Siemens SIMATIC NET SCALANCE XC-300 User manual

SIMATIC NET
Industrial Ethernet Switches
SCALANCE XC-300
Operating Instructions
10/2022
C79000-G8976-C584-01
Introduction 1
Safety notices 2
Security recommendations 3
Description of the device 4
Installing and removing 5
Connecting up 6
Maintenance and cleaning 7
Troubleshooting 8
Technical speci󹪝cations 9
Dimension drawings 10
Certi󹪝cations and approvals 11

Legal information
Warning notice system
This manual contains notices you have to observe in order to ensure your personal safety, as well as to prevent damage
to property. The notices referring to your personal safety are highlighted in the manual by a safety alert symbol, notices
referring only to property damage have no safety alert symbol. These notices shown below are graded according to
the degree of danger.
DANGER
indicates that death or severe personal injury will result if proper precautions are not taken.
WARNING
indicates that death or severe personal injury may result if proper precautions are not taken.
CAUTION
indicates that minor personal injury can result if proper precautions are not taken.
NOTICE
indicates that property damage can result if proper precautions are not taken.
If more than one degree of danger is present, the warning notice representing the highest degree of danger will be
used. A notice warning of injury to persons with a safety alert symbol may also include a warning relating to property
damage.
Quali󹪝ed Personnel
The product/system described in this documentation may be operated only by personnel quali󹪝ed for the speci󹪝c
task in accordance with the relevant documentation, in particular its warning notices and safety instructions.
Quali󹪝ed personnel are those who, based on their training and experience, are capable of identifying risks and
avoiding potential hazards when working with these products/systems.
Proper use of Siemens products
Note the following:
WARNING
Siemens products may only be used for the applications described in the catalog and in the relevant technical
documentation. If products and components from other manufacturers are used, these must be recommended or
approved by Siemens. Proper transport, storage, installation, assembly, commissioning, operation and maintenance
are required to ensure that the products operate safely and without any problems. The permissible ambient
conditions must be complied with. The information in the relevant documentation must be observed.
Trademarks
All names identi󹪝ed by ® are registered trademarks of Siemens AG. The remaining trademarks in this publication may
be trademarks whose use by third parties for their own purposes could violate the rights of the owner.
Disclaimer of Liability
We have reviewed the contents of this publication to ensure consistency with the hardware and software described.
Since variance cannot be precluded entirely, we cannot guarantee full consistency. However, the information in this
publication is reviewed regularly and any necessary corrections are included in subsequent editions.
Siemens AG
Digital Industries
Postfach 48 48
90026 NÜRNBERG
GERMANY
C79000-G8976-C584-01
Ⓟ 09/2022 Subject to change
Copyright © Siemens AG 2022.
All rights reserved

Table of contents
1 Introduction ........................................................................................................................................... 7
1.1 Scope of validity .................................................................................................................. 7
1.2 Designations used................................................................................................................ 7
1.3 Additional documentation ................................................................................................... 8
1.4 SIMATIC NET glossary........................................................................................................... 9
1.5 Security information ............................................................................................................ 9
1.6 Error/fault .......................................................................................................................... 10
1.7 Decommissioning .............................................................................................................. 10
1.8 Recycling and disposal ....................................................................................................... 10
1.9 Trademarks........................................................................................................................ 10
1.10 Electrostatic discharge ....................................................................................................... 11
2 Safety notices ...................................................................................................................................... 13
3 Security recommendations.................................................................................................................. 15
3.1 Security recommendations................................................................................................. 15
3.2 Available services............................................................................................................... 20
4 Description of the device..................................................................................................................... 23
4.1 Article numbers ................................................................................................................. 23
4.2 Device views...................................................................................................................... 25
4.2.1 SCALANCE XC316-8........................................................................................................... 25
4.2.2 SCALANCE XC319-4........................................................................................................... 26
4.2.3 SCALANCE XC324-4/XC324-4EEC ....................................................................................... 27
4.2.4 SCALANCE XC332 .............................................................................................................. 28
4.3 Type designation................................................................................................................ 29
4.4 Components of the product ............................................................................................... 29
4.5 Spare parts ........................................................................................................................ 30
4.5.1 Terminal blocks (2-pin) ...................................................................................................... 30
4.5.2 Con󹪝guration and License PLUG......................................................................................... 30
4.6 Accessories........................................................................................................................ 31
4.6.1 Energy cable...................................................................................................................... 31
4.6.2 Serial USB cable ................................................................................................................. 31
4.6.3 Plug-in transceiver ............................................................................................................. 31
4.6.4 Terminal blocks (4-pin) ...................................................................................................... 33
4.7 LED display ........................................................................................................................ 33
4.7.1 Position and arrangement.................................................................................................. 33
4.7.2 "F" LED............................................................................................................................... 33
SCALANCE XC-300
Operating Instructions, 10/2022, C79000-G8976-C584-01 3

4.7.3 "RM" LED............................................................................................................................ 34
4.7.4 "SB" LED............................................................................................................................. 34
4.7.5 LEDs "DM1" and "DM2"....................................................................................................... 34
4.7.6 LEDs "L1" and "L2".............................................................................................................. 35
4.7.7 "P" LEDs ............................................................................................................................. 36
4.8 SELECT/SET button............................................................................................................. 38
4.8.1 Position ............................................................................................................................. 38
4.8.2 Function ............................................................................................................................ 38
4.8.3 Setting the display mode.................................................................................................... 39
4.9 Con󹪝guration License PLUG................................................................................................ 39
4.9.1 Position ............................................................................................................................. 39
4.9.2 Function ............................................................................................................................ 40
5 Installing and removing....................................................................................................................... 41
5.1 Safety during mounting ..................................................................................................... 41
5.2 Types of installation ........................................................................................................... 44
5.3 Mounting on DIN rails ........................................................................................................ 45
5.4 Installation on a standard S7-300 rail ................................................................................. 46
5.5 Installation on a standard S7-1500 rail ............................................................................... 48
5.6 Wall mounting ................................................................................................................... 49
5.7 Changing the position of the securing bar .......................................................................... 50
5.8 Inserting and removing pluggable transceivers................................................................... 51
5.8.1 General notes for SFP transceivers...................................................................................... 51
5.8.2 Inserting a plug-in transceiver (SFP/SFP+)........................................................................... 51
5.8.3 Removing a pluggable transceiver (SFP/SFP+) ..................................................................... 52
5.9 Disassembly....................................................................................................................... 52
6 Connecting up ..................................................................................................................................... 53
6.1 Safety when connecting up................................................................................................ 53
6.2 Wiring rules ....................................................................................................................... 58
6.3 Power supply ..................................................................................................................... 58
6.4 Functional ground ............................................................................................................. 60
6.5 Industrial Ethernet ............................................................................................................. 61
6.5.1 Electrical............................................................................................................................ 61
6.5.2 Optical............................................................................................................................... 64
6.6 Signaling contact ............................................................................................................... 64
6.7 USB console interface ........................................................................................................ 66
6.8 Replacing a CLP.................................................................................................................. 67
7 Maintenance and cleaning .................................................................................................................. 69
8 Troubleshooting................................................................................................................................... 71
8.1 Resetting the device to default settings with the button (in the startup phase).................... 71
8.2 Resetting the device to default settings with the button (during operation)......................... 72
Table of contents
SCALANCE XC-300
4Operating Instructions, 10/2022, C79000-G8976-C584-01

8.3 Loading a 󹪝rmware 󹪝le via TFTP.......................................................................................... 73
9 Technical speci󹪝cations ....................................................................................................................... 75
9.1 Technical speci󹪝cations of SCALANCE XC316-8................................................................... 75
9.2 Technical speci󹪝cations of SCALANCE XC319-4................................................................... 78
9.3 Technical speci󹪝cations of SCALANCE XC324-4 and SCALANCE XC324-4EEC ....................... 81
9.4 Technical speci󹪝cations of SCALANCE XC332...................................................................... 84
9.5 Mechanical stability (in operation) ..................................................................................... 86
9.6 Cable lengths..................................................................................................................... 86
9.7 Switching properties.......................................................................................................... 86
9.8 RF radiation according to NAMUR NE21.............................................................................. 87
10 Dimension drawings............................................................................................................................ 89
10.1 Dimension drawings SCALANCE XC-300 ............................................................................. 89
11 Certi󹪝cations and approvals................................................................................................................ 93
Index .................................................................................................................................................. 101
Table of contents
SCALANCE XC-300
Operating Instructions, 10/2022, C79000-G8976-C584-01 5

Table of contents
SCALANCE XC-300
6Operating Instructions, 10/2022, C79000-G8976-C584-01

Introduction 1
These operating instructions will help you to install and connect devices of the SCALANCE
XC-300 product group.
The con󹪝guration and the integration of the devices in a network are not described in these
operating instructions.
1.1 Scope of validity
These operating instructions apply to the following devices:
• SCALANCE XC316-8
• SCALANCE XC319-4
• SCALANCE XC324-4
• SCALANCE XC324-4EEC
• SCALANCE XC332
Unless mentioned otherwise, the descriptions in these operating instructions refer to all devices
of the SCALANCE XC-300 product group speci󹪝ed in the scope of validity.
1.2 Designations used
This section describes the conventions used in this document to clearly and e󹪟ciently portray
information.
Classi󹪝cation Description Terms used
Product line The product line includes all devices and variants of all product groups.
If information applies to all product groups within the product line, the term
SCALANCE X-300 is used.
SCALANCE X-300
Product group If information applies to all devices and versions of a product group, the term
SCALANCE XC-300 is used.
SCALANCE XC-300
Device If information relates to a speci󹪝c device, the device name is used.
You can recognize the EEC variants by the su󹪟x "EEC" in the type designa‐
tion.
e.g. SCALANCE XC324-4
SCALANCE XC-300
Operating Instructions, 10/2022, C79000-G8976-C584-01 7

1.3 Additional documentation
The following additional documents may be of interest. Unless speci󹪝ed otherwise, the
documents are available in the Siemens Industry Online Support (SIOS) (https://
support.industry.siemens.com/cs/ww/en/ps/29061).
Note
The listed documents are the documents that were available at the time of the publication.
Newer versions of these documents or the associated products may be available. Additional
information is available in the SIOS or contact your Siemens customer service.
Product notes
Product notes are available online in the SIOS (https://support.industry.siemens.com/cs/ww/en/
ps/15247).
Manuals
Document title Link
Con󹪝guration manual "SIMATIC NET: Industrial
Ethernet Switches SCALANCE XB-200/XC-200/
XF-200BA/XP-200/XR-300WG Command Line Inter‐
face (CLI)"
Visit (https://
support.industry.siemens.com/cs/ww/en/view/
109799819)
Con󹪝guration manual "SIMATIC NET: Industrial
Ethernet Switches SCALANCE XB-200/XC-200/
XF-200BA/XP-200/XR-300WG Web Based Manage‐
ment (WBM)"
Visit (https://
support.industry.siemens.com/cs/ww/en/view/
109799818)
"Transceiver SFP/SFP+/SCP/STP" Operating Instruc‐
tions
Visit (https://
support.industry.siemens.com/cs/ww/en/ps/
25547/man)
"Industrial Ethernet/PROFINET Industrial Ethernet"
System Manual
Visit (https://
support.industry.siemens.com/cs/ww/en/view/
27069465)
"Industrial Ethernet/PROFINET Passive Network
Components" System Manual
Visit (https://
support.industry.siemens.com/cs/ww/en/view/
84922825)
In the system manuals "Industrial Ethernet / PROFINET Industrial Ethernet" and "Industrial
Ethernet / PROFINET passive network components", you will 󹪝nd information on other SIMATIC
NET products that you can operate along with the devices of this product line in an Industrial
Ethernet network.
There, you will 󹪝nd among other things optical performance data of the communication
partners that you require for the design.
Introduction
1.3 Additional documentation
SCALANCE XC-300
8Operating Instructions, 10/2022, C79000-G8976-C584-01

Catalogs
You will 󹪝nd the article numbers for the Siemens products of relevance here in the following
catalogs:
• SIMATIC NET Industrial Communication / Industrial Identi󹪝cation, catalog IK PI
• SIMATIC Products for Totally Integrated Automation and Micro Automation, catalog ST 70
• Industry Mall - catalog and ordering system for automation and drive technology, Online
catalog (https://mall.industry.siemens.com/goos/WelcomePage.aspx?regionUrl=/
de&language=en)
You can request the catalogs and additional information from your Siemens representative.
1.4 SIMATIC NET glossary
Explanations of many of the specialist terms used in this documentation can be found in the
SIMATIC NET glossary.
You will 󹪝nd the SIMATIC NET glossary here:
• SIMATIC NET Manual Collection or product DVD
The DVD ships with certain SIMATIC NET products.
• On the Internet under the following address:
50305045 (https://support.industry.siemens.com/cs/ww/en/view/50305045)
1.5 Security information
Siemens provides products and solutions with industrial security functions that support the
secure operation of plants, systems, machines and networks.
In order to protect plants, systems, machines and networks against cyber threats, it is necessary
to implement – and continuously maintain – a holistic, state-of-the-art industrial security
concept. Siemens’ products and solutions constitute one element of such a concept.
Customers are responsible for preventing unauthorized access to their plants, systems,
machines and networks. Such systems, machines and components should only be connected to
an enterprise network or the internet if and to the extent such a connection is necessary and only
when appropriate security measures (e.g. 󹪝rewalls and/or network segmentation) are in place.
For additional information on industrial security measures that may be implemented, please
visit
https://www.siemens.com/industrialsecurity (https://www.siemens.com/industrialsecurity).
Siemens’ products and solutions undergo continuous development to make them more secure.
Siemens strongly recommends that product updates are applied as soon as they are available
and that the latest product versions are used. Use of product versions that are no longer
supported, and failure to apply the latest updates may increase customer’s exposure to cyber
threats.
To stay informed about product updates, subscribe to the Siemens Industrial Security RSS Feed
under
https://www.siemens.com/cert (https://www.siemens.com/cert).
Introduction
1.5 Security information
SCALANCE XC-300
Operating Instructions, 10/2022, C79000-G8976-C584-01 9

1.6 Error/fault
If a fault develops, send the device to your SIEMENS representative for repair. Repairs on-site are
not permitted.
1.7 Decommissioning
Shut down the device properly to prevent unauthorized persons from accessing con󹪝dential
data in the device memory.
To do this, restore the factory settings on the device.
Also restore the factory settings on the storage medium.
1.8 Recycling and disposal
The products are low in pollutants, can be recycled and meet the requirements of the WEEE
directive 2012/19/EU for the disposal of electrical and electronic equipment.
Do not dispose of the products at public disposal sites.
For environmentally friendly recycling and the disposal of your old device contact a certi󹪝ed
disposal company for electronic scrap or your Siemens contact (Product return (https://
support.industry.siemens.com/cs/ww/en/view/109479891)).
Note the di󹪜erent national regulations.
1.9 Trademarks
The following and possibly other names not identi󹪝ed by the registered trademark sign ® are
registered trademarks of Siemens AG:
• SCALANCE
• SINEC
Introduction
1.9 Trademarks
SCALANCE XC-300
10 Operating Instructions, 10/2022, C79000-G8976-C584-01

1.10 Electrostatic discharge
NOTICE
Electrostatic sensitive devices (ESD)
Electronic modules contain electrostatic sensitive components
These components can easily be destroyed if handled incorrectly.
Note the following instructions to avoid damage.
• Touch electronic modules only when you absolutely need to work on them.
• If electronic modules need to be touched, the body of the person involved must 󹪝rst be
electrostatically discharged and grounded.
• Do not bring electronic modules in contact with electrically isolating materials such as
plastic 󹪝lm, isolating table top pads or clothing made of synthetic 󹪝bers.
• Place the modules only on conductive surfaces.
• Pack, store and transport electronic modules and components only in conductive packaging
such as metalized plastic or metal containers, conductive foam or household aluminum foil.
Introduction
1.10 Electrostatic discharge
SCALANCE XC-300
Operating Instructions, 10/2022, C79000-G8976-C584-01 11

Introduction
1.10 Electrostatic discharge
SCALANCE XC-300
12 Operating Instructions, 10/2022, C79000-G8976-C584-01

Safety notices 2
Read the safety notices
Note the following safety notices. These relate to the entire working life of the device.
You should also read the safety notices relating to handling in the individual sections,
particularly in the sections "Installation" and "Connecting up".
CAUTION
To prevent injury and damage, read the manual before using the device.
Safety notices on use in hazardous areas
General safety notices relating to protection against explosion
WARNING
EXPLOSION HAZARD
Do not open the device when the supply voltage is turned on.
Safety instructions for use in hazardous locations according to UL/FM HazLoc
If you use the device under UL or FM HazLoc conditions, you must also adhere to the following
safety instructions in addition to the general safety instructions for protection against explosion:
This equipment is suitable for use in Class I, Division 2, Groups A, B, C and D or non-hazardous
locations only.
This equipment is suitable for use in Class I, Zone 2, Group IIC or non-hazardous locations only.
SCALANCE XC-300
Operating Instructions, 10/2022, C79000-G8976-C584-01 13

Safety notices
SCALANCE XC-300
14 Operating Instructions, 10/2022, C79000-G8976-C584-01

Security recommendations 3
NOTICE
Information security
Connect to the device and change the standard password for the user set in the factory "admin"
and "" before you operate the device.
3.1 Security recommendations
To prevent unauthorized access to the device and/or network, observe the following security
recommendations.
General
• Check the device regularly to ensure that these recommendations and/or other internal
security policies are complied with.
• Evaluate the security of your location and use a cell protection concept with suitable products
(https://www.siemens.com/industrialsecurity).
• When the internal and external network are disconnected, an attacker cannot access internal
data from the outside. Therefore operate the device only within a protected network area.
• No product liability will be accepted for operation in a non-secure infrastructure.
• Use VPN to encrypt and authenticate communication from and to the devices.
• For data transmission via a non-secure network, use an encrypted VPN tunnel (IPsec,
OpenVPN).
• Separate connections correctly (WBM, SSH etc.).
• Check the user documentation of other Siemens products that are used together with the
device for additional security recommendations.
• Using remote logging, ensure that the system protocols are forwarded to a central logging
server. Make sure that the server is within the protected network and check the protocols
regularly for potential security violations or vulnerabilities.
SCALANCE XC-300
Operating Instructions, 10/2022, C79000-G8976-C584-01 15

Authentication
Note
Accessibility risk - Risk of data loss
Do not lose the passwords for the device. Access to the device can only be restored by resetting
the device to factory settings which completely removes all con󹪝guration data.
• Replace the default passwords for all user accounts, access modes and applications (if
applicable) before you use the device.
•De󹪝ne rules for the assignment of passwords.
• Use passwords with a high password strength. Avoid weak passwords, (e.g. password1,
123456789, abcdefgh) or recurring characters (e.g. abcabc).
This recommendation also applies to symmetrical passwords/keys con󹪝gured on the device.
• Make sure that passwords are protected and only disclosed to authorized personnel.
• Do not use the same passwords for multiple user names and systems.
• Store the passwords in a safe location (not online) to have them available if they are lost.
• Regularly change your passwords to increase security.
• A password must be changed if it is known or suspected to be known by unauthorized
persons.
• When user authentication is performed via RADIUS, make sure that all communication takes
place within the security environment or is protected by a secure channel.
• Watch out for link layer protocols that do not o󹪜er their own authentication between
endpoints, such as ARP or IPv4. An attacker could use vulnerabilities in these protocols to
attack hosts, switches and routers connected to your layer 2 network, for example, through
manipulation (poisoning) of the ARP caches of systems in the subnet and subsequent
interception of the data tra󹪟c. Appropriate security measures must be taken for non-secure
layer 2 protocols to prevent unauthorized access to the network. Physical access to the local
network can be secured or secure, higher layer protocols can be used, among other things.
Certi󹪝cates and keys
• There is a preset SSL/TLS (RSA) certi󹪝cate with 4096 bit key length in the device. Replace this
certi󹪝cate with a user-generated, high-quality certi󹪝cate with key. Use a certi󹪝cate signed by
a reliable external or internal certi󹪝cation authority. You can install the certi󹪝cate via the
WBM ("System > Load and Save").
• Use certi󹪝cates with a key length of 4096 bits.
• Use the certi󹪝cation authority including key revocation and management to sign the
certi󹪝cates.
• Make sure that user-de󹪝ned private keys are protected and inaccessible to unauthorized
persons.
• If there is a suspected security violation, change all certi󹪝cates and keys immediately.
• Use password-protected certi󹪝cates in the format "PKCS #12".
Security recommendations
3.1 Security recommendations
SCALANCE XC-300
16 Operating Instructions, 10/2022, C79000-G8976-C584-01

• Verify certi󹪝cates based on the 󹪝ngerprint on the server and client side to prevent "man in the
middle" attacks. Use a second, secure transmission path for this.
• Before sending the device to Siemens for repair, replace the current certi󹪝cates and keys with
temporary disposable certi󹪝cates and keys, which can be destroyed when the device is
returned.
Physical/remote access
• Operate the devices only within a protected network area. Attackers cannot access internal
data from the outside when the internal and the external network are separate from each
other.
• Limit physical access to the device exclusively to trusted personnel.
The memory card or the PLUG (C-PLUG, KEY-PLUG, CLP) contains sensitive data such as
certi󹪝cates and keys that can be read out and modi󹪝ed. An attacker with control of the
device's removable media could extract critical information such as certi󹪝cates, keys, etc. or
reprogram the media.
• Lock unused physical ports on the device. Unused ports can be used to gain forbidden access
to the plant.
• We highly recommend that you keep the protection from brute force attacks (BFA) activated
to prevent third parties from gaining access to the device. For more information, see the
con󹪝guration manuals, section "Brute Force Prevention (Page 8)".
• For communication via non-secure networks, use additional devices with VPN functionality
to encrypt and authenticate communication.
• When you establish a secure connection to a server (e.g. for an upgrade), make sure that
strong encryption methods and protocols are con󹪝gured for the server.
• Terminate the management connections (e.g. HTTP, HTTPS, SSH) properly.
• Make sure that the device has been powered down completely before you decommission it.
For more information, refer to "Decommissioning (Page 10)".
• We recommend formatting a PLUG that is not being used.
Hardware / Software
• Use VLANs whenever possible as protection against denial-of-service (DoS) attacks and
unauthorized access.
• Restrict access to the device by setting 󹪝rewall rules or rules in an access control list (ACL).
• Selected services are enabled by default in the 󹪝rmware. It is recommended to enable only
the services that are absolutely necessary for your installation.
For more information on available services, see "List of available services (Page 20)".
• To ensure you are using the most secure encryption methods available, use the latest web
browser version compatible with the product. Also, the latest web browser versions of
Mozilla Firefox, Google Chrome, and Microsoft Edge have 1/n-1 record splitting enabled,
which reduces the risk of attacks such as SSL/TLS Protocol Initialization Vector
Implementation Information Disclosure Vulnerability (for example, BEAST).
Security recommendations
3.1 Security recommendations
SCALANCE XC-300
Operating Instructions, 10/2022, C79000-G8976-C584-01 17

• Ensure that the latest 󹪝rmware version is installed, including all security-related patches.
You can 󹪝nd the latest information on security patches for Siemens products at the Industrial
Security (https://www.siemens.com/industrialsecurity) or ProductCERT Security Advisories
(https://www.siemens.com/cert/en/cert-security-advisories.htm) website.
For updates on Siemens product security advisories, subscribe to the RSS feed on the
ProductCERT Security Advisories website or follow @ProductCert on Twitter.
• Enable only those services that are used on the device, including physical ports. Free physical
ports can potentially be used to gain access to the network behind the device.
• Use the authentication and encryption mechanisms of SNMPv3 if possible. Use strong
passwords.
•Con󹪝guration 󹪝les can be downloaded from the device. Ensure that con󹪝guration 󹪝les are
adequately protected.
Con󹪝guration 󹪝les can be password protected during download. You enter passwords on the
WBM page "System > Load & Save > Passwords".
• When using SNMP (Simple Network Management Protocol):
–Con󹪝gure SNMP to generate a noti󹪝cation when authentication errors occur.
For more information, see WBM "System > SNMP > Noti󹪝cations".
– Ensure that the default community strings are changed to unique values.
– Use SNMPv3 whenever possible. SNMPv1 and SNMPv2c are considered non-secure and
should only be used when absolutely necessary.
– If possible, prevent write access.
Interfaces security
• Disable unused interfaces.
• Use IEEE 802.1X for interface authentication.
• Use the function "Locked Ports" to block interfaces for unknown nodes.
• Use the con󹪝guration options of the interfaces, e.g. the "Edge Type".
•Con󹪝gure the receive ports so that they discard all untagged frames ("Tagged Frames Only").
Security recommendations
3.1 Security recommendations
SCALANCE XC-300
18 Operating Instructions, 10/2022, C79000-G8976-C584-01

Secure/non-secure protocols and services
• Avoid or disable non-secure protocols and services, for example HTTP, Telnet and TFTP. For
historical reasons, these protocols are available, however not intended for secure
applications. Use non-secure protocols on the device with caution.
• Check whether use of the following protocols and services is necessary:
– Non authenticated and unencrypted ports
– MRP, HRP
– IGMP snooping
– LLDP
– DCP
– Syslog
– RADIUS
– DHCP Options 66/67
– TFTP
– GMRP and GVRP
• The following protocols provide secure alternatives:
– HTTP → HTTPS
– Telnet → SSH
– SNMPv1/v2c → SNMPv3
Check whether use of SNMPv1/v2c. is necessary. SNMPv1/v2c is classi󹪝ed as non-secure.
Use the option of preventing write access. The device provides you with suitable setting
options.
If SNMP is enabled, change the community names. If no unrestricted access is necessary,
restrict access with SNMP.
Use the authentication and encryption mechanisms of SNMPv3.
– TFTP → SFTP
– NTP → NTPsecure
• Use secure protocols when access to the device is not prevented by physical protection
measures.
• If you require non-secure protocols and services, operate the device only within a protected
network area.
• Restrict the services and protocols available to the outside to a minimum.
• For the DCP function, enable the "Read Only" mode after commissioning.
• If you use RADIUS for management access to the device, activate secure protocols and
services.
Security recommendations
3.1 Security recommendations
SCALANCE XC-300
Operating Instructions, 10/2022, C79000-G8976-C584-01 19

3.2 Available services
The table includes the following columns:
•Service/Protocol
The protocols and services supported by the device.
•Protocol / Port number
The protocol used by the service / the port number assigned to the service
•Default port status
The default state of the service (i.e. open, closed, active)
•Con󹪝gurable port
Speci󹪝es whether the port number can be con󹪝gured.
•Authentication
Speci󹪝es whether an authentication of the communication partner takes place or whether
an authentication can be con󹪝gured.
•Encryption
Speci󹪝es whether the transfer is encrypted or whether the encryption can be con󹪝gured.
List of available protocols (local access via a local network)
The following is a list of all available protocols and services as well as their ports through which
the device can be accessed.
Service/
Protocol
Protocol/
Port number
Default port sta‐
tus
Con󹪝gurable
port
Authentication Encryption
DHCPv4 Server UDP/67 Closed ✓ No No
DHCPv4 Client UDP/68 Open ✓ No No
EtherNet/IP TCP/44818
UDP/2222
UDP/44818
Closed
(Open with
EtherNetIP var‐
iants)
✓ No No
HTTP TCP/80 Open ✓ Yes No
HTTPS TCP/443 Open ✓ Yes Yes
NTP
SNTP
UDP/123 Closed ✓ No No
NTP (secure) UDP/123 Closed ✓ Yes No
PROFINET UDP/34964
UDP/49151 … 49159 1)
Open ✓ No No
RADIUS UPD/1812,1813 Closed ✓ Yes Yes
SMTP TCP/25
TCP/465
Closed ✓ Yes Yes
SNMPv1/v2c UDP/161 Open ✓ No No
SNMPv3 UDP/161 Open ✓ Optional Optional
SNMP Trap UDP/162 Outbound only - No No
SSH TCP/22 Open ✓ Yes Yes
Security recommendations
3.2 Available services
SCALANCE XC-300
20 Operating Instructions, 10/2022, C79000-G8976-C584-01