Siemens SIMATIC NET SCALANCE M874 User manual

SIMATIC NET
Industrial Remote Communication
Remote Networks
SCALANCE M874, M876
Operating Instructions
02/2023
C79000-G8976-C331-12
Preface
Safety notices 1
Security recommendations 2
Description of the device 3
Installation and removal 4
Connecting up 5
Maintenance and cleaning 6
Troubleshooting 7
Technical speci󹪝cations 8
Dimension drawings 9
Approvals 10

Legal information
Warning notice system
This manual contains notices you have to observe in order to ensure your personal safety, as well as to prevent
damage to property. The notices referring to your personal safety are highlighted in the manual by a safety alert
symbol, notices referring only to property damage have no safety alert symbol. These notices shown below are
graded according to the degree of danger.
DANGER
indicates that death or severe personal injury will result if proper precautions are not taken.
WARNING
indicates that death or severe personal injury may result if proper precautions are not taken.
CAUTION
indicates that minor personal injury can result if proper precautions are not taken.
NOTICE
indicates that property damage can result if proper precautions are not taken.
If more than one degree of danger is present, the warning notice representing the highest degree of danger will
be used. A notice warning of injury to persons with a safety alert symbol may also include a warning relating to
property damage.
Quali󹪝ed Personnel
The product/system described in this documentation may be operated only by personnel quali󹪝ed for the speci󹪝c
task in accordance with the relevant documentation, in particular its warning notices and safety instructions.
Quali󹪝ed personnel are those who, based on their training and experience, are capable of identifying risks and
avoiding potential hazards when working with these products/systems.
Proper use of Siemens products
Note the following:
WARNING
Siemens products may only be used for the applications described in the catalog and in the relevant technical
documentation. If products and components from other manufacturers are used, these must be recommended or
approved by Siemens. Proper transport, storage, installation, assembly, commissioning, operation and maintenance
are required to ensure that the products operate safely and without any problems. The permissible ambient
conditions must be complied with. The information in the relevant documentation must be observed.
Trademarks
All names identi󹪝ed by ® are registered trademarks of SiemensAG. The remaining trademarks in this publication
may be trademarks whose use by third parties for their own purposes could violate the rights of the owner.
Disclaimer of Liability
We have reviewed the contents of this publication to ensure consistency with the hardware and software
described. Since variance cannot be precluded entirely, we cannot guarantee full consistency. However, the
information in this publication is reviewed regularly and any necessary corrections are included in subsequent
editions.
Siemens AG
Digital Industries
Postfach 48 48
90026 NÜRNBERG
GERMANY
C79000-G8976-C331-12
Ⓟ 03/2023 Subject to change
Copyright © SiemensAG 2013 - 2023.
All rights reserved

Preface
Purpose of the operating instructions
These operating instructions contain information with which you can install and connect the
SCALANCE device correctly. The con󹪝guration and the integration of the device in a network are
not described in these instructions.
Scope of validity
These operating instructions cover the following products:
Product Description Article numbers
SCALANCE M874-2 Mobile wireless router for 2G (GPRS/EDGE) 6GK5874-2AA00-2AA2
SCALANCE M874-3 Mobile wireless router for 3G (HSPA+) 6GK5874-3AA00-2AA2
SCALANCE M876-3

Mobile wireless router for 3G (HSPA+) with
antenna diversity

6GK5876-3AA02-2BA2
6GK5876-3AA02-2EA2 (ROK)
SCALANCE M876-4 Mobile wireless router for 4G (LTE) with
antenna diversity
6GK5876-4AA00-2BA2 (EU)
6GK5876-4AA00-2DA2 (NAM)
Mobile wireless router for 4G (LTE) opti‐
mized for worldwide use
6GK5876-4AA10-2BA2
These operating instructions apply to the following 󹪝rmware version:
• SCALANCE M-800/S615 version 7.2 or later
Designations used
Classi󹪝cation Description Terms used
Product line For all devices and variants of all product
groups within the SCALANCE M-800 prod‐
uct line, the term M-800 is used.
M-800
Product group For all devices and variants of a product
group, only the product group is used.
M874 stands for M874-2 and
M874-3
M876 stands for M876-3 and
M876-4
M87x stands for M874-2, M874-3,
M876-3 and M876-4
Device For a device, only the device name is used. M874-2
M874-3
M876-3
M876-4
SCALANCE M874, M876
Operating Instructions, 02/2023, C79000-G8976-C331-12 3

You will 󹪝nd the article numbers for the Siemens products of relevance here in the following
catalogs:
• SIMATIC NET Industrial Communication / Industrial Identi󹪝cation, catalog IKPI
• SIMATIC Products for Totally Integrated Automation and Micro Automation, catalog ST70
• Industry Mall - catalog and ordering system for automation and drive technology, Online
catalog (https://mall.industry.siemens.com)
You can request the catalogs and additional information from your Siemens representative.
Supplementary documentation
Documentation on the Internet
You can 󹪝nd the current version of the document on the Internet at. (https://
support.industry.siemens.com/cs/ww/en/ps/15987/man)
Enter the name or article number of the product in the search 󹪝lter.
Documentation on con󹪝guration
You will 󹪝nd detailed information on con󹪝guring the devices in the following con󹪝guration
manuals:
• SCALANCE M-800 Web Based Management
• SCALANCE M-800 Command Line Interface
Note
Make sure that you read the explanations and instructions in the readme.htm 󹪝le.
Preface
SCALANCE M874, M876
4Operating Instructions, 02/2023, C79000-G8976-C331-12

Further documentation
• System manual "Industrial Ethernet"
The system manual contains information on other SIMATIC NET products that you can
operate along with the devices of this product line in an Industrial Ethernet network.
There, you will 󹪝nd among other things optical performance data of the communications
partner that you require for the installation.
The "SIMATIC NET Industrial Ethernet" system manual can be found on the Internet pages of
Siemens Industry Online Support under the following entry ID: 27069465 (https://
support.industry.siemens.com/cs/ww/en/view/27069465)
• "Passive network components" system manual
This system manual contains installation instructions for several of the most common
components and guidelines for setting up networked automation plants in buildings.
The "Passive network components" system manual can be found on the Internet pages of
Siemens Industry Online Support under the following entry ID: 84922825 (https://
support.industry.siemens.com/cs/ww/en/view/84922825)
SIMATIC NET manuals
You will 󹪝nd SIMATIC NET manuals on the Internet pages of Siemens Industry Online Support:
• using the search function:
Link to Siemens Industry Online Support (https://support.industry.siemens.com/cs/ww/en/)
Enter the entry ID of the relevant manual as the search item.
• In the navigation panel on the left hand side in the area "Industrial Communication":
Link to the area "Industrial Communication" (https://
support.industry.siemens.com/cs/ww/en/ps/15247/pm)
Go to the required product group and make the following settings:
tab "Entry list", Entry type "Manuals"
You will 󹪝nd the documentation for the SIMATIC NET products relevant here on the data
medium that ships with some products:
• Product CD / product DVD
• SIMATIC NET Manual Collection
Security information
Siemens provides products and solutions with industrial security functions that support the
secure operation of plants, systems, machines and networks.
In order to protect plants, systems, machines and networks against cyber threats, it is
necessary to implement – and continuously maintain – a holistic, state-of-the-art industrial
security concept. Siemens’ products and solutions constitute one element of such a concept.
Customers are responsible for preventing unauthorized access to their plants, systems,
machines and networks. Such systems, machines and components should only be connected
to an enterprise network or the internet if and to the extent such a connection is necessary
and only when appropriate security measures (e.g. 󹪝rewalls and/or network segmentation)
are in place.
Preface
SCALANCE M874, M876
Operating Instructions, 02/2023, C79000-G8976-C331-12 5

For additional information on industrial security measures that may be implemented, please
visit
https://www.siemens.com/industrialsecurity (https://www.siemens.com/industrialsecurity).
Siemens’ products and solutions undergo continuous development to make them more
secure. Siemens strongly recommends that product updates are applied as soon as they are
available and that the latest product versions are used. Use of product versions that are no
longer supported, and failure to apply the latest updates may increase customer’s exposure
to cyber threats.
To stay informed about product updates, subscribe to the Siemens Industrial Security RSS
Feed under
https://www.siemens.com/cert (https://www.siemens.com/cert).
Firmware
The 󹪝rmware is available on the Internet pages of the Siemens Industry Online Support (https://
support.industry.siemens.com/cs/ww/en/ps/15982/dl):
Note on 󹪝rmware/software support
Check regularly for new 󹪝rmware/software versions or security updates and apply them. After
the release of a new version, previous versions are no longer supported and are not maintained.
Error/fault
If a fault develops, send the device to your SIEMENS representative for repair. Repairs on-site are
not permitted.
Decommissioning
Shut down the device properly to prevent unauthorized persons from accessing con󹪝dential
data in the device memory.
To do this, restore the factory settings on the device.
Also restore the factory settings on the storage medium.
Recycling and disposal
The products are low in pollutants, can be recycled and meet the requirements of the WEEE
directive 2012/19/EU for the disposal of electrical and electronic equipment.
Do not dispose of the products at public disposal sites.
For environmentally friendly recycling and the disposal of your old device contact a certi󹪝ed
disposal company for electronic scrap or your Siemens contact (Product return (https://
support.industry.siemens.com/cs/ww/en/view/109479891)).
Note the di󹪜erent national regulations.
Preface
SCALANCE M874, M876
6Operating Instructions, 02/2023, C79000-G8976-C331-12

Trademarks
The following and possibly other names not identi󹪝ed by the registered trademark sign ® are
registered trademarks of Siemens AG:
SCALANCE, SINEMA, KEY-PLUG, C-PLUG
Open source license conditions
Note
Open source software
Read the license conditions for open source software carefully before using the product.
You will 󹪝nd license conditions in the following documents on the supplied data medium:
• OSS_Scalance-M-800-S615_86.pdf
SIMATIC NET glossary
The SIMATICNET glossary describes terms that may be used in this document.
You will 󹪝nd the SIMATIC NET glossary in the Siemens Industry Online Support at the
following address:
50305045 (https://support.industry.siemens.com/cs/ww/en/view/50305045)
Preface
SCALANCE M874, M876
Operating Instructions, 02/2023, C79000-G8976-C331-12 7

Preface
SCALANCE M874, M876
8Operating Instructions, 02/2023, C79000-G8976-C331-12

Table of contents
Preface ................................................................................................................................................... 3
1 Safety notices ...................................................................................................................................... 13
2 Security recommendations.................................................................................................................. 15
2.1 Security recommendations................................................................................................. 15
2.2 Available services............................................................................................................... 19
3 Description of the device..................................................................................................................... 23
3.1 Product characteristics ....................................................................................................... 23
3.2 Device views...................................................................................................................... 24
3.2.1 SCALANCE M874 ............................................................................................................... 24
3.2.2 SCALANCE M876 ............................................................................................................... 25
3.3 Scope of delivery ............................................................................................................... 25
3.4 Accessories........................................................................................................................ 26
3.4.1 Installation ........................................................................................................................ 27
3.4.2 PLUG ................................................................................................................................. 27
3.4.3 Flexible connecting cables, antennas and accessories ......................................................... 27
3.4.3.1 Flexible connecting cables ................................................................................................. 27
3.4.3.2 Antennas........................................................................................................................... 28
3.4.3.3 Accessories........................................................................................................................ 29
3.5 Terminals........................................................................................................................... 30
3.6 LED display ........................................................................................................................ 31
3.6.1 SCALANCE M874 ............................................................................................................... 31
3.6.2 SCALANCE M876 ............................................................................................................... 34
3.7 SET button......................................................................................................................... 37
3.8 PLUG ................................................................................................................................. 38
4 Installation and removal...................................................................................................................... 41
4.1 Safety notices for installation ............................................................................................. 41
4.2 Securing the housing......................................................................................................... 44
4.3 Wall mounting ................................................................................................................... 45
4.4 Installation on the DIN rail.................................................................................................. 46
4.5 Installing on the S7-300 standard rail ................................................................................. 47
4.6 Installing on the S7-1500 standard rail ............................................................................... 48
4.7 Installation in a 19" mounting frame .................................................................................. 49
4.8 Installation on a desktop pedestal ...................................................................................... 51
SCALANCE M874, M876
Operating Instructions, 02/2023, C79000-G8976-C331-12 9

5 Connecting up ..................................................................................................................................... 53
5.1 Safety when connecting up................................................................................................ 53
5.2 Power supply ..................................................................................................................... 59
5.3 Grounding ......................................................................................................................... 60
5.4 Digital input/output ........................................................................................................... 61
5.5 Antennas........................................................................................................................... 63
5.6 Ethernet port..................................................................................................................... 66
5.7 SIM card ............................................................................................................................ 67
5.8 Replacing the PLUG............................................................................................................ 68
6 Maintenance and cleaning .................................................................................................................. 71
7 Troubleshooting................................................................................................................................... 73
7.1 Downloading new 󹪝rmware using TFTP without WBM and CLI............................................. 73
7.2 Restoring the factory settings............................................................................................. 74
8 Technical speci󹪝cations ....................................................................................................................... 75
8.1 SCALANCE M874-2 ............................................................................................................ 75
8.2 SCALANCE M874-3 ............................................................................................................ 78
8.3 SCALANCE M876-3 ............................................................................................................ 82
8.4 SCALANCE M876-4 (EU)..................................................................................................... 86
8.5 SCALANCE M876-4 (NAM) ................................................................................................. 90
8.6 SCALANCE M876-4 ............................................................................................................ 94
8.7 Antenna gain..................................................................................................................... 98
9 Dimension drawings.......................................................................................................................... 101
9.1 SCALANCE M874 ............................................................................................................ 102
9.2 SCALANCE M876 ............................................................................................................. 104
9.3 19" installation frame....................................................................................................... 106
10 Approvals........................................................................................................................................... 107
10.1 EC declaration of conformity............................................................................................ 108
10.1.1 ATEX................................................................................................................................ 109
10.1.2 RoHS ............................................................................................................................... 109
10.1.3 RED ................................................................................................................................. 110
10.1.3.1 Protection of health and safety......................................................................................... 110
10.1.3.2 EMC................................................................................................................................. 110
10.1.3.3 E󹪟cient use of the radio spectrum ................................................................................... 111
10.1.4 Other technical standards ................................................................................................ 112
10.1.5 Products .......................................................................................................................... 112
10.2 UK Declaration of Conformity........................................................................................... 112
10.2.1 The Equipment and Protective Systems Intended for use in Potentially Explosive
Atmospheres Regulations 2016........................................................................................ 113
Table of contents
SCALANCE M874, M876
10 Operating Instructions, 02/2023, C79000-G8976-C331-12

10.2.2 The Restriction of the Use of Certain Hazardous Substances in Electrical and Electronic
Equipment Regulations 2012 ........................................................................................... 113
10.2.3 Radio Equipment Regulations 2017.................................................................................. 114
10.2.3.1 Protection of health and safety......................................................................................... 114
10.2.3.2 EMC................................................................................................................................. 114
10.2.3.3 E󹪟cient use of the radio spectrum ................................................................................... 115
10.2.4 Other technical standards ................................................................................................ 115
10.2.5 Products .......................................................................................................................... 116
10.3 Supplier’s declaration of conformity ................................................................................. 116
10.4 General approvals ........................................................................................................... 117
Index .................................................................................................................................................. 123
Table of contents
SCALANCE M874, M876
Operating Instructions, 02/2023, C79000-G8976-C331-12 11

Table of contents
SCALANCE M874, M876
12 Operating Instructions, 02/2023, C79000-G8976-C331-12

Safety notices 1
CAUTION
To prevent injury and damage, read the manual before using the device.
Read the safety notices
Note the following safety notices. These relate to the entire working life of the device.
You should also read the safety notices relating to handling in the individual sections,
particularly in the sections "Installation" and "Connecting up".
WARNING
Hot surfaces
Electric devices have hot surfaces. Do not touch these surfaces. They could cause severe burns.
• Allow the device to cool down before starting any work on it.
WARNING
EXPLOSION HAZARD
Do not open the device when the supply voltage is turned on.
SCALANCE M874, M876
Operating Instructions, 02/2023, C79000-G8976-C331-12 13

Safety notices
SCALANCE M874, M876
14 Operating Instructions, 02/2023, C79000-G8976-C331-12

Security recommendations 2
2.1 Security recommendations
To prevent unauthorized access to the device and/or network, observe the following security
recommendations.
Note
Note that GPS signals can be obfuscated or blocked by malicious third-party devices.
General
• Check the device regularly to ensure that these recommendations and/or other internal
security policies are complied with.
• Evaluate the security of your location and use a cell protection concept with suitable
products. For more information, refer to:
Link: (https://www.siemens.com/industrialsecurity)
• When the internal and external network are disconnected, an attacker cannot access internal
data from the outside. If possible, operate the device only within a protected network area.
• Use VPN to encrypt and authenticate communication from and to the devices.
• For data transmission via a non-secure network, use an encrypted VPN tunnel (IPsec,
OpenVPN).
• Check the user documentation of other Siemens products that are used together with the
device for additional security recommendations.
• Using remote logging, ensure that the system protocols are forwarded to a central logging
server. Make sure that the server is within the protected network and check the protocols
regularly for potential security violations or vulnerabilities.
Authentication
Note
Accessibility risk - Risk of data loss
Do not lose the passwords for the device. Access to the device can only be restored by resetting
the device to factory settings which completely removes all con󹪝guration data.
• Replace the default passwords for all user accounts, access modes and applications (if
applicable) before you use the device.
•De󹪝ne rules for the assignment of passwords.
SCALANCE M874, M876
Operating Instructions, 02/2023, C79000-G8976-C331-12 15

• Use passwords with a high password strength. Avoid weak passwords, (e.g. password1,
123456789, abcdefgh) or recurring characters (e.g. abcabc).
This recommendation also applies to symmetrical passwords/keys con󹪝gured on the device.
• Make sure that passwords are protected and only disclosed to authorized personnel.
• Do not use the same passwords for multiple user names and systems.
• Store the passwords in a safe location (not online) to have them available if they are lost.
• Regularly change your passwords to increase security.
• A password must be changed if it is known or suspected to be known by unauthorized
persons.
• When user authentication is performed via RADIUS, make sure that all communication takes
place within the security environment or is protected by a secure channel.
• Watch out for link layer protocols that do not o󹪜er their own authentication between
endpoints, such as ARP or IPv4. An attacker could use vulnerabilities in these protocols to
attack hosts, switches and routers connected to your layer 2 network, for example, through
manipulation (poisoning) of the ARP caches of systems in the subnet and subsequent
interception of the data tra󹪟c. Appropriate security measures must be taken for non-secure
layer 2 protocols to prevent unauthorized access to the network. Physical access to the local
network can be secured or secure, higher layer protocols can be used, among other things.
Certi󹪝cates and keys
• There is a pre-installed Web server certi󹪝cate (RSA, 2048 bit key length) and an SSH Private
Key in the device. Replace this certi󹪝cate with a user-generated, high-quality certi󹪝cate with
key. Use a certi󹪝cate signed by a reliable external or internal certi󹪝cation authority. You can
install the certi󹪝cate in the WBM via "System > Load and Save".
• Use the certi󹪝cation authority including key revocation and management to sign the
certi󹪝cates.
• Use password-protected certi󹪝cates in the format "PKCS #12".
• Use certi󹪝cates with a key length of 4096 bits.
• Make sure that user-de󹪝ned private keys are protected and inaccessible to unauthorized
persons.
• If there is a suspected security violation, change all certi󹪝cates and keys immediately.
• SSH and SSL keys are available for admin users. Make sure that you take appropriate security
measures when shipping the device outside of the trusted environment:
– Replace the SSH and SSL keys with disposable keys prior to shipping.
– Decommission the existing SSH and SSL keys. Create and program new keys when the
device is returned.
• Verify certi󹪝cates based on the 󹪝ngerprint on the server and client side to prevent "man in the
middle" attacks. Use a second, secure transmission path for this.
• Before sending the device to Siemens for repair, replace the current certi󹪝cates and keys with
temporary disposable certi󹪝cates and keys, which can be destroyed when the device is
returned.
Security recommendations
2.1Security recommendations
SCALANCE M874, M876
16 Operating Instructions, 02/2023, C79000-G8976-C331-12

Physical/remote access
• If possible, operate the devices only within a protected network area. Attackers cannot access
internal data from the outside when the internal and the external network are separate from
each other.
• Limit physical access to the device exclusively to trusted personnel.
The memory card or the PLUG (C-PLUG, KEY-PLUG, CLP) contains sensitive data such as
certi󹪝cates and keys that can be read out and modi󹪝ed. An attacker with control of the
device's removable media could extract critical information such as certi󹪝cates, keys, etc. or
reprogram the media.
• Lock unused physical ports on the device. Unused ports can be used to gain forbidden access
to the plant.
• We highly recommend that you keep the protection from brute force attacks (BFA) activated
to prevent third parties from gaining access to the device. For more information, see the
con󹪝guration manuals, section "Brute Force Prevention".
• If possible, use the VPN functionality to encrypt and authenticate communication for
communication via non-secure networks.
• When you establish a secure connection to a server (for example for an upgrade), make sure
that strong encryption methods and protocols are con󹪝gured for the server.
• Terminate the management connections (e.g. HTTPS, SSH) properly.
• Make sure that the device has been powered down completely before you decommission it.
For more information, refer to "Decommissioning (Page6)".
• We recommend formatting a PLUG that is not being used.
Hardware / Software
• Use VLANs whenever possible as protection against denial-of-service (DoS) attacks and
unauthorized access.
• Restrict access to the device by setting 󹪝rewall rules or rules in an access control list (ACL).
• Selected services are enabled by default in the 󹪝rmware. It is recommended to enable only
the services that are absolutely necessary for your installation.
For more information on available services, see "List of available services (Page19)".
• To ensure you are using the most secure encryption methods available, use the latest web
browser version compatible with the product. Also, the latest web browser versions of
Mozilla Firefox, Google Chrome, and Microsoft Edge have 1/n-1 record splitting enabled,
which reduces the risk of attacks such as SSL/TLS Protocol Initialization Vector
Implementation Information Disclosure Vulnerability (for example, BEAST).
• Ensure that the latest 󹪝rmware version is installed, including all security-related patches.
You can 󹪝nd the latest information on security patches for Siemens products at the Industrial
Security (https://www.siemens.com/industrialsecurity) or ProductCERT Security Advisories
(https://www.siemens.com/cert/en/cert-security-advisories.htm) website.
For updates on Siemens product security advisories, subscribe to the RSS feed on the
ProductCERT Security Advisories website or follow @ProductCert on Twitter.
• Enable only those services that are used on the device, including physical ports. Free physical
ports can potentially be used to gain access to the network behind the device.
Security recommendations
2.1Security recommendations
SCALANCE M874, M876
Operating Instructions, 02/2023, C79000-G8976-C331-12 17

• Use the authentication and encryption mechanisms of SNMPv3 if possible. Use strong
passwords.
•Con󹪝guration 󹪝les can be downloaded from the device. Ensure that con󹪝guration 󹪝les are
adequately protected.
Con󹪝guration 󹪝les can be password protected during download. You enter passwords on the
WBM page "System > Load & Save > Passwords".
• When using SNMP (Simple Network Management Protocol):
–Con󹪝gure SNMP to generate a noti󹪝cation when authentication errors occur.
For more information, see WBM "System > SNMP > Noti󹪝cations".
– Ensure that the default community strings are changed to unique values.
– Use SNMPv3 whenever possible. SNMPv1 and SNMPv2c are considered non-secure and
should only be used when absolutely necessary.
– If possible, prevent write access.
Secure/ non-secure protocols
• Use secure protocols if access to the device is not prevented by physical protection measures.
• Restrict the use of non-secure protocols. While some protocols are secure (e.g. HTTPS, SSH,
802.1X, etc.), others were not designed for the purpose of securing applications (e.g.
SNMPv1/v2c, RSTP, etc.).
Therefore, take appropriate security measures against non-secure protocols to prevent
unauthorized access to the device/network. Use non-secure protocols on the device using a
secure connection (e.g. SINEMA RC).
• If non-secure protocols and services are required, ensure that the device is operated in a
protected network area.
• Check whether use of the following protocols is necessary:
– Telnet
– HTTP
– Broadcast pings
– Non authenticated and unencrypted interfaces
– ICMP (redirect)
– LLDP
– DHCP Options 66/67
– SNTP
– NTP
– TFTP
– TIA Portal Cloud Connector (not available with SCALANCE MUM85x)
– VRRPv3
– DNS
– SNMPv1/V2c
Security recommendations
2.1Security recommendations
SCALANCE M874, M876
18 Operating Instructions, 02/2023, C79000-G8976-C331-12

• If a secure alternative is available for a protocol, use it.
The following protocols provide secure alternatives:
– SNMPv1/v2 → SNMPv3
Check whether use of SNMPv1 is necessary. SNMPv1 is classi󹪝ed as non-secure. Use the
option of preventing write access. The product provides you with suitable setting options.
If SNMP is enabled, change the community names. If no unrestricted access is necessary,
restrict access with SNMP.
– HTTP → HTTPS
– Telnet → SSH
– NTP → Secure NTP
– TFTP → SFTP
– TIA Portal Cloud Connector using a secure connection. Use the "TIA Portal Cloud
Connector" integrated in the product over a VPN solution (e.g. SINEMA RC).
Con󹪝gure the 󹪝rewall settings of the SCALANCE M800/S615 (e.g. prede󹪝ned IPv4 rules
"Cloud Connector" to prevent unauthorized access of network devices to the "TIA Portal
Cloud Connector Server").
• Using a 󹪝rewall, restrict the services and protocols available to the outside to a minimum.
• For the DCP function, enable the "Read Only" mode after commissioning.
2.2 Available services
List of available services
The following is a list of all available protocols and services as well as their ports through which
the device can be accessed.
The table includes the following columns:
•Service
The services that the device supports.
•Protocol / Port number
Port number assigned to the protocol.
•Default port status
The port status on delivery (factory setting) distinguishes between local and external access.
– Local access: The port is accessed via a local connection (vlan1).
– External access: The port is accessed via an external connection (vlan2).
•Con󹪝gurable port/service
Indicates whether the port number or the service can be con󹪝gured via WBM / CLI.
•Authentication
Speci󹪝es whether an authentication of the communication partner takes place or whether
an authentication can be con󹪝gured.
•Encryption
Speci󹪝es whether the transfer is encrypted or whether the encryption can be con󹪝gured.
Security recommendations
2.2Available services
SCALANCE M874, M876
Operating Instructions, 02/2023, C79000-G8976-C331-12 19

Service Protocol/
Port number
Default port status Con󹪝gurable Authenti‐
cation
Encryp‐
tion 2)
Local access External ac‐
cess 1)
Port Serv‐
ice
DHCPv4 Cli‐
ent
UDP/68 Closed 3) Closed -- ✓ -- --
DHCPv6 Cli‐
ent
TCP/546
UDP/546
Open Open -- -- -- --
DHCPv4-
Server
UDP/67 Closed Closed 4) -- ✓ -- --
DNS Client TCP/53
UDP/53
Outgoing only Outgoing on‐
ly
-- ✓ -- --
DNS Server TCP/53
UDP/53
Open 5) Closed -- ✓ -- --
DynDNS TCP/80
UDP/80
TCP/443
UDP/443
Outgoing only Outgoing on‐
ly
-- ✓ ✓ --
HTTP TCP/80 Open Closed ✓ ✓ ✓ --
HTTP Proxy TCP/3128
TCP/8080
Outgoing only Outgoing on‐
ly
✓ ✓ Optional --
HTTPS WBM
Server/Client
TCP/443 Open Closed ✓ ✓ ✓ ✓
IPsec/IKE UDP/500
UDP/4500
Closed Closed -- ✓ ✓ ✓
NTP Client UDP/123 Outgoing only Outgoing on‐
ly
✓ ✓ -- --
NTP Client
(secure)
UDP/123 Outgoing only Outgoing on‐
ly
✓ ✓ ✓ --
NTP Server UDP/123 Closed Closed ✓ ✓ -- --
NTP Server
(secure)
UDP/123 Closed Closed ✓ ✓ ✓ --
OpenVPN UDP/1194
TCP/1194
Outgoing only Outgoing on‐
ly
✓ ✓ ✓ ✓
Ping ICMP Open Closed -- ✓ -- --
PROFINET UDP/34964
UDP/49154
UDP/49155
Open Closed -- ✓ -- --
RADIUS Cli‐
ent
UDP/1812 Closed Closed ✓ ✓ ✓ Optional
UDP/1813 --
SFTP Server TCP/22 Outgoing only Outgoing on‐
ly
✓ ✓ ✓ ✓
Siemens Re‐
mote Serv‐
ice (cRSP/
SRS)
TCP/443 Outgoing only Outgoing on‐
ly
-- ✓ Optional ✓
Security recommendations
2.2Available services
SCALANCE M874, M876
20 Operating Instructions, 02/2023, C79000-G8976-C331-12