Siemens S7-400 - Page 55

Configuration and operation
6.1 Security recommendations
CP 443-1 Advanced
Equipment Manual, 03/2023, C79000-G8976-C256-07
55
Certificates and keys
• Use a certification authority including key revocation and management to sign certificates.
• Make sure that user-defined private keys are protected and inaccessible to unauthorized
persons.
• It is recommended that you use password-protected certificates in the PKCS #12 format.
• Verify certificates and fingerprints on the server and client to prevent "man in the middle"
attacks.
• It is recommended that you use certificates with a key length of at least 2048 bits.
• Change certificates and keys immediately if there is a suspicion of compromise.
Protocols
List of available protocols
The following is a list of all available protocols and their ports through which the device can
be accessed.
Service/
Protocol
Protocol/
port number
Default port
status
Configurable
Authentication Encryption
Servic
e
Port
S7 protocol
TCP/102
Open
--
--
No
No
HTTP
HTTPS
TCP/80
TCP/443
Open
Closed
✓
✓
--
--
No
Yes
No
Yes
FTP
FTPS
TCP/20
TCP/21
Closed ✓ ✓ Yes No
Yes
SNMP
UDP/161
Open
✓
--
Yes (with SNMPv3)
Yes (with SNMPv3)
TCP Modbus
TCP/502
Closed
✓
--
No
No
IPsec
UDP/500
Closed
✓
--
Yes
Yes
PROFINET CM
UDP/34964
Open
--
--
No
No
PROFINET-RPC 2x
PROFINET-PN-EPM
UDP/552xx
Open
--
--
No
No
Also note the ports for configured and programmed connections. See section 5.6, item 5.7 in
the configuration manual /2/ (Page 103).
Explanation for table:
• Service/Protocol
Protocols that the device supports.
• Protocol/port number
Port number assigned to the protocol.