What Firewall Rules should I configure between ES, OSS (WinCC server) and OS (WinCC Client)?

Hi all,

I need support here. Does anyone have ideas on what firewall rules to configure within a network firewall ( SC636-2C) between ES, OS Server (WinCC Server) and OS Client (WinCC Client)?

System - PCS 7 V9.x

WinCC - V7.4 / v7.5

After connecting the stations through network firewall with all TCP and UDP ports allowed to pass through, the simatic shell in ES could not reach WinCC server and WinCC Client.

Hi,

I would recommend you review the following links of the WinCC/PCS7 documentation:

How to Access Computers Outside a Subnet > Firewall settings

How do you manage to maintain the WinCC client-server communication when a firewall is switched on?

Additionally, there is the SIMATIC Security Controller tool that is used to restore the settings for registry, permissions, firewall, etc.

Thank you for the reply. Indeed, I have reviewed all the windows host firewall rules mentioned in both security controller and siemens pcs 7 installation security permissions page .

And then, I made the network firewall rules to all all TCP and UDP ports from ES/OSS/OSC to/from ES/OSS/OSC. The result is negative. Simatic shell cant see each other.

if the network firewall bypassed and directly connecting them to a hub, simatic shell can see all the stations.

Have you set up Multicast Proxy settings in SIMATIC Shell on machines on both sides of the firewall?  When dealing with firewall I've always found that you must use that even if all other traffic goes through (ping, SMB etc.)  Firewalls can't easily/don't really forward multicast traffic which is what SIMATIC Shell uses.

You can check more in the WinCC 7.5SP2 manual in section 1.2.2.4 and especially 5.1.9.3.

https://support.industry.siemens.com/cs/document/109792585/

Thank you. Let me give it a try. 

The current case of my issue is , the OS Servers and OS Clients are in the same subnet. A network firewall (SC636-2C) configured in between of them in terminal bus via Intervlan Bridge configuration. Even all rules allowed in the firewall, but simatic shell could not detect it. 

We will test the multicast configuration , to add all relevant IP address (same subnet) in the multicast list to see whether it works. 

Will update here again. 

Thank you for your advice.  

itafusna

Hi,

I would recommend you review the following links of the WinCC/PCS7 documentation:

How to Access Computers Outside a Subnet > Firewall settings

How do you manage to maintain the WinCC client-server communication when a firewall is switched on?

Additionally, there is the SIMATIC Security Controller tool that is used to restore the settings for registry, permissions, firewall, etc.

 thanks🙏🏻

RVS.wick

Have you set up Multicast Proxy settings in SIMATIC Shell on machines on both sides of the firewall?  When dealing with firewall I've always found that you must use that even if all other traffic goes through (ping, SMB etc.)  Firewalls can't easily/don't really forward multicast traffic which is what SIMATIC Shell uses.

You can check more in the WinCC 7.5SP2 manual in section 1.2.2.4 and especially 5.1.9.3.

https://support.industry.siemens.com/cs/document/109792585/

 I confirm this method is working. The issue is resolved after adding IP address into multicast. Within subnet or Outside Subnet , we can still add into the simatic shell multicast.

Thank you for the solution.