Siemens SIMATIC NET SCALANCE S615 Instruction sheet

SCALANCE S615
___________________
___________________
___________________
___________________
___________________
___________________
SIMATIC NET
Industrial Ethernet Security
SCALANCE S615
Web Based Management
Configuration Manual
05/2015
C79000
-G8976-C388-02
Preface
Description
1
Technical basics
2
Security recommendation
3
Configuring with Web Based
Management
4
Service and maintenance
5

Siemens AG
Division Process Industries and Drives
Postfach 48 48
90026 NÜRNBERG
GERMANY
C79000-G8976-C388-01
Ⓟ
05/2015 Subject to change
Copyright © Siemens AG 2015.
All rights reserved
Legal information
Warning notice system
This manual contains notices you have to observe in order to ensure your personal safety, as well as to prevent
damage to property. The notices referring to your personal safety are highlighted in the manual by a safety alert
symbol, notices referring only to property damage have no safety alert symbol. These notices shown below are
graded according to the degree of danger.
DANGER
indicates that death or severe personal injury will result if proper precautions are not taken.
WARNING
indicates that death or severe personal injury may result if proper precautions are not taken.
CAUTION
indicates that minor personal injury can result if proper precautions are not taken.
NOTICE
indicates that property damage can result if proper precautions are not taken.
If more than one degree of danger is present, the warning notice representing the highest degree of danger will
be used. A notice warning of injury to persons with a safety alert symbol may also include a warning relating to
property damage.
Qualified Personnel
The product/system described in this documentation may be operated only by
personnel qualified
for the specific
task in accordance with the relevant documentation, in particular its warning notices and safety instructions.
Qualified personnel are those who, based on their training and experience, are capable of identifying risks and
avoiding potential hazards when working with these products/systems.
Proper use of Siemens products
Note the following:
WARNING
Siemens products may only be used for the applications described in the catalog and in the relevant technical
documentation. If products and components from other manufacturers are used, these must be recommended
or approved by Siemens. Proper transport, storage, installation, assembly, commissioning, operation and
maintenance are required to ensure that the products operate safely and without any problems. The permissible
ambient conditions must be complied with. The information in the relevant documentation must be observed.
Trademarks
All names identified by ® are registered trademarks of Siemens AG. The remaining trademarks in this publication
may be trademarks whose use by third parties for their own purposes could violate the rights of the owner.
Disclaimer of Liability
We have reviewed the contents of this publication to ensure consistency with the hardware and software
described. Since variance cannot be precluded entirely, we cannot guarantee full consistency. However, the
information in this publication is reviewed regularly and any necessary corrections are included in subsequent
editions.

SCALANCE S615 Web Based Management
Configuration Manual, 05/2015, C79000-G8976-C388-02 3
Preface
Validity of the manual
This Configuration Manual covers the following product:
●SCALANCE S615
This Configuration Manual applies to the following software version:
●SCALANCE S615 firmware as of Version V04.00
Purpose of the Configuration Manual
This Configuration Manual is intended to provide you with the information you require to
install, commission and operate the device. It provides you with the information you require
to configure the devices.
Orientation in the documentation
Apart from the Configuration Manual you are currently reading, the following documentation
is also available from on the topic of Remote Network:
●Getting Started SCALANCE S615
Based on examples, this document explains the configuration of the SCALANCE S615.
●Operating Instructions SCALANCE S615
You will find this document on the Internet pages of Siemens Industry Online Support. It
contains information on installation, connecting up and approvals of the SCALANCE
S615.
●Operating Instructions SINEMA RC Server
You will find this document on the Internet pages of Siemens Industry Online Support. It
contains information on the installation, configuration and operation of the application
SINEMA Remote Connect Server.

Preface
SCALANCE S615 Web Based Management
4Configuration Manual, 05/2015, C79000-G8976-C388-02
SIMATIC NET manuals
You will find SIMATIC NET manuals on the Internet pages of Siemens Industry Online
Support:
●Using the search function:
Link to Siemens Industry Online Support
(http://support.automation.siemens.com/WW/view/en)
Enter the entry ID of the relevant manual as the search item.
●In the navigation panel on the left-hand side in the area "Industrial Communication":
Link to the area "Industrial Communication"
(http://support.automation.siemens.com/WW/view/en/10805878/130000)
Go to the required product group and make the following settings:
tab "Entry list", Entry type "Manuals"
You will find the documentation for the SIMATIC NET products relevant here on the data
storage medium that ships with some products:
●Product CD / product DVD
●SIMATIC NET Manual Collection
SIMATIC NET glossary
Explanations of many of the specialist terms used in this documentation can be found in the
SIMATIC NET glossary.
You will find the SIMATIC NET glossary here:
●SIMATIC NET Manual Collection or product DVD
The DVD ships with certain SIMATIC NET products.
●On the Internet under the following entry ID:
50305045 (http://support.automation.siemens.com/WW/view/en/50305045)
Security information
Siemens provides products and solutions with industrial security functions that support the
secure operation of plants, solutions, machines, equipment and/or networks. They are
important components in a holistic industrial security concept. With this in mind, Siemens’
products and solutions undergo continuous development. Siemens recommends strongly
that you regularly check for product updates.
For the secure operation of Siemens products and solutions, it is necessary to take suitable
preventive action (e.g. cell protection concept) and integrate each component into a holistic,
state-of-the-art industrial security concept. Third-party products that may be in use should
also be considered. For more information about industrial security, visit
http://www.siemens.com/industrialsecurity.
To stay informed about product updates as they occur, sign up for a product-specific
newsletter. For more information, visit http://support.automation.siemens.com.

Preface
SCALANCE S615 Web Based Management
Configuration Manual, 05/2015, C79000-G8976-C388-02 5
Firmware
The firmware is signed and encrypted. This ensures that only firmware created by Siemens
can be downloaded to the device.
License conditions
Note
Open source software
Read the license conditions for open source software carefully before using the product.
You will find license conditions in the following documents on the supplied data medium:
●DOC_OSS-SCALANCE-M_74.pdf
●DC_LicenseSummaryScalanceS615_76.htm

Preface
SCALANCE S615 Web Based Management
6Configuration Manual, 05/2015, C79000-G8976-C388-02
Trademarks
The following and possibly other names not identified by the registered trademark sign ®are
registered trademarks of Siemens AG:
SCALANCE

SCALANCE S615 Web Based Management
Configuration Manual, 05/2015, C79000-G8976-C388-02 7
Table of contents
Preface ................................................................................................................................................... 3
1 Description............................................................................................................................................ 11
1.1 Function ..................................................................................................................................11
1.2 Requirements for operation ....................................................................................................13
1.3 Configuration examples ..........................................................................................................14
1.3.1 TeleControl with SINEMA RC.................................................................................................14
1.3.2 Secure access with S615 .......................................................................................................16
1.4 Digital input / output ................................................................................................................17
2 Technical basics ................................................................................................................................... 19
2.1 IPv4 address, subnet mask and address of the gateway .......................................................19
2.2 VLAN.......................................................................................................................................21
2.2.1 VLAN.......................................................................................................................................21
2.2.2 VLAN tagging..........................................................................................................................22
2.3 NAT.........................................................................................................................................24
2.4 SNMP......................................................................................................................................26
2.5 Security functions....................................................................................................................28
2.5.1 Firewall....................................................................................................................................28
2.5.2 IPsecVPN................................................................................................................................29
2.5.3 Certificates ..............................................................................................................................32
3 Security recommendation...................................................................................................................... 33
4 Configuring with Web Based Management ............................................................................................ 37
4.1 Web Based Management .......................................................................................................37
4.2 Starting and logging in ............................................................................................................39
4.3 "Information" menu .................................................................................................................42
4.3.1 Start page ...............................................................................................................................42
4.3.2 Versions ..................................................................................................................................47
4.3.3 ARP Table...............................................................................................................................48
4.3.4 Log tables ...............................................................................................................................49
4.3.4.1 Event log .................................................................................................................................49
4.3.4.2 Security log .............................................................................................................................51
4.3.4.3 Firewall log..............................................................................................................................53
4.3.5 Faults ......................................................................................................................................55
4.3.6 DHCP Server ..........................................................................................................................56
4.3.7 LLDP .......................................................................................................................................57
4.3.8 Routing table...........................................................................................................................58
4.3.9 IPsec VPN...............................................................................................................................59
4.3.10 SINEMA RC ............................................................................................................................60
4.4 "System" menu .......................................................................................................................62

Table of contents
SCALANCE S615 Web Based Management
8Configuration Manual, 05/2015, C79000-G8976-C388-02
4.4.1 Configuration.......................................................................................................................... 62
4.4.2 General .................................................................................................................................. 65
4.4.2.1 Device .................................................................................................................................... 65
4.4.2.2 Coordinates............................................................................................................................ 67
4.4.3 Restart.................................................................................................................................... 68
4.4.4 Load and Save....................................................................................................................... 70
4.4.4.1 HTTP...................................................................................................................................... 70
4.4.4.2 TFTP ...................................................................................................................................... 73
4.4.4.3 Passwords.............................................................................................................................. 75
4.4.5 Events .................................................................................................................................... 76
4.4.5.1 Configuration.......................................................................................................................... 76
4.4.5.2 Severity filter .......................................................................................................................... 78
4.4.6 SMTP client............................................................................................................................ 80
4.4.7 SNMP..................................................................................................................................... 82
4.4.7.1 General .................................................................................................................................. 82
4.4.7.2 Traps ...................................................................................................................................... 83
4.4.7.3 Groups ................................................................................................................................... 85
4.4.7.4 Users...................................................................................................................................... 87
4.4.8 System Time .......................................................................................................................... 89
4.4.8.1 Manual setting........................................................................................................................ 89
4.4.8.2 SNTP client ............................................................................................................................ 91
4.4.8.3 NTP client............................................................................................................................... 93
4.4.8.4 SIMATIC Time Client ............................................................................................................. 95
4.4.9 Auto logout ............................................................................................................................. 97
4.4.10 Syslog Client .......................................................................................................................... 98
4.4.11 Fault monitoring ..................................................................................................................... 99
4.4.12 PLUG ................................................................................................................................... 102
4.4.12.1 Configuration........................................................................................................................ 102
4.4.12.2 License................................................................................................................................. 105
4.4.13 Ping ...................................................................................................................................... 107
4.4.14 DNS...................................................................................................................................... 108
4.4.14.1 DNS client ............................................................................................................................ 108
4.4.14.2 DNS proxy............................................................................................................................ 109
4.4.14.3 DDNS client.......................................................................................................................... 110
4.4.15 DHCP ................................................................................................................................... 111
4.4.15.1 DHCP client.......................................................................................................................... 111
4.4.15.2 DHCP server ........................................................................................................................ 113
4.4.15.3 DHCP Options...................................................................................................................... 115
4.4.15.4 Static Leases........................................................................................................................ 116
4.4.16 SRS...................................................................................................................................... 118
4.4.17 Proxy server......................................................................................................................... 119
4.4.18 SINEMA RC ......................................................................................................................... 121
4.5 "Interfaces" menu................................................................................................................. 123
4.5.1 Ethernet................................................................................................................................ 123
4.5.1.1 Overview .............................................................................................................................. 123
4.5.1.2 Configuration........................................................................................................................ 124
4.6 "Layer 2" menu..................................................................................................................... 127
4.6.1 Dynamic MAC Aging............................................................................................................ 127
4.6.2 VLAN.................................................................................................................................... 128
4.6.2.1 General ................................................................................................................................ 128
4.6.2.2 Port Based VLAN ................................................................................................................. 130

Table of contents
SCALANCE S615 Web Based Management
Configuration Manual, 05/2015, C79000-G8976-C388-02 9
4.6.3 LLDP .....................................................................................................................................132
4.7 "Layer 3" menu .....................................................................................................................134
4.7.1 Routes...................................................................................................................................134
4.7.2 Subnets.................................................................................................................................135
4.7.2.1 Overview ...............................................................................................................................135
4.7.2.2 Configuration.........................................................................................................................137
4.7.3 NAT.......................................................................................................................................138
4.7.3.1 Masquerading .......................................................................................................................138
4.7.3.2 NAPT.....................................................................................................................................139
4.7.3.3 Source NAT ..........................................................................................................................141
4.7.3.4 NETMAP ...............................................................................................................................143
4.8 "Security" menu ....................................................................................................................146
4.8.1 Password ..............................................................................................................................146
4.8.2 Certificates ............................................................................................................................147
4.8.2.1 Overview ...............................................................................................................................147
4.8.2.2 Certificates ............................................................................................................................149
4.8.3 Firewall..................................................................................................................................152
4.8.3.1 General .................................................................................................................................152
4.8.3.2 Predefined IPv4 ....................................................................................................................153
4.8.3.3 IP Services............................................................................................................................154
4.8.3.4 ICMP Services ......................................................................................................................156
4.8.3.5 IP Protocols...........................................................................................................................157
4.8.3.6 IP Rules ................................................................................................................................158
4.8.4 IPsec VPN.............................................................................................................................159
4.8.4.1 General .................................................................................................................................159
4.8.4.2 Remote End ..........................................................................................................................160
4.8.4.3 Connections ..........................................................................................................................162
4.8.4.4 Authentication .......................................................................................................................164
4.8.4.5 Phase 1.................................................................................................................................165
4.8.4.6 Phase 2.................................................................................................................................167
5 Service and maintenance.................................................................................................................... 169
5.1 Firmware update using HTTP...............................................................................................169
5.1.1 Firmware update using HTTP...............................................................................................169
5.2 Firmware update - using TFTP .............................................................................................171
5.3 Firmware update using WBM not possible ...........................................................................173
5.4 Firmware update using WBM not possible ...........................................................................175
Index................................................................................................................................................... 177

Table of contents
SCALANCE S615 Web Based Management
10 Configuration Manual, 05/2015, C79000-G8976-C388-02

SCALANCE S615 Web Based Management
Configuration Manual, 05/2015, C79000-G8976-C388-02 11
Description
1
1.1
Function
Configuration
Configuration of all parameters using the
●Web Based Management (WBM) via HTTP and HTTPS.
●Command Line Interface (CLI) via Telnet and SSH.
Security functions
●Router with NAT function
–IP masquerading
–NAPT
–SourceNAT
–NETMAP
●Password protection
●Firewall function
–Port forwarding
–IP firewall with stateful packet inspection (layer 3 and 4)
–Global and user-defined firewall rules
●VPN functions
To establish a VPN (Virtual Private Network), the following functions are available
–IPsecVPN for up to 20 connections
●SINEMA RC client
●Proxy server

Description
1.1 Function
SCALANCE S615 Web Based Management
12 Configuration Manual, 05/2015, C79000-G8976-C388-02
Monitoring / diagnostics / maintenance
●LEDs
Display of operating statuses via the LED display. You will find further information on this
in the Operating Instructions of the device.
●Logging
For monitoring have the events logged.
●SNMP
For monitoring and controlling network components such as routers or switches from a
central station.
Other functions
●Time-of-day synchronization
–NTP
–SNTP
●DHCP
–DHCP server (local network)
–DHCP client
●Virtual networks (VLAN)
To structure Industrial Ethernet networks with a fast growing number of nodes, a physical
network can be divided into several virtual subnets
●Digital input/digital output
●Dynamic DNS client
●DNS client
●SMTP client

Description
1.2 Requirements for operation
SCALANCE S615 Web Based Management
Configuration Manual, 05/2015, C79000-G8976-C388-02 13
1.2
Requirements for operation
Power supply
A power supply with a voltage between 12 VDC and 24 VDC that can provide sufficient
current.
You will find further information on this in the device-specific operating instructions.
Configuration
In the factory settings, the SCALANCE S615 can be reached as follows for initial
configuration:
Default values set in the factory
Ethernet interface for the configu-
ration
P1 ... P4
IP address 192.168.1.1
Subnet mask
255.255.255.0
User name admin (cannot be changed)
Password admin
The password needs to be changed after the first logon or after a
"Restore Factory Defaults and Restart"
You will find more information in "Web Based Management (Page 37)" and in "Starting and
logging in (Page 39)".

Description
1.3 Configuration examples
SCALANCE S615 Web Based Management
14 Configuration Manual, 05/2015, C79000-G8976-C388-02
1.3
Configuration examples
1.3.1
TeleControl with SINEMA RC
In this configuration, the remote maintenance master station is a connected to the
Internet/intranet via the SINEMA Remote Connect Server. The stations communicate via
SCALANCE M874 or SCALANCE S615 that establish a VPN tunnel to the SINEMA RC
server. In the master station, the SINEMA RC client establishes a VPN tunnel to the
SINEMA RC server.
The devices must log on to the SINEMA RC server. The VPN tunnel between the device and
the SINEMA RC server is established only after successful authentication. Depending on the
configured communications relations and the security settings, the SINEMA RC server
connects the individual VPN tunnels.

Description
1.3 Configuration examples
SCALANCE S615 Web Based Management
Configuration Manual, 05/2015, C79000-G8976-C388-02 15
Procedure
To be able to access a plant via a remote maintenance master station, follow the steps
below:
1. Establish the Ethernet connection between the S615 and the connected Admin PC.
2. Create the devices and node groups on the SINEMA RC Server.
3. Configure the connection to the SINEMA RC server on the device, refer to the section
SINEMA RC (Page 121).
4. Set up the connected applications of the plant for data communication.

Description
1.3 Configuration examples
SCALANCE S615 Web Based Management
16 Configuration Manual, 05/2015, C79000-G8976-C388-02
1.3.2
Secure access with S615
Secure remote access and network segmentation with SCALANCE S615
A secure connection for data exchange between an automation plant and remote stations
will be established via the Internet and mobile wireless network. At the same time, a secure
connection will be established when necessary for service purposes. This connection is,
however, restricted to a specific plant section or a specific machine.
In the automation plant, a SCALANCE S615 is connected to the Internet via the ADSL+
router M812-1. The remote stations will be connected to the Internet via the LTE-CP 1243-7
or the HSPA+ router SCALANCE M874-3.
The devices establish a VPN connection to the
SCALANCE S615 via which data can be exchanged securely.
When necessary, the service technician connects to the Internet. With the SOFTNET
Security Client, he or she establishes a secure VPN connection to the S615. Various IP
subnets are connected to the S615 between which the integrated firewall checks
communication. This allows the communication of the service technician to be restricted to a
specific IP subnet.

Description
1.4 Digital input / output
SCALANCE S615 Web Based Management
Configuration Manual, 05/2015, C79000-G8976-C388-02 17
1.4
Digital input / output
Introduction
The devices have a digital input/output.
The connection is made using two 2-pin terminal blocks. You will find information about the
pin assignment in the operating instructions of the devices.
Application example
●Digital input e.g. for establishing a VPN connection
●Digital output e.g. to signal existing VPN connections.
Control of the digital output
Using CLI and using the private MIB variable snMspsDigitalOutputLevel, you can control the
digital output (DO/1L).
Note
You can control the digital output directly via CLI or SNMP. In WBM and CLI, you can
configure the use of the digital output in "Events". Do not control the digital output direc
tly
when you use this in the WBM and CLI.
Note
If the digital input changes the status, an entry is made in the event protocol table.
●OID of the private MIB variable snMspsDigitalOutputLevel:
iso(1).org(3).dod(6).internet(1).private(4).enterprises(1).siemens(4329).industria
lComProducts(20).iComPlatforms(1).simaticNet(1).snMsps(1).snMspsCommon(1).snMspsDi
gitalIO(39).snMspsDigitalIOObjects(1).snMspsDigitalOutputTable(3).snMspsDigitalOut
putEntry(1).snMspsDigitalOutputLevel(6)
●values of the MIB variable
–1: Digital output is open (DO and 1L are interrupted).
–2: Digital output is closed (DO and 1L are jumpered).

Description
1.4 Digital input / output
SCALANCE S615 Web Based Management
18 Configuration Manual, 05/2015, C79000-G8976-C388-02
Digital input
Using the private MIB variable snMspsDigitalInputLevel, you can read out the status of the
digital input.
Note
If the digital output changes status, an entry is made in the event protocol table.
●OID of the private MIB variable snMspsDigitalInputLevel:
iso(1).org(3).dod(6).internet(1).private(4).enterprises(1).siemens(4329).industria
lComProducts(20).iComPlatforms(1).simaticNet(1).snMsps(1).snMspsCommon(1).snMspsDi
gitalIO(39).snMspsDigitalIOObjects(1).snMspsDigitalInputTable(2).snMspsDigitalInpu
tEntry(1).snMspsDigitalInputLevel(6)
●values of the MIB variable
–1: Signal 0 at the digital input (DI)
–2: Signal 1 at the digital input (DI)
MIB file
The MIB variables can be found in the file "SN-MSPS-DIGITAL-IO-MIB" that is part of the
private MIB file "scalance_m_msps.mib".

SCALANCE S615 Web Based Management
Configuration Manual, 05/2015, C79000-G8976-C388-02 19
Technical basics
2
2.1
IPv4 address, subnet mask and address of the gateway
Range of values for IPv4 address
The IPv4 address consists of four decimal numbers with the range from 0 to 255, each
number separated by a period; example: 141.80.0.16
IPv4 address format - notation
An IPv4 address consists of 4 bytes. Each byte is represented in decimal, with a dot
separating it from the previous one.
XXX.XXX.XXX.XXX
XXX stands for a number between 0 and 255
The IPv4 address consists of two parts:
●The address of the (sub) network
●The address of the node (generally also called end node, host or network node)
Range of values for subnet mask
The subnet mask consists of four decimal numbers with the range from 0 to 255, each
number separated by a period; example: 255.255.0.0
The binary representation of the 4 subnet mask decimal numbers must contain a series of
consecutive 1s from the left and a series of consecutive 0s from the right.
The 1s specify the network number within the IPv4 address. The 0s specify the host address
within the IPv4 address.
Example:
Correct values:
255.255.0.0 D = 1111 1111.1111 1111.0000 0000.0000 0000 B
255.255.128.0 D = 1111 1111.1111 1111.1000 0000.0000 0000 B
255.254.0.0 D = 1111 1111.1111 1110.0000 0000.0000.0000 B
Incorrect value:
255.255.1.0 D = 1111 1111.1111 1111.0000 0001.0000 0000 B

Technical basics
2.1 IPv4 address, subnet mask and address of the gateway
SCALANCE S615 Web Based Management
20 Configuration Manual, 05/2015, C79000-G8976-C388-02
Relationship between the IPv4 address and subnet mask
The first decimal number of the IPv4 address (from the left) determines the structure of the
subnet mask with regard to the number of "1" values (binary) as follows (where "x" is the
host address):
First decimal number of the IPv4 address
Subnet mask
0 to 127
255.x.x.x
128 to 191 255.255.x.x
192 to 223
255.255.255.x
Classless Inter-Domain Routing (CIDR)
CIDR is a method that groups several IPv4 addresses into an address range by representing
an IPv4 address combined with its subnet mask. To do this, a suffix is appended to the IPv4
address that specifies the number of bits of the network mask set to 1. Using the CIDR
notation, routing tables can be reduced in size and the available address ranges put to better
use.
Example:
IPv4 address 192.168.0.0 with subnet mask 255.255.255.0
The network part of the address covers 3 x 8 bits in binary representation; in other words 24
bits.
This results in the CIDR notation 192.168.0.0/24.
The host part covers 1 x 8 bits in binary notation. This results in an address range of 2 to the
power 8, in other words 256 possible addresses.
Value range for gateway address
The address consists of four decimal numbers taken from the range 0 to 255, each number
being separated by a period; example: 141.80.0.1
Relationship between IPv4 address and gateway address
The only positions of the IPv4 address and gateway address that may differ are those in
which "0" appears in the subnet mask.
Example:
You have entered the following: 255.255.255.0 for the subnet mask; 141.30.0.5 for the IPv4
address and 141.30.128.0 for the gateway address. Only the fourth decimal number of the
IPv4 address and gateway address may be different. In the example, however, the 3rd
position is different.
You must, therefore, change one of the following in the example:
The subnet mask to: 255.255.0.0 or
the IPv4 address to: 141.30.128.1 or
the gateway address to: 141.30.0.1