Dear Experts:

I have two sets of 400-s CPUs sitting in different networks:

-417-5H PN/DP on address 10.102.176.51

-412-3H on address 192.168.0.1

I want to use Get/Put on the 417 to read and write from 412 using S7 connection. I have a SCALANCE S602 as firewall between them with following configuration:

-Internal address: 10.102.176.201

-External address: 192.168.0.10

- Double NAT From Internal to External, Source IP = 10.102.176.51, Dest IP = 10.102.176.93, Dest translation = 192.168.0.1

- Double NAT From External to Internal, Source IP = 192.168.0.1, Dest IP = 192.168.0.100, Dest translation = 10.102.176.51

I have created an IP Service for TCP with all ports in source and target enabled and activated the rule.

On the Net Pro, I have created the following connections:

- In 417: S7 active connection to unknown partner, partner address 10.102.176.93, partner rack 0, slot 3 (cpu slot) and Connection Resource 03.

- In 412: S7 active connection to unknown partner, partner address 192.168.0.100, partner rack 0, slot 3 (cpu slot) and Connection Resource 03.

Problem is, after downloading the configuration to both cpus and the firewall, when I go online in netrpo it always shows "Connection being set up"  and "Reason for cancellation unknown "in both CPUs.

I have also tried without connection in 412, with connection in 412 as passive, and with the slot in 5 (cp card).

Any ideas on how to establish the connection?

Attached some screenshots.