Siemens S7-400 - Page 80

Configuration and operation
6.15 H-connections over VPN
CP 443-1 Advanced
80 Equipment Manual, 03/2023, C79000-G8976-C256-07
• "Perfect Forward Secrecy" can be enabled.
• All nodes of a VPN group must be able to reach one another.
If you insert modules that are connected to different physical networks in a VPN group,
the VPN group cannot be successfully established.
Possible VPN groups
• With H-connections via 2 paths with a physical network, at least one VPN group is
required.
Alternatively, 2 VPN groups can be used.
• With H-connections via 2 paths with 2 physically separated networks, 2 VPN groups are
required.
• With H-connections via 4 paths with a physical network, at least one VPN group is
required.
Alternatively, 2 or 4 VPN groups can be used.
• With H-connections via 4 paths with 2 physically separated networks, at least 2 VPN
groups are required.
Alternatively, 4 VPN groups can be used.
• With H-connections via 4 paths with 4 physically separated networks, 4 VPN groups are
required.
Configuration of the H-connection
• The H-connection can only be configured via the X1 interface (GBIT) of the CP.
• For fault-tolerant S7 connection, only the ISO-on-TCP type can be used.
The ISO type must not be used.