How to Access SCALANCE Switch Web-Based Management from SIMATIC PCS 7 Industrial PCs via CP 1623

In SIMATIC PCS 7, accessing the Web-Based Management (WBM) interface of a SCALANCE X industrial switch from an Industrial PC (such as IPC847D running Windows Server 2008 R2) equipped with a CP 1623 communications processor requires proper configuration of the CP 1623 NDIS driver, Windows IP routing, and browser security permissions. Even if ICMP ping succeeds, Internet Explorer may display 'The page cannot be displayed' or an empty 'Logon to SCALANCE X' screen. To resolve this, verify that the CP 1623 NDIS interface is enabled with a valid static IP on the plant bus subnet, enable JavaScript/Active scripting in Internet Explorer security zones, permit HTTP (Port 80) and HTTPS (Port 443) through Windows Firewall, and ensure TLS 1.0/1.2 protocols are active.

Industrial Ethernet Network Architecture: CP 1623 NDIS vs Hardnet Mode

In SIMATIC PCS 7 Operator Stations and Engineering Stations, the CP 1623 (6GK1162-3AA00) is a PCI Express communications processor designed to offload ISO Transport protocol and S7 communication:
* Dual Operation Modes:
* Hardnet / S7-1613 Mode: The CP hardware executes the S7 protocol stack directly on its onboard microprocessor, bypassing Windows networking.
* NDIS (Network Driver Interface Specification) Mode: The CP emulates a standard Windows Network Interface Card (NIC), exposing an IP stack to the Windows operating system.
* The Routing Requirement: To access the internal web server of a SCALANCE industrial switch, Windows must route HTTP/HTTPS traffic through the CP 1623's NDIS IP adapter. If the NDIS adapter IP address or subnet mask is missing or incorrectly bound in Windows Network Connections, standard TCP/IP browser requests cannot reach the switch.

Prerequisites for SCALANCE X Web-Based Management (WBM)

According to the Siemens SCALANCE X-200 / X-300 system manual, Web-Based Management requires:
1. Static IP Assignment: The SCALANCE switch must have a valid IP address and subnet mask assigned via PST (Primary Setup Tool), STEP 7 HW Config, or Proneta.
2. Layer 2 / Layer 3 Connectivity: The client PC must reside on the same IP subnet or have a valid gateway route.
3. Browser Compatibility: Microsoft Internet Explorer (or modern edge in IE mode) with active JavaScript engine.
4. Network Ports:
* Port 80 (HTTP) for standard WBM.
* Port 443 (HTTPS) for encrypted administrative access.

Configuring Microsoft Internet Explorer and Security Zones

When Internet Explorer displays the title 'Logon to SCALANCE X' but the page body remains blank or errors out:

Enable Active Scripting (JavaScript):
* Open Internet Explorer: Tools > Internet Options > Security.
* Select Trusted Sites and click Sites.
* Add the SCALANCE switch IP address (e.g., http://192.168.1.10 or https://192.168.1.10).
* Click Custom level.... Locate Active scripting and select Enable.
Configure TLS Security Protocols:
* Under the Advanced tab in Internet Options, scroll to the Security section.
* Ensure that Use TLS 1.0, Use TLS 1.1, and Use TLS 1.2 are checked.
* If connecting to older firmware SCALANCE units, unchecking Warn about certificate address mismatch prevents blank redirection locks.

Windows Firewall and Port Permutations (Port 80 and 443)

On industrial servers running Windows Server 2008 R2 or Windows Server 2012 R2:

Windows Firewall Exceptions:
Launch SIMATIC Security Controller and run Repeat Settings to ensure standard PCS 7 port exceptions are applied.
Open Windows Firewall with Advanced Security: inspect Inbound Rules and Outbound Rules.
Verify that outbound TCP ports 80 (HTTP) and 443 (HTTPS) are allowed on the active network profile (Domain or Private).
Verifying NDIS Routing:
Open Windows Command Prompt: execute ipconfig /all.
Confirm that the SIMATIC CP 1623 NDIS Adapter reports the correct static IP address matching the SCALANCE switch subnet.
Execute route print to verify that routing tables direct local plant bus subnets through the CP 1623 adapter.

Comparison of SCALANCE Switch Configuration Interfaces

The table below compares diagnostic and configuration access methods for SCALANCE X managed industrial switches.

Configuration InterfaceProtocol UsedPort / MediaSoftware RequiredBest ApplicationWeb-Based Management (WBM)HTTP / HTTPSTCP 80 / 443Web Browser (IE/Edge)General configuration and port diagnosticsCommand Line Interface (CLI)Telnet / SSH / SerialTCP 23 / 22 / RJ11PuTTY / HyperTerminalScripted backups & VLAN configurationSNMP DiagnosticsSNMP v1/v2c/v3UDP 161 / 162PCS 7 Maintenance StationAutomated DCS diagnostic alarmsPrimary Setup Tool (PST)DCP (Layer 2 MAC)ISO / Layer 2 BroadcastSiemens PST / PronetaInitial out-of-the-box IP assignmentSTEP 7 HW ConfigPROFINET IO / DCPIndustrial EthernetSIMATIC ManagerPlant-wide topology & MRP ring setup

Verification

To confirm that SCALANCE Web-Based Management is operating properly:
1. Open Windows Command Prompt: ping the switch IP address (e.g., ping 192.168.1.10). Confirm reply latency is under 1 ms.
2. Open Internet Explorer: enter https://192.168.1.10.
3. Verify that the SCALANCE login splash screen renders with graphics, username, and password fields.
4. Log in using default credentials (or site administrative password).
5. Confirm that the switch management dashboard opens, displaying active port link speeds, fiber optic power levels, and redundant ring status without rendering errors.

Limitations and Operational Precautions

Never change the IP address or subnet mask of an active SCALANCE switch carrying live plant bus traffic while the DCS is in RUN; communication loss can trip redundant S7-400H controllers.
Do not leave HTTP (unencrypted Port 80) active in production networks; enforce HTTPS (Port 443) and change the factory default password (admin) immediately during commissioning.
If using proxy servers on the terminal bus, configure Internet Explorer to bypass proxy servers for local plant bus IP addresses.
Always validate final switch firmware versions, network hardware, and ordering numbers against the applicable Siemens catalog and authorized distributor quotation.

Engineer FAQ

Why does ping work, but the web browser cannot display the SCALANCE page?

Ping uses low-level ICMP packets. The web browser uses TCP Port 80 or 443, which can be blocked by Windows Firewall, restricted by Internet Explorer security zones, or disabled inside the switch configuration.

Can I access SCALANCE WBM if the CP 1623 is in ISO-only mode?

No. ISO Transport mode handles industrial S7 frames without an IP stack. You must configure the NDIS IP address in Windows Network Connections to enable HTTP/HTTPS browser traffic through the CP 1623.

What is the default IP address of an unconfigured SCALANCE switch?

Out of the box, unmanaged/unconfigured SCALANCE switches have no factory default IP address (0.0.0.0); an IP address must be assigned using Primary Setup Tool (PST), Proneta, or STEP 7 HW Config via MAC broadcast.