address field and press Go online.

Once connected, the diagnostics view shows the CPU's operating state, the diagnostic buffer, module information, and a per-port PROFINET topology. From here you can navigate to a tag table view by selecting Online & Diagnostics > Watch table (the Monitor all button is enabled once online).

4. Method 2 — TIA Portal: Accessible Devices in an Existing Project

If a TIA Portal project is open (even one without hardware), you can scan the subnet for reachable S7 CPUs.

1. In the project tree, expand Online access.
2. Select the network adapter that physically connects to the PLC network (e.g., Ethernet [Intel I219-LM]).
3. Double-click Accessible devices in subnet, or right-click and choose Update accessible devices.
4. TIA Portal broadcasts a PROFINET DCP discovery message and lists every CPU, switch, and PROFINET device on the subnet that responds. The CPU appears with its IP, subnet, MAC address, and device name.

To go online against one of the listed CPUs, drag it from the Accessible devices subtree into the project tree, or right-click and choose Go online. The connection is established using the CPU's actual IP and the configured PG/PC interface.

5. Method 3 — TIA Portal: Create a Matching CPU Placeholder

To unlock full read/write access — including forcing tags, modifying watch tables online, and (after compile) downloading — the project must contain a CPU device whose ordering number and firmware version match the target CPU exactly. When you have only an S7 Program folder, the fastest path is to add a fresh CPU to the project:

1. Open the TIA Portal project containing the S7 Program folder.
2. Double-click Add new device in the project tree.
3. Search the hardware catalog for the exact Article number of the CPU. If you do not know the article number, you can read it from the target CPU by:
   • Browsing to the device with PRONETA (Section 8).
   • Connecting once with the Online & Diagnostics view (Section 3) and noting the article number in the module information.
   • Reading the label on the front of the CPU.
4. Select the matching Article number, Version, and (for S7-1500) the Firmware version, then click OK.
5. TIA Portal inserts the CPU device with a default Ethernet interface. Open Device view > Properties > Ethernet addresses and set the IP address, subnet mask, and router (if any) to match the target CPU.
6. Right-click the CPU in the project tree and select Go online. Choose the PG/PC interface and click Go online.

Once online, the existing S7 Program folder can be linked to the placeholder CPU, and the program can be compared or downloaded block by block. Drag the S7 Program from the project into the CPU's Program blocks tree, then choose Compare and resolve differences manually if needed.

6. Method 4 — Classic STEP 7 (Simatic Manager): Accessible Nodes

For S7-300 and S7-400 systems engineered in classic STEP 7, the Accessible Nodes browser has been the standard diagnostic tool for two decades and does not require any project at all.

1. Open Simatic Manager.
2. From the menu bar choose Options > Set PG/PC Interface. Pick the TCP/IP → <your NIC> entry for Ethernet-attached CPUs.
3. From the menu bar choose PLC > Accessible Nodes (in some versions: View > Accessible Nodes).
4. Simatic Manager displays a tree of every S7 CPU reachable on the wired Ethernet adapter, listed by MAC address when the IP is unknown.
5. Expand the entry to see Blocks, System Data, and CPU subfolders.
6. Open the Blocks folder to see the program structure: OBs, FBs, FCs, DBs, SFBs, SFCs. Right-click any block and choose Monitor/Modify for online access without opening the offline program editor.

To force a tag in a DB without the offline project, open the DB from Accessible Nodes > Blocks > System Data or from the corresponding Blocks folder, then choose PLC > Monitor/Modify > Insert Address. Enter the absolute address (for example DB10.DBD0) and click Force.

7. Method 5 — S7 Webserver (Browser-Based, No Siemens Software)

S7-1200 (firmware V4.0 and later), S7-1500, and S7-300/400 with a CP card can publish a read-only webserver. If the project integrator enabled it and the access list permits the connecting IP, the PLC can be inspected from any modern browser without installing TIA Portal or STEP 7.

1. Open a browser and navigate to http://<CPU IP> (HTTPS supported on S7-1500 with certificate).
2. The default page shows the CPU identification, the operating state, and module information.
3. Navigate to Tag tables to view live values of user-defined tags. Variables must have been published via the Webserver configuration in TIA Portal to appear.
4. Use the Diagnostics buffer link to read the same diagnostic events visible in TIA Portal.
5. Some firmware versions permit setting the operating state (RUN/STOP), flashing the LED, and updating the time. They do not allow editing ladder or FBD code.

8. Method 6 — PRONETA, SINEC NMS, and Topology Tools

PRONETA is a free Siemens engineering tool for PROFINET networks. It does not require a project, can scan a subnet, assign IP and PROFINET device names, and read diagnostics from all reachable devices. Use it when the CPU's IP is unknown, or when you need a quick network audit.

1. Download PRONETA from the Siemens support site (search for PRONETA on support.industry.siemens.com). Version 3.x supports modern TIA Portal projects; version 2.x is the last release for S7-300/400 commissioning.
2. Install and launch. Select Network analysis from the start screen.
3. Choose the network adapter connected to the PLC network and click Start. The tool enumerates every PROFINET and TCP/IP device that responds, displaying the device name, IP, MAC, vendor, and module information.
4. Double-click an S7 CPU to see its operating state, diagnostic buffer, and tag list (where published).
5. Use IO test to verify the wiring of a remote IO station without running a full program.
6. Use Set IP address or Set PROFINET name to bring an unconfigured CPU online if its IP was lost.

For larger sites, Siemens offers SINEC NMS, a network management system that can supervise thousands of PROFINET devices and store topology snapshots, firmware baselines, and event logs. It is licensed per network.

9. PG/PC Interface and Protocol Configuration

The single most common cause of "online failed" errors in both TIA Portal and STEP 7 is a misconfigured PG/PC interface. The interface must point to a physical adapter that can actually reach the target subnet.

To verify, open Start > Siemens Automation > Set PG/PC Interface (a Windows Control Panel applet installed with TIA Portal). Confirm the active entry matches the adapter your cable is plugged into, then close. Re-open TIA Portal for the new setting to take effect.

10. Network Configuration and IP Reachability

When the CPU is on a different subnet, the engineering station cannot reach it directly. There are three common workarounds.

1. Add a secondary IP to the laptop's NIC. In Network Connections > Ethernet > Properties > Internet Protocol Version 4 > Advanced, add a second IP in the target subnet. Windows will route correctly without rebooting.
2. Use a crossover cable or unmanaged switch. A direct PC-to-CPU Ethernet connection works for both S7-1200/1500 (auto-MDIX) and classic S7-300/400 CP cards.
3. Configure a router on the subnet. For multi-site access, a small industrial router (e.g., SCALANCE) can act as a gateway; configure the CPU's router address and add a static route on the PC.

To change the CPU's own IP without TIA Portal, use PRONETA (Section 8) or the S7 webserver (Section 7) — both offer IP editing under their access-control lists.

11. Verification Steps

After establishing any of the online connections above, run these checks to confirm the connection is functional, not just open.

1. CPU state visible. The online header should show RUN, STOP, or the configured startup state. If the field is blank or shows "???", the connection is partially open — usually a firewall or PG/PC interface issue.
2. Diagnostic buffer readable. Open Online & Diagnostics > Diagnostics buffer. A successful read returns a chronological list of events. Empty / refused = connection not fully established.
3. Tag monitoring. Add a known live tag (e.g., a system clock bit) to a watch table. Confirm the value updates at least once per second. If the column is static, the connection is open but the project tree is mis-bound to a different CPU.
4. Block comparison. Right-click the CPU in the project tree and select Compare > Offline/online. The resulting report tells you exactly which blocks match the target — a critical integrity check when only the program (not HW) is available.
5. Time sync. Verify the CPU's clock matches the PC's clock within 1 second. S7-1200/1500 supports time-of-day sync via NTP; the engineering station's time is what gets displayed in the diagnostic buffer.

12. Common Error Messages and Resolutions

13. Field-Proven Tips

• Keep a "go-bag" with a USB-to-Ethernet adapter, a Siemens PC-Adapter USB (for MPI/PROFIBUS fallback), and a portable install of TIA Portal with all common HSPs pre-loaded. This eliminates the most common field blocker — missing hardware support.
• When the only available artifact is an S7 Program folder, do not attempt to recreate the HW config from screenshots. Build a placeholder CPU (Method 3), connect online, and use Upload to device to get the actual hardware configuration from the live CPU. The Upload operation captures the real slot layout, module versions, and PROFINET device names.
• For S7-300/400 cabinets with no Ethernet at all, the only realistic online path is PROFIBUS via a CP card, or MPI via the PC-Adapter USB. Set the PG/PC interface accordingly before opening Simatic Manager.
• Document the IP assignment for every device you touch. PRONETA's Export topology produces a CSV of every discovered device — attach it to the project archive before leaving site.

14. Cross-Platform Notes

15. FAQ