Preventing WinCC Web Navigator Disconnections Across Corporate Firewalls and Proxies in SIMATIC PCS 7

When SIMATIC PCS 7 WinCC Web Navigator clients on corporate office laptops disconnect after 10 to 15 seconds, the root cause is firewall TCP connection timeouts or corporate HTTP proxy interference terminating the persistent process data stream. While initial HTTP/HTTPS web page requests succeed, real-time telemetry uses a continuous TCP socket (Port 1043 or HTTPS tunneling via Port 443). To resolve this, configure the Web Navigator for pure HTTPS tunneling, bypass corporate proxy servers for the Web Server IP, and adjust firewall stateful TCP idle timeouts.

WinCC Web Navigator Client-Server Communication Architecture

SIMATIC WinCC Web Navigator (6AV6371-1DH07-0AX0) enables remote operation and monitoring of PCS 7 OS stations via standard Internet Explorer / web browsers:
* The Dual-Connection Architecture:
1. HTTP / HTTPS Web Session (Port 80 / 443): Handles user authentication, XML navigation files, and downloading ActiveX controls (WinCCWebClient.cab).
2. Data Tunneling Stream (Port 1043 or Port 443 Tunnel): Once authenticated, a continuous bidirectional TCP socket stream transmits real-time process values, cyclic updates, and faceplate commands directly between the Web Server engine (WebNavigatorServer.exe) and the client browser control.
* The 10-Second Drop Symptom:
When office laptops launch the web client, the overview graphic loads perfectly (proving HTTP/HTTPS succeeded). However, 10 to 15 seconds later, process values freeze or a 'Connection to server lost' dialog appears. Refreshing the browser reconnects for another 10 seconds before failing again.

Firewall and Corporate Proxy Disconnection Mechanisms

Two distinct network security barriers cause premature web client disconnections:
1. Corporate HTTP/HTTPS Proxy Servers:
Corporate office laptops often route all web traffic through an enterprise proxy (e.g., Zscaler, BlueCoat). Standard web proxies do not support persistent non-HTTP binary TCP streams. When the proxy detects a raw TCP stream lingering over HTTP/HTTPS, it forcibly terminates the socket after its initial inspection window.
2. Stateful Firewall Idle Timeouts:
Enterprise firewalls separating the IT network from the plant OT Demilitarized Zone (DMZ) perform TCP sequence verification. If heartbeat packets on Port 1043 are blocked, the firewall flags the connection as dead and drops the session state.

Port and Protocol Configuration Matrix for WinCC Web Navigator

The table below outlines network ports and transport protocols required for WinCC Web Navigator:

Port NumberProtocolDirectionCommunication PurposeFirewall RequirementPort 80HTTPClient -> Web ServerStandard unencrypted web session & ActiveX downloadOptional (Deprecated for security)Port 443HTTPSClient -> Web ServerSSL/TLS encrypted web session & HTTPS TunnelingMandatory (Open & Uninspected)Port 1043TCPClient -> Web ServerDefault process data stream (if tunneling disabled)Required if HTTPS Tunneling is OFFPort 135 / 445TCPES -> Web ServerProject publishing and file transferInternal Engineering Network OnlyPort 4840TCPClient -> Web ServerOPC UA connectivity (if enabled on Web Server)Optional

Configuring HTTPS Port 443 Tunneling to Bypass Strict Firewalls

The most effective way to guarantee rock-solid connectivity across corporate IT firewalls without opening proprietary non-standard ports (like 1043) is configuring HTTPS Tunneling:
* Mechanism:
All real-time process data is encapsulated entirely inside standard TLS/SSL encrypted HTTPS packets over standard Port 443.
* Corporate Firewall Compatibility:
To intermediate firewalls and intrusion prevention systems, the entire communication stream appears as a standard HTTPS session, preventing arbitrary port blocks.
* Security Enhancement:
HTTPS tunneling encrypts all plant telemetry and operator commands across the enterprise network.

Step-by-Step Procedure to Eliminate Web Client Timeouts

Configure Web Configurator for HTTPS Port 443 Tunneling:
* On the WinCC Web Server, open Web Configurator from the Siemens program group.
* Select Modify existing Web site.
* Under communication settings, select HTTPS (Port 443) and bind a valid SSL server certificate.
* Check the option Enable Tunneling (encapsulates Port 1043 traffic within Port 443).
* Complete the wizard to update IIS (Internet Information Services).
Configure Corporate Browser Proxy Bypass:
* On the office laptops, open Windows Internet Options -> Connections -> LAN settings.
* Under Proxy server, click Advanced.
* In the Exceptions box, add the IP address and FQDN of the WinCC Web Server (e.g., 192.168.10.50; webos01.plant.local).
* This forces the laptop to connect directly to the industrial web server rather than routing through the corporate proxy.
Configure Firewall Keep-Alive Rules:
On the IT/OT perimeter firewall, create an explicit rule permitting bi-directional traffic on Port 443 between office subnets and the Web Server DMZ IP. Set the TCP connection timeout to a minimum of 3600 seconds.
Test Web Client Reconnection:
Launch Internet Explorer / web browser on the office laptop. Connect to https://webos01.plant.local and verify stable long-term streaming.

Verification

To verify that client disconnections are resolved:
1. Open the WinCC Web Client on an office laptop.
2. Monitor dynamic process graphics and trend curves continuously for 30 minutes without touching the keyboard or mouse.
3. Confirm that no disconnection dialogs appear and values update in real time without lag.
4. Open Windows Command Prompt on the laptop and run: netstat -ano | findstr 443. Confirm that the TCP connection to the Web Server remains in ESTABLISHED state.

Limitations and Operational Precautions

ActiveX Execution Permissions: WinCC Web Navigator requires running Siemens ActiveX controls. Modern browsers (Microsoft Edge) must run in Internet Explorer Mode with the Web Server added to the Trusted Sites zone.
Concurrent Web Client Licenses: WinCC Web Navigator licenses (6AV6371-1DH07-0AX0) are based on concurrent active client connections (e.g., 3, 10, 25 clients). If client count exceeds the license pool, new connections are rejected.
Licensing Disclaimer: Final license quantities and MLFBs for WinCC Web Navigator (6AV6371-1DH07-0AX0) must be validated against the applicable Siemens catalog and authorized distributor quotation.