Skip to Content

SiePortal

The integrated platform for your product selection, buying and support workflow - bringing together Industry Mall and Online Support.

SiePortalDeutsch

Search

Home
Support Support
{{(apiData.Support | filter:{'rank':1}:true)[0].title}} Support
- Menu temporary not available
- Menu temporary not available
- Menue temporary not available
- {{item.title}}

Products & Services
- Menu temporary not available
- Menue temporary not available
- {{item.title}}
Support Support
{{(apiData.Support | filter:{'rank':1}:true)[0].title}} Support
- Menu temporary not available
- Menue temporary not available
- {{item.title}}
MySiePortal MySiePortal
{{(apiData.MySiePortal | filter:{'rank':1}:true)[0].title}} MySiePortal
- Menu temporary not available
- Menue temporary not available
- {{item.title}}
Cart ({{apiData.CartCount}})

Navigation

remote access with Scalance S612

Created by: thanozn at: 4/1/2014 4:32 PM (18 Replies)

Rating (3)

Thanks 5

Result pages:: |; 1 | 2; |

19 Entries

Entries per page: 10 | all

4/30/2014 4:13 PM	Rate (0)
thanozn Bronze Member Joined: 7/29/2008 Last visit: 1/28/2025 Posts: 97 Rating: (4)	Hi Pittiplatsch! The router was used for a VPN network. So we got a new ADSL connection just for Scalance. However, there are still no ISAKMP packets from any direction! The router is a ZTE H108NS connected to the S612. All the ports are forwarded to scalance. Router firewall and VPN are deactivated. As for the SSC side. I tried with firewall on/off, used other computer as well, but nothing. The wireshark is installed on the remote PG / SSC side. Is that correct?

Suggestion To thank Quote Answer

5/2/2014 8:27 AM	Rate (0)
Pittiplatsch Posts: 1368 Rating: (128)	Hello, 1) do you remove the 2nd IP address (192.168.3.?) of the SSC? The SSC and the internal network on remote side must not be in the same Ip range! 2) All Antivirus-SW, Firewall are off? 3) The .dat File and Certificates are up to date? 4) Can you protocol the network communication between SSC and Router 1, and between S612 and Router 2 with whireshark? Therefore, you need a HUB (no switch) to connect a PC with Whireshark between the SSC and Router 1/ S612 and Router 2. Or a SCALANCE X and the "Mirror Port"-Function. 5) Can you post the results and -if possible- the .dat File? Then i can have a look...(if you want) Greetings!
Pittiplatsch Posts: 1368 Rating: (128)
Suggestion To thank Quote Answer
This contribution was helpful to 1 thankful Users thanozn

5/2/2014 9:55 AM	Rate (0)
thanozn Bronze Member Joined: 7/29/2008 Last visit: 1/28/2025 Posts: 97 Rating: (4)	Thank you for your reply Pittiplatsch! 1. I am following the application example https://support.automation.siemens.com/WW/llisapi.dll?func=cslib.csinfo&objId=22056713&nodeid4=20229805&load=content&lang=en&siteid=cseus&aktprim=4&objaction=csview&extranet=standard&viewreg=WW at document 1 pages 50-51 for router setup there must be a 2nd IP. The sides are at different IP ranges (for SCC 192.168.2.? and for S612 int 192.168.3.? and ext 10.30.130.?) with subnet masks are 255.255.255.0. 2. All antivirus/firewalls are disabled. I will also try another router for S612 side just to be sure. 3. Both sides are up to date. 4. The S612 side is at the clients location and I don't have direct access. I have contacted the clients IT and wait for results. 5. Below is the dat file. <?xml version="1.0" encoding="utf-8"?> <SWSEM xmlns="http://www.siemens.com"> <PC> <version>1.1</version> <sct_version>03.09.00.00</sct_version> <name>SCC</name> <comment /> <def_router> <ip_address>0.0.0.0</ip_address> <ip_mask>0.0.0.0</ip_mask> </def_router> <router /> <pkcs12files> <pkcs12filename>config.M14C5@G9A54.SCC.p12</pkcs12filename> </pkcs12files> <certificates> <certfilename>config.Group1.cer</certfilename> </certificates> </PC> <SEM> <name>S612</name> <module_type>S612</module_type> <comment /> <ip_address>REMOTE_WAN_IP</ip_address> <mode>routing</mode> <ip_int>192.168.3.210</ip_int> <ip_ext>10.30.130.40</ip_ext> <ip_wan>REMOTE_WAN_IP</ip_wan> <activelearn>no</activelearn> <secure> <group>2</group> <time1>172740</time1> <time2>172740</time2> <limit>0</limit> <encrypt1>3DES</encrypt1> <auth1>SHA</auth1> <encrypt2>3DES</encrypt2> <auth2>SHA</auth2> <pfs1>no</pfs1> <pfs2>no</pfs2> </secure> <ip_node /> <sub_node> <node> <ip_address>192.168.3.0</ip_address> <ip_mask>255.255.255.0</ip_mask> </node> </sub_node> <certfilename>config.Group1.cer</certfilename> </SEM> </SWSEM>

Suggestion To thank Quote Answer

5/2/2014 3:11 PM	Rate (1)
Pittiplatsch Posts: 1368 Rating: (128)	Hello, the additional IP address is only to configure the components (Router, SCALANCE S) and must be deleted after finishing the configuration! The.dat file seems correct. Can you also post a wireshark file? Can you try to build up a VPN between SSC and SCALANCE S in bridge mode (without WAN). So youcan exclude an error on the SSC-PG...(firewall, antivirus etc).
Pittiplatsch Posts: 1368 Rating: (128)
Suggestion To thank Quote Answer

5/10/2014 8:39 AM	Rate (0)
thanozn Bronze Member Joined: 7/29/2008 Last visit: 1/28/2025 Posts: 97 Rating: (4)	We couldn't get the wireshark details, couldn't find a hub. However, I run an online tool fromhttps://pentest-tools.com/discovery-probing/udp-port-scanner-online-nmap and got the following results. Starting Nmap 6.00 ( http://nmap.org ) at 2014-05-09 23:13 EEST Initiating Ping Scan at 23:13 Scanning WAN_IP_ADDRESS [4 ports] Completed Ping Scan at 23:13, 0.18s elapsed (1 total hosts) Initiating UDP Scan at 23:13 Scanning static_ip (WAN_IP_ADDRESS) [2 ports] Discovered open port 500/udp on WAN_IP_ADDRESS Completed UDP Scan at 23:13, 0.22s elapsed (2 total ports) Nmap scan report for static_ip (WAN_IP_ADDRESS) Host is up (0.15s latency). PORT STATE SERVICE 500/udp open isakmp 4500/udp open\|filtered nat-t-ike Read data files from: /usr/bin/../share/nmap Nmap done: 1 IP address (1 host up) scanned in 3.10 seconds Raw packets sent: 6 (400B) \| Rcvd: 2 (112B) So the ports are open. The 4500 is filtered. Is this a problem? We also changed the modem-router to NETGEAR DGN1000v3. Did remove the second ip from PC. When I try to connect through SCC there is a red sign now. Scalance is reachable from SCT, however, the packet log is empty. Perhaps something is wrong with the SCALANCE configuration file? I didn't use advanced mode for setup and just ticked tunnel communication only. according to: https://support.automation.siemens.com/WW/llisapi.dll?func=cslib.csinfo&objId=26361542&objAction=csOpen&nodeid0=18703650&lang=en&siteid=cseus&aktprim=0&extranet=standard&viewreg=WW When a VPN tunnel is set up between a SOFTNET security client and SCALANCE S 61x, the following firewall rule must be configured in the SCALANCE: allow internal -> external Is this included in the tunnel communication only?

Suggestion To thank Quote Answer

5/12/2014 9:33 AM	Rate (0)
Pittiplatsch Posts: 1368 Rating: (128)	No, that firewall rule is not necessarry for building up a VPN. For the firewall/ Portforwarding http://technet.microsoft.com/en-us/library/cc779912(v=ws.10).aspx Please have a look at this Getting Started. In Chapter "Remote Access with SCLANCE S and SSC" the procedure is explained step-by-step https://support.automation.siemens.com/WW/llisapi.dll?aktprim=0&lang=de&referer=%2fWW%2f&func=cslib.csinfo&siteid=csius&treeLang=en&groupid=4000002&extranet=standard&viewreg=WW&nodeid0=18703650&objaction=csopen Perhaps, you should proof, if all steps are done in your configuration... A few more questions: On which PC SCT is installed ? PC with SSC? The Router, the SSC is connected is without VPN function? Sorry for the many questions: Your Problem is sth like finding a needle in ahaystack.
Pittiplatsch Posts: 1368 Rating: (128)
Suggestion To thank Quote Answer

5/12/2014 9:47 AM	Rate (0)
Pittiplatsch Posts: 1368 Rating: (128)	The best thing would be building up a vpn without WAN, just LAN. So you do not need the DSL router and portforwarding ... so you could exclude a source of errors.
Pittiplatsch Posts: 1368 Rating: (128)
Suggestion To thank Quote Answer

5/13/2014 10:02 AM	Rate (0)
thanozn Bronze Member Joined: 7/29/2008 Last visit: 1/28/2025 Posts: 97 Rating: (4)	Thank you Pittiplatsch for your valuable help and support! I finally made the VPN connection. For the record three things caused the problem: 1. To establish a connection you must NOT enter a second IP as in the application example: https://support.automation.siemens.com/WW/llisapi.dll?func=cslib.csinfo&objId=22056713&nodeid4=20229805&load=content&lang=en&siteid=cseus&aktprim=4&objaction=csview&extranet=standard&viewreg=WW which was confusing as there was no actual connection (yellow dot sign at SSC) and I could also perform a tunnel test (even without scalance connected!!!). 2. On the remote PC the Windows Firewall must be ON, at least for Windows 7 that I tested, otherwise there was no connection. 3. I had success only with the "standard" modem-router with "IPSec passthrough", except for port forwarding of UDP 500 and UDP 4500.

Suggestion To thank Quote Answer
This contribution was helpful to 2 thankful Users Pittiplatsch nkr

3/7/2016 2:41 PM	Rate (0)
Min_Moderator Platinum Member Joined: 9/3/2014 Last visit: 3/13/2019 Posts: 4766 Rating: (122)	New question published by AutoGen_746386 is split to a separate thread with the subject Scalance S612, error whenever I download. Best regards Min_Moderator

Suggestion To thank Quote Answer

|

Share this page:

Share this page on...

Follow us on