Step 7: Reaching PLC/HMI over VPN

STL??? · Jul 12, 2010

Hi Folks,
I have a VPN connection to my company network and would like to be able to remotely support if needed.

On site i can reach any PLC/HMI without issue however i cannot over VPN.

I've done a search on here and havent found anything conclusive, so i was wondering if anybody here has had similar problems and what they did to overcome them?

http://www.plctalk.net/qanda/showthread.php?t=43154&highlight=vpn
Suggests the following:
"You also have to Nat the port 102 in the routers"
"Remember that on router you need unlock TCP port 1723"

Are these the only exceptions needed for communication?

Thanks in advance
Steve

Ken Roach · Jul 12, 2010

What brand PLC and HMI devices are you using ?

Most industrial devices use a TCP port that's one one of the common ones (HTTP on Port 80, Telnet on 24, SMTP on 25) so many VPN setups don't automatically pass those ports.

Allen-Bradley devices, for example, use TCP Ports 2222 and 44818.

You might also need to set up the "Default Gateway" setting on your controllers to work with the VPN server. Is this a PC that's running VPN software, or an appliance or router ?

Edit: Whoops, your title did mention S7. I'm off, then.

MATT116 · Jul 12, 2010

I have done this type of setup before but never with a S7
So you have verified that the tunnel is working?
Do you have access to both the local and remote modem/router?

STL??? · Jul 12, 2010

So you have verified that the tunnel is working?

Yes VPN is working fine, i can read email,access network drives etc

Do you have access to both the local and remote modem/router?

Unfortunately no - i need to make a request to our IT headquarters for exceptions if needed - i need to find out what first before the fight begins to get them implemented.

I cannot get any details of the setup either

Thanks for the Info Ken - good to know

MATT116 · Jul 12, 2010

IT departments

Maybe they have some type or ACL (action control list) that is blocking your PLC/HMI

Post your fix when you figure it out. I'm always interested in network setup

dimmarkov · Jul 13, 2010

Hi,
Did you select a Use router option in HW configuration of S7 PLC?

LestatZA · Jul 13, 2010

dimmarkov said:
Hi,
Did you select a Use router option in HW configuration of S7 PLC?

Would be my first question also.
Remember it must be the last router address in the routing chain.

krk · Jul 13, 2010

I just connect via VPN (using company laptop) and then use remote desktop to connect to my S7 & InTouch development PC.

Jeebs · Jul 13, 2010

krk said:
I just connect via VPN (using company laptop) and then use remote desktop to connect to my S7 & InTouch development PC.

This is the way we do it.

STL??? · Jul 13, 2010

Thanks everyone for the helpful replies,

dimmarkov
Hi,Did you select a Use router option in HW configuration of S7 PLC?

I had forgot about this

LestatZA
Remember it must be the last router address in the routing chain.

krk
I just connect via VPN (using company laptop) and then use remote desktop to connect to my S7 & InTouch development PC.

My setup is laptop based unfortunately - i have a docking station and second screen at my desk.

I have asked for last router IP address so ill see how it goes.

Regards Steve

Mike_RH · Jul 13, 2010

I have done this setup a couple of times, the items to watch have aready been mentioned:
1. Port 102 must be open along the entire communication path
2. The "Use router" connection and IP address must be configured in the HW configuration and already downloaded to the cpu.

I don't think the accessible node and browse features work.
There is a FAQ on the Siemens support site covering the set up.

STL??? · Jul 13, 2010

Thanks Mike - i did look for a FAQ on Siemens support without luck, think ill have another look with different search criteria.

Mike_RH · Jul 13, 2010

Try entry ID 8970169 for the ports used and 38571711 for remote access configuration.

STL??? · Jul 13, 2010

Thanks Mike

STL??? · Jul 15, 2010

S7 monitoring is now working over VPN - Thanks everyone for your help :site:

Step 7: Reaching PLC/HMI over VPN

STL???

Member

Ken Roach

Lifetime Supporting Member + Moderator

MATT116

Member

STL???

Member

MATT116

Member

dimmarkov

Member

LestatZA

Member

krk

Lifetime Supporting Member

Jeebs

Member

STL???

Member

Mike_RH

Lifetime Supporting Member

STL???

Member

Mike_RH

Lifetime Supporting Member

STL???

Member

STL???

Member

Similar Topics