C135 PCS 7 (PCS7)
6C
6 Cielo Ciencia y Tecnología
·Publicada en C135 PCS 7 (PCS7)

Deploying and Downloading to a PCS 7 OS Client in a Perimeter DMZ Across SCALANCE SC Firewalls

Deploying and Downloading to a PCS 7 OS Client in a Perimeter DMZ Across SCALANCE SC Firewalls

To enable remote project downloads from an internal Engineering Station (ES) to a SIMATIC PCS 7 OS Client located in a Demilitarized Zone (DMZ) across an industrial firewall (such as SCALANCE SC646-2C) without physically moving the PC: 1) In the firewall, open bidirectional rules for Windows File Sharing / SMB (TCP port 445 and TCP port 139) between the ES and DMZ Client IP addresses; 2) Permit Microsoft RPC Endpoint Mapper (TCP port 135) and the configured dynamic DCOM RPC port range; 3) Configure SIMATIC Shell with unicast remote communication partners or multicast proxying so stations discover each other across subnets; and 4) Ensure Windows share and NTFS security permissions on the DMZ client folder grant Full Control to the SIMATIC HMI user group.

Table of Contents

Executive Summary

In secure industrial architectures conforming to IEC 62443, operator terminals located in management control centers, visitor galleries, or corporate liaison rooms are frequently segregated into a perimeter Demilitarized Zone (DMZ) protected by industrial security appliances such as the SCALANCE SC600 family. While runtime communication between the internal OS Servers and the DMZ OS Client may function properly once the project is in place, engineers often discover that remote project downloads from the internal Engineering Station fail, forcing them to temporarily relocate the client to the internal subnet. This technical reference clarifies the protocol differences between WinCC Runtime and remote project engineering, details mandatory firewall rules, and outlines SIMATIC Shell configuration across routed subnets.

Architecture and Fundamental Mechanics

Protocol Separation: Runtime Operation vs. Remote Engineering Download

INTERNAL PROCESS NETWORK (VLAN 10)           DMZ PERIMETER NETWORK (VLAN 20)
+-----------------------+                    +-----------------------+
| Engineering Station   |                    | OS Client in DMZ      |
| IP: 192.168.10.50     |                    | IP: 192.168.20.100    |
|                       |                    |                       |
| [OS Servers 1 & 2]    |                    |                       |
+-----------------------+                    +-----------------------+
           |                                             ^
           |         +-------------------------+         |
           +-------->| SCALANCE SC646-2C       |---------+
                     | Industrial Firewall     |
                     +-------------------------+

The Two Distinct Phases of Remote OS Download

  1. Phase 1: File Copy Operation (Windows SMB):
    - SIMATIC Manager copies the compiled WinCC runtime project files (*.pdl, *.mcp, @*.pdl, scripts) over the network to the shared folder on the client.
    - Required Protocol: Server Message Block (SMB) over TCP Port 445 (and legacy NetBIOS TCP 139). If SMB is blocked by firewall inspection rules, the download aborts immediately with 'Path invalid' or 'Access denied'.
  2. Phase 2: Project Registration & Remote Configuration (DCOM / RPC & SIMATIC Shell):
    - SIMATIC Manager invokes remote COM/DCOM calls to register the project with the client's WinCC Station Management service and update the Project Duplicator state.
    - Required Protocol: RPC Endpoint Mapper (TCP Port 135) and dynamic RPC ports (49152–65535, or a restricted static DCOM port pool configured in dcomcnfg).
    - Network Discovery: SIMATIC Shell uses UDP multicast (Port 5222 / 5223). Across routed subnets or firewalls, multicast does not pass by default; an explicit unicast partner address or multicast proxy must be configured.

Step-by-Step Implementation Procedure

Step 1: Configure Firewall Rules on SCALANCE SC646-2C

  1. Log into the Web Based Management (WBM) interface of the SCALANCE SC646-2C.
  2. Navigate to Security > Firewall > IP Rules.
  3. Create firewall rules permitting traffic from the Engineering Station IP (192.168.10.50) to the DMZ OS Client IP (192.168.20.100):
    - TCP Port 445: Microsoft SMB (File Sharing)
    - TCP Port 139: NetBIOS Session Service
    - TCP Port 135: Microsoft RPC Endpoint Mapper
    - TCP Ports 1030 to 1032: SIMATIC Station Management
    - TCP Dynamic RPC Range (or custom restricted range, e.g., TCP 50000 - 50100)
  4. Create return rules permitting response traffic from DMZ Client to ES.
  5. Save and activate firewall rules.

Step 2: Configure SIMATIC Shell for Cross-Subnet Communication

  1. On the DMZ OS Client, open Windows File Explorer and navigate to This PC.
  2. Right-click SIMATIC Shell and select Settings....
  3. In the SIMATIC Shell Configuration dialog, ensure the active network adapter connected to the DMZ is selected.
  4. If multicast is blocked across the router, enable Multicast Proxy or expand the Remote Communication group.
  5. Click Add... and enter the IP address of the Engineering Station and OS Servers.
  6. Repeat this step on the Engineering Station, adding the IP address of the DMZ OS Client.
  7. Click OK and restart the PC when prompted.

Step 3: Configure Shared Folder Permissions on the DMZ Client

  1. On the DMZ OS Client, create the target project directory (e.g., D:\WinCC_Project).
  2. Right-click the folder and select Properties > Sharing > Advanced Sharing.
  3. Check Share this folder, set share name to WinCC_Project.
  4. Set Share Permissions: Add local/domain group SIMATIC HMI with Full Control.
  5. Select the Security tab (NTFS Permissions): Ensure SIMATIC HMI has Full Control.

Step 4: Validate Target Path and Download from SIMATIC Manager

  1. On the Engineering Station, open Windows Explorer and verify UNC access: \\192.168.20.100\WinCC_Project.
  2. In SIMATIC Manager, open the Object Properties of the DMZ OS Client PC station.
  3. In the Target OS and Standby OS computer tab, set the path to: \\192.168.20.100\WinCC_Project\<ProjectName>.mcp.
  4. Right-click the OS Client object and select PLC > Download.
  5. Confirm that the file transfer and remote project registration complete cleanly across the firewall.

Verification

  1. SIMATIC Shell Discovery Check: In Windows Explorer on the ES, expand SIMATIC Shell. Verify that the DMZ OS Client appears in the list with a valid station name and IP address.
  2. Test File Creation: On the ES, create a temporary text file in \\192.168.20.100\WinCC_Project via command line (echo test > \\192.168.20.100\WinCC_Project\test.txt). Confirm the file writes successfully, verifying SMB connectivity.
  3. Full Download Execution: Initiate the OS Client download from SIMATIC Manager. Confirm that the progress dialog executes both file copying and project configuration without error popups.

Limitations and Operational Precautions

  1. DCOM Port Range Restriction: By default, Windows RPC uses dynamic high ports (49152–65535). Opening this broad range on firewalls may violate enterprise cybersecurity policies; restrict the RPC dynamic range in dcomcnfg to a narrow band (e.g., 50000–50050) and open only those ports on the firewall.
  2. Bandwidth Limitations: Remote downloads over low-bandwidth DMZ links can experience timeouts on multi-gigabyte OS client projects; ensure minimum 100 Mbps or 1 Gbps links between internal and DMZ switches.

Engineer FAQ

Why did runtime work across the firewall while download failed?

Runtime uses WinCC terminal bus ports; remote download requires SMB file sharing (TCP 445) and DCOM RPC (TCP 135), which firewalls frequently block by default.

What ports must be opened for remote OS download?

TCP 445 (SMB), TCP 139 (NetBIOS), TCP 135 (RPC), dynamic DCOM ports (or restricted range), and TCP 1030-1032.

How does SIMATIC Shell cross firewalls?

By adding the remote station IP addresses into the 'Remote Communication' address list or configuring a Multicast Proxy in SIMATIC Shell Settings.

Can I download to an IP address instead of computer name?

SIMATIC Manager supports UNC paths using either hostnames or IP addresses (e.g., \\192.168.20.100\WinCC_Project), provided name resolution or hosts files match.

What firewall appliance is recommended for PCS 7 DMZ segregation?

Siemens SCALANCE SC600 series (such as SC632-2C, SC636-2C, or SC646-2C industrial security routers).

Does the DMZ client need to be in the same domain?

It can be in the same domain, a separate DMZ domain with one-way trust, or a workgroup with synchronized local user accounts and passwords.

What is the role of SIMATIC Security Control in firewalls?

It configures local Windows firewall rules on the PC, but perimeter hardware firewalls (SCALANCE SC) must be configured independently in their WBM.

Can I download the OS Client via VPN?

Yes, if an IPsec or OpenVPN tunnel is established through the SCALANCE SC router, routing all required ports transparently.

What happens if RPC port 135 is blocked?

The file copy phase will complete, but the final project configuration phase will fail with a DCOM RPC server unavailable error.

Where can I find Siemens firewall port documentation?

Refer to the SIMATIC PCS 7 PC Configuration and Network Security manual on Siemens Industry Online Support.

Technical References

Related Articles

Related Tags

  • DMZ
  • SCALANCE SC
  • OS Client
  • Firewall Rules
  • SIMATIC Shell
  • SMB Port 445
  • DCOM
20 respuestas