Siemens SIMATIC NET CP 443-1 Advanced User manual

___________________
___________________
___________________
___________________
___________________
___________________
___________________
___________________
___________________
___________________
___________________
SIMATIC NET
S7-400 - Industrial Ethernet
CP 443-1 Advanced (GX30)
Manual
Manual Part B
03/2019
C79000
-G8976-C256-05
Preface
Properties and services
1
Performance data
2
Requirements for use
3
LEDs
4
Installation and
commissioning
5
Configuration and operation
6
Diagnostics and upkeep
7
Technical specifications
8
Approvals
9
Documentation references
A

Siemens AG
Division Process Industries and Drives
Postfach 48 48
90026 NÜRNBERG
GERMANY
C79000-G8976-C256-05
Ⓟ
03/2019 Subject to change
Copyright © Siemens AG 2012 - 2019.
All rights reserved
Legal information
Warning notice system
This manual contains notices you have to observe in order to ensure your personal safety, as well as to prevent
damage to property. The notices referring to your personal safety are highlighted in the manual by a safety alert
symbol, notices referring only to property damage have no safety alert symbol. These notices shown below are
graded according to the degree of danger.
DANGER
indicates that death or severe personal injury will result if proper precautions are not taken.
WARNING
indicates that death or severe personal injury may result if proper precautions are not taken.
CAUTION
indicates that minor personal injury can result if proper precautions are not taken.
NOTICE
indicates that property damage can result if proper precautions are not taken.
If more than one degree of danger is present, the warning notice representing the highest degree of danger will
be used. A notice warning of injury to persons with a safety alert symbol may also include a warning relating to
property damage.
Qualified Personnel
The product/system described in this documentation may be operated only by
personnel qualified
for the specific
task in accordance with the relevant documentation, in particular its warning notices and safety instructions.
Qualified personnel are those who, based on their training and experience, are capable of identifying risks and
avoiding potential hazards when working with these products/systems.
Proper use of Siemens products
Note the following:
WARNING
Siemens products may only be used for the applications described in the catalog and in the relevant technical
documentation. If products and components from other manufacturers are used, these must be recommended
or approved by Siemens. Proper transport, storage, installation, assembly, commissioning, operation and
maintenance are required to ensure that the products operate safely and without any problems. The permissible
ambient conditions must be complied with. The information in the relevant documentation must be observed.
Trademarks
All names identified by ® are registered trademarks of Siemens AG. The remaining trademarks in this publication
may be trademarks whose use by third parties for their own purposes could violate the rights of the owner.
Disclaimer of Liability
We have reviewed the contents of this publication to ensure consistency with the hardware and software
described. Since variance cannot be precluded entirely, we cannot guarantee full consistency. However, the
information in this publication is reviewed regularly and any necessary corrections are included in subsequent
editions.

CP 443-1 Advanced (GX30)
Manual, 03/2019, C79000-G8976-C256-05 3
Preface
Legend:
1
X = placeholder for hardware product version
2
CPLUG (at rear)
3
Firmware version
4
LEDs
5 Gigabit interface: 1 x 8-pin RJ-45 jack
Security function: The padlock symbol identifies the interface to the external, non-secure sub-
net.
6 PROFINET interface: 4 x 8-pin RJ-45 jack
Security function: Interface to the internal, protected subnet
7
Label with MAC addresses
Figure 1 CP 443-1 Advanced

Preface
CP 443-1 Advanced (GX30)
4Manual, 03/2019, C79000-G8976-C256-05
Validity and product names
This description contains information on the following product:
●CP 443-1 Advanced
Article number 6GK7 443-1GX30-0XE0
●CP 443-1 Advanced (conformal coating)
CP with coated printed circuit board
Article number 6GK7 443-1GX30-0XE1
Hardware product version 1
Firmware version V3.2
Communications processor for SIMATIC S7-400 / S7-400H
Product names
●
CP
In this document, the term "CP" is also used instead of the full product name CP 443-1
Advanced.
●
STEP 7
The name STEP 7 is used for the configuration tool instead of the names STEP 7 V5.5
and STEP 7 Professional.
New in this release
●New ATEX/IECEx approval
●Revision of the system environment
●Editorial revision
Note
Make sure that you read the information relating to compatibility of the CP and enhanced
functions in the section
Enhanced functions (Page 14).
Replaced manual issue
Edition 11/2015
Structure of the documentation
The documentation for this device consists of the following parts:
●Manual Part A: Configuration manual "Configuring and Commissioning S7CPs for
Industrial Ethernet", see /2/ (Page 118).
●Manual Part B: Manual "CP 443-1 Advanced" (this manual)

Preface
CP 443-1 Advanced (GX30)
Manual, 03/2019, C79000-G8976-C256-05 5
●SIMATIC NET Industrial Ethernet Security - Basics and Application, configuration manual,
see /17/ (Page 121)
●Program blocks for SIMATIC NET S7 CPs - programming manual, see /12/ (Page 120)
Contains the detailed description of the program blocks for the following services:
–Open communications services
–Access coordination with FETCH/WRITE
–Connection and system diagnostics
–FTP services
–Programmed connections and IP configuration
–PROFINET
Current version of the manual and Information on the Internet
You will find the current version of this document and further information (e.g. FAQs) on
using the CP on the Internet at the following address:
Link: (https://support.industry.siemens.com/cs/ww/en/ps/15353)
Select the appropriate entry type in the filter settings.
CP documentation in the Manual Collection (article number A5E00069051)
The "SIMATIC NET Manual Collection" DVD contains the manuals of all SIMATIC NET
products current at the time it was created. It is updated at regular intervals.
Version History / Current Downloads for the SIMATIC NET S7 CPs
The "Version History/Current Downloads for SIMATIC NET S7 CPs" document provides
information on all CPs available up to now for SIMATIC S7 (Industrial Ethernet, PROFIBUS,
IE/PB Link).
The current version of these documents can be found on the Internet at the following
address:
Link: (https://support.industry.siemens.com/cs/ww/en/view/9836605)
Address label: Unique MAC address preset for the CP
The CP is supplied with total of 6 default MAC addresses with the following assignment:
●Gigabit interface
●PROFINET interface
●1 MAC address for each port of the PROFINET interface
The two MAC addresses of the PROFINET interface and the gigabit interface are printed on
the housing.The MAC address of the PROFINET interface is printed on the housing.

Preface
CP 443-1 Advanced (GX30)
6Manual, 03/2019, C79000-G8976-C256-05
If you configure a MAC address (ISO transport connections), we recommend that you use
the MAC address of the relevant interface printed on the module for module configuration!
●This ensures that you assign a unique MAC address in the subnet!
●If you replace a module, the MAC address of the predecessor is adopted when you load
the configuration data. Configured ISO transport connections remain operable.
License conditions
Note
Open source software
The product contains open source
software. Read the license conditions for open source
software carefully before using the product.
You will find license conditions in the following document on the supplied data medium:
●OSS_CP4431_99.pdf
Firmware
The firmware is signed and encrypted. This ensures that only firmware created by Siemens
can be downloaded to the device.
Security information
Siemens provides products and solutions with industrial security functions that support the
secure operation of plants, systems, machines and networks.
In order to protect plants, systems, machines and networks against cyber threats, it is
necessary to implement – and continuously maintain – a holistic, state-of-the-art industrial
security concept. Siemens’ products and solutions constitute one element of such a concept.
Customers are responsible for preventing unauthorized access to their plants, systems,
machines and networks. Such systems, machines and components should only be
connected to an enterprise network or the internet if and to the extent such a connection is
necessary and only when appropriate security measures (e.g. firewalls and/or network
segmentation) are in place.
For additional information on industrial security measures that may be implemented, please
visit
Link: (https://www.siemens.com/industrialsecurity)
Siemens’ products and solutions undergo continuous development to make them more
secure. Siemens strongly recommends that product updates are applied as soon as they are
available and that the latest product versions are used. Use of product versions that are no
longer supported, and failure to apply the latest updates may increase customers’ exposure
to cyber threats.
To stay informed about product updates, subscribe to the Siemens Industrial Security RSS
Feed under
Link: (https://www.siemens.com/industrialsecurity)

Preface
CP 443-1 Advanced (GX30)
Manual, 03/2019, C79000-G8976-C256-05 7
SIMATIC NET glossary
Explanations of many of the specialist terms used in this documentation can be found in the
SIMATIC NET glossary.
You will find the SIMATIC NET glossary on the Internet at the following address:
Link: (https://support.industry.siemens.com/cs/ww/en/view/50305045)
Training, Service & Support
You will find information on training, service and support in the multilanguage document
"DC_support_99.pdf" on the Internet pages of Siemens Industry Online Support:
Link: (https://support.industry.siemens.com/cs/ww/en/view/38652101)

Preface
CP 443-1 Advanced (GX30)
8Manual, 03/2019, C79000-G8976-C256-05

CP 443-1 Advanced (GX30)
Manual, 03/2019, C79000-G8976-C256-05 9
Table of contents
Preface ................................................................................................................................................... 3
1 Properties and services......................................................................................................................... 13
1.1 Properties of the CP................................................................................................................13
1.2 Enhanced functions ................................................................................................................14
1.3 Communication services.........................................................................................................16
1.4 Further services and characteristics of the CP.......................................................................18
2 Performance data ................................................................................................................................. 23
2.1 General characteristic data.....................................................................................................23
2.2 Characteristics of S7 communication .....................................................................................24
2.3 SEND/RECEIVE interface ......................................................................................................24
2.3.1 Characteristic data ..................................................................................................................24
2.3.2 Number of simultaneous SEND/RECEIVE calls.....................................................................26
2.4 Characteristics of open TCP/IP communication .....................................................................28
2.5 Characteristic data for PROFINET IO.....................................................................................28
2.6 Characteristic data for PROFINET CBA .................................................................................29
2.6.1 Typical values and limit values ...............................................................................................29
2.6.2 Cycle times .............................................................................................................................32
2.6.3 Reaction times ........................................................................................................................33
2.7 Characteristics of e-mail mode ...............................................................................................35
2.8 Characteristic data for FTP / FTPS mode...............................................................................36
2.9 Characteristic data of TCP connections for HTTP / HTTPS...................................................37
2.10 Characteristic data for the use of Java applets ......................................................................37
2.11 Memory organization in the CP 4431 Advanced ....................................................................38
2.12 Characteristic data of the integrated 4port switch ..................................................................39
3 Requirements for use............................................................................................................................ 41
3.1 Configuration limits .................................................................................................................41
3.2 System environment ...............................................................................................................41
3.3 Project engineering .................................................................................................................45
3.4 SOFTNET Security Client for VPN tunnels with PCs .............................................................46
3.5 Programming ..........................................................................................................................46
4 LEDs..................................................................................................................................................... 49
5 Installation and commissioning.............................................................................................................. 53
5.1 Important notes on using the device.......................................................................................53

Table of contents
CP 443-1 Advanced (GX30)
10 Manual, 03/2019, C79000-G8976-C256-05
5.1.1 Notices on use in hazardous areas........................................................................................ 53
5.1.2 Notices on use in hazardous areas according to ATEX / IECEx ........................................... 54
5.1.3 Notices on use in hazardous areas according to UL HazLoc................................................ 55
5.2 Installing and connecting up .................................................................................................. 56
5.3 Commissioning....................................................................................................................... 58
5.4 CPLUG (configuration plug)................................................................................................... 60
6 Configuration and operation .................................................................................................................. 63
6.1 Security recommendations .................................................................................................... 63
6.2 Controlling the mode.............................................................................................................. 67
6.3 Effects of protection levels ..................................................................................................... 67
6.4 Configuration in STEP 7 ........................................................................................................ 68
6.5 Interface configuration ........................................................................................................... 69
6.5.1 Network settings..................................................................................................................... 69
6.5.1.1 IP address assignment and communications path ................................................................ 69
6.5.1.2 Fast Ethernet with the PROFINET and gigabit interface ....................................................... 69
6.5.1.3 Transmission speed of the gigabit interface .......................................................................... 71
6.5.2 IP configuration and DHCP.................................................................................................... 72
6.5.2.1 S7 connections and DHCP .................................................................................................... 72
6.5.2.2 Address assignment via DHCP- gigabit interface.................................................................. 72
6.5.2.3 Restart after detection of a duplicate IP address in the network ........................................... 72
6.5.3 Unused PROFINET interface without BUS2F indicator......................................................... 73
6.5.4 Using the CP as an IP router ................................................................................................. 73
6.6 Port configuration with redundant partners............................................................................ 73
6.7 PROFINET IO mode .............................................................................................................. 74
6.7.1 How PROFINET IO devices start up in a large configuration................................................ 74
6.7.2 Reduce the communication allocation reserved for PROFINET IO when operating
alongside other services. ....................................................................................................... 74
6.7.3 Prioritized startup in PROFINET IO ....................................................................................... 74
6.7.4 IRT communication: Types of synchronization ...................................................................... 75
6.7.5 Operating PROFINET IO devices with a current firmware version........................................ 76
6.7.6 Shared device - using the router address.............................................................................. 76
6.8 Media redundancy ................................................................................................................. 77
6.9 Interface in the user program................................................................................................. 77
6.9.1 Call interface for open communications services SEND/RECV ............................................ 77
6.9.2 Programmed communication connections with IP_CONFIG................................................. 78
6.9.3 IP access protection with programmed communications connections .................................. 78
6.9.4 Programmed communications connections - assigning parameters to the ports.................. 79
6.9.5 Open TCP/IP communication ................................................................................................ 79
6.9.6 Recommendation for use with a high communications load ................................................. 80
6.10 Security .................................................................................................................................. 81
6.10.1 Using VPN - effects on communication ................................................................................. 81
6.10.2 Reloading firewall rules.......................................................................................................... 81
6.10.3 Activating IP access protection .............................................................................................. 82
6.10.4 Importing certificates for SMTP with STARTTLS or FTPS .................................................... 82
6.10.5 Security and STEP 7 special diagnostics activated - configuration activities blocked .......... 82

Table of contents
CP 443-1 Advanced (GX30)
Manual, 03/2019, C79000-G8976-C256-05 11
6.11 Time-of-day synchronization...................................................................................................83
6.12 SNMP......................................................................................................................................84
6.13 Ping: Permitted length of ICMP packets.................................................................................86
6.14 Use in the H system................................................................................................................86
6.15 Using the CP for PROFINET CBA..........................................................................................87
6.15.1 CBA interface in the user program .........................................................................................87
6.15.2 Preparing for configuration with STEP 7.................................................................................88
6.15.3 PROFINET CBA configuration with SIMATIC iMap................................................................89
6.15.4 Using PROFINET CBA communication and standard communication at the same time ......92
7 Diagnostics and upkeep ........................................................................................................................ 95
7.1 Online security diagnostics via port 443 .................................................................................95
7.2 Diagnostics options.................................................................................................................95
7.3 The CP as Web server............................................................................................................96
7.4 Replacing older modules: Module replacement / upgrading ..................................................97
7.5 Replacing older modules: CPs with configurable data management ...................................100
7.6 Replacing a module without a programming device.............................................................101
7.7 Loading new firmware...........................................................................................................103
7.8 Memory reset / reset to factory defaults ...............................................................................104
8 Technical specifications ...................................................................................................................... 109
9 Approvals............................................................................................................................................ 111
A Documentation references .................................................................................................................. 117
A.1 On configuring, commissioning and using the CP................................................................117
A.1.1 /1/ ..........................................................................................................................................117
A.1.2 /2/ ..........................................................................................................................................118
A.1.3 /3/ ..........................................................................................................................................118
A.1.4 /4/ ..........................................................................................................................................118
A.1.5 /5/ ..........................................................................................................................................118
A.1.6 /6/ ..........................................................................................................................................118
A.2 On installing and commissioning the CP ..............................................................................119
A.2.1 /7/ ..........................................................................................................................................119
A.3 For configuration with STEP 7 / NCM S7 .............................................................................119
A.3.1 /8/ ..........................................................................................................................................119
A.3.2 /9/ ..........................................................................................................................................119
A.3.3 /10/ ........................................................................................................................................119
A.3.4 /11/ ........................................................................................................................................120
A.4 On programming (blocks, OPC) ...........................................................................................120
A.4.1 /12/ ........................................................................................................................................120
A.4.2 /13/ ........................................................................................................................................120
A.4.3 /14/ ........................................................................................................................................120
A.4.4 /15/ ........................................................................................................................................121
A.4.5 /16/ ........................................................................................................................................121
A.5 Industrial Ethernet security ...................................................................................................121

Table of contents
CP 443-1 Advanced (GX30)
12 Manual, 03/2019, C79000-G8976-C256-05
A.5.1 /17/ ....................................................................................................................................... 121
A.5.2 /18/ ....................................................................................................................................... 121
A.6 For application and configuration of PROFINET IO............................................................. 122
A.6.1 /19/ ....................................................................................................................................... 122
A.6.2 /20/ ....................................................................................................................................... 122
A.7 On project engineering of PROFINET CBA......................................................................... 122
A.7.1 /21/ ....................................................................................................................................... 122
A.7.2 /22/ ....................................................................................................................................... 122
A.7.3 /23/ ....................................................................................................................................... 122
A.7.4 /24/ ....................................................................................................................................... 123
A.8 On setting up and operating an Industrial Ethernet network ............................................... 123
A.8.1 /25/ ....................................................................................................................................... 123
Index ...................................................................................................................................................125

CP 443-1 Advanced (GX30)
Manual, 03/2019, C79000-G8976-C256-05 13
Properties and services
1
1.1
Properties of the CP
Application
The CP is intended for use in an S7400 or S7400H (faulttolerant) automation system. It
allows the S7400 / S7400H to be connected to Industrial Ethernet.
Security Integrated
With a combination of different security measures such as firewall, NAT/NAPT routers and
VPN (Virtual Private Network) over IPsec tunnels, the CP protects individual S7-400 stations
or even entire automation cells from unauthorized access.
The CP has the following interfaces:
●PROFINET interface (Ethernet interface)
A 4-port switch with IRT capability and with autocrossing, autonegotiation and
autosensing is integrated in the CP. The 4-port switch allows the integration of the CP in
a bus or a ring with media redundancy.
Each port of the switch is designed for simple diagnostics and is equipped with a
combined RXD/TXD / LINK dual LED. For special situations, each port can also be set to
a fixed mode manually using STEP 7, for example 10 or 100 Mbps half duplex / full
duplex.
●Gigabit interface with security access
The CP also has an Ethernet interface complying with the gigabit standard IEEE 802.3ab.
This is independent of the PROFINET interface and supports autocrossing,
autonegotiation and autosensing. The gigabit interface can, for example, be used to
connect to a PG/PC or to a higherlevel company network.
The gigabit interface allows a secure connection to external networks via a firewall and
VPN. The CP provides the following protective function:
–Protection of the S7-400 station in which the CP is operated.
–Protection of the internal company networks connected to the PROFINET interface.
Each port can be disabled individually in the configuration.
Note
The following servic
es or characteristics are only available on the PROFINET interface:
•
PROFINET
•
Programmed communications connections (program block IP_CONFIG).

Properties and services
1.2 Enhanced functions
CP 443-1 Advanced (GX30)
14 Manual, 03/2019, C79000-G8976-C256-05
1.2
Enhanced functions
Compatibility with predecessor modules
The CP 443-1 Advanced (6GK7 443−1GX30−0XE0) with firmware version V3.2 supports all
functions of the following predecessor modules:
●6GK7 443−1GX30−0XE0, Firmware version V3.0 / V3.1
●6GK7 443−1GX20−0XE0, Firmware version V2.4 / V2.3 / V2.2 / V2.1 / V2.0 / V1.0
For information on replacing modules, read the section Replacing older modules: Module
replacement / upgrading (Page 97)
Functional expansions of the current firmware version V3.2
●Expansion of the block “FTP_CMD“ for FTP client operation with the addition of the
function “Passive FTP” (client establishes connection) in STEP 7 V5.5. You will find the
description in the manual /12/ (Page 120).
●Sending e-mails with STARTTLS, see Characteristics of e-mail mode (Page 35).
●Use of the CP as a purely diagnostics CP via the gigabit interface without networking the
PROFINET interface, see Diagnostics options (Page 95).
●Configuration of passive TCP connections between a CP and a redundant partner with
the identical number of the local port, see Port configuration with redundant partners
(Page 73).
●Expansion of the protection concept of the CP when a protection level of the CPU is
activated, see Effects of protection levels (Page 67).
Expanded functions of the older firmware versions V2.1 to V3.0
Functions
The following characteristics are new and can be used during configuration with STEP 7, see
section Project engineering (Page 45):
●Security functionality
●Advanced Web diagnostics; among other things with the following additional options:
–Update center for firmware download, updating of the IP access control list and
language settings
–Topology representation
–Diagnostics of S7 connections
–Status of the configured security functions
–Module identification

Properties and services
1.2 Enhanced functions
CP 443-1 Advanced (GX30)
Manual, 03/2019, C79000-G8976-C256-05 15
●PROFINET IO
–IRT with the option "high performance"
–Full PROFINET IO diagnostics on the gigabit interface
–Full PROFINET IO diagnostics on all interfaces also in the expansion rack
●Use in fault-tolerant systems (H systems) is also possible on the gigabit interface.
Expansions on the interface to the user program
●New program block AG_CNTEX for connection and system diagnostics with PING
functionality
●Expanded program block FTP_CMD for FTP services allows the establishment of secure
SSL connections.
Functional improvements
The overall communication speed of the CP during simultaneous operation of standard
communications functions and PROFINET IO controller mode was further improved.

Properties and services
1.3 Communication services
CP 443-1 Advanced (GX30)
16 Manual, 03/2019, C79000-G8976-C256-05
1.3
Communication services
The CP supports the following communication services:
●
PROFINET IO controller
PROFINET IO allows direct access to PROFINET IO devices over Industrial Ethernet.
PROFINET IO can only be used via the ports of the PROFINET interface.
–Prioritized startup
The CP supports prioritized startup. Per PROFINET IO controller, a maximum of 32
PROFINET IO devices can be configured that support prioritized startup. Of these 32
IO devices, simultaneous startup times with values as low as 0.5 s can be achieved by
up to 8 IO devices.
–IRT communication (Isochronous Real Time) with IRT option "high performance"
IRT communication with the IRT option "high-performance" is possible with
PROFINET IO. The IRT option "high-performance" optimizes data traffic as the result
of topology planning.
Note: IRT with the option "high flexibility" is now only supported when a CP GX20 is
replaced.
Note
IRT communication or MRP
If you are us
ing IRT communication, no media redundancy is supported.
–Shared device
As a PROFINET IO controller, individual submodules of an IO device can be assigned
to the CP. Read the information in /19/ (Page 122) regarding configuration of
PROFINET IO systems and shared IO devices.
●
PROFINET CBA
Use of a SIMATIC S7400 for Component based Automation on the basis of the
PROFINET standard of the PNO. This standard allows:
–Component technology in automation
–Communication between intelligent devices is configured graphically instead of
requiring laborious programming
–Vendor-independent, plantwide engineering
Note
PROFINET CBA versus security function
If yo
u use PROFINET CBA, you cannot enable the CP for the "Security" functionality.
●
S7 communication with the following functions:
–PG functions
–Operator monitoring and control functions
–Data exchange over S7 connections

Properties and services
1.3 Communication services
CP 443-1 Advanced (GX30)
Manual, 03/2019, C79000-G8976-C256-05 17
●
Open communication services with the following functions:
–SEND/RECEIVE interface over ISO transport connections
–SEND/RECEIVE interface over TCP connections, ISO-on-TCP and UDP connections
With the SEND/RECEIVE interface via TCP connections, the CP supports the socket
interface to TCP/IP available on practically every end system.
UDP frame buffering on the CP can be disabled during configuration. When
necessary, this allows you to achieve a shorter reaction time between the arrival of a
UDP frame and its evaluation on the CPU.
–Multicast over UDP connection
The multicast mode is made possible by selecting a suitable IP address when
configuring connections.
–FETCH/WRITE services (server services; corresponding to S5 protocol) via ISO
transport connections, ISO-on-TCP connections and TCP connections;
Here, the SIMATIC S7400 with the CP is always the server (passive connection
establishment) while the read or write access (client function with active connection
establishment) is always initiated by a SIMATIC S5 or a device from another range /
PC.
–LOCK/UNLOCK with FETCH/WRITE services (CPU-dependent; see section
Requirements for use (Page 41))
●
Open TCP/IP communication
Open TCP/IP communication provides a program interface for the transfer of connection-
oriented and connectionless services. The establishment and termination of connections
is initiated here only via the "dynamic" program interface.
STEP 7 provides a UDT for the connection description as well as four FBs for data
exchange.
The CP supports communication via ISO-on-TCP connections for this interface.
●
SIMATIC Safety - Fail-safe communication
The CP supports fail-safe communication via S7 connections. A fail-safe connection can
run from the local CPU via the CP to the relevant communications partner, for example
another F-CPU or a fail-safe distributed I/O system.
You do not need to configure any special safety relevant properties for the CP.
●
IT functions
–
HTTP
–Web server: Monitoring devices and process data (HTML process control)
–
FTP
FTP functions (File Transfer Protocol) for file management and access to data blocks
in the CPU (client and server functions)
–
E-mail
Sending e-mail via SMTP or ESMTP. The CP supports t SMTP-Auth for authentication
on an email server and STARTTLS.

Properties and services
1.4 Further services and characteristics of the CP
CP 443-1 Advanced (GX30)
18 Manual, 03/2019, C79000-G8976-C256-05
1.4
Further services and characteristics of the CP
●
Security functions
Depending on the configuration, the security functions of the CP provide protected
communication beyond network boundaries and within a network.
–
Protection concept beyond network boundaries - separation of the internal from the
external network
On its gigabit interface, the CP provides the option of secure access from an external
network connected here to the internal network (PROFINET interface).
With a combination of different security measures such as firewall, NAT/NAPT routers
and VPN (Virtual Private Network) over IPsec tunnels, the CP protects individual
devices or even entire automation cells from unauthorized access.
The CP allows this protection flexibly, without repercussions, protocol-independent (as
of Layer 2 according to IEEE 802.3).
The secure protocols HTTPS, FTPS, NTP (secure) and SNMPv3 can also be
activated.
–
Communication in the internal network (PROFINET interface)
If security is enabled, you now have the option of using the secure protocols HTTPS,
FTPS, NTP (secure) and SNMPv3 within the internal network.
Note: The switch function of the PROFINET interface integrated in the CP forwards
frames in the internal subnet regardless of the security setting of the CP.
–
SMTPS with STARTTLS
Support of SSL/TLS encryption for the secure transfer of e-mails
Note
UDP multicast
UDP multicast via a VPN channel is not supported.
You need to enable the security functions in the configuration.

Properties and services
1.4 Further services and characteristics of the CP
CP 443-1 Advanced (GX30)
Manual, 03/2019, C79000-G8976-C256-05 19
●
Media redundancy
Within an Ethernet network with a ring topology, the CP supports the media redundancy
protocol MRP. You can assign the role of redundancy manager to the CP.
●
Timeofday synchronization over Industrial Ethernet using the following configurable
modes:
–SIMATIC mode
The CP receives MMS timeofday messages and synchronizes its local time.
You can choose whether or not the time of day is forwarded. You can also decide on
the direction in which it is forwarded.
Synchronization using the SIMATIC mode is only possible on the PROFINET
interface.
or
–NTP mode (NTP: Network Time Protocol)
The CP sends timeofday queries at regular intervals to an NTP server and
synchronizes its local time of day.
The time can also be forwarded automatically to the CPU modules in the S7 station
allowing the time to be synchronized in the entire S7 station.
If security is enabled, the CP supports the NTP (secure) protocol for secure time-of-
day synchronization and transfer of the time of day.
●
Addressable with the factoryset MAC address
To assign the IP address to a new CP (direct from the factory), it can be accessed using
the preset MAC address on the interface being used. Online address assignment is made
in STEP 7.
●
SNMP agent
The CP supports data queries over SNMP in version V1 (Simple Network Management
Protocol). It delivers the content of certain MIB objects according to the MIB II standard,
LLDP MIB, Automation System MIB and MRP Monitoring MIB.
If security functions are enabled, the CP supports SNMPv3 for transfer of network
analysis information protected from eavesdropping.
●
Module access protection
To protect the module from accidental or unauthorized access, protection can be
configured at various levels.
For more information, refer to the section Effects of protection levels (Page 67).
●
IP access protection (IPACL)
Using IP access protection gives you the opportunity of restricting communication over
the CP of the local S7 station to partners with specific IP addresses.

Properties and services
1.4 Further services and characteristics of the CP
CP 443-1 Advanced (GX30)
20 Manual, 03/2019, C79000-G8976-C256-05
●
IP configuration
For the PROFINET interface and the gigabit interface, you can configure how and with
which method the CP is assigned the IP address, the subnet mask and the address of a
gateway.
For the PROFINET interface, the IP configuration and the connection configuration can
also be assigned to the CP by the user program (program block IP_CONFIG; see /12/
(Page 120)).
Note: Does not apply to S7 connections.
●
Web diagnostics
With the aid of Web diagnostics, you can read out the diagnostics data from a station
connected via the CP to a PG/PC with a Web browser. From the integrated Download
Center, you can download firmware updates.
The Web pages contain the following information:
–Module and status information
–Information on security functions
–Special information on S7 connections
●
Diagnostics buffer extract request
With the aid of a Web browser, the CP supports the option of obtaining an extract of the
diagnostics buffer containing the most recent diagnostics events of the CPUs and CPs
located in the same S7 station as the CP.
●
Connection diagnostics with the AG_CNTEX program block
With the AG_CNTEX program block, you can diagnose connections.
–When necessary, you can activate or deactivate connections or initiate
reestablishment of a connection.
–You can check the reachability of the connection partners using the PING function.
–You can find out which connection types are set up for the SEND / RECEIVE
interface.
●
S5/S7 addressing mode
The addressing mode can be configured for FETCH/WRITE access as the S7 or S5
addressing mode (S7 addressing mode only for data blocks / DBs).