Siemens SIMATIC NET System Manual page 270

SCALANCE network components
4.8 SCALANCE S Industrial Security Appliance
The communication via these IPsec tunnels makes it possible for PG/PC applications such
as NCM (Network and Communication Management) diagnostics or with STEP 7 to securely
access devices or networks that are located in an internal network protected by
SCALANCE S.
Note
Note that you can only use the SOFTNET Security Client in groups with modules in the
active bridge mode.
Automatic communication via VPN
For your application, it is important that the SOFTNET Security Client automatically detects
when there is access to the IP address of a VPN node. The nodes are addressed via the IP
address as if they were in the local subnet to which the programming device / PC is also
connected with this application.
How it works
The SOFTNET Security Client reads in the configuration created by the Security
Configuration Tool and obtains the required information on the certificates to be imported
from the relevant file. The root certificate and the private keys are imported and stored on the
local PG / PC. Subsequently security settings are made based on the data from the
configuration so that applications can access IP addresses downstream from the
SCALANCE S Industrial Security Appliances.
If the learning mode for the internal nodes or programmable controllers is activated, the
configuration module first sets a security policy for the secure access to the SCALANCE S
devices. The SOFTNET Security Client then addresses the SCALANCE S devices to obtain
the IP addresses of the relevant internal nodes. The SOFTNET Security Client registers
these IP addresses in special filter lists belonging to this security policy. Following this,
applications such as STEP 7 can communicate with the programmable controllers via VPN.
Article numbers
The SOFTNET Security Client software for establishing secure IP-based VPN connections
from the PG /PC to network segments secured by SCALANCE S can be supplied for the
following Windows operating systems.
● 1 single license for one installation,
● runtime software (German / English),
270
System Manual, 09/2019, C79000-G8976-C242-10
Industrial Ethernet