Siemens SCALANCE S615 User manual

SCALANCE S615 Getting Started
___________________
___________________
___________
SIMATIC NET
Industrial Ethernet Security
SCALANCE S615 Getting Started
Getting Started
03/2015
C79000
-G8900-C390-01
Preface
Connecting SCALANCE
S615 to the WAN
1
OpenVPN tunnel between
SCALANCE S615 and
SINEMA RC Server
2

Siemens AG
Division Process Industries and Drives
Postfach 48 48
90026 NÜRNBERG
GERM
ANY
C79000-G8900-C390-01
Ⓟ
04/2015 Subject to change
Copyright © Siemens AG 2015.
All rights reserved
Legal information
Warning notice system
This manual contains notices you have to observe in order to ensure your personal safety, as well as to prevent
damage to property. The notices referring to your personal safety are highlighted in the manual by a safety alert
symbol, notices referring only to property damage have no safety alert symbol. These notices shown below are
graded according to the degree of danger.
DANGER
indicates that death or severe personal injury will result if proper precautions are not taken.
WARNING
indicates that death or severe personal injury may result if proper precautions are not taken.
CAUTION
indicates that minor personal injury can result if proper precautions are not taken.
NOTICE
indicates that property damage can result if proper precautions are not taken.
If more than one degree of danger is present, the warning notice representing the highest degree of danger will
be used. A notice warning of injury to persons with a safety alert symbol may also include a warning relating to
property damage.
Qualified Personnel
The product/system described in this documentation may be operated only by
personnel qualified
for the specific
task in accordance with the relevant documentation, in particular its warning notices and safety instructions.
Qualified personnel are those who, based on their training and experience, are capable of identifying risks and
avoiding potential hazards when working with these products/systems.
Proper use of Siemens products
Note the following:
WARNING
Siemens products may only be used for the applications described in the catalog and in the relevant technical
documentation. If products and components from other manufacturers are used, these must be recommended
or approved by Siemens. Proper transport, storage, installation, assembly, commissioning, operation and
maintenance are required to ensure that the products operate safely and without any problems. The permissible
ambient conditions must be complied with. The information in the relevant documentation must be observed.
Trademarks
All names identified by ® are registered trademarks of Siemens AG. The remaining trademarks in this publication
may be trademarks whose use by third parties for their own purposes could violate the rights of the owner.
Disclaimer of Liability
We have reviewed the contents of this publication to ensure consistency with the hardware and software
described. Since variance cannot be precluded entirely, we cannot guarantee full consistency. However, the
information in this publication is reviewed regularly and any necessary corrections are included in subsequent
editions.

SCALANCE S615 Getting Started
Getting Started, 03/2015, C79000-G8900-C390-01 3
Preface
Purpose
The configuration of the SCALANCE S615 is shown based on examples.
IP settings for the examples
Note
The IP settings used in the examples were freely chosen.
In a real network, you would need to adapt these IP settings to avoid possible address
conflicts.
General naming conventions
The designation . . . stands for . . .
SINEMA RC
SINEMA Remote Connect
SINEMA RC Server
SINEMA Remote Connect server
S615
SCALANCE S615
Further Information
Apart from the Configuration Manual you are currently reading, the following documentation
is also available on the topic of Remote Network:
●"Industrial Ethernet Security - SCALANCE S615 Web Based Management" configuration
manual
This document is intended to provide you with the information you require to install,
commission and operate the device. It provides you with the information you require to
configure the devices.
●"Industrial Remote Communication - TeleControl SINEMA Remote Connect Client"
operating instructions
This manual supports you when installing, configuring and operating the application
SINEMA RC Client.
●"Industrial Remote Communication - TeleControl SINEMA Remote Connect Server"
operating instructions
This manual supports you when installing, configuring and operating the application
SINEMA RC Server.

Preface
SCALANCE S615 Getting Started
4Getting Started, 03/2015, C79000-G8900-C390-01
●Getting Started Industrial Remote Communication - TeleControl - SINEMA Remote
Connect"
Based on examples, this document explains the configuration of SINEMA RC.
●The "SIMATIC NET Industrial Ethernet Network Manual" contains information on other
SIMATIC NET products that you can operate along with the devices of this product line in
an Industrial Ethernet network. There, you will find among other things optical
performance data of the communications partners that you require for the installation.
You will find this document on the Internet under the following entry ID: 27069465
(http://support.automation.siemens.com/WW/view/en/27069465)
SIMATIC NET manuals
You will find SIMATIC NET manuals on the Internet pages of Siemens Industry Online
Support:
●Using the search function:
Link to Siemens Industry Online Support (http://support.automation.siemens.com/)
Enter the entry ID of the relevant manual as the search item.
●In the navigation panel on the left hand side in the area "Industrial Communication":
Link to the area "Industrial Communication"
(http://support.automation.siemens.com/WW/view/en/10805878/133400)
Go to the required product group and make the following settings:
"Entry list" tab, Entry type "Manuals"
SIMATIC NET glossary
Explanations of many of the specialist terms used in this documentation can be found in the
SIMATIC NET glossary.
You will find the SIMATIC NET glossary here:
●SIMATIC NET Manual Collection or product DVD
The DVD ships with certain SIMATIC NET products.
●On the Internet under the following entry ID:
50305045 (http://support.automation.siemens.com/WW/view/en/50305045)
Training, Service & Support
You will find information on Training, Service & Support in the multi--language document
"DC_support_99.pdf" on the data medium supplied with the documentation.

Preface
SCALANCE S615 Getting Started
Getting Started, 03/2015, C79000-G8900-C390-01 5
Security information
Siemens provides products and solutions with industrial security functions that support the
secure operation of plants, solutions, machines, equipment and/or networks. They are
important components in a holistic industrial security concept. With this in mind, Siemens’
products and solutions undergo continuous development. Siemens recommends strongly
that you regularly check for product updates.
For the secure operation of Siemens products and solutions, it is necessary to take suitable
preventive action (e.g. cell protection concept) and integrate each component into a holistic,
state-of-the-art industrial security concept. Third-party products that may be in use should
also be considered. For more information about industrial security, visit
http://www.siemens.com/industrialsecurity.
To stay informed about product updates as they occur, sign up for a product-specific
newsletter. For more information, visit http://support.automation.siemens.com.
Trademarks
The following and possibly other names not identified by the registered trademark sign ®are
registered trademarks of Siemens AG:
SINEMA, SCALANCE

Preface
SCALANCE S615 Getting Started
6Getting Started, 03/2015, C79000-G8900-C390-01

SCALANCE S615 Getting Started
Getting Started, 03/2015, C79000-G8900-C390-01 7
Table of contents
Preface .................................................................................................................................................. 3
1 Connecting SCALANCE S615 to the WAN .............................................................................................. 9
1.1 Procedure in principle ...............................................................................................................9
1.2 Setting up SCALANCE S615 and network .............................................................................11
1.3 Launching Web Based Management......................................................................................12
1.4 Logging in to Web Based Management..................................................................................15
1.5 Changing the IP settings of the S615 .....................................................................................17
1.6 Specifying device information .................................................................................................19
1.7 Setting the time .......................................................................................................................20
1.8 Creating IP subnet ..................................................................................................................22
2 OpenVPN tunnel between SCALANCE S615 and SINEMA RC Server ................................................. 25
2.1 Procedure in principle .............................................................................................................25
2.2 Configuring access to the SINEMA RC Serve........................................................................29
2.2.1 Configuring a route .................................................................................................................29
2.2.2 Activating IP masquerading ....................................................................................................30
2.2.3 Allow access ...........................................................................................................................31
2.3 Configure a remote connection on the SINEMA RC Server...................................................32
2.3.1 Creating node groups .............................................................................................................32
2.3.2 Create devices ........................................................................................................................34
2.3.3 Configure communications relations.......................................................................................36
2.4 Configure a remote connection on the S615 ..........................................................................38
2.4.1 Secure OpenVPN connection with fingerprint ........................................................................38
2.4.2 Secure OpenVPN connection with CA certificate...................................................................41
2.4.2.1 Loading a certificate................................................................................................................41
2.4.2.2 Configure an OpenVPN connection to the SINEMA RC Server.............................................42

Table of contents
SCALANCE S615 Getting Started
8Getting Started, 03/2015, C79000-G8900-C390-01

SCALANCE S615 Getting Started
Getting Started, 03/2015, C79000-G8900-C390-01 9
Connecting SCALANCE S615 to the WAN
1
1.1
Procedure in principle
In this example the SCALANCE S615 that is in the factory settings status is assigned an IP
address. Following this, the device will be configured using Web Based Management
(WBM). Access to the WAN via the Ethernet interface P5 of the S615 will be connected
.
Structure
Required devices/components
●1 x S615 (additional option: a suitably installed standard rail with fittings)
●1 x 24 V power supply with cable connector and terminal block plug
●1 x PC for configuring the S615
●The required network cable, TP cable (twisted pair) complying with the IE FC RJ-45
standard for Industrial Ethernet

Connecting SCALANCE S615 to the WAN
1.1 Procedure in principle
SCALANCE S615 Getting Started
10 Getting Started, 03/2015, C79000-G8900-C390-01
Settings used
For the configuration example, the devices are given the following IP address settings:
Interface
IP address
LAN1 S615 LAN port P1
(vlan1)
192.168.100.1
255.255.255.0
WAN port P5
(vlan2)
192.168.50.1
255.255.255.0
PC1 LAN port 192.168.100.20
255.255.255.0
Gateway: IP address vlan1
Note
The IP settings used in the example were freely chosen.
In a real network, you would need to adapt these IP settings to avoid possible address
conflicts.
Steps in configuration
1. Setting up SCALANCE S615 and network (Page 11)
2. Launching Web Based Management (Page 12)
3. Logging in to Web Based Management (Page 15)
4. Changing the IP settings of the SCALANCE S615 (Page 17)
5. Configuring SCALANCE S615
–Specifying device information (Page 19)
–Setting the time (Page 20)
–Creating IP subnet (Page 22)

Connecting SCALANCE S615 to the WAN
1.2 Setting up SCALANCE S615 and network
SCALANCE S615 Getting Started
Getting Started, 03/2015, C79000-G8900-C390-01 11
1.2
Setting up SCALANCE S615 and network
Note
Familiarize yourself with the security instructions before you commission the device. You will
find the security instructions in the operating ins
tructions.
Procedure
1. First unpack the S615 and check that it is undamaged.
2. Fit the power supply.
WARNING
Use safety extra-low voltage only
The SCALANCE S615 is designed for operation with safety extra-low voltage. This
means that only safety extra-low voltages (SELV) complying with IEC950/EN60950/
VDE0805 can be connected to the power supply terminals.
The power supply unit for the SCALANCE S615 power supply must meet NEC Class 2,
according to the National Electrical Code(r) (ANSI / NFPA 70).
3. Wire up the S615, see Setup (Page 9).
4. Connect the device to the local network via the Ethernet ports.
5. Turn the device on. After connecting up, the fault LED (F) is lit red.
6. Now, turn on the PC.

Connecting SCALANCE S615 to the WAN
1.3 Launching Web Based Management
SCALANCE S615 Getting Started
12 Getting Started, 03/2015, C79000-G8900-C390-01
1.3
Launching Web Based Management
In the factory settings, the SCALANCE S615 can be reached at the following IP address:
●IP address: 192.168.1.1
●Subnet mask: 255.255.255.0
In this configuration example, the Admin PC has the following IP address setting to allow it to
access the Web Based Management of the S615.
IP address
Subnet mask
192.168.1.20
255.255.255.0
Procedure
1. On the Admin PC, open the Control Panel with the menu command "Start" > "Control
Panel".
2. Click "Network and Sharing Center" and select the "Change Adapter Settings" option in
the navigation menu on the left.
3. Right-click on the "LAN Connection" symbol and select the "Properties" menu command.
4. In the "Local Area Connection Properties" dialog, enable the "Internet Protocol Version 4
(TCP/IPv4)" check box.

Connecting SCALANCE S615 to the WAN
1.3 Launching Web Based Management
SCALANCE S615 Getting Started
Getting Started, 03/2015, C79000-G8900-C390-01 13
5. Enter the values in the table above.

Connecting SCALANCE S615 to the WAN
1.3 Launching Web Based Management
SCALANCE S615 Getting Started
14 Getting Started, 03/2015, C79000-G8900-C390-01
6. Confirm the dialogs with "OK" and close the Control Panel.
7. Enter the IP address "192.168.1.1" in the address box of the Web browser. If there is a
problem-free connection to the device, the login page of Web Based Management (WBM)
is displayed.

Connecting SCALANCE S615 to the WAN
1.4 Logging in to Web Based Management
SCALANCE S615 Getting Started
Getting Started, 03/2015, C79000-G8900-C390-01 15
1.4
Logging in to Web Based Management
Procedure
1. Log in with the user name "admin" and the password "admin". You will be prompted to
change the password.
2. Confirm the dialog. The "Password" WBM page is opened automatically.
3. In "Username", select the user "admin".
4. Enter the default password "admin" in "Current Admin Password".
5. Specify the new password in "New Password".

Connecting SCALANCE S615 to the WAN
1.4 Logging in to Web Based Management
SCALANCE S615 Getting Started
16 Getting Started, 03/2015, C79000-G8900-C390-01
6. Repeat the password in "Password Confirmation" to confirm it. The entries must match.
7. Click the "Set Values" button.
Result
The password for the "admin" user is changed. The changes take immediate effect.

Connecting SCALANCE S615 to the WAN
1.5 Changing the IP settings of the S615
SCALANCE S615 Getting Started
Getting Started, 03/2015, C79000-G8900-C390-01 17
1.5
Changing the IP settings of the S615
Procedure
1. Click on "Layer 3" > "Subnet" in the navigation area and on the "Configuration" tab in the
content area.
2. Enter the IP address for vlan1 according to the table "Settings used (Page 9)".
3. Click "Set Values".
The IP address is adjusted automatically in the address bar of the Web browser. The
Web browser on the Admin PC can no longer access Web Based Management because
its IP settings no longer match.
4. On the Admin PC, open the Control Panel with the menu command "Start" > "Control
Panel".
5. Click "Network and Sharing Center" and select the "Change Adapter Settings" option in
the navigation menu on the left.
6. In the "Local Area Connection Properties" dialog, enable the "Internet Protocol Version 4
(TCP/IPv4)" check box.

Connecting SCALANCE S615 to the WAN
1.5 Changing the IP settings of the S615
SCALANCE S615 Getting Started
18 Getting Started, 03/2015, C79000-G8900-C390-01
7. Enter the values for the PC from the "Settings used (Page 9)" table.
8. Confirm the dialogs with "OK" and close the Control Panel.
9. In the address box of the Web browser, enter the IP address for vlan1, see table
"Settings used (Page 9)". If there is a problem-free connection to the device, the login
page of Web Based Management (WBM) is displayed.
10.Log in with the user name "admin" and the modified password.

Connecting SCALANCE S615 to the WAN
1.6 Specifying device information
SCALANCE S615 Getting Started
Getting Started, 03/2015, C79000-G8900-C390-01 19
1.6
Specifying device information
To allow better identification of the SCALANCE S615, specify general device information.
Procedure
1. Click "System" > "General" in the navigation panel and on the "Device" tab in the content
area.
2. In "System Name", enter a system name for the device, e.g. "S615-1".
3. Enter the contact person responsible for the device in "System Contact".
4. Enter the identifier for the location at which the device is installed in "System Location",
for example the room number.
5. Click the "Set Values" button.
Result
The general device information for the SCALANCE S615 has been specified.

Connecting SCALANCE S615 to the WAN
1.7 Setting the time
SCALANCE S615 Getting Started
20 Getting Started, 03/2015, C79000-G8900-C390-01
1.7
Setting the time
The date and time are kept on the SCALANCE S615 to check the validity (time) of
certificates and for the time stamps of log entries. You can set the system time yourself
manually or have it synchronized automatically with a time server. For this example, the time
server is configured using NTP.
Note
Manual time setting - reaction after interrupting the power supply
Note that the time is reset to the factory setting if the power supply is interrupted. On retu
rn
of the power, you need to set the system time again. As result, certificates can lose their
validity.
Synchronization using a time server
Synchronization of the system time using a public time server creates additional data traffic
on the connection. T
his may result in additional costs, depending on your subscriber
contract.
Requirement
●An NTP server can be reached in the local network.
●The IP address of the NTP server is known.
For this example, a local time server with the IP address 192.168.100.87 is used.
Procedure
1. Click on "System" > "System Time" in the navigation area and on the "NTP Client" tab in
the content area.
2. In "Time Zone", enter the local time difference to world time (UTC). For Central European
Summer time (CEST) +02:00.