indicates that death or severe personal injury will result if proper precautions are not taken.
WARNING
indicates that death or severe personal injury may result if proper precautions are not taken.
CAUTION
indicates that minor personal injury can result if proper precautions are not taken.
NOTICE
indicates that property damage can result if proper precautions are not taken.
Qualified Personnel
personnel qualified
Proper use of Siemens products
WARNING
Siemens products may only be used for the applications described in the catalog and in the relevant technical
re required to ensure that the products operate safely and without any problems. The permissible
ambient conditions must be complied with. The information in the relevant documentation must be observed.
Trademarks
Disclaimer of Liability
This manual contains notices you have to observe in order to ensure your personal safety, as well as to prevent
damage to property. The notices referring to your personal safety are highlighted in the manual by a safety alert
symbol, notices referring only to property damage have no safety alert symbol. These notices shown below are
graded according to the degree of danger.
If more than one degree of danger is present, the warning notice representing the highest degree of danger will
be used. A notice warning of injury to persons with a safety alert symbol may also include a warning relating to
property damage.
The product/system described in this documentation may be operated only by
task in accordance with the relevant documentation, in particular its warning notices and safety instructions.
Qualified personnel are those who, based on their training and experience, are capable of identifying risks and
avoiding potential hazards when working with these products/systems.
Note the following:
documentation. If products and components from other manufacturers are used, these must be recommended
or approved by Siemens. Proper transport, storage, installation, assembly, commissioning, operation and
maintenance a
All names identified by ® are registered trademarks of Siemens AG. The remaining trademarks in this publication
may be trademarks whose use by third parties for their own purposes could violate the rights of the owner.
We have reviewed the contents of this publication to ensure consistency with the hardware and software
described. Since variance cannot be precluded entirely, we cannot guarantee full consistency. However, the
information in this publication is reviewed regularly and any necessary corrections are included in subsequent
editions.
for the specific
08/2016 Subject to change
Introduction
Purpose of the Operating Instructions
Validity of the Operating Instructions
Designations used
Classification
Description
Terms used
line, the term SCALANCE X-200 is used.
group, the term SCALANCE XP-200 is used.
used.
These operating instructions support you when installing and connecting up devices of the
SCALANCE XP-200 product group.
The configuration and the integration of the devices in a network are not described in these
operating instructions.
These operating instructions apply to the following devices:
● SCALANCE XP208
● SCALANCE XP208EEC
● SCALANCE XP208PoE EEC
● SCALANCE XP216
● SCALANCE XP216EEC
● SCALANCE XP216PoE EEC
Unless mentioned otherwise, the descriptions in these operating instructions refer to all
devices of the SCALANCE XP-200 product group named above in the section on validity.
There are two variants of some devices, refer to the section "Product overview (Page 17)".
Product line The product line includes all devices and variants of all product
groups.
If information applies to all product groups within the product
Product group If information applies to all devices and variants of a product
Device If information relates to a specific device, the device name is
You will find detailed information on configuring the devices in the following configuration
manuals:
● SCALANCE XB-200/XP-200 Web Based Management
● SCALANCE XB-200/XP-200 Command Line Interface
You will find the configuration manuals here:
● on the data medium that ships with some products:
– Product CD / product DVD
– SIMATIC NET Manual Collection
● On the Internet pages of Siemens Industry Online Support
(https://support.industry.siemens.com/cs/ww/en/ps/21869/man
).
In the system manuals "Industrial Ethernet / PROFINET Industrial Ethernet" and "Industrial
Ethernet / PROFINET passive network components", you will find information on other
SIMATIC NET products that you can operate along with the devices of this product line in an
Industrial Ethernet network.
There, you will find among other things optical performance data of the communications
partner that you require for the installation.
You will find the system manuals here:
● On the data medium that ships with some products:
– Product CD / product DVD
– SIMATIC NET Manual Collection
● On the Internet pages of Siemens Industry Online Support under the following entry IDs:
Siemens provides products and solutions with industrial security functions that support the
secure operation of plants, systems, machines and networks.
In order to protect plants, systems, machines and networks against cyber threats, it is
necessary to implement – and continuously maintain – a holistic, state-of-the-art industrial
security concept. Siemens’ products and solutions only form one element of such a concept.
Customer is responsible to prevent unauthorized access to its plants, systems, machines
and networks. Systems, machines and components should only be connected to the
enterprise network or the internet if and to the extent necessary and with appropriate security
measures (e.g. use of firewalls and network segmentation) in place.
Additionally, Siemens’ guidance on appropriate security measures should be taken into
account. For more information about industrial security, please visit
http://www.siemens.com/industrialsecurity (http://www.siemens.com/industrialsecurity
Siemens’ products and solutions undergo continuous development to make them more
secure. Siemens strongly recommends to apply product updates as soon as available and to
always use the latest product versions. Use of product versions that are no longer supported,
and failure to apply latest updates may increase customer’s exposure to cyber threats.
)
To stay informed about product updates, subscribe to the Siemens Industrial Security RSS
Feed under
https://support.industry.siemens.com/cs/ww/en/ps/15247/pm
(https://support.industry.siemens.com/cs/ww/en/ps/15247/pm
The following and possibly other names not identified by the registered trademark sign ® are
registered trademarks of Siemens AG:
These components can easily be destroyed if handled incorrectly.
Note the following instructions to avoid damage.
• Touch electronic modules only when you absolutely need to work on them.
• If electronic modules need to be touched, the body of the person involved must first be
electrostatically discharged and grounded.
• Do not bring electronic modules in contact with electrically isolating materials such as
plastic film, isolating table top pads or clothing made of synthetic fibers.
• Place the modules only on conductive surfaces.
• Pack, store and transport electronic modules and components only in conductive
packaging such as metalized plastic or metal containers, conductive foam or household
aluminum foil.
4 Connecting up ....................................................................................................................................... 51
A Approvals ............................................................................................................................................. 85
Index .................................................................................................................................................... 93
General safety notices relating to protection against explosion
WARNING
EXPLOSION HAZARD
Safety notices when using the device according to Hazardous Locations (HazLoc)
Note the following safety notices. These relate to the entire working life of the device.
You should also read the safety notices relating to handling in the individual sections,
particularly in the sections "Installation" and "Connecting up".
If you open the device, it loses its water and dust protection.
• Do not open the device.
If the is not adhered to, the manufacturer's guarantee is lost.
Only clean the outer parts of the housing with a dry cloth.
Do not use any liquids or solvents.
Do not open the device when the supply voltage is turned on.
If you use the device under HazLoc conditions you must also keep to the following safety
notices in addition to the general safety notices for protection against explosion:
This equipment is suitable for use in Class I, Division 2, Groups A, B, C and D or nonhazardous locations only.
This equipment is suitable for use in Class I, Zone 2, Group IIC or non-hazardous locations
only.
Connect to the device and change the standard passwords for the users "admin" and "user"
before you operate the device. To be able to change passwords you need to be logged in
with write access to the configuration data.
To prevent unauthorized access, note the following security recommendations.
● You should make regular checks to make sure that the device meets these
recommendations and/or other security guidelines.
● Evaluate your plant as a whole in terms of security. Use a cell protection concept with
suitable products.
● When confidential zones are used, the internal and external network are disconnected, an
attacker cannot access the data from the outside.
● Operate the device only within a protected network area.
● Use additional devices with VPN functionality (e.g. SCALANCE S) to encrypt and
authenticate communication from and to the devices.
● For data transfer via a non-secure network, use an encrypted VPN tunnel (IPsec) by
using additional devices with VPN functionality (e.g. SCALANCE S).
● For operation of the device in a non-secure infrastructure no product liability will be
accepted.
● Separate connections correctly (WBM. Telnet, SSH etc.).
● Limit physical access to the device to qualified personnel.
The memory card or the C-PLUG contains sensitive data such as certificates, keys etc.
that can be read out and modified.
● Lock unused physical ports on the device. Unused ports can be used to gain forbidden
access to the plant.
● Keep the software up to date. Check regularly for security updates of the product.
You will find information on this on the Internet pages "Industrial Security
(http://www.siemens.com/industrialsecurity
● Inform yourself regularly about security advisories and bulletins published by Siemens
productCERT (http://www.siemens.com/cert/en/cert-security-advisories.htm
● Only activate protocols that you really require to use the device.
)"
).
Safety notices
Passwords
Keys and certificates
1.1 Security recommendations
● Restrict access to the device with a firewall or rules in an access control list (ACL -
Access Control List).
● Restrict access to the management of the device with rules in an access control list
(ACL).
● The option of VLAN structuring provides good protection against DoS attacks and
unauthorized access. Check whether this is practical or useful in your environment.
● Enable logging functions. Use the central logging function to log changes and access
attempts centrally. Check the logging information regularly.
● Configure a Syslog server to forward all logs to a central location.
● Define rules for the use of devices and assignment of passwords.
● Regularly update passwords and keys to increase security.
● Change all default passwords for users before you operate the device.
● Only use passwords with a high password strength. Avoid weak passwords for example
password1, 123456789, abcdefgh.
● Make sure that all passwords are protected and inaccessible to unauthorized personnel.
● Do not use the same password for different users and systems or after it has expired.
This section deals with the security keys and certificates you require to set up SSL.
● We strongly recommend that you create your own SSL certificates and make them
● Use the certification authority including key revocation and management to sign the
● Handle user-defined private keys with great caution if you use user-defined SSH or SSL
● Verify certificates and fingerprints on the server and client to avoid "man in the middle"
● We recommend that you use certificates with a key length of 2048 bits.
● Change keys and certificates immediately, if there is a suspicion of compromise.
available.
There are preset certificates and keys on the device. The preset and automatically
created SSL certificates are self-signed. We recommend that you use SSL certificates
signed either by a reliable external or by an internal certification authority.
The device has an interface via which you can import the certificates and keys.
● Avoid or disable non-secure protocols, for example Telnet and TFTP. For historical
reasons, these protocols are still available, however not intended for secure applications.
Use non-secure protocols on the device with caution.
● Avoid or disable non-secure protocols. Check whether use of the following protocols is
necessary:
– PROFINET
– Broadcast pings
– Non authenticated and unencrypted interfaces
– ICMP (redirect)
– MRP, HRP
– GMRP and IGMP
– LLDP
– Syslog
– RADIUS
– DHCP Options 66/67
– TFTP
– GMRP and GVRP
– Multicast routing
● The following protocols provide secure alternatives:
– SNMPv1/v2 → SNMPv3
Check whether use of SNMPv1 is necessary. SNMPv1 is classified as non-secure.
Use the option of preventing write access. The product provides you with suitable
setting options.
If SNMP is enabled, change the community names. If no unrestricted access is
necessary, restrict access with SNMP.
Use SNMPv3 in conjunction with passwords.
– HTTP → HTTPS
– TFTP → FTPS
– Telnet → SSH
– SNTP → NTP
● Use secure protocols when access to the device is not prevented by physical protection
measures.
● To prevent unauthorized access to the device or network, take suitable protective
measures against non-secure protocols.
● If you require non-secure protocols and services, operate the device only within a
protected network area.
The PoE variants SCALANCE XP-200 are expected to be available as of the second half of 2016.
Factory settings
EtherNet/IP variants
There are two variants of some devices with different article numbers. These variants differ
only in their factory settings. All other properties are identical.
SCALANCE XP208 8 x 10/100 Mbps M12 connector
SCALANCE XP208EEC 8 x 10/100 Mbps M12 connector
technology electrical, varnished
SCALANCE XP208PoE EEC 8 x 10/100 Mbps M12 connector
technology electrical, varnished
circuit board, Power over Ethernet
Preassembled, serial cable with
M12 and RS-232 plug,
Length: 3 m
cable for connection to FC
OUTLET RJ-45, for universal use,
4-wire, shielded, CAT 5E
6GK5 980-3BC00-0AA5
6XV1 840-2AH10
19
Description of the device
Component
Description
Article number
Sold by the meter
Sold by the meter
cable, flexible wires, shielded, CAT
Sold by the meter
Sold by the meter
Sold by the meter
Sold by the meter
Sold by the meter
RJ-45 Plug 145
M12 plugs (D-coded)
* Available in different lengths
2.1 Product overview
IE FC TP ROBUST
STANDARD CABLE GP 2X2
(PROFINET type A)
IE FC TP ROBUST FLEXIBLE
CABLE GP 2X2
(PROFINET type B)
IE FC TP FLEXIBLE CABLE
GP 2X2
(PROFINET type B)
IE FC TP TRAILING CABLE
2X2
(PROFINET type C)
IE TP TORSION CABLE 2X2
(PROFINET type C)
Standard bus cable, ATPE outer
jacket for connection to FC RJ45
PLUG and FC OUTLET RJ45,
fixed installation, for universal use,
4-wire, shielded, CAT 5
Flexible bus cable, TPE outer
jacket for connection to FC RJ45
PLUG and FC OUTLET RJ45,
flexible wires, 4-wire, shielded,
CAT 5
Flexible bus cable, TP installation
5
Highly flexible bus cable, TP installation cable for connection to FC
OUTLET RJ45, for use in drag
chains, 4-wire, shielded, CAT 5
Highly flexible bus cable, TP installation cable for use in highly flexible applications (torsion), 4-wire
6XV1 841-2A
6XV1 841-2B
6XV1 870-2B
6XV1 840-3AH10
6XV1 870-2F
IE FC TP STANDARD CABLE
GP 4X2
IE FC TP FLEXIBLE CABLE
GP 4X2
IE CONNECTING CABLE
M12-180/IE RJ45
IE CONNECTING CABLE
M12-180/M12-180
Shielded TP installation cable for
connection to IE FC RJ45 PLUG
4X2, CAT 6, AWG 24
Shielded TP installation cable for
connection to IE FC RJ45 PLUG
4X2, flexible wires, CAT 6, 24
AWG
Flexible IE connecting cable, 4wire, preassembled with a 4-pin
M12 plug (D-coded) and an IE FC
Flexible IE connecting cable, 4wire, preassembled with two 4-pin