Skip to Content

Register Login

Industry Online Support

Technical Forum

Navigation

Firewall rules PG in external network

Created by: p van os at: 12/16/2008 11:17 AM (8 Replies)

Rating (0)

Thanks 0

9 Entries

12/16/2008 11:17 AM	Rate (0)
p van os Advanced Member Joined: 7/14/2006 Last visit: 10/24/2024 Posts: 7 Rating: (0)	Hello, I have an PG in the office network. I want to connect to the PLC's and the WinCC OS which are located in the internal network. The WinCC OS has also webnavigator on it. i have the following communications running: - Windows explorer is able to connect to the WinCC share - Webclient is connected to the server Does anyone know the firewall rules for PG/PLC communication? I use TCP connection to a 315PN-DP CPU. Pim
	Last edited by: p van os at: 12/16/2008 11:17 AM
Suggestion To thank Quote Answer

12/16/2008 1:17 PM	Rate (0)
INS Gold Member Joined: 4/6/2006 Last visit: 2/5/2024 Posts: 604 Rating: (56)	Hello, Normally you should need to open Port 102 for TCP. This should be enough. And off course you should enable the programs used to connect to the PLC to be allowed to have communication over the Ethernet port. I mean the list with Allowed PRograms if you use the WIndows Firewall for example.
	Best regards, INS
Suggestion To thank Quote Answer

12/16/2008 1:39 PM	Rate (0)
p van os Advanced Member Joined: 7/14/2006 Last visit: 10/24/2024 Posts: 7 Rating: (0)	I use an S612 Scalance. When the PG is connected to the internal network it is working fine. When connected to the external network i only see the S612. Attached is the configuration of the scalance Attachment S612.GIF (282 Downloads)

Suggestion To thank Quote Answer

12/16/2008 1:46 PM	Rate (0)
INS Gold Member Joined: 4/6/2006 Last visit: 2/5/2024 Posts: 604 Rating: (56)	Hello Pim, Are you able to open the WebPage of the CPU or is that not possible too? I think you are using the TCP MEthod in Step 7 or am I incorrect with this statement? Are you using Routing in the Scalance S or is it a flat network within the same subnet? Have you probaly selected TCP/IP (Auto) in the Set PG/PC Interface? If so could you select TCP/IP instead? If this is not the case or of this is not helping you: Please post a copy of your Scalance S Project so I can have a closer look atit.
	Best regards, INS
Suggestion To thank Quote Answer

12/16/2008 1:59 PM	Rate (0)
INS Gold Member Joined: 4/6/2006 Last visit: 2/5/2024 Posts: 604 Rating: (56)	Pim, Please also have a look at the attachment. I used the Standard Mode to add the S7 Service to the IP Definitions. As yu can see there is no Source port available. Could be that this is the solution to your problem. Please change the Source Port number to an * Attachment ScalanceS-FW.jpg (275 Downloads)
	Last edited by: INS at: 12/16/2008 2:00 PM Best regards, INS
Suggestion To thank Quote Answer

12/16/2008 2:00 PM	Rate (0)
p van os Advanced Member Joined: 7/14/2006 Last visit: 10/24/2024 Posts: 7 Rating: (0)	Hello INS, I am using an extention of the office network for the plc's (it is a testing environment). In the DHCP router of the office the addresses 192.168.0.200 - 225 are excluded. The addresses in this range I use for the PLC's and the WinCC server. I can connect to the webinterface of the Scalance X204-2 which is located in the plc-part of the network. My PG interface is TCP -> Broadcom (not the auto version) I will now try to make a connection with the Security Client, but I am not happy with this software package. It should work without.

Suggestion To thank Quote Answer

12/16/2008 2:15 PM	Rate (0)
INS Gold Member Joined: 4/6/2006 Last visit: 2/5/2024 Posts: 604 Rating: (56)	Pim, Why the Security Client? And why don't you like this there a almost none features it's only necessary to load the certificates and to build up the VPN tunnel. Do you use VPN Tunnels here? Otherwise you won't need this tool. I'm having a little bit of doubts or I understand your complete configuration at this moment. Maybe a small drawing? And with the drawing from your project please send me your project in the Security Configuration Tool you can off course send the Passwords with a Private Message.
	Best regards, INS
Suggestion To thank Quote Answer

12/16/2008 2:34 PM	Rate (0)
p van os Advanced Member Joined: 7/14/2006 Last visit: 10/24/2024 Posts: 7 Rating: (0)	INS, This setup has 3 purposes: 1: Downloading to PLC 2: Downloading to OS (Windows share connection) 3: Webclient (http port 80 connection) Attached is the network layout Attachment NetworkLayout.pdf (281 Downloads)

Suggestion To thank Quote Answer

12/16/2008 2:43 PM	Rate (0)
INS Gold Member Joined: 4/6/2006 Last visit: 2/5/2024 Posts: 604 Rating: (56)	Pim, Then this should work. There must be an other issue here. Did you changed the Source Port as mentioned in one of the above posts? And did it changed something? If that didn't work please try to test once with verything open in the firewall. Just to be sure te settings besides the Firewall rules are correct.
	Best regards, INS
Suggestion To thank Quote Answer

|

Share this page:

Share this page on...

Follow us on