Network components

Examples See also History Extra
Network components

This chapter contains the following information:
  • S7-1200 telecontrol CPs Load, TeleService, project number, station number
  • S7-1500 CM/CP
  • PC CPs and applications
  • Security modules
  • Media converters


S7-1200 telecontrol CPs Load, TeleService, project number, station number

Changing the project number or station number for the entire STEP 7 project Copying Security modules Mobile wireless CPs: Download / TeleService
S7-1200 telecontrol CPs Load, TeleService, project number, station number

Changing the project number or station number for the entire STEP 7 project

If you change the project number or the station number in the "CP identification" parameter group for a telecontrol CP, this parameter is changed for all CPs in the STEP 7 project.

Copying Security modules

Copying stations with activated Security functions to another project without activated Security functions is forbidden and can lead to serious inconsistencies.

Mobile wireless CPs: Download / TeleService

The following behavior applies to all mobile wireless CPs:

  • CP 1242‑7 (6GK7 242‑7KX30‑0XE0)

  • CP 1242‑7 GPRS V2 (6GK7 242‑7KX31‑0XE0)

  • CP 1243‑7 LTE‑EU (6GK7 243‑7KX30‑0XE0)

  • CP 1243‑7 LTE‑USA (6GK7 243‑7SX30‑0XE0)

Connection resources for TeleService

The TeleService function occupies a connection resource on the engineering station.

The function download to device or upload from device during a TeleService session occupies a second connection resource on the engineering station.

Download to device

Only use the "Download to device" function with the mobile wireless CP via a TeleService connection as follows:

  1. Select the CP in STEP 7.

  2. Select the "Online" > "Download to device" menu.

  3. In the "Extended download" dialog that appears, select the TeleService interface.

  4. Download the project data from the "Extended download" dialog.

Upload from device

The "Upload from device" function via a TeleService connection is supported by the mobile wireless CPs with the following TeleService server applications:

  • TeleControl Server Basic as of version V3

  • TeleService Gateway as of version V3


S7-1500 CM/CP

CM 1542‑1: Remove retentive storage of the IP address if there are duplicate addresses
S7-1500 CM/CP

CM 1542‑1: Remove retentive storage of the IP address if there are duplicate addresses

The IP address and the device name of the CM 1542-1 remain installed retentively:

If, for example during startup, the CM detects a duplicate address in another network, the CM is not connected to the network. The CM changes to RUN and cannot be reached via the Ethernet interface.

To be able to connect the CM to the network, you can remove the retentively stored IP address as follows:

  1. Remove the memory card of the CPU.

  2. Using DCP with the Primary Setup Tool (PST) and with the CPU in STOP, set the IP address of the CM to 0.0.0.0 without configuration.

    You have removed the retentively stored IP address of the CM. The CM can be connected into the network.

  3. Insert the memory card in the CPU again.


PC CPs and applications

PC CPs for VMware vSphere Hypervisor ESXi Downloading to PC stations with a CP 1628 PROFIBUS S7 connections with OPC servers
PC CPs and applications

PC CPs for VMware vSphere Hypervisor ESXi

The following communications processors have been released for operation with VMware vSphere Hypervisor ESXi:

  • CP 5711

  • VMware E1000 network adapter

The following communications processors have not been released for operation with VMware vSphere Hypervisor ESXi:

  • CP 5611

  • CP 5612

  • CP 5621

  • CP 5622

  • CP 5512

Other communications processors such as the CP 1623 and CP 1628 are released following installation of the SIMATIC NET PC software. You will find information on this in the readme file of the SIMATIC NET PC software.

Downloading to PC stations with a CP 1628

If you download project data to a CP 1628, make sure that the CP is reachable.

In the "Extended download to device" dialog, do not enable the check box for the search for compatible nodes.

If you want to download to a different CP from the one selected earlier in the project, change the IP address of the CP manually in the "Extended download to device" dialog in the list of configured access nodes.

PROFIBUS S7 connections with OPC servers

The configuration of an S7 connection via PROFIBUS is not possible between an OPC server as of V12 and an S7‑1200 as of V4 or an S7‑1500.

Remedy: Use an OPC server / PC application < V12 or use an S7‑1200 < V4 or an S7‑300 or S7‑400 as the S7 station.


Security modules

Migration of projects with Ethernet CPs and activated security functions Migration of IP access protection lists when activating the security functions Copying Security modules Security online diagnostics of S7 CPs IKE mode Downloading configuration data to an S7-300/400 via a VPN tunnel VPN tunnel establishment with 1200/1500 CPs capable of VPN
Security modules

Migration of projects with Ethernet CPs and activated security functions

In STEP 7 V5.5 projects that contain Industrial Ethernet CPs with activated security functions, the security settings are disabled during migration to STEP 7 Professional.

If necessary, follow these steps after the migration:

  1. Activate the security functionality.

  2. Configure the required security settings.

Migration of IP access protection lists when activating the security functions

An active IP access protection list is converted to firewall rules when security functions are activated. These rules are visible in advanced firewall mode and can be adjusted there. The advanced firewall mode is activated automatically.

Copying Security modules

Copying stations with activated Security functions to another project without activated Security functions is forbidden and can lead to serious inconsistencies.

Security online diagnostics of S7 CPs

Security online diagnostics of a CP with security capability is only possible if the online connection is established directly via the CP. If the online connection was established by STEP 7 via the CPU to the station, with the "Connect online" button on the security diagnostics page "Security" > "Status" of the security CP you can establish a direct connection to the CP to run security online diagnostics. As an alternative, you can also terminate the online connection to the CPU and enter the IP address of the CP in the "Station address" input box under the entry "Online access" in online diagnostics.

IKE mode

When negotiating the key in phase 1 the IKE mode "Main" should be preferred. This mode normally provides a reliable procedure compared with the "Aggressive" mode. One reason for using the "Aggressive" setting is when you have VPN groups with different pre-shared keys since only one pre-shared key is supported with the "Main" setting.

The IKE "Aggressive" mode should not be used in conjunction with certificates. In the IKE "Aggressive" mode, only use pre-shared keys.

The SOFTNET Security Client only supports the IKE "Main" mode.

A security module must not be used in VPN groups that use different IKE modes.

Downloading configuration data to an S7-300/400 via a VPN tunnel

When you download configuration data via the gigabit interface of a CP x43-1 Advanced to an S7-300/S7-400 station, the path via which the download takes place is stored in the project. If the project is then downloaded via a VPN tunnel established between a SCALANCE S module and the CP x43-1 Advanced, the download fails due to the changed path.

To download via the VPN tunnel, follow the steps below:

  1. Using the "Go online" button, connect the engineering station to the gigabit interface of the CP x43‑1 Advanced.

  2. Disconnect the online connection to the CP x43‑1 Advanced.

  3. Download the project to the station via the gigabit interface of the CP x43‑1 Advanced.

VPN tunnel establishment with 1200/1500 CPs capable of VPN

The establishment of VPN tunnel connections by 1200/1500 CPs capable of VPN with the authentication method "pre-shared key" is only possible if the VPN connection partner is also a 1200/1500 CP capable of VPN. The establishment of VPN tunnel connections by a 1200/1500 CP capable of VPN to all other VPN connection partners is only possible with the "certificate" authentication method.


Media converters

Media converters

When you migrate a project, you need to reconfigure the media converters.