I am having issues configuring my firewall for my users and getting Primary Setup Tool v4.2 to work.

When the firewall is enabled, PST doesnt find anything, when PST is disabled, PST is able to find devices.

On page 9 of the PST User Guide document  (https://support.industry.siemens.com/cs/ww/en/view/19440762) it states that ports 102, 49153, and 49154 are opened on Windows firewall when the program is installed. I have created a rule in our firewall to open these ports in both directions. I have also specificlly allowed the .exe to run.  This did not correct the issue.

I captured the network traffic using Wireshark of the firewall on and off and running the scan. When the firewall is disabled I can see a LLDP_Multicast packet sent out and then some LLDP and DCP protocols return packet.  
When the firewall is enabled...I do not see the LLDP_Multicast packet in the Wireshark capture.

I have contacted McAfee and we confirm the block is happening, but none of McAfee firewall logs show an instance or a record of it being blocked.  McAfee can not figure out how this application works either to help create a rule to allow this to work with the firewall enabled.

Anyone have any ideas or suggestions?

Hello Michael.Maus

Siemens Software is also testet only with Windows internal Firewalls.

And The Tool Simatic Security Controller only does settings in the Windows Filewall, not in Firewalls of third Party...

I´m sorry we do not use McAfee in our company so I cannot test and help you.

Bye Murof

wolves and hawks

Did you check whether proneta does the same job for you? It is the new tool from Siemens. To my knowledge searches are done with broadcasts from Siemens. If those do not get back from the network no devices are found.

Just to attached with the link to proneta. 

Thank you. 

It is very strange to me that Siemens and Intel\McAfee had\have a bit of a partnership and this issue has not been addressed?

"Siemens and Intel Security are expanding their collaboration to help protect industrial automation systems from increased cyber threats."   ...   "The offering now encompasses Intel Security solutions including McAfee® VirusScan, McAfee Application Control, McAfee ePolicy Orchestrator® (ePO®) as well as McAfee Enterprise Security Manager, the security information and event management.

The McAfee VirusScan software enhances protection against malware such as viruses, rootkits, worms and Trojans. The software can, for instance, be used for the TIA Portal or the Simatic PCS 7 process control system."

Source:https://www.siemens.com/press/en/pressrelease/?press=/en/pressrelease/2016/digitalfactory/pr2016030170dfen.htm&content[]=DF

Thank you for the Proneta software suggestion.  I will test that out with my engineers and see if this might be a viable workaround.

wolves and hawks

Siemens does check with McAfee, but I think real time scans are not allowed. As I googled on that topics it seems McAfee has some problems like many other virus software manufactures. They seem to use patterns and ways to get around doing everything for every individual form of attack. This way they "manage" the amount every second brought to the world, but do not learn the causes of their actions immediatly. Patern matching can give fauls positives and firewall integration can be a pain in the a.. to find issues. Proneta has the benefit of not having to be installed. It is portable and if you like it, please, let your Siemens contact know it. Siemens software part should do more software packages this way.

Hello Michael

perhaps you can give it a try to contact McAfee Support or Forum, perhaps there are some settings to allow the MAC Adress Broadcast telegrams.

Bye Murof

So as a followup for anyone else that might run into this in the future...

The rule that I had to setup to allow this to work was to allow all protocols (as Profinet was not listed in their specified protocol list to create a rule from.  Again, I find this strange that an industry standard as large as Profinet is not an available choice with McAfee being a semi-partner (see my above post)).

I also had to include an allow status for the following applications:
**/conhost.exe
**/s7wnpstx.exe

Thanks for everyone's assistance with this.