Siemens SIMATIC S7-1500 Function Manual page 307

Routing
10.5 Virtual interface for IP-based applications
Settings in the communication module
The settings of the internal CP firewall do not have an effect on communication over the
virtual interface. This means the security functions of the communication module cannot
protect the data traffic via the virtual interface.
NOTICE
Connecting to non-secure networks
If you connect the CP to a non-secure network, it is absolutely necessary to connect an
additional firewall between the CP and the non-secure network. For example, use the
security modules SCALANCE S602 V3 and SCALANCE S623 with integrated firewall.
306
Function Manual, 11/2019, A5E03735815-AH
Communication