Skip to Content

Register Login

Industry Online Support

Technical Forum

Navigation

S7 links

Created by: ARuiz at: 3/6/2007 7:04 PM (10 Replies)

Rating (0)

Thanks 0

Result pages:: |; 1 | 2; |

11 Entries

Entries per page: 10 | all

3/6/2007 7:04 PM	Rate (0)
ARuiz Regular Member Joined: 9/18/2006 Last visit: 3/27/2024 Posts: 21 Rating: (1)	Hi, I'm trying to do a S7 link between S7-300 and another elementin differents networks using NAT conversion. I can do it within the same network and without NAT but with the NAT conversion it doesn't work. I wish to know if is possible do theseS7 link in different nertworks? Thanks

Suggestion To thank Quote Answer

3/7/2007 3:50 AM	Rate (0)
Dec Gold Expert Joined: 5/19/2006 Last visit: 12/3/2024 Posts: 549 Rating: (107)	Can you be more specific what do you mean by S7 links (S7 Connection ?)and NAT (Network Address Translation ?) Dec

Suggestion To thank Quote Answer

3/7/2007 9:38 AM	Rate (0)
Calm_down Posts: 324 Rating: (30)	Hi ARuiz, I am sorry but this will not work as the S7 Communication works with a specific Port, in this case the Port 102. NAT will change the Port therefore it will not work. If you want to use a Router you will have to use a more improved one that is not using NAT. For a better security, especially if you work across other Networks I would recommend the use of VPNs anyway. Stay calm
Calm_down Posts: 324 Rating: (30)
Suggestion To thank Quote Answer

3/7/2007 11:12 PM	Rate (0)
Late Platinum Expert Joined: 1/7/2006 Last visit: 12/23/2024 Posts: 2705 Rating: (320)	Hi, Have you looked to the Version 2 Scalance Security modules? In the handbook of this modules there are some examples where you can look to. SCALANCE S and SOFTNET Security Client Also on internet there are some examples. Industrial Communication with SCALANCE Protection of an Automation Cell Using the Security Module SCALANCE S612 via Firewall
	I hope that the answer will help, if you have still questions, don't hesitate to ask me. All the best, Late Never say never, think in solutions, not in trouble......
Suggestion To thank Quote Answer

3/8/2007 12:00 AM	Rate (0)
Dec Gold Expert Joined: 5/19/2006 Last visit: 12/3/2024 Posts: 549 Rating: (107)	Calm_down Hi ARuiz, I am sorry but this will not work as the S7 Communication works with a specific Port, in this case the Port 102. NAT will change the Port therefore it will not work... Stay calm Some applications send IP addresses or port numbers hidden inside their data packets, where NAT can't properly rewrite them (exception ftp, ICMP)- so those applications don't work when you try to use them on computers behind NATs. RFC-1006 and S7-Protocol does nothave IP addressor Port number inside their data packets so it should work from this perspective. Some NATs, for security reasons, only allow incoming traffic from an outside address if an outgoing packet has already been sent to that outside address. If you have 2 NATs like this then you probable can't establish an S7 connection. Dec

Suggestion To thank Quote Answer

3/8/2007 10:07 AM	Rate (0)
Calm_down Posts: 324 Rating: (30)	Hi Dec, if you have 2 "standard" NAT Router, without Port Forwarding,that allow a S7 Connection over each other I would really apprechiate more informationations aboutthis configuration to try myself. Stay calm
Calm_down Posts: 324 Rating: (30)
Suggestion To thank Quote Answer

3/8/2007 12:51 PM	Rate (0)
ARuiz Regular Member Joined: 9/18/2006 Last visit: 3/27/2024 Posts: 21 Rating: (1)	Hi, with my initial case the NAT is forwarding all ports, allow allincoming traffic to private network and all outgoing packets are sent.

Suggestion To thank Quote Answer

3/14/2007 4:48 PM	Rate (0)
DanielGuillize Posts: 10 Rating: (0)	Hi ARuiz, I really have doubts about this subject. Did you try with S7 TCP/IP connection ? I think that it will work even with RFC1006 ! Am I right ?
DanielGuillize Posts: 10 Rating: (0)
Suggestion To thank Quote Answer

3/15/2007 9:42 AM	Rate (0)
Calm_down Posts: 324 Rating: (30)	Hello, please let me explain my doubts. If we take a look to the NAT Router we know that the Router allows a certain number of PCs or other devices to share one IP Address on the Internet. So if we think that one of lets say ten PCs is connecting to another System on the Internet he is initiating a communication calling an IP Address with a certain Port (with STEP7 of S7-Communication the Port 102). Needless to say that the Port 102 is not one of the well known ports to forward on the Internet, but anyway lets think all Routers in between forward this port too. So what is the NAT Router doing? He is mapping, because he knows too that the Port 102 is not one of the well known ports, the Port 102 internally to any free chosen Port on the Internet, lets say to Port 33154. This works fine, I agree. Now lets see the other side. The Request with the IP Address and the Port 102 as its Destination arrives. What is the NAT Router doing??? If he has a Port Forwarding configured on Port 102, it will work. You will reach the Station directed with the Port Forwarding.So if you have 1 PLC on the Receiving side, you will be able to make it. If you have a PROFIBUS Network connected to it and additional Nodes on this PROFIBUS Network you will even be able to Route. But this is it! More is not possible. No FTP, no HTTP, no WinCC flexible... nothing. If you have 2 or more PLCs on the Receiving Network it will not work. You can not forward the Port 102 to more than 1 Station. If you do not use Port Forwarding it is even worse. The NAT Router has no idea what to do with it. The NAT Router can only handle Ports initiated locally.It will trash the Telegram. Nothing else will happen. Therefore VPN, VPN Tunnels all Traffic to a destination point where it will be decoded and Routed to the Network.... ALL TRAFFIC. So WinCC flexible, FTP, HTTP or even PC Networking is no big deal anymore. This is what I think... maybe you have another opinion. Please share it with us. Stay calm
Calm_down Posts: 324 Rating: (30)
Suggestion To thank Quote Answer

3/16/2007 3:01 PM	Rate (0)
DanielGuillize Posts: 10 Rating: (0)	Hi ARuiz and Calm_down, This subject is very interesting for me. Please go deep !!! I think if you have a configuration with two NAT's one configured as SNAT on Client side and other one configured as DNAT you can make this communication possible even with more than one peer on the net. DNAT can even do a load balancing task but this is another subject. If you use a IPTABLES with filter packet based on packet strings you could redirect it to a specific station (based on T-SAP for instance). This is so interesting that if I have time I will test this situation. Best Regards, DanielGuillize.
DanielGuillize Posts: 10 Rating: (0)
Suggestion To thank Quote Answer

|

Share this page:

Share this page on...

Follow us on