Dear experts,

In our project we are supposed to use LAN as the backbone for SCADA / Field communication. For the sake of network security we have to put a Cisco firewall in control center as an interface between LAN and servers. At field side we have standard S7-400 AS which will communicate through its CP443 via IEC60870-5-104 protocol.

The issue is that the communication between server (at SCADA center) and CP443 at field is not established when firewall is included and active but it's OK when firewall is bypassed and the connection is direct. I also tried to set CP443-1 gateway / router according to firewall's IP in HW config but it did not work. On the other hand, a Field PG/PC can communicate to servers through firewall and simulate the IEC104 protocol as a slave.

Please help me to know if there is any specific setting on CP443 when a hardware firewall is used in network.

Thanks

Hi,

Have a quick look at the compendium part F:

SIMATIC Process Control System PCS 7 Compendium Part F - Industrial Security (V8.0)

Dear Microman

Thanks for the hint, but the manual deals with network security among workstations, servers, clients, etc. Please have a look at the configured network attached. IPs for S7-Station, Firewall, Servers, and Notebook are also illustrated. The issue is that communication between servers and test notebook is OK but S7 stations could not even be pinged by servers. Gateways on S7(CP443) and notebook are defined similar to that of firewall's IP.

S7 to server communication is activated as soon as the firewall is bypassed. That means S7 could not communicate through firewall as its gateway. I wonder if some other parameters should be set in HW config.

Hi,

I answered the wrong question. That is brilliant! 

Anyhow, see this collection of links maybe you find something there:

https://support.industry.siemens.com/cs/gb/en/view/92651441