Hi forum

I've set up a server running WinCC Unified runtime, which gets its HMI connections through a 1:1 NAT Setup through Sinema Remote Connect.

I can log in through a browser from the computer that runs the runtime fine. The HMI Connections work.

But now i've installed a Sinema Remote Connect client on another PC, which is set up to have access to the Runtime server.

When the VPN-Tunnel is running, I can ping the Runtime server. When I enter the IP of the runtime server as URL, it directs me to a Microsoft Windows Server page, saying Internet Information Services.

When I close the VPN, I can no longer access the IP through the browser.

Using the Runtime server's machine name as URL doesnt show anything.

Now, what may I be missing, so that i'm redirected to the Unified page, instead of the microsoft one?

I've looked over https://support.industry.siemens.com/tf//WW/en/posts/connect-to-a-wincc-unified-web-server-over-the-internet-using-ddns/245172?page=0&pageSize=10

I'm thinking it's a certificate thing? But i'm not sure.

Any guesses will be greatly appreciated!

Hi,

this might be too simple to be the solution, but did you type https:// infront of the ip address?

Else you will land on http://ip-Address which will show the Microsoft Page.

Best regards

ZickZackTIA

This was exactly the problem.

Now i'm trying to figure out how to handle the certificates.

In the WinCC Unified Certificate Manager, do I need to add every device that is supposed to log in?

Or is the certificate download through the browser sufficient?

What does the IP provider field in the WinCC Unified Configuration determine?

I'm trying as i go.. Thanks for the reply, you hit the nail on the head :)

EDIT:

So far i've succeeded in getting a secure connection through VPN.

To answer my own points:

I added the client device in the Certificate Manager on the Runtime server, with computer name and VPN-address. I dont know if this is needed, and will have to test later.

I clicked the IP provider field in Unified configuration, and added the IP of the runtime server.

I used a SelfSigned certificate in the Unified configuration, i'm no network expert, but from what i can gather, this is not the best practice. But it'll have to do for now, until I know more.

Hi Anders,

i recommend following this FAQ: https://support.industry.siemens.com/cs/ww/en/view/109777591

You do not need to define the client stations in the certificate manager.

The checkbox for the IP-Identity Provider is crucial if you do or don't have a DNS -> can't reach it under the Computer Name. If you can, then you don't have to check it.
It just says: if https://computername is not your entry point because you can not reach, then https://ip-Address is. Be careful only one should be used at the time, not both. You should decide.

Best regards

ZickZackTIA

Thanks a lot ZickZackTIA!

Do you by chance know what the difference is between using a certificate ending with _SelfSigned or one ending with the user account of the runtime server?

Hi Anders,

it's just a name for the certificate. Using the one from the certificate manager make the selfsigned one useless. I don't know how you got the one with the Username. But typicly you do the configuration once and then install the certificate from the certificate manager. That way it is made sure that the runtime uses the correct one. At least i would do it like this.

Best regards,

ZickZackTIA

I see

The one with a username is something i created myself during testing.

So far it's all coming together!

Thanks again for your input, I appreciate it!