Creating Vpn Tunnel Communication Between S7-1500 Stations - Siemens S7-1500 Operating Instructions Manual

● Securing the computer systems including the associated data communication within an
automation network or secure remote access via the Internet.
● Secure remote access from a PC/programming device to automation devices or networks
protected by security modules is possible via public networks.
Cell protection concept
With Industrial Ethernet Security, individual devices, automation cells or network segments
of an Ethernet network can be protected:
● The access to individual devices or even to entire automation cells protected by security
modules is allowed.
● Secure connections via non-secure network structures becomes possible.
Due to the combination of different security measures such as firewall, NAT/NAPT routers
and VPN via IPsec tunnels, security modules protect against the following:
● Data espionage
● Data manipulation
● Unwanted access
4.4.1.1

Creating VPN tunnel communication between S7-1500 stations

Requirements
To create a VPN tunnel between two S7-1500 stations, the following requirements must be
met:
● Two S7-1500 stations have been configured.
● Both CPs are configured with a firmware version ≥ V1.1.
● The Ethernet interfaces of the two stations are located in the same subnet.
Note
Communication also possible via an IP router
Communication between the two S7-1500 stations is also possible via an IP router. To use
this communications path, however, you need to make further settings.
Procedure
To create a VPN tunnel, you need to work through the following steps:
1. Create a security user.
If the security user has already been created: Log on as a user.
2. Select the "Activate security features" check box.
CP 1543-1
Operating Instructions, 05/2017, C79000-G8976-C289-07
Configuration, programming
4.4 Security
37