Configuring Firewall Ports for Remote OS Project Download and Runtime in PCS 7

Configuring an external hardware or software firewall between a SIMATIC PCS 7 Engineering Station (ES) and a remote Operator Station (OS) requires opening specific management, database, and RPC ports across the Terminal Bus. While port 102 (ISO-on-TCP) is required for Plant Bus S7 controller communications, an OS project download operates entirely over the Terminal Bus using Server Message Block (SMB/CIFS on TCP port 445), RPC Endpoint Mapper (TCP port 135), NetBIOS services (UDP 137/138, TCP 139), and dynamic RPC ports (TCP 49152 to 65535). In PCS 7 V8.1 and higher, enabling Encrypted Communication in Simatic Shell allows firewall traversal using a single user-defined TLS port (such as TCP 5226).

Terminal Bus vs Plant Bus Firewall Architecture

In a secured SIMATIC PCS 7 installation adhering to IEC 62443 industrial network security standards, firewalls separate process networks from corporate IT and isolate the Plant Bus (AS-to-OS) from the Terminal Bus (ES-to-OS-to-Client).

A frequent engineering error occurs when an external perimeter firewall is enabled between the Engineering Station and an OS Server, and only TCP port 102 is permitted. While port 102 satisfies S7 communication between the S7-400 controller and WinCC, an OS Download (transferring the compiled WinCC project database from the ES to the target OS machine) is a complex distributed transaction involving file sharing, database duplication, and DCOM object instantiation. Without opening the appropriate Terminal Bus services, SIMATIC Manager aborts the download with the error: OS is not available.

Port Requirements for Remote OS Project Download

A standard unencrypted PCS 7 OS project download and runtime synchronization session requires opening several standardized network services:

Protocol / ServicePort NumberTransport LayerDirectionFunctional Purpose in PCS 7RPC Endpoint Mapper135TCPBidirectionalDCOM interface discovery and object activationSMB over IP (File Sharing)445TCPES -> OSWindows file copy of WinCC project files and SQL databasesNetBIOS Name / Datagram137, 138UDPBidirectionalLegacy Windows name resolution and station browsingNetBIOS Session Service139TCPBidirectionalNetBIOS session handling for network sharesDynamic RPC Ports49152 - 65535TCPBidirectionalDCOM execution for WinCC, Automation License Manager, and Simatic ShellSimatic Shell Multicast5226, 5227UDPSubnet BroadcastStation presence announcement and redundant server discoveryISO-on-TCP (Plant Bus)102TCPBidirectionalDirect AS-OS S7 communication (not used for OS project downloads)

In modern Windows operating systems (Windows Server 2012 R2, 2016, and Windows 10), dynamic RPC ports are assigned within the range 49152 to 65535. Opening this broad port range on an external perimeter firewall often conflicts with corporate cybersecurity policies.

Dynamic RPC Allocation and Simatic Shell Encrypted Mode

To overcome the security risks of opening large dynamic RPC port ranges across external firewalls, Siemens introduced Encrypted Communication in Simatic Shell (available in PCS 7 V8.1 / WinCC V7.3 and higher):

Deterministic Single-Port Tunneling: When encrypted communication is enabled in Simatic Shell, all cross-station WinCC communication, project replication, and client-server synchronization are tunneled through a single, static user-configurable port (default TCP/UDP port 5226).
Cryptographic Security: Communication is authenticated and encrypted using TLS certificates and a shared network key, preventing packet sniffing and unauthorized DCOM injection.
Simplified Firewall Rules: Network engineers only need to open the single designated encryption port (e.g., 5226) alongside SMB (445) for file transfer, completely eliminating the need to expose the dynamic RPC port range.

Step-by-Step Firewall Configuration Procedure

To configure firewall traversal for remote OS downloads:

Configure Hardware/External Firewall:
- Create a firewall rule between the ES IP address and the OS Server IP address.
- Permit inbound traffic to the OS on: TCP 135, TCP 445, UDP 137, UDP 138, TCP 139.
- If using standard DCOM: Permit TCP 49152–65535.
- If using Encrypted Simatic Shell: Permit TCP 5226 (or custom chosen port).
Enable Encrypted Communication in Simatic Shell:
- On the ES and all OS machines, open Windows Explorer -> This PC -> Simatic Shell.
- Right-click Simatic Shell and select Settings....
- Check Encrypted communication.
- Enter a secure shared network key (password) and confirm the port number (e.g., 5226).
- Apply the identical key and port across all PCS 7 stations in the project.
Verify Windows Local Firewall:
- Ensure the local Windows Firewall on both ES and OS is configured by the Siemens Security Controller utility (SecurityController.exe), which automatically creates local rule exceptions for installed PCS 7 components.

Verification

To verify firewall rule configuration and download readiness:
1. From the Engineering Station, execute Test-NetConnection -ComputerName <OS_IP> -Port 445 in PowerShell; confirm TcpTestSucceeded: True.
2. Test RPC endpoint availability: Test-NetConnection -ComputerName <OS_IP> -Port 135; confirm TcpTestSucceeded: True.
3. In Simatic Shell, verify that the remote OS Server appears in the tree with a green lock icon indicating active encrypted communication.
4. In SIMATIC Manager, right-click the OS project -> PLC -> Download; select Entire OS or Changes only; confirm that project files transfer and register without connection timeout errors.

Limitations and Operational Precautions

Never disable firewalls completely on an industrial network. While disabling the firewall temporarily may confirm a port blockage, it exposes the industrial host to unauthorized network probes and malware propagation. When enabling Encrypted Communication in Simatic Shell, ensure that every participating OS Server, Client, and ES has the exact same network key applied; mismatched keys will immediately isolate the station from the runtime network.

Engineer FAQ

Why is port 102 insufficient for downloading an OS project?

Port 102 is exclusively used by the S7 communication protocol between controllers and PCs. OS project downloads occur via Windows file sharing (SMB port 445) and DCOM (port 135 and dynamic ports).

Can I restrict the dynamic RPC port range in Windows?

Yes. Windows netsh commands can restrict the dynamic RPC range (e.g., to ports 50000–50100), but utilizing Simatic Shell Encrypted Communication is the Siemens recommended standard.

What role does the Siemens Security Controller play?

The Siemens Security Controller is a system tool that automatically configures local Windows Firewall rules, DCOM permissions, and user group rights according to the installed PCS 7 software requirements.