Troubleshooting S7-400 CP443-1 Routing Through Cisco Firewall

Problem Overview

When integrating Siemens S7-400 automation stations (AS) into a SCADA backbone using a Cisco firewall as the security boundary between the field LAN and the control-center server LAN, a recurring fault mode appears: the SCADA servers can reach the engineering notebook through the firewall, but the S7-400 stations behind the CP443-1 communication processors cannot be pinged or contacted at all. The station appears completely isolated from the server side, even though the physical cabling, link LEDs, and firewall routing tables are all correct. Removing the firewall from the path (straight cable from server switch to field switch) restores S7-to-server communication immediately.

This symptom almost always points to a routing/gateway mismatch on the CP443-1 itself. The CP443-1 behaves like a Layer-3 host on the field subnet. If the operator assigns it an IP address and a subnet mask but forgets to declare the firewall as its default router in the STEP 7 hardware configuration, the CP443-1 will only answer ARP requests and IP packets that originate inside its own subnet. Any packet destined for the server subnet (for example 198.122.100.0/24) is silently discarded because the CP443-1 has nowhere to send it.

Reference Network Architecture

The typical layout that produces this fault is shown below:

The notebook is intentionally dual-homed or sits in the OT zone with a route to the IT/SCADA zone. Because the notebook already has the firewall IP (192.168.2.1) as its default gateway, it can reach the server subnet without further configuration. The CP443-1 is on the same OT subnet, but it has no knowledge of any subnet other than 192.168.2.0/24 until a router is configured.

Root Cause Analysis

Three defects typically combine to produce the symptom:

1. Missing default-router entry in CP443-1. In STEP 7 V5.x HW Config, the CP443-1 properties dialog contains a field "Use router" with a free-form IP address. When this field is empty, the CP443-1 treats every packet destined outside its own subnet as unroutable. There is no implicit gateway.
2. Symmetric firewall policy not in place. Even with a correct CP443-1 gateway, the Cisco firewall must permit ICMP echo-request/reply, ISO-on-TCP (port 102), and IEC 60870-5-104 (TCP port 2404) from the server zone to the field zone and the return path. Stateful inspection on ASA/FTD will block the first ping if the inspection engine does not recognize the IEC 104 traffic.
3. CP443-1 firmware or mode mismatch. Some CP443-1 firmware revisions require "Router mode" to be activated separately from the IP configuration. CP443-1 EX11 and earlier, in particular, do not always forward unsolicited packets correctly.

Quick diagnostic checklist before changing any configuration:

• From the engineering notebook on the OT side, ping 192.168.2.10 (CP443-1 directly) succeeds.
• From the engineering notebook on the OT side, ping 198.122.100.10 (SCADA server through firewall) succeeds.
• From a SCADA server on the IT side, ping 192.168.2.10 (CP443-1) fails with timeout.
• From the firewall CLI, show arp shows the CP443-1 MAC address bound to 192.168.2.10.
• ping from the firewall's inside interface to the CP443-1 succeeds.

If the first three conditions hold, the problem is purely routing on the CP443-1 and/or a missing firewall rule. If even the firewall itself cannot ping the CP443-1, suspect an ACL, an IP helper entry, or a switchport VLAN mismatch on the field switch.

Solution 1: Configure Default Router on CP443-1 in STEP 7

Prerequisites

• STEP 7 V5.5 SP4 or later (or TIA Portal V13+ for S7-400 projects migrated to PCF).
• CP443-1 firmware compatible with STEP 7 version. Recommended: CP443-1 EX30 (6GK7443-1EX30-0XE0) firmware V3.x or CP443-1 Advanced (6GK7443-1GX20-0XE0) for new deployments.
• Engineering access to the S7-400 station via MPI/Profibus or via the OT-side notebook.
• The S7 project file (S7P) that contains the HW Config for the AS.

Step-by-Step Procedure

1. Open SIMATIC Manager and the S7 project containing the affected station.
2. Open HW Config and locate the CP443-1 in the rack (slot 4 or higher, depending on the S7-400 power-supply configuration).
3. Double-click the CP443-1 to open the Properties dialog.
4. Switch to the General > Interface tab and confirm:
   • IP address: 192.168.2.10
   • Subnet mask: 255.255.255.0
   • "Set MAC address / Use ISO protocol" unchecked unless ISO transport is in use.
5. Switch to the General > Gateway tab (visible as a separate sub-dialog in STEP 7 V5.x; in TIA Portal it is integrated in Properties > Ethernet addresses > IP protocol).
6. Check the radio button "Use router" and enter the firewall's inside interface IP: 192.168.2.1.
7. Click OK and recompile HW Config (Station > Save and Compile).
8. Download the HW Config to the AS: PLC > Download to Target System > All or selectively only the CP443-1 if the CPU is in RUN.
9. Cycle power on the CP443-1 if STEP 7 prompts for a restart (most firmware revisions require this for routing-table changes).
10. From the SCADA server, execute ping 192.168.2.10 -t and confirm echo replies within 1-3 ms.

Solution 2: Validate Cisco Firewall Policy

The CP443-1 routing alone is not sufficient. The Cisco firewall must explicitly allow the SCADA-relevant protocols and ICMP between the zones. IEC 60870-5-104 is a TCP-based protocol on port 2404, and ISO-on-TCP (used by some S7 communication paths) is on port 102. Modern ASA and FTD platforms need an explicit access rule because they do not have built-in deep-packet-inspection for IEC 104 unless the Cisco ASA FirePOWER module or an industrial-protocol IPS subscription is installed.

Minimum Access Rules (Cisco ASA/FTD)

Verification from the Firewall CLI

! Cisco ASA example
ASA-FW# show access-list | include 192.168.2
ASA-FW# show conn address 192.168.2.10
ASA-FW# packet-tracer input IT-Servers protocol tcp 198.122.100.10 10234 192.168.2.10 2404

If show conn shows no entry when an IEC 104 poll is in progress, the firewall is dropping the SYN packet. Run debug icmp trace or, on FTD, capture via FTD Captures to confirm.

Solution 3: CP443-1 Firmware and Mode Checks

Some older CP443-1 firmware revisions have known routing anomalies. Confirm the firmware and operating mode via HW Config or by reading the diagnostic buffer:

Router mode is enabled by default on EX20 and later. On EX11, ensure Properties > Operating Mode > "Router" is checked.

Step-by-Step Verification

1. Layer-1 and Layer-2 verification. From the OT notebook: ping 192.168.2.10 returns reply in <1 ms. The CP443-1 link LED on the field switch is steady green.
2. Firewall routing. From the firewall inside interface: ping 192.168.2.10 succeeds; ping 198.122.100.10 from the inside interface also succeeds (return path to IT/SCADA verified).
3. End-to-end ping. From the SCADA server: ping 192.168.2.10 returns reply in 1-3 ms. Repeat for every CP443-1 in the station.
4. ISO-on-TCP S7 connection test. From STEP 7 on the SCADA server, open PLC > Edit Ethernet Node > Browse. The CP443-1 MAC address should appear with its IP 192.168.2.10.
5. IEC 60870-5-104 connection test. Using the SCADA master test tool, force a general interrogation (GI). The CP443-1 should respond with measured values within the configured cycle time (typically 5-30 s).
6. Firewall connection table. On the firewall, show conn shows an established TCP connection with source 198.122.100.10/<ephemeral> and destination 192.168.2.10/2404, flags UIO or FA.
7. Sustained load. Leave the ping and IEC 104 poll running for at least 1 hour and watch for timeouts. Some router-mode bugs in CP443-1 EX11 firmware only manifest after a few hours of idle.

Common Pitfalls and Field Notes

Pitfall 1: Duplicate IP and ARP poisoning

If two devices on the field subnet use 192.168.2.10 (for example, a temporary engineering PC that was never disconnected), the firewall will receive inconsistent ARP replies. Symptom: intermittent ping failure, "destination host unreachable." Remove the duplicate device or reassign the CP443-1.

Pitfall 2: Cisco firewall doing NAT without an exemption

If the firewall performs NAT between the OT and IT zones, the SCADA server will see the CP443-1 as a translated address (often the firewall's outside IP). Configure a nothing NAT rule (identity NAT) between the two zones, or use route-mode (no NAT) on the firewall. Verify with show xlate on ASA.

Pitfall 3: BPDU guard on the field switch port

If the CP443-1 is plugged into an access port on a managed switch with BPDU guard enabled, the port will go into err-disabled state the moment the CP443-1 sends any STP BPDU. Verify show interface status err-disabled on the switch.

Pitfall 4: CP443-1 in "PG mode" only

A CP443-1 that has not been fully integrated into the STEP 7 project (only used as a programming interface) may have its routing disabled. After integrating the CP into HW Config as a production CP with active connections, the routing becomes permanent across reboots.

Pitfall 5: Server-side default gateway wrong

If the SCADA server's default gateway is incorrectly set to 192.168.2.1 (the firewall's inside IP), return packets will be black-holed because 192.168.2.1 does not route server-originated packets onto the IT side. The correct gateway is always the firewall's interface that faces the source device: 198.122.100.1 for SCADA servers.

Security Hardening Recommendations

After connectivity is restored, lock down the boundary:

• Disable ICMP echo-request from IT to OT after commissioning. Replace with synthetic IEC 104 supervision tags.
• Enable Cisco ASA Modular Policy Framework (MPF) with connection limits per IEC 104 master (typically 1-5 concurrent connections from each SCADA server).
• Configure CP443-1 Access Protection (Properties > Security > Access Protection) with an explicit list of permitted partner IPs and S7 connection slots.
• Enable Syslog on the firewall for denied IEC 104 packets and forward to the SCADA historian.
• Apply a management-plane ACL so that only the engineering VLAN can SSH into the firewall.

Alternative Architectures

For very large deployments (more than 50 S7-400 stations, more than 5 SCADA servers), a single firewall becomes a bottleneck and single point of failure. Common scaled-up topologies include:

• Dual firewall HA (Active/Standby) with stateful failover. Cisco ASA 5525-X or FTD 4110 in failover pair, dedicated IEC 104 inspection module.
• DMZ with IEC 104 gateway. A Siemens SICAM PAS or SIPLUS RIC IEC 104-to-OPC UA gateway sits in a DMZ, terminating IEC 104 from the field and exposing OPC UA to the SCADA tier.
• CP443-1 with Industrial Security module. The CP443-1 EX30 and later support a SCALANCE S612 or CP1628-based security module that can perform IPsec encapsulation to the SCADA master, eliminating the need for an inline firewall.

Troubleshooting Matrix

FAQ