STEP 7 V5.5 Remote Download: Configuring Internet IP in HW Config

Engineers maintaining a SIMATIC S7-300/S7-400 station across the public Internet frequently encounter a confusing asymmetry: the Upload station to PG action in SIMATIC Manager prompts for the remote IP address, but the Download action does not. When the operator clicks Download, STEP 7 attempts to reach a partner that "is not responding" and aborts with the dialog "Online: connection could not be established." This article documents the root cause, the exact hardware configuration change required, and the verification steps that confirm a successful remote download to a CPU such as the 416-3 DP with a CP 443-1 communications processor.

1. Problem Statement

Engineer A on a service laptop runs SIMATIC Manager Step 7 V5.5 SP4 with WinCC flexible 2008 SP5. The customer plant publishes a SIMATIC HMI (MP 377) and a SIMATIC S7-400 station on the public Internet through a static public IP. The engineer reports the following repeatable sequence:

1. Menu PLC > Upload Station to PG — a dialog appears requesting the partner IP. The engineer enters the customer's public WAN IP. Upload of the S7 program completes.
2. Menu PLC > Download (or highlight blocks and select Download) — no partner IP dialog appears. After the default TCP timeout (default 10 s, configurable up to 60 s) the message "Online: connection could not be established. The connection partner is not responding." is shown. The progress dialog never indicates which IP it tried.
3. WinCC flexible 2008 Transfer from the same laptop does prompt for a target IP and downloads the HMI image successfully.

The asymmetry between the S7 and the HMI download path is the diagnostic clue. WinCC flexible Transfer uses its own Ethernet channel configuration (PN/IE), so the IP is supplied by the operator at run time. STEP 7 V5.5 Download, by contrast, takes the partner address from the project's hardware configuration.

2. Root Cause Analysis

STEP 7 V5.5 Online operations use the ISO-on-TCP / TCP / PROFIBUS partner address stored against the CP object in the offline HW Config project. The Download action does not consult a runtime prompt; it consults the project. The Upload action uses a separate path (S7 routing / dynamic connection establishment) and that path is why the IP is requested at run time.

Concretely, the partner IP for a Download is taken from one of the following places inside HW Config:

• CP 443-1 / CP 343-1 — the IP address field of the Ethernet interface properties.
• PROFINET interface of the CPU (e.g. CPU 416-3 PN/DP) — the IP address assigned to the PN-IO subnet of the CPU.
• An S7 routing path through an additional CP that is reachable via the configured gateway.

If HW Config still holds the customer's private LAN IP (e.g. 192.168.0.10) the Download tries that address on the engineer's laptop. Because that address is not routable on the Internet and is not even on the engineer's local subnet, the TCP connection times out and STEP 7 reports the connection-partner error.

This is documented in the Siemens support entry "What you should watch out for with a remote access to a SIMATIC S7 with STEP 7 via the Internet" (entry ID 28810054). The same KB article notes that a permanent public IP on the remote partner simplifies the workflow considerably.

3. Prerequisites

• STEP 7 V5.5 + SPx installed on the engineering station, with the same project (or a freshly uploaded offline copy) used for the remote session.
• Customer station reachable from the engineering LAN: the customer's firewall must permit inbound TCP/UDP on the S7 ports, and the S7-400 must be at a known public static IP, or the public IP must be reachable through a 1:1 NAT on the customer's router.
• CP 443-1 (or equivalent) firmware that supports ISO-on-TCP / TCP S7 communication, typically firmware V2.x or V3.x. Compatible firmware is delivered with STEP 7 V5.5; cross-check the version with the Siemens product support pages.
• For S7-300 stations: CP 343-1 (6GK7 343-1EX30 / 6GK7 343-1CX10 / 6GK7 343-1GX30 families are typical). The same IP-from-HW-Config rule applies.
• The customer's online HW Config must be retained on the CPU: the engineer must not write the changed HW Config back to the PLC.

4. Step-by-Step Solution

The fix is a controlled, temporary edit of the offline project. The remote IP is entered into HW Config, the Download is executed, and HW Config is then restored so that the offline project continues to match the PLC.

4.1 Open HW Config in the offline project

1. In SIMATIC Manager, open the S7 project that corresponds to the customer station.
2. Select the SIMATIC 400 Station (or SIMATIC 300 Station) object.
3. Double-click Hardware to launch HW Config.

4.2 Edit the IP of the relevant Ethernet interface

1. Locate the Ethernet entry: for a CPU 416-3 DP, the PN interface of the CPU or, more commonly, the CP 443-1 in the rack. For a CPU 416-3 PN/DP, the PN-IO interface of the CPU is the active node.
2. Double-click the interface object (for example, CP 443-1 > properties > Properties > Ethernet interface).
3. In the IP address field, replace the customer's private LAN IP with the customer's public Internet IP (or with the public IP that NATs 1:1 to the CP's private IP).
4. Leave the subnet mask at the default class appropriate for the public address (typically 255.255.255.252 or the customer's ISP-supplied value). Do not modify the router address unless the customer's router has a public address in the same subnet.
5. Click OK. HW Config marks the station as "changed" (yellow icon).

4.3 Perform the block Download

1. Close HW Config. SIMATIC Manager returns focus.
2. In the project tree, select the Blocks folder (or the specific blocks to be loaded).
3. Menu PLC > Download (or right-click > Download to Target System).
4. STEP 7 reads the (now public) IP from the offline project and establishes the S7 connection. The Connect to Target System dialog now shows the public IP as the partner.
5. Confirm the download. Blocks transfer to the CPU.

4.4 Restore HW Config to the LAN IP

1. Re-open HW Config.
2. Re-enter the customer's private LAN IP and the original subnet mask / router address.
3. Station > Save and Compile (Ctrl+S). Do not download HW Config to the PLC.
4. Close HW Config.

The offline project now matches the live PLC again, and the engineer can continue local work without surprises.

5. Verification

1. In SIMATIC Manager, PLC > Accessible Nodes. The remote CPU should appear with the public IP and the correct module / firmware identifier.
2. Open the online block view (Blocks > right-click > Monitor/Modify or open online/offline comparison). The freshly downloaded blocks must show the new logic / new FC/FB numbers.
3. From a Windows command prompt on the engineering laptop, ping <public IP> must return a reply (subject to the customer's firewall not dropping ICMP). If ICMP is filtered, a successful TCP connection from STEP 7 is itself the proof.
4. Check the S7 connection diagnostic on the CP: in HW Config on a session at the customer site, right-click the CP > Diagnostics shows the live connection list and confirms the engineering IP is registered as a partner.

6. Port and Protocol Requirements

For an S7-400 reachable directly over TCP, the customer's router must forward the following ports to the CP's private IP. Exact port list depends on the S7 services used.

Exposing TCP/102 directly to the public Internet is supported by Siemens for engineering access, but is widely considered a security anti-pattern. A site-to-site IPsec VPN or an SSL-VPN concentrator that drops the engineer onto a private subnet that includes the S7 station is the recommended architecture. The Siemens KB 28810054 covers this trade-off in detail.

7. Firewall and NAT Caveats

Three failure modes account for almost every "connection partner is not responding" report on a public-IP setup:

1. Stateful firewall dropping idle S7 connections. A 60-second idle timeout will close the TCP session. Raise the timeout to 30 minutes or more for the S7 source IP.
2. 1:1 NAT mismatch. The customer router forwards <public IP>:102 to 192.168.0.10:102 on the CP. STEP 7 connects to the public IP; the CP replies from 192.168.0.10. If the firewall is not in fast-path mode, return packets can be dropped. Force a static source NAT so the CP's reply exits with the public IP as source.
3. Carrier-grade NAT / double NAT. The customer's ISP supplies a 100.64.x.x address (CGNAT) rather than a true public IP. STEP 7 then cannot reach the CP at all. Confirm with tracert from the engineer side, or with the customer's ISP, that the public IP is a true global address.

8. Alternate Architecture: Remote Desktop to a Jump Host

For sites where opening TCP/102 to the Internet is not acceptable, drive STEP 7 from a Windows host that already lives inside the customer LAN. The engineer connects to that host with Remote Desktop and runs SIMATIC Manager locally; HW Config then holds the private IP and the Download works as it would on-site. Two well-supported clients exist:

• Microsoft Remote Desktop — native RDP client. Configure the jump host with a fixed LAN IP, enable Remote Desktop, and add a routable inbound rule on the customer's firewall to TCP/3389. Use Network Level Authentication and a certificate to avoid exposing NLA-less RDP to the Internet.
• Chrome Remote Desktop — browser-based relay that does not require inbound port forwarding on the customer side. The relay is operated by Google; the customer host initiates an outbound HTTPS connection, the engineer joins via a one-time access code. Latency is acceptable for STEP 7 transfer of medium-sized programs; large downloads are faster over RDP because the bandwidth is direct.

From a STEP 7 perspective, a remote-desktop session is the cleanest option: HW Config is unmodified, the IP is the local LAN IP, and the only change is the latency between the engineer's keystroke and the CPU's reaction.

9. WinCC Flexible 2008 — Why HMI Transfer Works Without This Trick

WinCC flexible 2008 transfer uses the PN/IE interface settings of the WinCC flexible project, which are independent of the STEP 7 project. The transfer dialog has its own field for target IP, populated by the operator at the moment of transfer. This is why the engineer sees a prompt for the HMI but not for the S7. The two products share an Ethernet medium but not a configuration model.

10. Firmware and CPU Compatibility Notes

For ordering and current firmware, consult the Siemens product support portal at support.industry.siemens.com. The order numbers above are the standard families; specific MLFBs (and the matching firmware files) must be taken from the customer's hardware inventory.

11. Troubleshooting Matrix

12. Security and Operational Guidance

• Don't expose TCP/102 to the public Internet unless the customer's policy requires it. A VPN, jump host, or TLS-secured remote-maintenance gateway is the engineering recommendation.
• Use a dedicated service account on the S7 CPU (CPU password, know-how protection) so that a leaked STEP 7 project does not hand a stranger write access.
• Always restore HW Config after the remote session, otherwise the offline project silently diverges from the live PLC and the next on-site engineer will be confused.
• Audit the change: download events to a CPU are recorded in the CPU's diagnostic buffer with the source IP and the timestamp. Use this for an after-the-fact audit trail.
• Document the customer's public IP, the NAT port-forwarding, and the firewall rules in the project folder. The next engineer on rotation will need it.

13. Quick Procedure (Cheat Sheet)

1. SIMATIC Manager > open the customer project.
2. Open Hardware.
3. Double-click the Ethernet CP or PN-IO interface.
4. Replace the LAN IP with the customer's public IP.
5. Save HW Config (Ctrl+S). Do not download HW Config to the PLC.
6. Close HW Config.
7. Select Blocks > PLC > Download.
8. After the download completes, re-open HW Config and restore the LAN IP.
9. Save HW Config (Ctrl+S). Do not download HW Config to the PLC.
10. Run PLC > Accessible Nodes to confirm connectivity.

14. Frequently Asked Questions