Siemens SIMATIC NET SCALANCE MUM856-1 User manual

SIMATIC NET
Industrial Remote Communication -
Remote Networks
SCALANCE MUM856-1
Operating Instructions
02/2023
C79000-G8976-C628-05
Preface
Safety notices 1
Security recommendations 2
Description of the device 3
Assembly and disassembly 4
Connecting up 5
Maintenance and cleaning 6
Troubleshooting 7
Technical speci󹪝cations 8
Dimension drawings 9
Approvals 10

Legal information
Warning notice system
This manual contains notices you have to observe in order to ensure your personal safety, as well as to prevent
damage to property. The notices referring to your personal safety are highlighted in the manual by a safety alert
symbol, notices referring only to property damage have no safety alert symbol. These notices shown below are
graded according to the degree of danger.
DANGER
indicates that death or severe personal injury will result if proper precautions are not taken.
WARNING
indicates that death or severe personal injury may result if proper precautions are not taken.
CAUTION
indicates that minor personal injury can result if proper precautions are not taken.
NOTICE
indicates that property damage can result if proper precautions are not taken.
If more than one degree of danger is present, the warning notice representing the highest degree of danger will
be used. A notice warning of injury to persons with a safety alert symbol may also include a warning relating to
property damage.
Quali󹪝ed Personnel
The product/system described in this documentation may be operated only by personnel quali󹪝ed for the speci󹪝c
task in accordance with the relevant documentation, in particular its warning notices and safety instructions.
Quali󹪝ed personnel are those who, based on their training and experience, are capable of identifying risks and
avoiding potential hazards when working with these products/systems.
Proper use of Siemens products
Note the following:
WARNING
Siemens products may only be used for the applications described in the catalog and in the relevant technical
documentation. If products and components from other manufacturers are used, these must be recommended or
approved by Siemens. Proper transport, storage, installation, assembly, commissioning, operation and maintenance
are required to ensure that the products operate safely and without any problems. The permissible ambient
conditions must be complied with. The information in the relevant documentation must be observed.
Trademarks
All names identi󹪝ed by ® are registered trademarks of SiemensAG. The remaining trademarks in this publication
may be trademarks whose use by third parties for their own purposes could violate the rights of the owner.
Disclaimer of Liability
We have reviewed the contents of this publication to ensure consistency with the hardware and software
described. Since variance cannot be precluded entirely, we cannot guarantee full consistency. However, the
information in this publication is reviewed regularly and any necessary corrections are included in subsequent
editions.
Siemens AG
Digital Industries
Postfach 48 48
90026 NÜRNBERG
GERMANY
C79000-G8976-C628-05
Ⓟ 02/2023 Subject to change
Copyright © SiemensAG 2021 - 2023.
All rights reserved

Preface
Purpose of the operating instructions
These operating instructions contain information with which you can install and connect the
SCALANCE device correctly. The con󹪝guration and the integration of the device in a network are
not described in these instructions.
Scope of validity
These operating instructions cover the following products:
Product Article numbers Certi󹪝cation ID
SCALANCE MUM856-1 6GK5856-2EA00-3AA1 (ROW)
6GK5856-2EA00-3DA1 (EU)
6GK5856-2EA00-3FA1 (CN)
MS5G15R-65-M1-M12-E4-1
These operating instructions apply to the following 󹪝rmware version:
• SCALANCE M-800/S615 version 7.2 or later
You will 󹪝nd the article numbers for the Siemens products of relevance here in the following
catalogs:
• SIMATIC NET Industrial Communication / Industrial Identi󹪝cation, catalog IKPI
• SIMATIC Products for Totally Integrated Automation and Micro Automation, catalog ST70
• Industry Mall - catalog and ordering system for automation and drive technology, Online
catalog (https://mall.industry.siemens.com)
You can request the catalogs and additional information from your Siemens representative.
Documentation on the Internet
You can 󹪝nd the current version of the document on the Internet at. (https://
support.industry.siemens.com/cs/ww/en/ps/28821/man)
Enter the name or article number of the product in the search 󹪝lter.
Documentation on con󹪝guration
You will 󹪝nd detailed information on con󹪝guring the devices in the following con󹪝guration
manuals:
• SCALANCE M-800 Web Based Management
• SCALANCE M-800 Command Line Interface
SCALANCE MUM856-1
Operating Instructions, 02/2023, C79000-G8976-C628-05 3

Note
Make sure that you read the explanations and instructions in the readme.htm 󹪝le.
Further documentation
• System manual "Industrial Ethernet"
The system manual contains information on other SIMATIC NET products that you can
operate along with the devices of this product line in an Industrial Ethernet network.
There, you will 󹪝nd among other things optical performance data of the communications
partner that you require for the installation.
The "SIMATIC NET Industrial Ethernet" system manual can be found on the Internet pages of
Siemens Industry Online Support under the following entry ID: 27069465 (https://
support.industry.siemens.com/cs/ww/en/view/27069465)
• "Passive network components" system manual
This system manual contains installation instructions for several of the most common
components and guidelines for setting up networked automation plants in buildings.
The "Passive network components" system manual can be found on the Internet pages of
Siemens Industry Online Support under the following entry ID: 84922825 (https://
support.industry.siemens.com/cs/ww/en/view/84922825)
SIMATIC NET manuals
You will 󹪝nd SIMATIC NET manuals on the Internet pages of Siemens Industry Online Support:
• using the search function:
Link to Siemens Industry Online Support (https://support.industry.siemens.com/cs/ww/en/)
Enter the entry ID of the relevant manual as the search item.
• In the navigation panel on the left hand side in the area "Industrial Communication":
Link to the area "Industrial Communication" (https://
support.industry.siemens.com/cs/ww/en/ps/15982/man)
Go to the required product group and make the following settings:
tab "Entry list", Entry type "Manuals"
You will 󹪝nd the documentation for the SIMATIC NET products relevant here on the data
medium that ships with some products:
• Product CD / product DVD
• SIMATIC NET Manual Collection
Security information
Siemens provides products and solutions with industrial security functions that support the
secure operation of plants, systems, machines and networks.
Preface
SCALANCE MUM856-1
4Operating Instructions, 02/2023, C79000-G8976-C628-05

In order to protect plants, systems, machines and networks against cyber threats, it is
necessary to implement – and continuously maintain – a holistic, state-of-the-art industrial
security concept. Siemens’ products and solutions constitute one element of such a concept.
Customers are responsible for preventing unauthorized access to their plants, systems,
machines and networks. Such systems, machines and components should only be connected
to an enterprise network or the internet if and to the extent such a connection is necessary
and only when appropriate security measures (e.g. 󹪝rewalls and/or network segmentation)
are in place.
For additional information on industrial security measures that may be implemented, please
visit
https://www.siemens.com/industrialsecurity (https://www.siemens.com/industrialsecurity).
Siemens’ products and solutions undergo continuous development to make them more
secure. Siemens strongly recommends that product updates are applied as soon as they are
available and that the latest product versions are used. Use of product versions that are no
longer supported, and failure to apply the latest updates may increase customer’s exposure
to cyber threats.
To stay informed about product updates, subscribe to the Siemens Industrial Security RSS
Feed under
https://www.siemens.com/cert (https://www.siemens.com/cert).
Firmware
The 󹪝rmware is available on the Internet pages of the Siemens Industry Online Support (https://
support.industry.siemens.com/cs/ww/en/ps/15982/dl):
Note on 󹪝rmware/software support
Check regularly for new 󹪝rmware/software versions or security updates and apply them. After
the release of a new version, previous versions are no longer supported and are not maintained.
Error/fault
If a fault develops, send the device to your SIEMENS representative for repair. Repairs on-site are
not permitted.
Decommissioning
Shut down the device properly to prevent unauthorized persons from accessing con󹪝dential
data in the device memory.
To do this, restore the factory settings on the device.
Also restore the factory settings on the storage medium.
Preface
SCALANCE MUM856-1
Operating Instructions, 02/2023, C79000-G8976-C628-05 5

Recycling and disposal
The products are low in pollutants, can be recycled and meet the requirements of the WEEE
directive 2012/19/EU for the disposal of electrical and electronic equipment.
Do not dispose of the products at public disposal sites.
For environmentally friendly recycling and the disposal of your old device contact a certi󹪝ed
disposal company for electronic scrap or your Siemens contact (Product return (https://
support.industry.siemens.com/cs/ww/en/view/109479891)).
Note the di󹪜erent national regulations.
Open source license conditions
Note
Open source software
Read the license conditions for open source software carefully before using the product.
You will 󹪝nd license conditions in the following documents on the supplied data medium:
• OSS_SCALANCE_MuM856_86.pdf
SIMATIC NET glossary
The SIMATICNET glossary describes terms that may be used in this document.
You will 󹪝nd the SIMATIC NET glossary in the Siemens Industry Online Support at the
following address:
50305045 (https://support.industry.siemens.com/cs/ww/en/view/50305045)
Trademarks
The following and possibly other names not identi󹪝ed by the registered trademark sign ® are
registered trademarks of Siemens AG:
SCALANCE, SINEMA, KEY-PLUG, C-PLUG
Preface
SCALANCE MUM856-1
6Operating Instructions, 02/2023, C79000-G8976-C628-05

Table of contents
Preface ................................................................................................................................................... 3
1 Safety notices ........................................................................................................................................ 9
2 Security recommendations.................................................................................................................. 11
2.1 Security recommendations................................................................................................. 11
2.2 Available services............................................................................................................... 15
3 Description of the device..................................................................................................................... 19
3.1 Structure of the type designation ....................................................................................... 19
3.2 Product characteristics ....................................................................................................... 19
3.3 Device view ....................................................................................................................... 20
3.4 Scope of delivery ............................................................................................................... 20
3.5 Accessories........................................................................................................................ 22
3.5.1 Installation ........................................................................................................................ 22
3.5.2 CLP.................................................................................................................................... 22
3.5.3 Flexible connecting cables, antennas and accessories ......................................................... 22
3.6 LED display ........................................................................................................................ 24
3.7 Reset button ...................................................................................................................... 26
3.8 Con󹪝guration License PLUG................................................................................................ 27
4 Assembly and disassembly .................................................................................................................. 29
4.1 Safety notices for installation ............................................................................................. 29
4.2 Types of installation ........................................................................................................... 32
4.3 Wall mounting ................................................................................................................... 32
4.4 DIN rail mounting .............................................................................................................. 33
4.4.1 Installation with the DIN rail mounting adapter .................................................................. 33
4.4.2 Mounting with bracket support .......................................................................................... 35
5 Connecting up ..................................................................................................................................... 39
5.1 Safety when connecting up................................................................................................ 39
5.2 Power supply ..................................................................................................................... 44
5.3 Ethernet ............................................................................................................................ 46
5.4 Antennas........................................................................................................................... 47
5.5 SIM card ............................................................................................................................ 49
5.6 Grounding ......................................................................................................................... 51
5.7 Digital input/output ........................................................................................................... 52
5.8 Replacing a CLP.................................................................................................................. 54
SCALANCE MUM856-1
Operating Instructions, 02/2023, C79000-G8976-C628-05 7

6 Maintenance and cleaning .................................................................................................................. 57
7 Troubleshooting................................................................................................................................... 59
7.1 Downloading new 󹪝rmware using TFTP without WBM and CLI............................................. 59
7.2 Restoring the factory settings............................................................................................. 60
8 Technical speci󹪝cations ....................................................................................................................... 63
9 Dimension drawings............................................................................................................................ 69
10 Approvals............................................................................................................................................. 73
10.1 EC declaration of conformity.............................................................................................. 74
10.1.1 RoHS ................................................................................................................................. 75
10.1.2 RED ................................................................................................................................... 75
10.1.2.1 Protection of health and safety........................................................................................... 75
10.1.2.2 EMC................................................................................................................................... 75
10.1.2.3 E󹪟cient use of the radio spectrum ..................................................................................... 76
10.1.3 Other technical standards .................................................................................................. 77
10.2 UK Declaration of Conformity............................................................................................. 77
10.2.1 The Restriction of the Use of Certain Hazardous Substances in Electrical and Electronic
Equipment Regulations 2012 ............................................................................................. 78
10.2.2 The Radio Equipment Regulations 2017 ............................................................................. 78
10.2.2.1 Protection of health and safety........................................................................................... 78
10.2.2.2 EMC................................................................................................................................... 78
10.2.2.3 E󹪟cient use of the radio spectrum ..................................................................................... 79
10.2.3 Other technical standards .................................................................................................. 80
10.3 Supplier’s declaration of conformity ................................................................................... 80
10.4 General approvals .............................................................................................................. 81
Index .................................................................................................................................................... 85
Table of contents
SCALANCE MUM856-1
8Operating Instructions, 02/2023, C79000-G8976-C628-05

Safety notices 1
CAUTION
To prevent injury and damage, read the manual before using the device.
Read the safety notices
Note the following safety notices. These relate to the entire working life of the device.
You should also read the safety notices relating to handling in the individual sections,
particularly in the sections "Installation" and "Connecting up".
WARNING
Hot surfaces
Electric devices have hot surfaces. Do not touch these surfaces. They could cause severe burns.
• Allow the device to cool down before starting any work on it.
WARNING
EXPLOSION HAZARD
Do not open the device when the supply voltage is turned on.
SCALANCE MUM856-1
Operating Instructions, 02/2023, C79000-G8976-C628-05 9

Safety notices
SCALANCE MUM856-1
10 Operating Instructions, 02/2023, C79000-G8976-C628-05

Security recommendations 2
2.1 Security recommendations
To prevent unauthorized access to the device and/or network, observe the following security
recommendations.
Note
Note that GPS signals can be obfuscated or blocked by malicious third-party devices.
General
•Check the device regularly to ensure that these recommendations and/or other internal
security policies are complied with.
• Evaluate the security of your location and use a cell protection concept with suitable
products. For more information, refer to:
Link: (https://www.siemens.com/industrialsecurity)
• When the internal and external network are disconnected, an attacker cannot access internal
data from the outside. If possible, operate the device only within a protected network area.
• Use VPN to encrypt and authenticate communication from and to the devices.
• For data transmission via a non-secure network, use an encrypted VPN tunnel (IPsec,
OpenVPN).
• Check the user documentation of other Siemens products that are used together with the
device for additional security recommendations.
• Using remote logging, ensure that the system protocols are forwarded to a central logging
server. Make sure that the server is within the protected network and check the protocols
regularly for potential security violations or vulnerabilities.
Authentication
Note
Accessibility risk - Risk of data loss
Do not lose the passwords for the device. Access to the device can only be restored by resetting
the device to factory settings which completely removes all con󹪝guration data.
• Replace the default passwords for all user accounts, access modes and applications (if
applicable) before you use the device.
•De󹪝ne rules for the assignment of passwords.
SCALANCE MUM856-1
Operating Instructions, 02/2023, C79000-G8976-C628-05 11

• Use passwords with a high password strength. Avoid weak passwords, (e.g. password1,
123456789, abcdefgh) or recurring characters (e.g. abcabc).
This recommendation also applies to symmetrical passwords/keys con󹪝gured on the device.
• Make sure that passwords are protected and only disclosed to authorized personnel.
• Do not use the same passwords for multiple user names and systems.
• Store the passwords in a safe location (not online) to have them available if they are lost.
• Regularly change your passwords to increase security.
• A password must be changed if it is known or suspected to be known by unauthorized
persons.
• When user authentication is performed via RADIUS, make sure that all communication takes
place within the security environment or is protected by a secure channel.
• Watch out for link layer protocols that do not o󹪜er their own authentication between
endpoints, such as ARP or IPv4. An attacker could use vulnerabilities in these protocols to
attack hosts, switches and routers connected to your layer 2 network, for example, through
manipulation (poisoning) of the ARP caches of systems in the subnet and subsequent
interception of the data tra󹪟c. Appropriate security measures must be taken for non-secure
layer 2 protocols to prevent unauthorized access to the network. Physical access to the local
network can be secured or secure, higher layer protocols can be used, among other things.
Certi󹪝cates and keys
• There is a pre-installed Web server certi󹪝cate (RSA, 2048 bit key length) and an SSH Private
Key in the device. Replace this certi󹪝cate with a user-generated, high-quality certi󹪝cate with
key. Use a certi󹪝cate signed by a reliable external or internal certi󹪝cation authority. You can
install the certi󹪝cate in the WBM via "System > Load and Save".
• Use the certi󹪝cation authority including key revocation and management to sign the
certi󹪝cates.
• Use password-protected certi󹪝cates in the format "PKCS #12".
• Use certi󹪝cates with a key length of 4096 bits.
• Make sure that user-de󹪝ned private keys are protected and inaccessible to unauthorized
persons.
• If there is a suspected security violation, change all certi󹪝cates and keys immediately.
• SSH and SSL keys are available for admin users. Make sure that you take appropriate security
measures when shipping the device outside of the trusted environment:
– Replace the SSH and SSL keys with disposable keys prior to shipping.
– Decommission the existing SSH and SSL keys. Create and program new keys when the
device is returned.
• Verify certi󹪝cates based on the 󹪝ngerprint on the server and client side to prevent "man in the
middle" attacks. Use a second, secure transmission path for this.
• Before sending the device to Siemens for repair, replace the current certi󹪝cates and keys with
temporary disposable certi󹪝cates and keys, which can be destroyed when the device is
returned.
Security recommendations
2.1Security recommendations
SCALANCE MUM856-1
12 Operating Instructions, 02/2023, C79000-G8976-C628-05

Physical/remote access
• If possible, operate the devices only within a protected network area. Attackers cannot access
internal data from the outside when the internal and the external network are separate from
each other.
• Limit physical access to the device exclusively to trusted personnel.
The memory card or the PLUG (C-PLUG, KEY-PLUG, CLP) contains sensitive data such as
certi󹪝cates and keys that can be read out and modi󹪝ed. An attacker with control of the
device's removable media could extract critical information such as certi󹪝cates, keys, etc. or
reprogram the media.
• Lock unused physical ports on the device. Unused ports can be used to gain forbidden access
to the plant.
• We highly recommend that you keep the protection from brute force attacks (BFA) activated
to prevent third parties from gaining access to the device. For more information, see the
con󹪝guration manuals, section "Brute Force Prevention".
• If possible, use the VPN functionality to encrypt and authenticate communication for
communication via non-secure networks.
• When you establish a secure connection to a server (for example for an upgrade), make sure
that strong encryption methods and protocols are con󹪝gured for the server.
• Terminate the management connections (e.g. HTTPS, SSH) properly.
• Make sure that the device has been powered down completely before you decommission it.
For more information, refer to "Decommissioning (Page5)".
• We recommend formatting a PLUG that is not being used.
Hardware / Software
• Use VLANs whenever possible as protection against denial-of-service (DoS) attacks and
unauthorized access.
• Restrict access to the device by setting 󹪝rewall rules or rules in an access control list (ACL).
• Selected services are enabled by default in the 󹪝rmware. It is recommended to enable only
the services that are absolutely necessary for your installation.
For more information on available services, see "List of available services (Page15)".
• To ensure you are using the most secure encryption methods available, use the latest web
browser version compatible with the product. Also, the latest web browser versions of
Mozilla Firefox, Google Chrome, and Microsoft Edge have 1/n-1 record splitting enabled,
which reduces the risk of attacks such as SSL/TLS Protocol Initialization Vector
Implementation Information Disclosure Vulnerability (for example, BEAST).
• Ensure that the latest 󹪝rmware version is installed, including all security-related patches.
You can 󹪝nd the latest information on security patches for Siemens products at the Industrial
Security (https://www.siemens.com/industrialsecurity) or ProductCERT Security Advisories
(https://www.siemens.com/cert/en/cert-security-advisories.htm) website.
For updates on Siemens product security advisories, subscribe to the RSS feed on the
ProductCERT Security Advisories website or follow @ProductCert on Twitter.
• Enable only those services that are used on the device, including physical ports. Free physical
ports can potentially be used to gain access to the network behind the device.
Security recommendations
2.1Security recommendations
SCALANCE MUM856-1
Operating Instructions, 02/2023, C79000-G8976-C628-05 13

• Use the authentication and encryption mechanisms of SNMPv3 if possible. Use strong
passwords.
•Con󹪝guration 󹪝les can be downloaded from the device. Ensure that con󹪝guration 󹪝les are
adequately protected.
Con󹪝guration 󹪝les can be password protected during download. You enter passwords on the
WBM page "System > Load & Save > Passwords".
• When using SNMP (Simple Network Management Protocol):
–Con󹪝gure SNMP to generate a noti󹪝cation when authentication errors occur.
For more information, see WBM "System > SNMP > Noti󹪝cations".
– Ensure that the default community strings are changed to unique values.
– Use SNMPv3 whenever possible. SNMPv1 and SNMPv2c are considered non-secure and
should only be used when absolutely necessary.
– If possible, prevent write access.
Secure/ non-secure protocols
• Use secure protocols if access to the device is not prevented by physical protection measures.
• Restrict the use of non-secure protocols. While some protocols are secure (e.g. HTTPS, SSH,
802.1X, etc.), others were not designed for the purpose of securing applications (e.g.
SNMPv1/v2c, RSTP, etc.).
Therefore, take appropriate security measures against non-secure protocols to prevent
unauthorized access to the device/network. Use non-secure protocols on the device using a
secure connection (e.g. SINEMA RC).
• If non-secure protocols and services are required, ensure that the device is operated in a
protected network area.
• Check whether use of the following protocols is necessary:
– Telnet
– HTTP
– Broadcast pings
– Non authenticated and unencrypted interfaces
– ICMP (redirect)
– LLDP
– DHCP Options 66/67
– SNTP
– NTP
– TFTP
– TIA Portal Cloud Connector (not available with SCALANCE MUM85x)
– VRRPv3
– DNS
– SNMPv1/V2c
Security recommendations
2.1Security recommendations
SCALANCE MUM856-1
14 Operating Instructions, 02/2023, C79000-G8976-C628-05

• If a secure alternative is available for a protocol, use it.
The following protocols provide secure alternatives:
– SNMPv1/v2 → SNMPv3
Check whether use of SNMPv1 is necessary. SNMPv1 is classi󹪝ed as non-secure. Use the
option of preventing write access. The product provides you with suitable setting options.
If SNMP is enabled, change the community names. If no unrestricted access is necessary,
restrict access with SNMP.
– HTTP → HTTPS
– Telnet → SSH
– NTP → Secure NTP
– TFTP → SFTP
– TIA Portal Cloud Connector using a secure connection. Use the "TIA Portal Cloud
Connector" integrated in the product over a VPN solution (e.g. SINEMA RC).
Con󹪝gure the 󹪝rewall settings of the SCALANCE M800/S615 (e.g. prede󹪝ned IPv4 rules
"Cloud Connector" to prevent unauthorized access of network devices to the "TIA Portal
Cloud Connector Server").
• Using a 󹪝rewall, restrict the services and protocols available to the outside to a minimum.
• For the DCP function, enable the "Read Only" mode after commissioning.
2.2 Available services
List of available services
The following is a list of all available protocols and services as well as their ports through which
the device can be accessed.
The table includes the following columns:
•Service
The services that the device supports.
•Protocol / Port number
Port number assigned to the protocol.
•Default port status
The port status on delivery (factory setting) distinguishes between local and external access.
– Local access: The port is accessed via a local connection (vlan1).
– External access: The port is accessed via an external connection (vlan2).
•Con󹪝gurable port/service
Indicates whether the port number or the service can be con󹪝gured via WBM / CLI.
•Authentication
Speci󹪝es whether an authentication of the communication partner takes place or whether
an authentication can be con󹪝gured.
•Encryption
Speci󹪝es whether the transfer is encrypted or whether the encryption can be con󹪝gured.
Security recommendations
2.2Available services
SCALANCE MUM856-1
Operating Instructions, 02/2023, C79000-G8976-C628-05 15

Service Protocol/
Port number
Default port status Con󹪝gurable Authenti‐
cation
Encryp‐
tion 2)
Local access External ac‐
cess 1)
Port Serv‐
ice
DHCPv4 Cli‐
ent
UDP/68 Closed 3) Closed -- ✓ -- --
DHCPv6 Cli‐
ent
TCP/546
UDP/546
Open Open -- -- -- --
DHCPv4-
Server
UDP/67 Closed Closed 4) -- ✓ -- --
DNS Client TCP/53
UDP/53
Outgoing only Outgoing on‐
ly
-- ✓ -- --
DNS Server TCP/53
UDP/53
Open 5) Closed -- ✓ -- --
DynDNS TCP/80
UDP/80
TCP/443
UDP/443
Outgoing only Outgoing on‐
ly
-- ✓ ✓ --
HTTP TCP/80 Open Closed ✓ ✓ ✓ --
HTTP Proxy TCP/3128
TCP/8080
Outgoing only Outgoing on‐
ly
✓ ✓ Optional --
HTTPS WBM
Server/Client
TCP/443 Open Closed ✓ ✓ ✓ ✓
IPsec/IKE UDP/500
UDP/4500
Closed Closed -- ✓ ✓ ✓
NTP Client UDP/123 Outgoing only Outgoing on‐
ly
✓ ✓ -- --
NTP Client
(secure)
UDP/123 Outgoing only Outgoing on‐
ly
✓ ✓ ✓ --
NTP Server UDP/123 Closed Closed ✓ ✓ -- --
NTP Server
(secure)
UDP/123 Closed Closed ✓ ✓ ✓ --
OpenVPN UDP/1194
TCP/1194
Outgoing only Outgoing on‐
ly
✓ ✓ ✓ ✓
Ping ICMP Open Closed -- ✓ -- --
PROFINET UDP/34964
UDP/49154
UDP/49155
Open Closed -- ✓ -- --
RADIUS Cli‐
ent
UDP/1812 Closed Closed ✓ ✓ ✓ Optional
UDP/1813 --
SFTP Server TCP/22 Outgoing only Outgoing on‐
ly
✓ ✓ ✓ ✓
Siemens Re‐
mote Serv‐
ice (cRSP/
SRS)
TCP/443 Outgoing only Outgoing on‐
ly
-- ✓ Optional ✓
Security recommendations
2.2Available services
SCALANCE MUM856-1
16 Operating Instructions, 02/2023, C79000-G8976-C628-05

Service Protocol/
Port number
Default port status Con󹪝gurable Authenti‐
cation
Encryp‐
tion 2)
Local access External ac‐
cess 1)
Port Serv‐
ice
SINEMA RC HTTPS/443
and TCP/UDP
depending on
the server
con󹪝guration
Outgoing only Outgoing on‐
ly
✓ ✓ ✓ ✓
SMTP Client TCP/25 Outgoing only Outgoing on‐
ly
✓ ✓ -- --
SMTP (se‐
cure)
TCP/465
TCP/587
Outgoing only Outgoing on‐
ly
✓ ✓ Optional ✓
SNMPv1/v2c UDP/161 Open Closed ✓ ✓ -- --
SNMPv3
Server
UDP/161 Open Closed ✓ ✓ Optional Optional
SNMP Trap UDP/161 Open Closed ✓ ✓ Optional Optional
SNTP Client UDP/123 Closed Closed ✓ ✓ -- --
SSH CLI TCP/22 Open Closed ✓ ✓ ✓ ✓
Syslog Client UDP/514 Outgoing only Outgoing on‐
ly
✓ ✓ -- --
Syslog Client
TLS
TCP/6514 Outgoing only Outgoing on‐
ly
✓ ✓ -- ✓
Telnet TCP/23 Closed Closed ✓ ✓ ✓ --
TFTP UDP/69 Outgoing only Outgoing on‐
ly
✓ ✓ -- --
TIA Portal
Cloud Con‐
nector 6)
TCP/9023 Closed Closed ✓ ✓ -- --
TCP Event TCP/26864 Closed Closed ✓ ✓ -- --
SMS Relay 7) TCP/26864 Closed Closed ✓ ✓ -- --
VXLAN 8) UDP/4789 Closed Closed ✓ ✓ -- --
1) With SCALANCE M826 and M804PB, only access via vlan1 is possible in the delivery state
(factory setting).
2) You can 󹪝nd additional information on the encryption methods used in the WBM appendix
"Ciphers used".
3) Only open with SCALANCE M826
4) Only open with SCALANCE S615
5) Only closed with SCALANCE S615
6) Not available with SCALANCE MUM85x
7) Only available with the SCALANCE M87x and MUM85x
8) Only available with SCALANCE MUM85x
The following is a list of all available Layer 2 services through which the device can be
accessed.
Security recommendations
2.2Available services
SCALANCE MUM856-1
Operating Instructions, 02/2023, C79000-G8976-C628-05 17

The table includes the following columns:
•Layer 2 service
The Layer 2 services that the device supports.
•Default status
The default status of the service (open or closed).
•Service con󹪝gurable
Indicates whether the service can be con󹪝gured via WBM / CLI.
Layer 2 service Default status Con󹪝gurable
DCP Open (when con󹪝gured) ✓
LLDP Open (when con󹪝gured) ✓
SIMATIC NET TIME Open (when con󹪝gured) ✓
VLAN Open (when con󹪝gured) ✓
VXLAN 1) Open (when con󹪝gured) ✓
1) Only with SCALANCE MUM85x
Security recommendations
2.2Available services
SCALANCE MUM856-1
18 Operating Instructions, 02/2023, C79000-G8976-C628-05

Description of the device 3
3.1 Structure of the type designation
Structure of the type designation
The type designation of the device is made up of several parts that have the following meaning:
0801XPEHURIPRELOHZLUHOHVVLQWHUIDFHV8VHU&OLHQW5RXWHU0RELOHZLUHOHVV,3[*0DLQ/LQH,3
3.2 Product characteristics
Interfaces
Functionality SCALANCE MUM856-1
Connectors for external antennas 4 x N-Connect
Ethernet interface 1 x M12 Ethernet interface P1 LAN PoE, X-coded, 8-pin
Power supply (direct) M12 interface, direct infeed, L-coded, 4-pin
Digital input/output M12 interface, A-coded, 5-pin
SCALANCE MUM856-1
Operating Instructions, 02/2023, C79000-G8976-C628-05 19

3.3 Device view

①A1 antenna port, female N-Connect type
②Screw-down cover:
- for the reset button and
- for the CLP slot
③A2 antenna port, female N-Connect type
④LED display
⑤Ground connector (threadM4) on the bottom
⑥Connector for power supply (L1, L2)
⑦Digital input (DI) / Digital output (DQ)
⑧Ethernet connector P1 (PoE capability)
⑨A4 antenna port, female N-Connect type
⑩A3 antenna port, female N-Connect type
⑪Slot for the micro SIM card 3FF on the device rear under a cover
3.4 Scope of delivery
The following components are supplied with the product:
• A SCALANCE MUM856-1
• A cover for the CLP slot
• Four protective caps for the antenna sockets
Description of the device
3.4Scope of delivery
SCALANCE MUM856-1
20 Operating Instructions, 02/2023, C79000-G8976-C628-05