Vpn Communication With Softnet Security Client (Engineering Station); Connection To The Telecontrol Server - Siemens S7-1200 Operating Instructions Manual

Configuration and operation
4.13 Security functions
4.13.1.4

VPN communication with SOFTNET Security Client (engineering station)

Setting up VPN tunnel communication between the SOFTNET Security Client and CP has
essentially same requirements and procedure as described in the section Creating a VPN
tunnel for S7 communication between stations (Page 59).
VPN tunnel communication works only if the internal node is disabled
Under certain circumstances the establishment of VPN tunnel communication between
SOFTNET Security Client and the CP fails.
SOFTNET Security Client also attempts to establish VPN tunnel communication to a lower-
level internal node. This communication establishment to a non-existing node prevents the
required communication being established to the CP.
To establish successful VPN tunnel communication to the CP, you need to disable the
internal node.
Use the procedure for disabling the node as explained below only if the described problem
occurs.
Disable the node in the SOFTNET Security Client tunnel overview:
1. Disable the option "Enable active learning" check box.
The lower-level node initially disappears from the tunnel list.
2. In the tunnel list, select the required connection to the CP.
3. With the right mouse button, select "Enable all members" in the shortcut menu.
The lower-level node appears again temporarily in the tunnel list.
4. Select the lower-level node in the tunnel list.
5. Select "Delete Entry" in the shortcut menu.
Result: The lower-level node is now fully disabled. VPN tunnel communication to the CP can
be established.
4.13.1.5

Connection to the telecontrol server

No VPN connection between CP and TCSB
For secure communication via a VPN tunnel, the communications partners are assigned to a
common VPN group. The configuration of a VPN connection between CP and TCSB is not
possible because the telecontrol server cannot be configured in STEP 7.
Thanks to the encrypted telecontrol protocol, the connection between the CP and telecontrol
server is already protected.
62
Operating Instructions, 01/2015, C79000-G8976-C381-01
CP 1243-7 LTE