Skip to Content

SiePortal

The integrated platform for your product selection, buying and support workflow - bringing together Industry Mall and Online Support.

SiePortalDeutsch

Search

Home
Support Support
{{(apiData.Support | filter:{'rank':1}:true)[0].title}} Support
- Menu temporary not available
- Menu temporary not available
- Menue temporary not available
- {{item.title}}

Products & Services
- Menu temporary not available
- Menue temporary not available
- {{item.title}}
Support Support
{{(apiData.Support | filter:{'rank':1}:true)[0].title}} Support
- Menu temporary not available
- Menue temporary not available
- {{item.title}}
MySiePortal MySiePortal
{{(apiData.MySiePortal | filter:{'rank':1}:true)[0].title}} MySiePortal
- Menu temporary not available
- Menue temporary not available
- {{item.title}}
Cart ({{apiData.CartCount}})

Navigation

remote access with Scalance S612

Created by: thanozn at: 4/1/2014 4:32 PM (18 Replies)

Rating (3)

Thanks 5

Result pages:: |; 1 | 2; |

19 Entries

Entries per page: 10 | all

4/1/2014 4:32 PM	Rate (0)
thanozn Bronze Member Joined: 7/29/2008 Last visit: 1/28/2025 Posts: 97 Rating: (4)	I am using for the first time SCALANCE S612 (V4) and Softnet Security Client (V4+HF1). I would like to access a SIMATIC PLC/HMI network (NETWORK ID 192.168.3.0) remotely through VPN with a static IP using a router with portforwarding to s612 (UDP 500, UDP 4500). After following tutorials with no success. http://support.automation.siemens.com/WW/llisapi.dll?func=cslib.csinfo&objId=22056713&objAction=csOpen&lang=en&siteid=cseus&aktprim=4&extranet=standard&viewreg=WW http://support.automation.siemens.com/WW/llisapi.dll?query=22056713_S612_VPN_DOKU_V30_en&func=cslib.cssearch&content=adsearch%2Fadsearch.aspx&lang=en&siteid=cseus&objaction=cssearch&searchinprim=&nodeid4=20229805 SCALANCE S612 cannot be reached remotely through internet even through the security configuration tool online mode. WAN IP static address router IP 10.30.130.1 SCALANCE external IP 10.30.130.40 SCALANCE internal IP 192.168.3.210 Attached are pictures from the security configuration tool (V4). As for VPN tab, Wait for partner (responder) is selected and the WAN IP address is the public static WAN address. Any help will be greately appreciated. Attachment scalance_config.pdf (533 Downloads)

Suggestion To thank Quote Answer

4/1/2014 4:43 PM	Rate (1)
Pittiplatsch Posts: 1368 Rating: (128)	Hello, Is your Firewall of the PC on or off? Try both variantes (on/off)... The router IP 10.30.130.1 is it internal (LAN)? The portforwarding off UDP ports to the external IP of S612? What the state of the SSC? ...
Pittiplatsch Posts: 1368 Rating: (128)
Suggestion To thank Quote Answer
This contribution was helpful to 1 thankful Users thanozn

4/1/2014 8:30 PM	Rate (0)
thanozn Bronze Member Joined: 7/29/2008 Last visit: 1/28/2025 Posts: 97 Rating: (4)	The firewall on the PC is off. Did try both on/off without success. I use the following config for the PC ip address: 192.168.2.100 subnet mask: 255.255.255.0 default gateway: 192.168.2.1 second ip address: 192.168.3.100 The router ip10.30.130.1is for LAN connected on the external port (ip10.30.130.40)of scalance. The router forwards the ports to scalance. The SCC shows the scalance connection with a yellow dot (Module / node can be reached, tunnel to module / node is, however, disabled. There is no IP security policy set up in the system. You communicate with this module / node without encryption). I did test the tunnel and I got a response at 1610msec. However the message I always get is: [ Apr. 01, 2014 - 20:38:17] [icmp] 192.168.3.210: "Request timed out. " I have attached the extended diagnostics from the SCC. Attachment SCC_extended_diagnostics.jpg (530 Downloads)

Suggestion To thank Quote Answer

4/2/2014 8:07 AM	Rate (1)
Pittiplatsch Posts: 1368 Rating: (128)	Hello, please remove the 2nd IP address (192.168.3.100)of the PC. The Tunnel must go over 192.168.2.100 and not 192.168.3.100!!! Please give feedback...thx
Pittiplatsch Posts: 1368 Rating: (128)
Suggestion To thank Quote Answer
This contribution was helpful to 1 thankful Users thanozn

4/2/2014 9:34 AM	Rate (0)
thanozn Bronze Member Joined: 7/29/2008 Last visit: 1/28/2025 Posts: 97 Rating: (4)	Thank you for your reply Pittiplatsch. Did try removing the 2nd IP address, but there is no connection at all. Scalance has a red dot (Module / node cannot be reached.) and I get the following message: [ Apr. 02, 2014 - 10:17:29] [icmp] 192.168.3.210: "General failure. "

Suggestion To thank Quote Answer

4/2/2014 12:44 PM	Rate (0)
Pittiplatsch Posts: 1368 Rating: (128)	Do you configure a gateway in the PLC on the remote station? All modules behind the SCALANCE S must have the internal ip of the SCALANCE as default gateway...
Pittiplatsch Posts: 1368 Rating: (128)
Suggestion To thank Quote Answer

4/2/2014 4:14 PM	Rate (0)
thanozn Bronze Member Joined: 7/29/2008 Last visit: 1/28/2025 Posts: 97 Rating: (4)	Yes, all PLCs, HMIs have default gateway the S612 internal IP 192.168.3.210. I do not understand why I can test the tunnel, but SSC shows that there is no VPN yellow dot.

Suggestion To thank Quote Answer

4/3/2014 10:41 AM	Rate (0)
Pittiplatsch Posts: 1368 Rating: (128)	Are you able to make a network recording of the packets, which are leaving/receiving SSC? May be with whireshark... There must be ISKAMP packets in both directions... Can youpost this recording? Thanks...
Pittiplatsch Posts: 1368 Rating: (128)
Suggestion To thank Quote Answer

4/3/2014 4:35 PM	Rate (0)
thanozn Bronze Member Joined: 7/29/2008 Last visit: 1/28/2025 Posts: 97 Rating: (4)	I did use wireshark but did not capture any ISAKMP packets. What does this mean?

Suggestion To thank Quote Answer

4/4/2014 8:02 AM	Rate (0)
Pittiplatsch Posts: 1368 Rating: (128)	That means, that no security policies were exchanged between S612 and SSC and that course, that no VPN tunnel could build up. Are there really no ISKMP packets? Wether in one direction (SSC -> S612)? Reasons can be: ==> Firewall/ Anti-Virus Software blocks these packets on SSC side ==> Do you use a VPN Router as gateway and VPN is on? So the ISKMP packets are not forwarded to S612 and SSC. ==> Note: you can not record a network with a switch. You need a Hub...Or Whireshark is on the PC of the SSC. Greeting
Pittiplatsch Posts: 1368 Rating: (128)
Suggestion To thank Quote Answer

|

Share this page:

Share this page on...

Follow us on