Remote Maintenance for SINUMERIK ONE: Ewon Flexy 205 on the X120 System Network

Once a machine tool is installed at the customer’s plant, remote maintenance often decides whether a fault is fixed within an hour or only after a service trip. In this use case, a SINUMERIK ONE is equipped with an Ewon Flexy 205 from HMS. The router works without an extension card, is connected to the controller’s X120 system network and gets its internet connection from the customer’s network.

The starting point

• Controller: SINUMERIK ONE (NCU) with SINUMERIK Operate, operator panel and machine control panel on the X120 system network.
• Router: Ewon Flexy 205 base unit, without WiFi, cellular or additional Ethernet card.
• Internet: The customer provides a network connection with internet access and opens the required ports in their firewall.
• Goal: The service engineer can access PLC, NC and operator interface remotely, without connecting the customer’s network to the machine.

The Ewon Flexy 205 without extension card

According to the datasheet, the base unit provides four Ethernet ports (RJ45, 10/100 Mbit/s). The ports can be configured as LAN or WAN, port 1 is always LAN. For this use case, that is all you need:

• One port as WAN: connection to the customer network and thus to the internet.
• Port 1 (LAN): connection to the X120 system network of the SINUMERIK ONE.
• Digital inputs: The unit has two digital inputs and one digital output. They are suitable, for example, for a key switch that lets the operator enable remote access (see below).

An extension card is only needed if the router is to reach the internet via cellular or WiFi, or if additional separate networks are required.

Why X120 and not X130?

The NCU of the SINUMERIK ONE has several Ethernet interfaces with clearly defined roles:

On X120, the service engineer sees the machine as if standing right next to it with a programming device. That is convenient, but it also means: whoever has access to the router has access to the whole machine. This makes a clean configuration of the Flexy all the more important, especially on the WAN side.

Addresses in the system network

The X120 system network uses the SINUMERIK default addresses (network 192.168.214.0/24):

• NCU: 192.168.214.1
• Fixed addresses of additional NCUs: .2 to .9
• NCU DHCP range: .10 to .239 (operator panels, machine control panels, etc.)
• PCU: .241, additional PCUs .242 to .249
• PGs with fixed address (service): .250 to .254

The Flexy gets a fixed LAN address outside the DHCP range, for example 192.168.214.250, subnet mask 255.255.255.0. Important: the DHCP server on the Flexy’s LAN side stays off, because the NCU assigns the addresses in the system network. Two DHCP servers on the same network lead to nodes that no longer boot up properly.

Note: The address assignment may have been adapted in a specific project. Before commissioning, check the machine’s network configuration to see which addresses are actually in use.

Routing: how the reply finds its way back

Via Talk2M, the remote PC gets an address from the VPN range, i.e. outside the system network. The nodes on X120 do not know this range. There are two ways to make sure their replies reach the Flexy:

1. NAT on the Flexy’s LAN side (called “Plug’n Route” by HMS): the router replaces the source address with its own LAN address. To the NCU, every request looks as if it came from its own network, and the reply goes straight back to the Flexy. Nothing has to be changed in the controller’s network configuration. For this use case, this is the simplest and most robust approach.
2. Flexy as gateway or static route on the nodes: the controller sends packets for the VPN range explicitly to the Flexy. However, this means changing the machine’s network configuration and may conflict with settings the customer has made elsewhere.

Internet connection at the customer: which ports?

The big advantage of Talk2M: the Flexy establishes the VPN connection from the inside out. Therefore, no inbound ports have to be opened in the customer’s firewall. According to HMS, the Flexy needs the following outbound ports:

HMS lists the exact Talk2M server addresses in its knowledge base, in case the IT department wants to whitelist destinations and not only ports. On the WAN side, the Flexy gets a fixed address or one via DHCP, plus gateway and DNS server, depending on the customer network. If the customer uses a proxy, it can be configured in the Flexy.

The remote PC running eCatcher also needs outbound access to Talk2M. In the machine builder’s office network this is rarely a problem, in hotel or guest networks it sometimes is.

Commissioning step by step

1. Update firmware: bring the Flexy to the latest firmware before installation.
2. Change default credentials: replace the default administrator password immediately.
3. Define WAN: configure one of the ports as WAN and set the parameters of the customer network (DHCP or fixed address, gateway, DNS).
4. Set up LAN: fixed address in the system network, for example 192.168.214.250/24, DHCP server off.
5. Set up Talk2M: register the Flexy using the wizard and the activation key from the Talk2M account.
6. Enable WAN protection: on the WAN side, discard all traffic except VPN and self-initiated connections, and do not expose the web interface or other services on the WAN.
7. No pass-through: disable forwarding between WAN and LAN so that the customer network never ends up directly in the system network.
8. Enable NAT on the LAN side if the NCU is not supposed to route via the Flexy (see above).
9. Test: connect with eCatcher and check whether the NCU is reachable at 192.168.214.1, for example by going online with TIA Portal.

What the engineer can do remotely

• TIA Portal online: monitor the PLC program, download blocks, read the diagnostic buffer.
• Operator interface: view and operate SINUMERIK Operate remotely, depending on the permissions granted at the machine.
• Back up and exchange data: commissioning archives, part programs, machine data.

The ports used by the individual Siemens tools in the system network are described in their documentation. If you want to restrict access further, you can filter the permitted services in the Talk2M account or in the Flexy. Whether and how finely this is possible depends on the Talk2M subscription and the firmware version.

Security: the customer stays in control

• Local enabling: a key switch on a digital input allows remote maintenance only when needed. How this is implemented (configuration or script) depends on the firmware version and should be tested in advance.
• Users and permissions: give each engineer their own Talk2M account, enable two-factor authentication and limit permissions to the machines actually needed.
• Logging: connections are logged in Talk2M. This helps with traceability and audits.
• Coordination with IT: the customer’s IT should know which device is installed, which ports it needs and who maintains it. This builds trust and prevents blocked connections when a fault occurs.

With the Cyber Resilience Act and the new Machinery Regulation, a well-documented remote access is also a matter of compliance, not just convenience.

Conclusion

For a single SINUMERIK ONE, the Ewon Flexy 205 without extension card is a lean solution: one port to the customer, one port into the X120 system network, and only outbound connections via Talk2M. A few points are decisive: a fixed address outside the DHCP range, no second DHCP server, NAT on the LAN side and a consistently secured WAN side. Then the machine is reachable remotely, and the customer’s network stays cleanly separated from the controller.