Siemens SCALANCE W778-1 User manual

SCALANCE W778-1 / W738-1
SIMATIC NET
Industrial Wireless LAN
SCALANCE W778
-1 / W738-1
Operating Instructions
MSN65-W1-M12-E2
03/2022
C79000
-G8976-C450-07
Introduction
1
Safety notices
2
Security
recommendations
3
Description of the device
4
Installation and removal
5
Connection
6
Maintenance and cleaning
7
Upkeep and maintenance
8
Technical specifications
9
Dimension drawing
10
Approvals
11

Siemens AG
Digital Industries
Postfach 48 48
90026 NÜRNBERG
GERMANY
C79000-G8976-C450-07
Ⓟ
03/2022 Subject to change
Copyright © Siemens AG 2017 -
2022.
All rights reserved
Legal information
Warning notice system
This manual contains notices you have to observe in order to ensure your personal safety, as well as to
prevent damage to property. The notices referring to your personal safety are highlighted in the manual by a
safety alert symbol, notices referring only to property damage have no safety alert symbol. These notices
shown below are graded according to the degree of danger.
DANGER
indicates that death or severe personal injury will result if proper precautions are not taken.
WARNING
indicates that death or severe personal injury may result if proper precautions are not taken.
CAUTION
indicates that minor personal injury can result if proper precautions are not taken.
NOTICE
indicates that property damage can result if proper precautions are not taken.
If more than one degree of danger is present, the warning notice representing the highest degree of danger
will be used. A notice warning of injury to persons with a safety alert symbol may also include a warning
relating to property damage.
Qualified Personnel
The product/system described in this documentation may be operated only by personnel qualified for the
specific task in accordance with the relevant documentation, in particular its warning notices and safety
instructions. Qualified personnel are those who, based on their training and experience, are capable of
identifying risks and avoiding potential hazards when working with these products/systems.
Proper use of Siemens products
Note the following:
WARNING
Siemens products may only be used for the applications described in the catalog and in the relevant
technical documentation. If products and components from other manufacturers are used, these must be
recommended or approved by Siemens. Proper transport, storage, installation, assembly, commissioning,
operation and maintenance are required to ensure that the products operate safely and without any
problems. The permissible ambient conditions must be complied with. The information in the relevant
documentation must be observed.
Trademarks
All names identified by ® are registered trademarks of Siemens AG. The remaining trademarks in this
publication may be trademarks whose use by third parties for their own purposes could violate the rights of
the owner.
Disclaimer of Liability
We have reviewed the contents of this publication to ensure consistency with the hardware and software
described. Since variance cannot be precluded entirely, we cannot guarantee full consistency. However, the
information in this publication is reviewed regularly and any necessary corrections are included in
subsequent editions.

SCALANCE W778-1 / W738-1
Operating Instructions, 03/2022, C79000-G8976-C450-07 3
Table of contents
1 Introduction ............................................................................................................................................. 5
2 Safety notices.......................................................................................................................................... 9
3 Security recommendations .................................................................................................................. 11
4 Description of the device ..................................................................................................................... 19
4.1 Structure of the type designation............................................................................................... 19
4.2 Device view .................................................................................................................................... 20
4.3 Components of the product......................................................................................................... 21
4.4 Accessories .................................................................................................................................... 21
4.4.1 Installation...................................................................................................................................... 21
4.4.2 PLUG............................................................................................................................................... 22
4.4.3 Industrial Ethernet ........................................................................................................................ 22
4.4.4 Power supply ................................................................................................................................. 23
4.4.5 Flexible connecting cables, antennas and accessories.......................................................... 24
4.4.5.1 Flexible connecting cables .......................................................................................................... 24
4.4.5.2 Lightning protection...................................................................................................................... 25
4.4.5.3 Terminating resistor ..................................................................................................................... 25
4.4.5.4 Cabinet feedthrough..................................................................................................................... 25
4.4.5.5 Antennas......................................................................................................................................... 26
4.5 LED display .................................................................................................................................... 28
4.6 Reset button................................................................................................................................... 31
4.7 PLUG............................................................................................................................................... 34
5 Installation and removal....................................................................................................................... 37
5.1 Safety notices for installation ..................................................................................................... 37
5.2 Types of installation ..................................................................................................................... 40
5.3 Wall mounting................................................................................................................................ 41
5.4 Installation on a DIN rail .............................................................................................................. 42
5.4.1 Installation with the DIN rail mounting adapter....................................................................... 42
5.4.2 Mounting with bracket support................................................................................................... 45
6 Connection............................................................................................................................................. 49
6.1 Safety when connecting up ......................................................................................................... 49
6.2 Power supply ................................................................................................................................. 54
6.3 Ethernet .......................................................................................................................................... 56
6.4 Antenna connector........................................................................................................................ 57
6.5 Replacing the PLUG ..................................................................................................................... 58
6.6 Grounding ....................................................................................................................................... 60

Table of contents
SCALANCE W778-1 / W738-1
4Operating Instructions, 03/2022, C79000-G8976-C450-07
7 Maintenance and cleaning................................................................................................................... 61
8 Upkeep and maintenance .................................................................................................................... 63
8.1 Device configuration with PRESET-PLUG ................................................................................63
8.2 Restoring the factory settings .....................................................................................................65
8.3 Firmware update via WBM or CLI not possible........................................................................67
9 Technical specifications....................................................................................................................... 69
10 Dimension drawing ............................................................................................................................... 73
11 Approvals ............................................................................................................................................... 75
Index....................................................................................................................................................... 77

SCALANCE W778-1 / W738-1
Operating Instructions, 03/2022, C79000-G8976-C450-07 5
Introduction
1
Validity of the Operating Instructions
These operating instructions cover the following products:
Article number Article number
US version
Access points
SCALANCE W778-1 M12
6GK5778-1GY00-0AA0
6GK5778-1GY00-0AB0
SCALANCE W778-1 M12 EEC
6GK5778-1GY00-0TA0
6GK5778-1GY00-0TB0
Client module
SCALANCE W738-1 M12
6GK5738-1GY00-0AA0
6GK5738-1GY00-0AB0
These operating instructions apply to the following software version:
•SCALANCE W778/W738 with firmware as of version 6.5
Definition
An access point is a node in a WLAN that also performs administrative functions in the
network and, for example, provides client modules with a connection to wired networks,
to other client modules in the same wireless cell or in other wireless cells.
Purpose of the Operating Instructions
Based on the operating instructions, you will be able to install and connect up the
SCALANCE W778/W738 correctly. The configuration and the integration of the device in
a WLAN are not described in these instructions.
Documentation on the accompanying CD
You will find detailed information about configuration in the SCALANCE W700
configuration manuals on the accompanying SIMATIC NET IWLAN CD under the file
name:
PH_SCALANCE-W770-W730-WBM_76.pdf and PH_SCALANCE-W770-W730-
CLI_76.pdf
Note
Make sure that you
read the explanations and instructions in the readme.htm file

Introduction
SCALANCE W778-1 / W738-1
6Operating Instructions, 03/2022, C79000-G8976-C450-07
Documentation on the Internet
You can find the current version of the document on the Internet at
(https://support.industry.siemens.com/cs/de/en/ps/15859/man)
Enter the name or article number of the product in the search filter.
Documentation on configuration
You will find detailed information on configuring the devices in the following
configuration manuals:
•SCALANCE W770/W730 nach IEEE 802.11n Web Based Management
•SCALANCE W770/W730 nach IEEE 802.11n Command Line Interface
Note
Make sure that you read the
explanations and instructions in the readme.htm file.
Training, Service & Support
You will find information on Training, Service & Support in the multi-language document
"DC_support_99.pdf" on the data medium supplied with the documentation.
Security information
Siemens provides products and solutions with industrial security functions that support
the secure operation of plants, systems, machines and networks.
In order to protect plants, systems, machines and networks against cyber threats, it is
necessary to implement –and continuously maintain –a holistic, state-of-the-art
industrial security concept. Siemens’products and solutions constitute one element of
such a concept.
Customers are responsible for preventing unauthorized access to their plants, systems,
machines and networks. Such systems, machines and components should only be
connected to an enterprise network or the internet if and to the extent such a connection
is necessary and only when appropriate security measures (e.g. firewalls and/or network
segmentation) are in place.
For additional information on industrial security measures that may be implemented,
please visit
https://www.siemens.com/industrialsecurity
(https://www.siemens.com/industrialsecurity).
Siemens’products and solutions undergo continuous development to make them more
secure. Siemens strongly recommends that product updates are applied as soon as they
are available and that the latest product versions are used. Use of product versions that
are no longer supported, and failure to apply the latest updates may increase customer’s
exposure to cyber threats.
To stay informed about product updates, subscribe to the Siemens Industrial Security
RSS Feed under
https://www.siemens.com/cert (https://www.siemens.com/cert).

Introduction
SCALANCE W778-1 / W738-1
Operating Instructions, 03/2022, C79000-G8976-C450-07 7
Firmware
The firmware is signed and encrypted. This ensures that only firmware created by
Siemens can be downloaded to the device.
The firmware is available on the Internet pages of the Siemens Industry Online Support:
(https://support.industry.siemens.com/cs/de/en/ps/15860/dl)
Note on firmware/software support
Check regularly for new firmware/software versions or security updates and apply them.
After the release of a new version, previous versions are no longer supported and are not
maintained.
Device defective
If a fault develops, send the device to your SIEMENS representative for repair. Repairs
on-site are not possible.
Decommissioning
Shut down the device properly to prevent unauthorized persons from accessing
confidential data in the device memory.
To do this, restore the factory settings on the device.
Also restore the factory settings on the storage medium.
Recycling and disposal
The products are low in pollutants, can be recycled and meet the requirements of the
WEEE directive 2012/19/EU for the disposal of electrical and electronic equipment.
Do not dispose of the products at public disposal sites.
For environmentally friendly recycling and the disposal of your old device contact a
certified disposal company for electronic scrap or your Siemens contact (Product return
(https://support.industry.siemens.com/cs/ww/en/view/109479891)).
Note the different national regulations.
Trademarks
The following and possibly other names not identified by the registered trademark sign ®
are registered trademarks of Siemens AG:
SCALANCE, C-PLUG, RCoax

Introduction
SCALANCE W778-1 / W738-1
8Operating Instructions, 03/2022, C79000-G8976-C450-07

SCALANCE W778-1 / W738-1
Operating Instructions, 03/2022, C79000-G8976-C450-07 9
Safety notices
2
CAUTION
To prevent injury and damage, read the manual before using the device.
Read the safety notices
Note the following safety notices. These relate to the entire working life of the device.
You should also read the safety notices relating to handling in the individual sections,
particularly in the sections "Installation" and "Connecting up".
WARNING
Hot surfaces
Electric devices have hot surfaces. Do not touch these surfaces. They could cause
severe burns.
•Allow the device to cool down before starting any work on it.
WARNING
EXPLOSION HAZARD
Do not open the device when the supply voltage is turned on.

Safety notices
SCALANCE W778-1 / W738-1
10 Operating Instructions, 03/2022, C79000-G8976-C450-07

SCALANCE W778-1 / W738-1
Operating Instructions, 03/2022, C79000-G8976-C450-07 11
Security recommendations
3
To prevent unauthorized access to the device and/or network, observe the following
security recommendations.
General
•Check the device regularly to ensure that these recommendations and/or other
internal security policies are complied with.
•Evaluate the security of your location and use a cell protection concept with suitable
products (https://www.siemens.com/industrialsecurity).
•When the internal and external network are disconnected, an attacker cannot access
internal data from the outside. Therefore operate the device only within a protected
network area.
•No product liability will be accepted for operation in a non-secure infrastructure.
•Use VPN to encrypt and authenticate communication from and to the devices.
•For data transmission via a non-secure network, use an encrypted VPN tunnel (IPsec,
OpenVPN).
•Separate connections correctly (WBM, SSH etc.).
•Check the user documentation of other Siemens products that are used together with
the device for additional security recommendations.
•Using remote logging, ensure that the system protocols are forwarded to a central
logging server. Make sure that the server is within the protected network and check
the protocols regularly for potential security violations or vulnerabilities.
WLAN
•We recommend that you ensure redundant coverage for WLAN clients.
•More information on data security and data encryption for SCALANCE W is available
in SCALANCE W: Setup of a Wireless LAN in the Industrial Environment
(https://support.industry.siemens.com/cs/ww/en/view/22681042)
Authentication
Note
Accessibility risk
- Risk of data loss
Do not lose the passwords for the device. Access to the device can only be restored by
resetting the
device to factory settings which completely removes all configuration data.

Security recommendations
SCALANCE W778-1 / W738-1
12 Operating Instructions, 03/2022, C79000-G8976-C450-07
•Replace the default passwords for all user accounts, access modes and applications
(if applicable) before you use the device.
•Define rules for the assignment of passwords.
•Use passwords with a high password strength. Avoid weak passwords, (e.g.
password1, 123456789, abcdefgh) or recurring characters (e.g. abcabc).
This recommendation also applies to symmetrical passwords/keys configured on the
device.
•Make sure that passwords are protected and only disclosed to authorized personnel.
•Do not use the same passwords for multiple user names and systems.
•Store the passwords in a safe location (not online) to have them available if they are
lost.
•Regularly change your passwords to increase security.
•A password must be changed if it is known or suspected to be known by unauthorized
persons.
•When user authentication is performed via RADIUS, make sure that all
communication takes place within the security environment or is protected by a
secure channel.
•Watch out for link layer protocols that do not offer their own authentication between
endpoints, such as ARP or IPv4. An attacker could use vulnerabilities in these
protocols to attack hosts, switches and routers connected to your layer 2 network, for
example, through manipulation (poisoning) of the ARP caches of systems in the
subnet and subsequent interception of the data traffic. Appropriate security measures
must be taken for non-secure layer 2 protocols to prevent unauthorized access to the
network. Physical access to the local network can be secured or secure, higher layer
protocols can be used, among other things.
Certificates and keys
•There is a preset SSL/TLS (RSA) certificate with 2048 bit key length in the device.
Replace this certificate with a user-generated, high-quality certificate with key. Use a
certificate signed by a reliable external or internal certification authority. You can
install the certificate via the WBM ("System > Load and Save").
•Use certificates with a key length of 4096 bits.
•Use the certification authority including key revocation and management to sign the
certificates.
•Make sure that user-defined private keys are protected and inaccessible to
unauthorized persons.
•If there is a suspected security violation, change all certificates and keys immediately.
•Use password-protected certificates in the format "PKCS #12".

Security recommendations
SCALANCE W778-1 / W738-1
Operating Instructions, 03/2022, C79000-G8976-C450-07 13
•Verify certificates based on the fingerprint on the server and client side to prevent
"man in the middle" attacks. Use a second, secure transmission path for this.
•Before sending the device to Siemens for repair, replace the current certificates and
keys with temporary disposable certificates and keys, which can be destroyed when
the device is returned.
Physical/remote access
•Operate the devices only within a protected network area. Attackers cannot access
internal data from the outside when the internal and the external network are
separate from each other.
•Limit physical access to the device exclusively totrusted personnel.
The memory card orthe PLUG (C-PLUG, KEY-PLUG, CLP) contains sensitive data
such as certificates andkeys that can be read out and modified. An attacker with
control of the device's removable media could extract critical information such as
certificates, keys, etc. or reprogram the media.
•Lock unused physical ports on the device. Unused ports can be used to access the
system without authorization.
•For communication via non-secure networks, use additional devices with VPN
functionality to encrypt and authenticate communication.
•When you establish a secure connection to a server (for example for an upgrade),
make sure that strong encryption methods and protocols are configured for the
server.
•Terminate themanagement connections (e.g. HTTP, HTTPS, SSH) properly.
•Make sure that the device has been powered down completely before you
decommission it. For more information, refer to "Decommissioning (Page 7)".
•We recommend formatting a PLUG that is not being used.
Hardware / Software
•Use VLANs whenever possible asprotection against denial-of-service (DoS) attacks
and unauthorized access.
•Restrict access tothe device by setting firewall rules or rules in an access control list
(ACL).
•Selected services are enabled by default in the firmware. It is recommended toenable
only the services that are absolutely necessary for your installation.
For more information on available services, see "List of available services (Page 17)".
•Use the latest web browser version compatible with the product to ensure you are
using the most secure encryption methods available. Also, the latest web browser
versions ofMozilla Firefox, Google Chrome, and Microsoft Edge have 1/n-1 record
splitting enabled, which reduces the risk of attacks such asSSL/TLS Protocol
Initialization Vector Implementation Information Disclosure Vulnerability (for example,
BEAST).

Security recommendations
SCALANCE W778-1 / W738-1
14 Operating Instructions, 03/2022, C79000-G8976-C450-07
•Ensure that the latest firmware version is installed, including all security-related
patches.
You can find the latest information on security patches for Siemens products at the
Industrial Security (https://www.siemens.com/industrialsecurity)or ProductCERT
Security Advisories (https://www.siemens.com/cert) website.
For updates on Siemens product security advisories, subscribe to the RSS feed on the
ProductCERT Security Advisories website orfollow @ProductCert on Twitter.
•Enable only those services that are used on the device, including physical ports. Free
physical ports can potentially be used to gain access tothe network behind the
device.
•For optimal security, use SNMPv3 authentication and encryption mechanisms
whenever possible, and use strong passwords.
•Configuration files can be downloaded from the device. Ensure thatconfiguration files
are adequately protected. The options for achieving this include digitally signing and
encrypting the files, storing them in a secure location, or transmitting configuration
files only through secure communication channels.
Configuration files can be password protected during download. You enter passwords
on the WBM page "System >Load & Save > Passwords".
•When using SNMP (Simple Network Management Protocol):
–Configure SNMP to generate a notification when authentication errors occur. For
more information, see WBM "System > SNMP > Notifications".
–Ensure that the default community strings are changed tounique values.
–Use SNMPv3 whenever possible. SNMPv1 and SNMPv2c are considered non-
secure and should only be used when absolutely necessary.
–If possible, prevent write access above all.
•Use the security functions such asaddress translation with NAT (Network Address
Translation) or NAPT (Network Address Port Translation) to protect receiving ports
from access by third parties.
•Use WPA2/ WPA2-PSK with AES to protect the WLAN. You can find additional
information in the configuration manual Web Based Management "Security menu".

Security recommendations
SCALANCE W778-1 / W738-1
Operating Instructions, 03/2022, C79000-G8976-C450-07 15
Secure/ non-secure protocols
•Use secure protocols if access to the device is not prevented by physical protection
measures.
•Disable or restrict the use of non-secure protocols. While some protocols are secure
(e.g. HTTPS, SSH, 802.1X, etc.), others were not designed for the purpose of securing
applications (e.g. SNMPv1/v2c, RSTP, etc.).
Therefore, take appropriate security measures against non-secure protocols to
prevent unauthorized access to the device/network. Use non-secure protocols on the
device using a secure connection (e.g. SINEMA RC).
•If non-secure protocols and services are required, ensure that the device is operated
in a protected network area.
•Check whether use of the following protocols and services is necessary:
–Non-authenticated and unencrypted ports
–LLDP
–Syslog
–DHCP options 66/67
–TFTP
–Telnet
–HTTP
–SNMP v1/2c
–Syslog
–SNTP
•The following protocols provide secure alternatives:
–SNMPv1/v2c →SNMPv3
Check whether use of SNMPv1/v2c is necessary. SNMPv1/v2c is classified as
non-secure. Use the option of preventing write access. The product provides you
with suitable setting options.
If SNMP is enabled, change the community names. If no unrestricted access is
necessary, restrict access with SNMP.
Use SNMPv3 in conjunction with passwords.
–HTTP →HTTPS
–Telnet →SSH
–TFTP →SFTP
–Syslog Client →Syslog Client TLS
•Using a firewall, restrict the services and protocols available to the outside to a
minimum.
•For the DCP function, enable the "Read Only" mode after commissioning.

Security recommendations
SCALANCE W778-1 / W738-1
16 Operating Instructions, 03/2022, C79000-G8976-C450-07
List of available services
The following is a list of all available services and their ports through which the device
can be accessed.
The table includes the following columns:
•Service
The services that the device supports
•Default port status
This is the status of the port in the delivery state (factory setting).
•Configurable port/service
Indicates whether the port number or the service can be configured via WBM / CLI.
•Authentication
Specifies whether the communication partner is authenticated.
If optional, the authentication can be configured as required.
•Encryption
Specifies whether the transfer is encrypted.
If optional, the encryption can be configured as required.

Security recommendations
SCALANCE W778-1 / W738-1
Operating Instructions, 03/2022, C79000-G8976-C450-07 17
Service
Protocol / Port
number
Default port
status
Configurable
Authentication
Encryption
Port
Service
DHCP Client IPv4
UDP/68
Outgoing only
--
✓
--
--
DHCP Client IPv6
UDP/546
Outgoing only
--
✓
--
--
DHCP Server
UDP/67
Closed
--
✓
--
--
DNS Client
TCP/53
UDP/53
Outgoing only
--
✓
--
--
EthernetIP
TCP/44818
UDP/2222
UDP/44818
Closed
--
✓
--
--
HTTP
TCP/80
Open
✓
✓
✓
--
HTTPS
TCP/443
Open
✓
✓
✓
✓
NTP Client
UDP/123
Outgoing only
✓
✓
--
--
PROFINET
UDP/34964
UDP/49154
UDP/49155
Open
--
✓
--
--
RADIUS Client
UDP/1812
Outgoing only
✓
✓
✓
--
Remote Capture
TCP/2002
Closed
--
✓
--
--
SFTP Client
TCP/22
Closed
✓
✓
✓
✓
SMTP Client
TCP/25
Closed
✓
✓
--
--
SMTP Client (secure)
1)
TCP/465
Closed
✓
✓
✓
✓
SNMPv1/v2c
UDP/161
Open
✓
✓
--
--
SNMPv3
UDP/161
Open
✓
✓
Optional
Optional
SNMP Traps
UDP/162
Outgoing only
--
✓
--
--
SNTP Client
UDP/123
Outgoing only
✓
✓
--
--
SSH
TCP/22
Open
✓
✓
✓
✓
Syslog Client
UDP/514
Closed
✓
✓
--
--
Syslog (secure) Client
TCP/6514
Closed
✓
✓
--
✓
Telnet
TCP/23
Closed 1) /
Open 2)
✓
✓
✓
--
TFTP Client
UDP/69
Outgoing only
✓
✓
--
--
1) Only for SCALANCE W1700ac
2) Only for SCALANCE W700n

Security recommendations
SCALANCE W778-1 / W738-1
18 Operating Instructions, 03/2022, C79000-G8976-C450-07
The following is a list of all available Layer 2 services through which the device can be
accessed.
The table includes the following columns:
•Layer 2 service
The Layer 2 services that the device supports.
•Default status
The default status of the service (open or closed).
•Service configurable
Indicates whether the service can be configured via WBM / CLI.
Layer 2 service
Default
status
Service
configurable
DCP
Open
✓
LLDP
Open
✓
RSTP
Open
✓
iPRP
Open
✓
MSTP
Closed
✓
SIMATIC NET TIME
Closed
✓

SCALANCE W778-1 / W738-1
Operating Instructions, 03/2022, C79000-G8976-C450-07 19
Description of the device
4
4.1 Structure of the type designation
Structure of the type designation
The type designation of the device is made up of several parts that have the following
meaning:

Description of the device
4.2 Device view
SCALANCE W778-1 / W738-1
20 Operating Instructions, 03/2022, C79000-G8976-C450-07
4.2 Device view
①
LED display
②
Antenna connector R1A1
③
PLUG slot / Reset button
④
Antenna connector R1A2
⑤
Grounding
⑥
Connector for power supply
⑦
Ethernet connector P1
⑧
Ethernet connector P2 (PoE capability)