Editing PLC program over an VPN

the most important think as far as I see it is to build up a VPN Tunnel in between the two sites. As far as I know is the use of VPN Client Software mostly not successful the best solution is to use Hardware VPN Router. With the Software Versions we know that mostly the SIMATIC NET Security Client and the Microsoft VPN Client support the needed Capabilities for STEP 7, other Client Software does not really work with our requirements, as far as I know.

So I would recommend the use of Hardware VPN Router to connect the two sites and allow the Port 102 to be processed.

Best regards

it seems so as the case I mentioned in my first post here is your case. The use of a Software VPN Adaptor does not warranty the functionality, especially not if this VPN Adaptor is placed on top of the Microsoft NDIS Interface.
The best solution is to use Hardware VPN Router, these devices warranty the Tunnel and the transport of the requested telegrams.
If you would have two Hardware Router it might be, especially if you have the same Subnet, that you do not have to change anything. The system would work automatically.
In case of the Software VPN Adaptor, as you have it, I had it only working twice, once with the Microsoft VPNSoftware and the SIMATIC NET Security Client.
If you want to use it with your Software I have to wish you luck.

Best regards

I am sorry, but I can not tell you any price, this information is out of my reach.
What I can say is that if you have a Router to Router connection over VPN you need noadditionalSoftware on the PC, everything that is required to connect to a S7-CP or CPU is delivered by STEP 7. The configuration of the VPN Router depends by the used Router, most can be configured on Web base but some need additional Configuration software. The range of VPNHardware may start with Cisco or 3COM and ends with Linksys or Netgear. It is your choice.

Best regards

SCALANCE S Security Modules are the core of the new pathbreaking industrial security concept by Siemens Automation & Drives, based on the protection of automation cells and network segments. This enables an even more effective protection of the automation network against danger from inside, such as deliberate or undeliberate incorrect accessing by employees and excessive or unnecessary communication load. In the case of remote accessing via unsafe networks, such as Internet or WAN, encryption can be used to safeguard the communication against data espionage and manipulation.

As a result of the increasing integrated Ethernet-based interconnection of automation networks with other networks (e.g. MES or office networks), or connection to company Intranets and remote maintenance via WAN or Internet, modern industrial communication is subject to considerable risks and dangers. Existing security concepts designed for office environments are no longer sufficient for the special requirements of automation technology, because

• they require permanent maintenance and special expert knowlege
• the integration in existing networks is not free from retroaction, i.e. network topologies have to be changed and network subscribers newly configured
• the special world of automation protocols is not accounted for, in particular Layer 2 protocols.

Functions

Security functions

VPN (Virtual Private Network): For safe authentication (identification) of network subscribers, for data encryption and checking of data integrity.

Firewall: Filters data packages and disables or enables communication connections in accordance with a filter list (packet-filter firewall). Both incoming and outgoing communication can be filtered. IP and MAC addresses, as well as communication protocols (ports) are filtered. The firewall can be used as an alternative, or as a supplement to VPN.

Authentication

Every incoming data stream is monitored and checked. In view of the fact that IP addresses can be forged (IP spoofing), checking the IP address (of the client access) is not enough. In addition, client PCs may have changing IP addresses. For this reason authentication is carried out by means of proven VPN mechanisms.

Data encryption

Safe encryption is needed to protect the data exchange against espionage and manipulation. In this way the data will remain unintelligable for any eavesdropper in the network. The Security Modulewill establish a VPN tunnel to other Security Modules for this purpose.

Logging

To be able to identify and follow-up attack or access attempts, such data can be stored in a log file and read out with the configuration tool.

Configuration without special security know-how

The configuration can also be done by users posessing no deeper knowledge about security mechanisms.The minimum configuration needed is to allocate the Security Modules of a network to groups. Only the modules within a group can establish VPN tunnels with one another. This ensures that only safely authenticated and authorized devices can access a network subscriber protected by a Security Module. Above that the data transmission is encrypted and in this way protected against espionage and manipulation. In view of the fact that the configuration tool generates the VPN certificates, no elaborate PKI infrastructure or separate creation or loading of keys is necessary! Automatic learning by the subscribers of the internal network and recognizing of other Security Modules in a network ensures a minimum of configuration work and also enables dynamic expansion without much configuration! The configuration tool is included in the scope of supply of SCALANCE S.

Module replacement without programming device

The C-PLUG (Configuration Plug) is available as an option to save all the configuration data of a SCALANCE S module. If a SCALANCE S device should fail, the C-PLUG can be removed and plugged into the new SCALANCE S device, so that downtime is reduced considerably.