Resolving Online Connection Failures Between PCS 7 Engineering Station and S7-400 AS - Antivirus and Firewall Policies

When a newly rebuilt or reinstalled SIMATIC PCS 7 Engineering Station (ES) fails to connect online with an S7-400 automation controller—despite having identical PG/PC interface settings, correct IP subnets, and functional ping connectivity—the root cause is typically third-party antivirus endpoint protection policies or Windows Defender Firewall rules blocking industrial communication ports. SIMATIC PCS 7 relies on ISO-on-TCP (RFC 1006) across TCP Port 102 for STEP 7 engineering, CFC online monitoring, and WinCC Named Connections, alongside UDP/TCP Ports 5225 and 5226 for Simatic Shell communication. If corporate IT antivirus policies enforce packet filtering or network intrusion prevention on industrial network adapters, outbound S7 packets are silently discarded. Resolving the blockage requires configuring antivirus exclusions, opening TCP Port 102, and whitelisting Siemens communication executables.

Industrial Protocol Architecture: RFC 1006 and S7 Communication Ports

In a SIMATIC PCS 7 environment, communication between the Engineering Station (ES) and the S7-400 or AS 410-5H controllers utilizes the proprietary Siemens S7 protocol layered over Industrial Ethernet. This communication conforms to RFC 1006 (ISO-on-TCP), utilizing TCP Port 102 as the dedicated transport mechanism.

When an engineer clicks 'Go Online' in SIMATIC Manager or attempts to download a CFC chart, the SIMATIC communication layer (s7oiehsx.exe and s7tgtopx.exe) initiates a three-way TCP handshake to Port 102 on the CPU or CP 443-1. Standard ICMP network commands (such as ping <IP_Address>) only verify Layer 3 IP reachability. If an endpoint security suite intercepts Layer 4 TCP traffic and identifies Port 102 as unapproved or anomalous, ping will succeed 100% while all SIMATIC online functions report: Error 0x8000: Connection could not be established.

Antivirus and Firewall Interference in Industrial Automation Networks

Corporate enterprise security policies often deploy centralized endpoint detection and response (EDR) software (such as McAfee, Symantec, Trend Micro, or Windows Defender Advanced Threat Protection) onto plant workstations:

Network / Security LayerIndustrial PurposeAntivirus / Firewall Failure ModeTCP Port 102RFC 1006 ISO-on-TCP for S7 AS-ES / AS-OS communicationBlocked by default firewall profiles; S7 connection refusedTCP/UDP Ports 5225, 5226Simatic Shell multicast / broadcast station discoveryStation invisible in Simatic Shell; server packages failNetwork Adapter FilteringPlant Bus NIC (CP 1623 / Softnet-IE)Real-time packet inspection introduces jitter, tripping S7 timeoutsProcess Memory Inspections7epatsx.exe, s7tgtopx.exe, CCDataMgr.exeBehavioral blockers freeze SIMATIC threads during compilationFile System LockingProject .mdf, .ldf, .DCF database filesOn-access file scanners lock project databases, corrupting archives

Siemens publishes strict security whitepapers specifying mandatory firewall rules, port openings, and directory exclusions required to operate PCS 7 without performance disruption.

Step-by-Step Configuration of Port Exceptions and Antivirus Whitelisting

To restore robust online communication between the ES and the S7-400 AS, execute the following technical measures:

Configure Windows Defender / Firewall Exceptions:
- Open Windows Firewall with Advanced Security (wf.msc).
- Create a new Inbound and Outbound Rule: Type Port -> Protocol TCP -> Specific ports 102 -> Action Allow the connection.
- Create rules for Simatic Shell: Protocol TCP and UDP -> Specific ports 5225, 5226 -> Action Allow the connection.
- Apply the rules to Domain, Private, and Public profiles.
Configure Corporate Antivirus Exclusions:
- In the antivirus administrative console, exclude the plant bus network adapter from deep packet inspection.
- Add full folder exclusions for the Siemens installation and project directories: C:\Program Files (x86)\Siemens\*, C:\Program Files\Siemens\*, and the active project drive C:\Cielo2\*.
- Whitelist core SIMATIC communication executables: s7oiehsx.exe, s7epatsx.exe, Transfer.exe, and CCDataMgr.exe.
Verify Set PG/PC Interface:
- Open Set PG/PC Interface in Windows Control Panel. Confirm that the access point S7ONLINE is mapped to TCP/IP -> [Active_Network_Adapter_Name] rather than PC internal.local.1.

Verification

Confirm that communication barriers are eliminated using these validation steps:

Port 102 Connectivity Test: In PowerShell on the ES, run Test-NetConnection -ComputerName <PLC_IP> -Port 102. Confirm that TcpTestSucceeded : True is returned.
Accessible Nodes Inspection: In SIMATIC Manager, click the Accessible Nodes icon. Verify that the S7-400 CPU and CP 443-1 modules appear immediately with their correct hardware addresses.
CFC Online Test: Open any CFC chart and enter test mode (Test -> Open). Confirm that dynamic parameter values update live and the online status bar indicates RUN in green.

Limitations and Operational Precautions

When configuring security exceptions for industrial automation, maintain robust cyber protection:

Network Segmentation: Never disable firewalls globally. Open only the specific ports (e.g., TCP 102) required for SIMATIC communication, and ensure the plant bus is physically or logically segmented (VLAN) from the corporate business LAN.
Approved Antivirus Scanners: Siemens tests and qualifies specific antivirus software suites for each PCS 7 version (such as Trend Micro OfficeScan / Apex One, Symantec Endpoint Protection, and McAfee Application Control). Deploy only certified products.
Pattern Update Management: Never allow antivirus clients to download updates directly from the Internet on live automation stations. Updates must be distributed centrally via an internal corporate update server during scheduled maintenance windows.

Engineer FAQ

Why did ping work when S7 communication failed?

Ping uses ICMP (Internet Control Message Protocol), which operates at Layer 3 without port numbers. S7 communication operates at Layer 4 across TCP Port 102. Firewalls frequently permit ICMP while blocking Port 102.

Can Windows Firewall block communication if the network profile changes?

Yes. If Windows classifies the industrial Ethernet connection as 'Public' rather than 'Private', it automatically applies stricter firewall policies that block inbound S7 packets. Configure the network adapter as Private or Domain.

What is the function of the Simatic Shell ports (5225, 5226)?

Simatic Shell uses multicast/broadcast over ports 5225 and 5226 for computer name resolution, server package announcements, and terminal bus station discovery between engineering stations, servers, and clients.