Siemens SCALANCE XRH-300 User manual

SIMATIC NET
Industrial Ethernet Switches
SCALANCE XRH-300/XRM-300
Product Manual
10/2022
C79000-G8976-C546-01
Introduction 1
Safety notices 2
Security recommendations 3
Description of the device 4
Installing and removing 5
Connecting up 6
Maintenance and cleaning 7
Troubleshooting 8
Technical speci󹪝cations 9
Dimension drawings 10
Approvals 11

Legal information
Warning notice system
This manual contains notices you have to observe in order to ensure your personal safety, as well as to prevent damage
to property. The notices referring to your personal safety are highlighted in the manual by a safety alert symbol, notices
referring only to property damage have no safety alert symbol. These notices shown below are graded according to
the degree of danger.
DANGER
indicates that death or severe personal injury will result if proper precautions are not taken.
WARNING
indicates that death or severe personal injury may result if proper precautions are not taken.
CAUTION
indicates that minor personal injury can result if proper precautions are not taken.
NOTICE
indicates that property damage can result if proper precautions are not taken.
If more than one degree of danger is present, the warning notice representing the highest degree of danger will be
used. A notice warning of injury to persons with a safety alert symbol may also include a warning relating to property
damage.
Quali󹪝ed Personnel
The product/system described in this documentation may be operated only by personnel quali󹪝ed for the speci󹪝c
task in accordance with the relevant documentation, in particular its warning notices and safety instructions.
Quali󹪝ed personnel are those who, based on their training and experience, are capable of identifying risks and
avoiding potential hazards when working with these products/systems.
Proper use of Siemens products
Note the following:
WARNING
Siemens products may only be used for the applications described in the catalog and in the relevant technical
documentation. If products and components from other manufacturers are used, these must be recommended or
approved by Siemens. Proper transport, storage, installation, assembly, commissioning, operation and maintenance
are required to ensure that the products operate safely and without any problems. The permissible ambient
conditions must be complied with. The information in the relevant documentation must be observed.
Trademarks
All names identi󹪝ed by ® are registered trademarks of Siemens AG. The remaining trademarks in this publication may
be trademarks whose use by third parties for their own purposes could violate the rights of the owner.
Disclaimer of Liability
We have reviewed the contents of this publication to ensure consistency with the hardware and software described.
Since variance cannot be precluded entirely, we cannot guarantee full consistency. However, the information in this
publication is reviewed regularly and any necessary corrections are included in subsequent editions.
Siemens AG
Digital Industries
Postfach 48 48
90026 NÜRNBERG
GERMANY
C79000-G8976-C546-01
Ⓟ 09/2022 Subject to change
Copyright © Siemens AG 2022.
All rights reserved

Table of contents
1 Introduction ........................................................................................................................................... 7
1.1 Purpose ............................................................................................................................... 7
1.2 Scope of validity .................................................................................................................. 7
1.3 Designations used................................................................................................................ 7
1.4 Supplementary documentation............................................................................................ 8
1.5 Service & Support ............................................................................................................... 9
1.6 SIMATIC NET glossary........................................................................................................... 9
1.7 Security information ............................................................................................................ 9
1.8 Error/fault .......................................................................................................................... 10
1.9 Decommissioning .............................................................................................................. 10
1.10 Recycling and disposal ....................................................................................................... 10
1.11 Trademarks........................................................................................................................ 11
1.12 Electrostatic discharge ....................................................................................................... 11
2 Safety notices ...................................................................................................................................... 13
3 Security recommendations.................................................................................................................. 15
3.1 Security recommendations................................................................................................. 15
3.2 Available services............................................................................................................... 18
4 Description of the device ..................................................................................................................... 21
4.1 Article numbers ................................................................................................................. 21
4.2 Device views...................................................................................................................... 24
4.2.1 SCALANCE XRH334/XRM334 with 8 SFP/SFP+ slots ............................................................. 24
4.2.1.1 24 V AC/DC device version.................................................................................................. 24
4.2.1.2 100 to 240 VAC / 110 to 250 VDC device version ................................................................ 25
4.2.2 SCALANCE XRM334 with 12 SFP/SFP+ slots ........................................................................ 26
4.2.2.1 24 V AC/DC device version.................................................................................................. 26
4.2.2.2 100 to 240 VAC / 110 to 250 VDC device version ................................................................ 27
4.3 Type designation................................................................................................................ 28
4.4 Components of the product ............................................................................................... 28
4.5 Spare parts ........................................................................................................................ 29
4.6 Accessories........................................................................................................................ 29
4.6.1 Installation ........................................................................................................................ 29
4.6.2 Serial USB cable ................................................................................................................. 30
4.6.3 Power cable....................................................................................................................... 30
4.6.4 Con󹪝guration and License PLUG......................................................................................... 30
4.6.5 SFP Transceivers................................................................................................................. 31
SCALANCE XRH-300/XRM-300
Equipment Manual, 10/2022, C79000-G8976-C546-01 3

4.7 LED display ........................................................................................................................ 33
4.7.1 Position ............................................................................................................................. 33
4.7.2 "A" LED .............................................................................................................................. 33
4.7.3 LEDs "DM1" and "DM2"....................................................................................................... 34
4.7.4 LEDs "L1" and "L2".............................................................................................................. 34
4.7.5 "P" LEDs ............................................................................................................................. 35
4.8 SELECT / SET button ........................................................................................................... 36
4.8.1 Position ............................................................................................................................. 36
4.8.2 Function ............................................................................................................................ 36
4.8.3 Setting the display mode.................................................................................................... 37
4.9 Con󹪝guration License PLUG................................................................................................ 37
4.9.1 Position ............................................................................................................................. 37
4.9.2 Function ............................................................................................................................ 38
5 Installing and removing....................................................................................................................... 39
5.1 Safety during installation ................................................................................................... 39
5.2 Types of installation ........................................................................................................... 42
5.3 19" rack mounting ............................................................................................................. 44
5.4 Four-point mounting.......................................................................................................... 46
5.5 Inserting and removing pluggable transceivers................................................................... 49
5.5.1 General notes for SFP transceivers...................................................................................... 49
5.5.2 Inserting a plug-in transceiver (SFP/SFP+)........................................................................... 49
5.5.3 Removing a pluggable transceiver (SFP/SFP+) ..................................................................... 50
5.6 Disassembly....................................................................................................................... 50
6 Connecting up ..................................................................................................................................... 51
6.1 Safety when connecting up................................................................................................ 51
6.2 Wiring rules ....................................................................................................................... 55
6.3 24 V AC/DC power supply................................................................................................... 56
6.4 Power supply 100 to 240 VAC / 110 to 250 VDC.................................................................. 60
6.5 Grounding ......................................................................................................................... 63
6.5.1 Functional ground ............................................................................................................. 64
6.5.2 Protective grounding (24 V AC/DC device versions) ............................................................. 64
6.5.3 Protective grounding (100 to 240 VAC / 110 to 250 VDC device versions)............................ 65
6.5.4 Connecting the grounding via a grounding bolt.................................................................. 66
6.6 Industrial Ethernet ............................................................................................................. 66
6.6.1 Electrical............................................................................................................................ 66
6.6.2 Optical............................................................................................................................... 69
6.6.3 Dependency between ports and ambient temperature (derating) ....................................... 70
6.7 Signaling contact ............................................................................................................... 71
6.8 USB console interface ........................................................................................................ 73
6.9 Replacing a CLP.................................................................................................................. 74
Table of contents
SCALANCE XRH-300/XRM-300
4Equipment Manual, 10/2022, C79000-G8976-C546-01

7 Maintenance and cleaning .................................................................................................................. 75
8 Troubleshooting................................................................................................................................... 77
8.1 Resetting the device to default settings with the button (in the startup phase).................... 77
8.2 Resetting the device to default settings with the button (during operation)......................... 78
8.3 Load a 󹪝rmware 󹪝le via TFTP............................................................................................... 79
9 Technical speci󹪝cations ....................................................................................................................... 81
9.1 SCALANCE XRH334/XRM334 with 8 SFP/SFP+ slots ............................................................. 81
9.1.1 24 V AC/DC device version.................................................................................................. 81
9.1.2 100 to 240 VAC / 110 to 250 VDC device version ................................................................ 84
9.2 SCALANCE XRM334 with 12 SFP/SFP+ slots ........................................................................ 87
9.2.1 24 V AC/DC device version.................................................................................................. 87
9.2.2 100 to 240 VAC / 110 to 250 VDC device version ................................................................ 90
9.3 Mechanical stability (in operation) ..................................................................................... 93
9.4 Cable lengths..................................................................................................................... 94
9.5 Switching properties.......................................................................................................... 94
10 Dimension drawings............................................................................................................................ 97
10.1 Dimension drawings SCALANCE XRM-300 .......................................................................... 97
10.2 Mounting brackets for use on ships .................................................................................... 98
11 Approvals........................................................................................................................................... 101
Index .................................................................................................................................................. 109
Table of contents
SCALANCE XRH-300/XRM-300
Equipment Manual, 10/2022, C79000-G8976-C546-01 5

Table of contents
SCALANCE XRH-300/XRM-300
6Equipment Manual, 10/2022, C79000-G8976-C546-01

Introduction 1
These operating instructions will help you to install and connect devices of the SCALANCE
XRH-300/XRM-300 product group.
The con󹪝guration and the integration of the devices in a network are not described in these
operating instructions.
1.1 Purpose
The SCALANCE XRH-300/XRM-300 switches are rack switches for installation in the 19" control
cabinet. Up to 12 SFP transceivers can be plugged in, thus enabling 󹪞exible network
construction and expansions. On both the 󹪝eld level and the control level, the control cabinet
switches perform networking with the distributed 󹪝eld devices and ensure high plant availability
with extensive diagnostics options and high transmission speeds.
The SCALANCE XRH-300 (Enhanced Environmental Conditions) switches also feature high
immunity and can be used in an extended temperature range.
1.2 Scope of validity
These operating instructions apply to the following devices:
• SCALANCE XRH334
• SCALANCE XRM334
Unless mentioned otherwise, the descriptions in these operating instructions refer to all devices
of the SCALANCE XRH-300/XRM-300 product group mentioned in the scope of validity.
1.3 Designations used
This section describes the conventions used in this document to clearly and e󹪟ciently portray
information.
Classi󹪝cation Description Terms used
Product line The product line includes all devices and variants of all product groups.
If information applies to all product groups within the product line, the
term SCALANCE X-300 is used.
SCALANCE X-300
Product group If information applies to all devices and versions of a product group, the
term SCALANCE XRH-300/SCALANCE XRM-300 is used.
SCALANCE XRH-300
SCALANCE XRM-300
Device If information applies to a speci󹪝c device, the device name with the num‐
ber of SFP-/SFP+ slots is used.
e.g. SCALANCE XRM334 with 8
SFP/SFP+ slots
Device version For a version of the device, the device name contains the special feature
of the version.
e.g. SCALANCE XRM334 AC/
DC 24 V device versions
SCALANCE XRH-300/XRM-300
Equipment Manual, 10/2022, C79000-G8976-C546-01 7

1.4 Supplementary documentation
The following additional documents may be of interest. Unless speci󹪝ed otherwise, the
documents are available in the Siemens Industry Online Support (SIOS) (https://
support.industry.siemens.com/cs/ww/en/ps/15247).
Note
The listed documents are the documents that were available at the time of the publication.
Newer versions of these documents or the associated products may be available. Additional
information is available in the SIOS or contact your Siemens customer service.
Product notes
Product notes are available online in the SIOS (https://support.industry.siemens.com/cs/ww/en/
ps/15247).
Manuals
Document title Link
"Command Line Interface (CLI) SINEC OS" con󹪝gu‐
ration manual
Visit (https://
support.industry.siemens.com/cs/ww/en/ps/
15298/man)
"Web User Interface (Web UI) SINEC OS" con󹪝gura‐
tion manual
Visit (https://
support.industry.siemens.com/cs/ww/en/ps/
15298/man)
"Transceiver SFP/SFP+/SCP/STP" Operating Instruc‐
tions
Visit (https://
support.industry.siemens.com/cs/ww/en/ps/
25547/man)
"Industrial Ethernet/PROFINET Industrial Ethernet"
System Manual
Visit (https://
support.industry.siemens.com/cs/ww/en/view/
27069465)
"Industrial Ethernet/PROFINET Passive Network
Components" System Manual
Visit (https://
support.industry.siemens.com/cs/ww/en/view/
84922825)
In the system manuals "Industrial Ethernet / PROFINET Industrial Ethernet" and "Industrial
Ethernet / PROFINET passive network components", you will 󹪝nd information on other SIMATIC
NET products that you can operate along with the devices of this product line in an Industrial
Ethernet network.
There, you will 󹪝nd among other things optical performance data of the communication
partners that you require for the design.
Catalogs
You will 󹪝nd the article numbers for the Siemens products of relevance here in the following
catalogs:
• SIMATIC Products for Totally Integrated Automation and Micro Automation, catalog ST 70
• Industry Mall - catalog and ordering system for automation and drive technology, Online
catalog (https://mall.industry.siemens.com/goos/WelcomePage.aspx?regionUrl=/
de&language=en)
Introduction
1.4 Supplementary documentation
SCALANCE XRH-300/XRM-300
8Equipment Manual, 10/2022, C79000-G8976-C546-01

You can request the catalogs and additional information from your Siemens representative.
1.5 Service & Support
Industry Online Support
In addition to the product documentation, you are supported by the comprehensive online
information platform of Siemens Industry Online Support at the following Internet address:
SIOS (https://support.industry.siemens.com/cs/de/en/)
Apart from news, there you will also 󹪝nd:
• Project information: Manuals, FAQs, downloads, application examples etc.
• Contacts, Technical Forum
• The option submitting a support query:
Support requests (https://support.industry.siemens.com/My/ww/en/requests)
• Our service o󹪜er:
Right across our products and systems, we provide numerous services that support you in
every phase of the life of your machine or system - from planning and implementation to
commissioning, through to maintenance and modernization.
You will 󹪝nd contact data on the Internet at the following address:
Contact partners (https://www.automation.siemens.com/aspa_app/?ci=yes&lang=en)
Pascal Janitschke
Siemens AG
Gleiwitzer Str. 555
90475 Nuremberg
Germany
1.6 SIMATIC NET glossary
Explanations of many of the specialist terms used in this documentation can be found in the
SIMATIC NET glossary.
You will 󹪝nd the SIMATIC NET glossary here:
• SIMATIC NET Manual Collection or product DVD
The DVD ships with certain SIMATIC NET products.
• On the Internet under the following address:
50305045 (https://support.industry.siemens.com/cs/ww/en/view/50305045)
1.7 Security information
Siemens provides products and solutions with industrial security functions that support the
secure operation of plants, systems, machines and networks.
Introduction
1.7 Security information
SCALANCE XRH-300/XRM-300
Equipment Manual, 10/2022, C79000-G8976-C546-01 9

In order to protect plants, systems, machines and networks against cyber threats, it is necessary
to implement – and continuously maintain – a holistic, state-of-the-art industrial security
concept. Siemens’ products and solutions constitute one element of such a concept.
Customers are responsible for preventing unauthorized access to their plants, systems,
machines and networks. Such systems, machines and components should only be connected to
an enterprise network or the internet if and to the extent such a connection is necessary and only
when appropriate security measures (e.g. 󹪝rewalls and/or network segmentation) are in place.
For additional information on industrial security measures that may be implemented, please
visit
https://www.siemens.com/industrialsecurity (https://www.siemens.com/industrialsecurity).
Siemens’ products and solutions undergo continuous development to make them more secure.
Siemens strongly recommends that product updates are applied as soon as they are available
and that the latest product versions are used. Use of product versions that are no longer
supported, and failure to apply the latest updates may increase customer’s exposure to cyber
threats.
To stay informed about product updates, subscribe to the Siemens Industrial Security RSS Feed
under
https://www.siemens.com/cert (https://www.siemens.com/cert).
1.8 Error/fault
If a fault develops, send the device to your SIEMENS representative for repair. Repairs on-site are
not permitted.
1.9 Decommissioning
Shut down the device properly to prevent unauthorized persons from accessing con󹪝dential
data in the device memory.
To do this, restore the factory settings on the device.
Also restore the factory settings on the storage medium.
1.10 Recycling and disposal
The products are low in pollutants, can be recycled and meet the requirements of the WEEE
directive 2012/19/EU for the disposal of electrical and electronic equipment.
Do not dispose of the products at public disposal sites.
For environmentally friendly recycling and the disposal of your old device contact a certi󹪝ed
disposal company for electronic scrap or your Siemens contact (Product return).
Note the di󹪜erent national regulations.
Introduction
1.10 Recycling and disposal
SCALANCE XRH-300/XRM-300
10 Equipment Manual, 10/2022, C79000-G8976-C546-01

1.11 Trademarks
The following and possibly other names not identi󹪝ed by the registered trademark sign ® are
registered trademarks of Siemens AG:
• SCALANCE
• SINEC
1.12 Electrostatic discharge
NOTICE
Electrostatic sensitive devices (ESD)
Electronic modules contain electrostatic sensitive components
These components can easily be destroyed if handled incorrectly.
Note the following instructions to avoid damage.
• Touch electronic modules only when you absolutely need to work on them.
• If electronic modules need to be touched, the body of the person involved must 󹪝rst be
electrostatically discharged and grounded.
• Do not bring electronic modules in contact with electrically isolating materials such as
plastic 󹪝lm, isolating table top pads or clothing made of synthetic 󹪝bers.
• Place the modules only on conductive surfaces.
• Pack, store and transport electronic modules and components only in conductive packaging
such as metalized plastic or metal containers, conductive foam or household aluminum foil.
Introduction
1.12 Electrostatic discharge
SCALANCE XRH-300/XRM-300
Equipment Manual, 10/2022, C79000-G8976-C546-01 11

Introduction
1.12 Electrostatic discharge
SCALANCE XRH-300/XRM-300
12 Equipment Manual, 10/2022, C79000-G8976-C546-01

Safety notices 2
Read the safety notices
Note the following safety notices. These relate to the entire working life of the device.
You should also read the safety notices relating to handling in the individual sections,
particularly in the sections "Installation" and "Connecting up".
CAUTION
To prevent injury and damage, read the manual before using the device.
Safety notices on use in hazardous areas
General safety notices relating to protection against explosion
WARNING
EXPLOSION HAZARD
Do not open the device when the supply voltage is turned on.
Safety instructions for use in hazardous locations according to UL/FM HazLoc
If you use the device under UL or FM HazLoc conditions, you must also adhere to the following
safety instructions in addition to the general safety instructions for protection against explosion:
This equipment is suitable for use in Class I, Division 2, Groups A, B, C and D or non-hazardous
locations only.
This equipment is suitable for use in Class I, Zone 2, Group IIC or non-hazardous locations only.
SCALANCE XRH-300/XRM-300
Equipment Manual, 10/2022, C79000-G8976-C546-01 13

Safety notices
SCALANCE XRH-300/XRM-300
14 Equipment Manual, 10/2022, C79000-G8976-C546-01

Security recommendations 3
NOTICE
Information security
Connect to the device and change the standard password for the user set in the factory "admin"
and "" before you operate the device.
3.1 Security recommendations
To prevent unauthorized access to the device and/or network, note the following security
recommendations.
General
• Periodically audit the device to make sure it complies with these recommendations and/or
any internal security policies.
• Evaluate the security of your site and use a cell protection concept with suitable products.
For more information, visit Industrial Security Website (https://www.siemens.com/
industrialsecurity).
• Review the user documentation for other Siemens products used along with the device for
further security recommendations.
• Use remote system logging to forward system logs to a central logging server. Make sure the
server is within the protected network and check the logs regularly to identify potential
security breaches/vulnerabilities.
For more information, refer to "Supplementary documentation (Page 8)".
Authentication
NOTICE
Accessibility hazard - risk of data loss
Do not misplace passwords for the device. Access to the device can only be restored by resetting
it to factory defaults, which will remove all con󹪝guration data.
• Replace the default passwords for all user accounts, access modes and applications (where
applicable) before the device is deployed.
• Use strong passwords. Avoid weak passwords (e.g. password1, 123456789, abcdefgh) or
repeated characters (e.g. abcabc).
This recommendation also applies to symmetric passwords/keys con󹪝gured on the device.
• Make sure passwords are protected and not shared with unauthorized personnel.
• Do not re-use passwords across di󹪜erent user names and systems.
SCALANCE XRH-300/XRM-300
Equipment Manual, 10/2022, C79000-G8976-C546-01 15

• Record passwords in a safe, secure, o󹪜-line location for future retrieval should they be
misplaced.
• Change passwords regularly and often.
• When RADIUS is utilized for user authentication, make sure all communications are within
the security perimeter or protected by a secure channel.
• Be aware of any link layer protocols that do not provide any inherent authentication between
endpoints, such as ARP in IPv4. A malicious entity could exploit weaknesses in these protocols
to attack hosts, switches, and routers connected to your Layer 2 network, for example, by
poisoning the ARP caches of systems within the subnet and subsequently intercepting
tra󹪟c. Appropriate safeguards against non-secure Layer 2 protocols, such as securing
physical access to the local network and using secure higher layer protocols, should be taken
to prevent unauthorized access to the network.
Certi󹪝cates and keys
• Immediately change all certi󹪝cates and keys upon suspision of a security breach.
• SSH and SSL keys are accessible to admin users. Make sure to take appropriate precautions
when shipping the device beyond the boundaries of the trusted environment:
– Replace the SSH and SSL keys with throwaway keys prior to shipping.
– Take the existing SSH and SSL keys out of service. When the device returns, create and
program new keys for the device.
• Use password-protected certi󹪝cates that are in PKCS #12 format.
• Use certi󹪝cates with a key length of 4096 bits.
• Before returning the device to Siemens for repair, replace the current certi󹪝cates and keys
with temporary throwaway certi󹪝cates and keys that can be destroyed upon the device's
return.
• Verify certi󹪝cates and 󹪝ngerprints on the server and client to prevent Man-in-the-Middle
(MitM) attacks.
Physical/remote access
• Only operate the devices in a protected network area. Attackers cannot access internal data
from outside when the internal and external network are disconnected.
• Restrict physical access to the device to only trusted personnel. A malicious user in possession
of the device's removable media could extract critical information, such as certi󹪝cates, keys,
etc. (user passwords are protected by hash codes), or reprogram the media.
• Control access to the serial console to the same degree as any physical access to the device.
• It is highly recommended to keep Brute Force Attack (BFA) protection enabled to prevent a
third-party from obtaining unauthorized access to the device.
For more information, refer to "Supplementary documentation (Page 8)".
• For communication via non-secure networks, use additional devices with VPN functionality
to encrypt and authenticate communications.
• When securely connecting to a server (e.g. in the case of a secure upgrade), make sure the
server side is con󹪝gured with strong ciphers and protocols.
Security recommendations
3.1 Security recommendations
SCALANCE XRH-300/XRM-300
16 Equipment Manual, 10/2022, C79000-G8976-C546-01

• Terminate management connections (e.g. HTTP, HTTPS, SSH, etc.) properly.
• Make sure the device is fully decommissioned before taking the device out of service.
For more information, refer to "Supplementary documentation (Page 8)".
Secure/non-secure protocols
• Use secure protocols when access to the device is not prevented by physical protection
measures.
• Disable or limit the use of non-secure protocols. While some protocols are secure (e.g. HTTPS,
SSH, 802.1X, etc.) , others were not designed for secure applications (e.g. SNMPv1/v2c, RSTP,
etc.).
Appropriate safeguards against non-secure protocols should be taken to prevent
unauthorized access to the device/network.
• If non-secure protocols and services are required, make sure the device is operated within a
protected network area.
• When a secure alternative is available for a protocol, use the secure version instead. For
example:
– Use HTTPS instead of HTTP
– Use SNMPv3 instead of SNMPv1/v2c
• Avoid or limit use of the following:
– Non-authenticated and unencrypted protocols
– Link Layer Discovery Protocol (LLDP)
• After commissioning, make sure Discovery and Con󹪝guration Protocol (DCP) access rights
are set to read-only.
Hardware/software
• Limit critical applications and access to management services to private networks.
Connecting a SINEC OS device to the Internet is possible. However, the utmost care should
be taken to protect the device and the network behind it using secure means, such as a
󹪝rewall and IPsec.
• Whenever possible, use VLANs to protect against Denial of Service (DoS) attacks and
unauthorized access.
• Select services are enabled by default in SINEC OS. It is recommended to only enable the
minimum services that are required for your setup.
For more information about available services, "Supplementary documentation (Page 8)".
• Use the latest Web browser version compatible with SINEC OS to make sure the most secure
ciphers available are employed. Additionally, 1/n-1 record splitting is enabled in the latest
Web browser versions of Mozilla Firefox, Google Chrome and Microsoft Edge, and mitigates
against attacks such as SSL/TLS Protocol Initialization Vector Implementation Information
Disclosure Vulnerability (e.g. BEAST).
Security recommendations
3.1 Security recommendations
SCALANCE XRH-300/XRM-300
Equipment Manual, 10/2022, C79000-G8976-C546-01 17

• Make sure the latest 󹪝rmware version is installed, including all security-related patches.
For the latest information on security patches for Siemens products, visit the Industrial
Security (https://www.siemens.com/industrialsecurity) website or the ProductCert Security
Advisories (https://www.siemens.com/cert/en/cert-security-advisories.htm) website.
Updates to the Siemens Product Security Advisories can be obtained by subscribing to the RSS
feed on the Siemens ProductCERT Security Advisories website, or by following @ProductCert
on Twitter.
• Only enable services that will be used on the device, including physical ports. Unused
physical ports could potentially be used to gain access to the network behind the device.
• For optimal security, use the authentication and encryption mechanisms in SNMPv3
whenever possible, and apply strong passwords.
•Con󹪝guration 󹪝les can be downloaded from the device. Make sure con󹪝guration 󹪝les are
properly protected. For instance, digitally sign and encrypt the 󹪝les, store them in a secure
place, and only transfer con󹪝guration 󹪝les via secure communication channels.
Con󹪝guration 󹪝les can be password-protected when downloaded. For information about
protecting a con󹪝guration 󹪝le with a password, refer to "Supplementary documentation
(Page 8)".
• When using SNMP (Simple Network Management Protocol):
–Con󹪝gure SNMP to raise a trap upon authentication failures.
For more information, refer to "Supplementary documentation (Page 8)".
– Make sure the default community strings are changed to unique values.
– Use SNMPv3 whenever possible. SNMPv1 and SNMPv2c are considered non-secure and
should only be used when necessary.
– Whenever possible, prevent write access.
3.2 Available services
The following is a list of all available protocols or services and their ports through which the
device can be accessed, including the following information:
•Service
The service supported by the device.
•Protocol
The protocol used by the service.
•Port number
The port number assigned to the service.
•Default status
The default state of the service (i.e. Open, Closed, Active)
•Con󹪝gurable service
Speci󹪝es whether or not the service can be con󹪝gured.
•Con󹪝gurable port number
Speci󹪝es whether the port number is con󹪝gurable.
Security recommendations
3.2 Available services
SCALANCE XRH-300/XRM-300
18 Equipment Manual, 10/2022, C79000-G8976-C546-01

•Authentication
Speci󹪝es whether an authentication of the communication partner takes place or whether
an authentication can be con󹪝gured.
•Encryption
Speci󹪝es whether the transfer is encrypted or whether the encryption is con󹪝gurable.
Service Protocol Port
number
Default
status
Con󹪝gurable
service
Con󹪝gura‐
ble port
number
Authentication Encryption
PROFINET UDP 34964 Open - - - -
SNMPv1/v2c UDP 161 Closed ✓ ✓ Con󹪝gurable -
SNMPv3 UDP 161 Closed ✓ ✓ Con󹪝gurable Con󹪝gurable
SSH TCP 22 Open ✓ ✓ ✓ ✓
SSH/NETCONF TCP 830 Open ✓ ✓ ✓ ✓
DCP - - Active ✓ - - -
LLDP - - Active ✓ - - -
Ping ICMP - Active - - - -
NTP UDP 123 Closed ✓ - - -
Ethernet/IP TCP 44818 Closed ✓ - - -
HTTP TCP 80 Open ✓ ✓ ✓ -
HTTPS TCP 443 Open ✓ ✓ ✓ ✓
Security recommendations
3.2 Available services
SCALANCE XRH-300/XRM-300
Equipment Manual, 10/2022, C79000-G8976-C546-01 19

Security recommendations
3.2 Available services
SCALANCE XRH-300/XRM-300
20 Equipment Manual, 10/2022, C79000-G8976-C546-01