Siemens SCALANCE S Firewall Setup for OPC UA Industrial Networks

Overview

Adding a dedicated firewall and a second network for OPC UA exchanges is the first concrete step an automation engineer takes when moving a flat plant network into a properly segmented architecture. Siemens addresses this requirement with the SCALANCE S Industrial Security Appliance family, which combines a stateful inspection firewall, optional IPsec VPN termination, and Industrial Ethernet switching in a DIN-rail form factor designed for cabinet mounting next to SIMATIC S7-1200, S7-1500, ET 200SP, or SCADA hardware.

The goal of this guide is to take a small starter system (a single PLC, a few sensors, and now a new SCADA workstation that needs to read an OPC UA server) and convert it into a segmented, two-zone network with a SCALANCE S appliance enforcing the boundary. The configuration example is based on the official Siemens knowledge base entry "Understanding and Using Firewall of Industrial Security Appliance SCALANCE S" and the SCALANCE S V21 firewall PDF manual.

Prerequisites

Before commissioning the firewall, verify the following items are available and within the supported firmware envelope of the SCALANCE S device.

• SCALANCE S hardware (one of): SCALANCE SC622-2C, SC632-2C, SC636-2C, SC642-2C, SC646-2C (SC-600 family), SCALANCE S615, or SCALANCE SC-400 series. The SC-600 line is current as of the V8.x firmware train used in this article.
• Firmware loaded on the device, for example SCALANCE SC600 V8.2 or later. The latest version and SHA-256 checksums are listed on the Siemens Industry Online Support product page; never run a SCALANCE S device on firmware older than the version Siemens has designated as the current security baseline.
• Configuration access via Web Based Management (HTTPS, TCP 443) or TIA Portal (with the SCALANCE device plug-in). SSH (TCP 22) and Telnet (TCP 23) should be disabled after commissioning.
• A management station (engineering laptop) with a static IP in the same subnet as the SCALANCE S management interface for the initial login.
• OPC UA server already commissioned and reachable on its own subnet. Confirm the server software version and its Endpoint URL, typically opc.tcp://<server-ip>:4840.
• SCADA software with an OPC UA client channel. Examples: WinCC V7.5 SP2 / WinCC Professional V18, WinCC Unified, Ignition, or any third-party SCADA that speaks OPC UA.
• A network plan documenting the subnets, VLAN IDs, and the OPC UA TCP/UDP port(s) the server actually uses. Default OPC UA binary port is TCP 4840. Discovery uses the same port. HTTPS-based OPC UA uses TCP 443. Keep the firewall rule set to the minimum port set actually required.

Reference Architecture and Network Topology

The architecture used in the rest of this article is a two-zone cell with a SCALANCE S appliance acting as the zone boundary and as the default gateway for both zones. Each zone is one IP subnet and one VLAN. No inter-VLAN traffic is allowed unless a firewall rule explicitly permits it.

The SCALANCE S acts as a 3-port routed boundary. Ports P1, P2, and P3 are mapped to the three VLANs above as 802.1Q tagged members (or as access ports, depending on the peer switch configuration). A typical wiring pattern is:

• P1 – uplink to the management switch / engineering station.
• P2 – trunk to the SCADA network switch carrying VLAN 2 (and VLAN 1 as native).
• P3 – direct connection to the OPC UA server (or trunk to the server's switch carrying VLAN 10).

IP Addressing and VLAN Design

Decide on the IP and VLAN plan before you connect the SCALANCE S to the live network. Changing subnets on a running OPC UA server usually means re-importing certificates and re-binding the SCADA channel, so get it right the first time.

1. Choose non-overlapping RFC 1918 subnets for every zone. In this article the SCADA zone is 192.168.2.0/24 and the OPC UA server zone is 192.168.10.0/24.
2. Assign the SCALANCE S a stable IP on every zone interface; the address ending in .1 is conventional (192.168.2.1 and 192.168.10.1). This becomes the default gateway for every host in that zone.
3. Map each zone to a VLAN ID. Use a written VLAN table; the device will not warn you about an ID conflict.
4. For the SC-600 family, configure VLANs under Layer 3 > VLAN in Web Based Management, and bind each VLAN to a port as either access (untagged, single PVID) or trunk (tagged, multiple VLANs).
5. Document the OPC UA server's Endpoint URL and any alternative endpoints (e.g., opc.tcp://192.168.10.11:4840 for binary, https://192.168.10.11:443 for HTTPS transport). The firewall rule must allow the specific transport used.

SCALANCE S Initial Configuration

Bring the device up on the management network first, before any production VLAN is wired to a live PLC or SCADA. The default IP of a factory-fresh SCALANCE S is 192.168.16.1/24, with the Web Based Management reachable on TCP 443.

1. Connect the engineering station directly to port P1 of the SCALANCE S. Configure the engineering station with a static IP in 192.168.16.0/24 (e.g., 192.168.16.100/24).
2. Browse to https://192.168.16.1. Accept the self-signed certificate warning. The default user is admin; the initial password is printed on the device label and must be changed on first login.
3. Run the Wizard > First Setup workflow. Set the device name, location, contact, and the management IP. Replace the default password with a strong passphrase that meets the device's complexity policy (minimum length, mixed case, digit, special character).
4. Update firmware to the current released version before applying any production rules. Use System > Load & Save > Firmware Update. Reboot and re-verify the Web Based Management login.
5. Configure the system time using System > Time. NTP is recommended; if no NTP server is available, set the time manually and document the drift. Correct timestamps are required for log correlation and for OPC UA certificate validity windows.
6. Create the IP interfaces for the two zones: Layer 3 > Interfaces > Create. Interface vlan2 with address 192.168.2.1/24 bound to VLAN 2, and interface vlan10 with address 192.168.10.1/24 bound to VLAN 10.
7. Bind the VLANs to the physical ports under Layer 2 > VLAN. For the pattern in this article, P2 is a trunk carrying VLAN 1 (PVID, untagged) and VLAN 2 (tagged); P3 is an access port with PVID 10.

Firewall Rule Configuration

The SCALANCE S firewall is a stateful packet filter with explicit Permit rules. Implicit deny is the default for traffic that does not match a rule. Each rule binds a source interface or IP to a destination interface or IP, a protocol, and a port set. The full syntax is described in section 5 of the SCALANCE S V21 firewall manual.

For the topology in this article, the minimum rule set is two permits and a default deny:

To enter the rules in Web Based Management:

1. Open Security > Firewall > IPv4 Rules.
2. Click New. Set Action to Accept, From to IP 192.168.2.11, To to IP 192.168.10.11, and Service to the predefined OPC UA (4840) object (or define a custom TCP service 4840).
3. Add the ICMP rule. The SCALANCE S recognizes ICMP echo as a built-in service. Use it only for the initial bring-up; remove it once the SCADA channel is verified.
4. Enable the firewall globally under Security > Firewall > Global and confirm the Firewall state is On.
5. Save the configuration and back it up via System > Load & Save > Backup. Keep the backup file off the device, ideally in the same change-management repository as the PLC and SCADA projects.

OPC UA Port and Protocol Configuration

OPC UA is not a single port. The endpoint URL determines the transport:

For most cell-level SCADA integrations, OPC UA Binary on TCP 4840 is sufficient. If the OPC UA server is configured with SecurityPolicy=None for the initial bring-up, plan a hardening pass that switches the endpoint to Basic256Sha256 with SignAndEncrypt and replaces the self-signed certificates with ones issued by the plant PKI.

SCADA and OPC UA Server Configuration

1. Set the SCADA workstation's default gateway to 192.168.2.1 (the SCALANCE S VLAN 2 interface). Set the OPC UA server's default gateway to 192.168.10.1 (the SCALANCE S VLAN 10 interface).
2. In the SCADA OPC UA client channel, enter the endpoint URL exactly as published by the server, for example opc.tcp://192.168.10.11:4840. Do not use a hostname if DNS is not configured between the two zones; the SCALANCE S will not run a recursive resolver for you, and a missed DNS hop is the most common cause of "endpoint unreachable" in this topology.
3. Define the security policy and authentication mode. Anonymous is acceptable only during commissioning. Switch to certificate-based authentication (X.509) before production.
4. Subscribe to the tags needed for visualization. The number of monitored items and the publishing interval drive the bandwidth and the load on the SCALANCE S firewall state table. With up to 1,000 firewall rules and gigabit-class throughput on the SC-600 family, a few hundred monitored items is well within the device's capacity; thousands of items with a sub-second publish interval is not.
5. Persist the SCADA project and back up the OPC UA server configuration alongside the SCALANCE S backup file.

Verification and Diagnostics

Verify the configuration in a fixed order. Do not skip a step; a passing test at one layer proves only that layer, not the whole chain.

1. Layer 1 – physical/link: Verify port LEDs on P2 and P3 are solid green, indicating an active link at the negotiated speed.
2. Layer 2 – VLAN: From the engineering station on the management VLAN, ping 192.168.2.1 and 192.168.10.1. Both should respond. If only one responds, the VLAN-to-port binding is wrong.
3. Layer 3 – routing: From the SCADA workstation, ping 192.168.10.1 (the SCALANCE S VLAN 10 address). From the OPC UA server, ping 192.168.2.1. Both should respond. If routing fails, the IP interface or default gateway is misconfigured.
4. Layer 4 – firewall and ICMP: From the SCADA workstation, ping 192.168.10.11 (the OPC UA server's own address, not the gateway). This exercises the ICMP rule and the stateful return path. A failure here means the ICMP rule is missing or the implicit deny is firing.
5. Layer 7 – OPC UA: From the SCADA workstation, attempt the OPC UA connection in the SCADA client. A successful Read on a single tag proves TCP 4840, certificate trust, and authentication are all working. The status code in the OPC UA client should be Good (numeric 0).
6. Counter audit: In SCALANCE Web Based Management, open Information > Firewall > Statistics. Verify the rule counters for the OPC UA rule are incrementing in both directions. A non-zero Drops counter on a rule that should be passing indicates asymmetric routing, MTU issues, or an out-of-state packet.

Diagnostic commands on the SCALANCE S CLI

For a quick sanity check beyond the Web Based Management counters, the SCALANCE S command-line interface supports the following on SC-600 firmware V8.x:

show ip route
show firewall rules ipv4
show firewall statistics ipv4
ping 192.168.10.11 source 192.168.2.1
traceroute 192.168.10.11 source 192.168.2.1

The show firewall statistics output includes a per-rule hit count, byte count, and last-match timestamp. Use this to confirm that the OPC UA rule is matching live traffic and that the implicit deny is not catching legitimate packets.

Security Hardening Recommendations

Once the OPC UA channel is verified, perform a hardening pass before the cell is considered production-ready.

• Remove the ICMP rule that was used for the initial bring-up. Re-add it only when actively troubleshooting.
• Disable HTTP, Telnet, SNMPv1/v2c, and any unused management protocols under System > Services. Keep only HTTPS and SSH (with public-key authentication, not password).
• Replace the default self-signed certificate of the SCALANCE S with a certificate signed by the plant CA. The Web Based Management is then reachable as a trusted HTTPS endpoint.
• Enable logging to a remote syslog server. The SCALANCE S supports syslog over TCP with TLS; configure a dedicated log interface IP and a server-side certificate.
• Enable SINEC NMS or LMS for centralized firmware and configuration management. The firewall settings workflow is described in the LMS firewall configuration topic.
• On the OPC UA server, switch the security policy to Basic256Sha256 with SignAndEncrypt, enforce certificate-based authentication, and disable anonymous login.
• Document the rule set in a change record, with the same rigor as a PLC program change. The firewall is a control system element, not an IT appliance.

Troubleshooting Matrix

Frequently Asked Questions