Service Bridge – Setup and Configuration
Entry ID: 109747975, V1.4, 05/2019
Siemens AG 2019 All rights reserved
4 Configuration file
The configuration of the Service Bridge is divided into the VLAN configuration,
which enables the Service Bridge's basic functionality, and the settings for
increasing operational reliability and IT security.
The settings for the Service Bridge, which differ from the standard configuration
(factory settings) of a SCALANCE XC-200 switch, are described in the following
section. These settings are already included in the pre-set configuration file and are
applied automatically by loading them in the switch.
You can download the configuration file from the following link:
https://support.industry.siemens.com/cs/ww/en/view/109747975
4.1 VLAN configuration
A VLAN configuration with the Private VLAN function is used to implement central
access to the PROFINET networks and secure separation of the networks from
one another.
4.1.1 Basics
VLANs (Virtual Local Area Network) allow a physical network to be divided into
several logical networks that are shielded from each other. The Private VLAN
(PVLAN) function makes a further subdivision possible, whereby the following units
are distinguished:
Primary Private VLAN
A Primary Private VLAN refers to the subdivided VLAN. Access to all the
Secondary Private VLANs is possible from the Primary PVLAN.
Secondary Private VLANs
Each Secondary PVLAN has a specific VLAN ID and is connected with the Primary
PVLAN. The various Secondary PVLANs cannot communicate with each other.
There are also two types of Secondary PVLANs. Isolated Secondary PVLANs are
used for the PROFINET networks of the Service Bridge:
Isolated Secondary PVLAN
– Devices within an Isolated Secondary PVLAN cannot communicate with
each other via Layer 2
Community Secondary PVLAN (not relevant here)
– Devices within a Community Secondary PVLAN can communicate with
each other directly via Layer 2.
Application on the Service Bridge
In the Service Bridge configuration, Port 1 is configured for access from the plant
bus as a Primary Private VLAN; the remaining ports are configured as Isolated
Secondary Private VLANs for the PROFINET networks.
With this configuration, access to all PROFINET networks is possible from Port 1,
and the PROFINET networks remain separated from each other at the same time.