indicates that death or severe personal injury will result if proper precautions are not taken.
WARNING
indicates that death or severe personal injury may result if proper precautions are not taken.
CAUTION
indicates that minor personal injury can result if proper precautions are not taken.
NOTICE
indicates that property damage can result if proper precautions are not taken.
Qualified Personnel
personnel qualified
Proper use of Siemens products
WARNING
Siemens products may only be used for the applications described in the catalog and in the relevant technical
maintenance are required to ensure that the products operate safely and without any problems. The permissible
ambient conditions must be complied with. The information in the relevant documentation must be observed.
Trademarks
Disclaimer of Liability
This manual contains notices you have to observe in order to ensure your personal safety, as well as to prevent
damage to property. The notices referring to your personal safety are highlighted in the manual by a safety alert
symbol, notices referring only to property damage have no safety alert symbol. These notices shown below are
graded according to the degree of danger.
If more than one degree of danger is present, the warning notice representing the highest degree of danger will
be used. A notice warning of injury to persons with a safety alert symbol may also include a warning relating to
property damage.
The product/system described in this documentation may be operated only by
task in accordance with the relevant documentation, in particular its warning notices and safety instructions.
Qualified personnel are those who, based on their training and experience, are capable of identifying risks and
avoiding potential hazards when working with these products/systems.
Note the following:
documentation. If products and components from other manufacturers are used, these must be recommended
or approved by Siemens. Proper transport, storage, installation, assembly, commissioning, operation and
All names identified by ® are registered trademarks of Siemens AG. The remaining trademarks in this publication
may be trademarks whose use by third parties for their own purposes could violate the rights of the owner.
We have reviewed the contents of this publication to ensure consistency with the hardware and software
described. Since variance cannot be precluded entirely, we cannot guarantee full consistency. However, the
information in this publication is reviewed regularly and any necessary corrections are included in subsequent
editions.
5 Connecting up ....................................................................................................................................... 35
A Approvals ............................................................................................................................................. 61
Index .................................................................................................................................................... 69
6.1 Downloading new firmware using TFTP without WBM and CLI ............................................ 47
6.2 Restoring the factory settings ................................................................................................ 48
7.1 Technical specifications of the SCALANCE XR324WG ........................................................ 49
These operating instructions support you when installing and connecting up devices of the
SCALANCE XR-300WG product group.
The configuration and the integration of the devices in a network are not described in these
operating instructions.
These operating instructions apply to the following devices:
● SCALANCE XR324WG
● SCALANCE XR328-4C WG
Unless mentioned otherwise, the descriptions in these operating instructions refer to all
devices of the SCALANCE XR-300WG product group named above in the section on
validity.
Product line The product line includes all devices and variants of all product groups.
If information applies to all product groups within the product line, the
Product group If information applies to all devices and variants of a product group, the
Device If information relates to a specific device, the device name is used. e.g. SCALANCE XR328-4C
Variant For a variant of the device, the device name has the appropriate vari-
ant added to it in brackets. or the characteristic of the variant.
With the variant SCALANCE XR328-4C
In addition, note the Operating Instructions of the pluggable transceivers.
You will find the supplementary documentation here:
● On the data medium that ships with some products:
– Product CD / product DVD
– SIMATIC NET Manual Collection
● On the Internet pages of Siemens Industry Online Support
(https://support.industry.siemens.com/cs/ww/en/ps/15247
)
You will find detailed information on configuring the devices in the following configuration
manuals:
● SCALANCE XB-200/XC-200/XP-200/XR-300WG Web Based Management
● SCALANCE XB-200/XC-200/XP-200/XR-300WG Command Line Interface
You will find the configuration manuals here:
● on the data medium that ships with some products:
– Product CD / product DVD
– SIMATIC NET Manual Collection
● On the Internet pages of Siemens Industry Online Support
(https://support.industry.siemens.com/cs/ww/en/ps/24678/man
In the system manuals "Industrial Ethernet / PROFINET Industrial Ethernet" and "Industrial
Ethernet / PROFINET passive network components", you will find information on other
SIMATIC NET products that you can operate along with the devices of this product line in an
Industrial Ethernet network.
There, you will find among other things optical performance data of the communications
partner that you require for the installation.
You will find the system manuals here:
● On the data medium that ships with some products:
– Product CD / product DVD
– SIMATIC NET Manual Collection
).
● On the Internet pages of Siemens Industry Online Support under the following entry IDs:
If you use damaged parts, there is no guarantee that the device will function according to
the specification.
If you use damaged parts, this can lead to the following problems:
• Injury to persons
• Loss of the approvals
• Violation of the EMC regulations
• Damage to the device and other components
Use only undamaged parts.
1. Make sure that the package is complete.
2. Check all the parts for transport damage.
The products are low in pollutants, can be recycled and meet the requirements of the WEEE
directive 2012/19/EU for the disposal of electrical and electronic equipment.
Do not dispose of the products at public disposal sites.
For environmentally friendly recycling and the disposal of your old device contact a certified
disposal company for electronic scrap or your Siemens contact (Product return
(https://support.industry.siemens.com/cs/ww/en/view/109479891
Note the different national regulations.
Siemens provides products and solutions with industrial security functions that support the
secure operation of plants, systems, machines and networks.
In order to protect plants, systems, machines and networks against cyber threats, it is
necessary to implement – and continuously maintain – a holistic, state-of-the-art industrial
security concept. Siemens’ products and solutions only form one element of such a concept.
Customer is responsible to prevent unauthorized access to its plants, systems, machines
and networks. Systems, machines and components should only be connected to the
enterprise network or the internet if and to the extent necessary and with appropriate security
measures (e.g. use of firewalls and network segmentation) in place.
Additionally, Siemens’ guidance on appropriate security measures should be taken into
account. For more information about industrial security, please visit
http://www.siemens.com/industrialsecurity (http://www.siemens.com/industrialsecurity
)).
)
Siemens’ products and solutions undergo continuous development to make them more
secure. Siemens strongly recommends to apply product updates as soon as available and to
always use the latest product versions. Use of product versions that are no longer supported,
and failure to apply latest updates may increase customer’s exposure to cyber threats.
To stay informed about product updates, subscribe to the Siemens Industrial Security RSS
Feed under
https://support.industry.siemens.com/cs/ww/en/ps/15247/pm
(https://support.industry.siemens.com/cs/ww/en/ps/15247/pm
).
The following and possibly other names not identified by the registered trademark sign ® are
registered trademarks of Siemens AG:
General safety notices relating to protection against explosion
WARNING
EXPLOSION HAZARD
Safety notices when using the device according to Hazardous Locations (HazLoc) and FM.
Note the following safety notices. These relate to the entire working life of the device.
You should also read the safety notices relating to handling in the individual sections,
particularly in the sections "Installation" and "Connecting up".
To prevent injury, read the manual before use.
Do not open the device when the supply voltage is turned on.
If you use the device under HazLoc or FM conditions you must also keep to the following
safety notices in addition to the general safety notices for protection against explosion:
This equipment is suitable for use in Class I, Division 2, Groups A, B, C and D or nonhazardous locations only.
This equipment is suitable for use in Class I, Zone 2, Group IIC or non-hazardous locations
only.
Connect to the device and change the standard passwords for the users "admin" and "user"
before you operate the device. To be able to change passwords you need to be logged in
with write access to the configuration data.
To prevent unauthorized access, note the following security recommendations.
● You should make regular checks to make sure that the device meets these
recommendations and/or other security guidelines.
● Evaluate your plant as a whole in terms of security. Use a cell protection concept with
suitable products (
● When the internal and external network are disconnected, an attacker cannot access
internal data from the outside. Therefore operate the device only within a protected
network area.
● For communication via non-secure networks use additional devices with VPN functionality
to encrypt and authenticate the communication.
● Restrict physical access to the device to qualified personnel.
● Lock unused physical ports on the device. Unused ports can be used to gain forbidden
access to the plant.
● Keep the firmware up to date. Check regularly for security updates for the device. You will
find information on this on the Internet pages Industrial Security
(http://www.siemens.com/industrialsecurity
● Inform yourself regularly about security recommendations by Siemens ProductCERT
(http://www.siemens.com/cert/en/cert-security-advisories.htm
● Only activate protocols that you require to use the device.
● Restrict access to the management of the device with rules in an access control list
(ACL).
Safety notices
Passwords
Certificates and keys
2.1 Security recommendations
● The option of VLAN structuring provides protection against DoS attacks and unauthorized
access. Check whether this is practical or useful in your environment.
● Use a central logging server to log changes and accesses. Operate your logging server
within the protected network area and check the logging information regularly.
● Define rules for the assignment of passwords.
● Regularly change your passwords to increase security.
● Use passwords with a high password strength.
● Make sure that all passwords are protected and inaccessible to unauthorized persons.
● Do not use the same password for different users and systems.
● On the device there is a preset SSL certificate with key. Replace this certificate with a
self-made certificate with key. We recommend that you use a certificate signed either by
a reliable external or by an internal certification authority.
● Use a certification authority including key revocation and management to sign certificates.
● Make sure that user-defined private keys are protected and inaccessible to unauthorized
persons.
● It is recommended that you use password-protected certificates in the PKCS #12 format
● Verify certificates and fingerprints on the server and client to prevent "man in the middle"
attacks.
● It is recommended that you use certificates with a key length of at least 2048 bits.
● Change certificates and keys immediately, if there is a suspicion of compromise.
● Avoid or disable non-secure protocols and services, for example HTTP, Telnet and TFTP.
For historical reasons, these protocols are available, however not intended for secure
applications. Use non-secure protocols on the device with caution.
● Check whether use of the following protocols and services is necessary:
– Non authenticated and unencrypted ports
– MRP, HRP
– IGMP snooping
– LLDP
– Syslog
– RADIUS
– DHCP Options 66/67
– TFTP
– GMRP and GVRP
● The following protocols provide secure alternatives:
– HTTP → HTTPS
– Telnet → SSH
– SNMPv1/v2c → SNMPv3
Check whether use of SNMPv1/v2c. is necessary. SNMPv1/v2c is classified as nonsecure. Use the option of preventing write access. The device provides you with
suitable setting options.
If SNMP is enabled, change the community names. If no unrestricted access is
necessary, restrict access with SNMP.
Use the authentication and encryption mechanisms of SNMPv3.
● Use secure protocols when access to the device is not prevented by physical protection
measures.
● If you require non-secure protocols and services, operate the device only within a
protected network area.
● Restrict the services and protocols available to the outside to a minimum.
● For the DCP function, enable the "Read Only" mode after commissioning.
● If you use RADIUS for management access to the device, activate secure protocols and
services.
● Disable unused interfaces.
● Use IEEE 802.1X for interface authentication.
● Use the function "Locked Ports" to block interfaces for unknown nodes.