Unable to ping/Scan Profinet PLC Device Through Siemens SCALANCE X108 connected to Cisco VLAN-Based Switches

Question

I'm facing an issue with network connectivity to a Profinet PLC device and would appreciate some help. Here's the setup:

• PC ↔ DLINK Switch ↔ Cisco C2960 ↔ SCALANCE X108 ↔ PLC Device
• Only Managed switch is the Cisco Switch, All other switches are Unmanaged
• SCALANCE X108 is an Industrial Unmanaged switch.
• The PLC is assigned an IP address of 192.168.101.9 and is configured with Profinet.
• Both the PC and the port connecting to the SCALANCE X108 are configured in VLAN 101. The Switch has several other VLANs for other IT infrastructure.

Issue:

• I can successfully ping and scan the Profinet PLC in TIA Portal when it's connected directly to the DLINK Switch.
• I can ping the two PLC devices (192.168.101.21, 192.168.101.22) that use Modbus over TCP/IP.
• However, when the Profinet PLC connected through the SCALANCE X108, I can no longer ping it from the PC, I think the Cisco Switch is dropping VLAN 0 frames. Priority is assigned to Profinet real-time messages in accordance wit standard IEEE 802.1Q. The VLAN ID 0 with VLAN priority 6 is used for Profinet Real Time packets.

What I've Checked:

Since Profinet use VLAN 0, I configured Cisco Switch port to allow this VLAN 0 traffic, I've tried two workarounds , to make a non industrial Cisco Catalyst VLAN-Based Switch to work with Profinet Protocol. The first uses a voice VLAN that will pass vlan 0. The second approach uses a trunk port.

1. Voice VLAN over access port :

Switch(config)# interface GigabitEthernet 0/16
Switch(config-if)# switchport mode access
Switch(config-if)# switchport access vlan 101
Switch(config-if)# switchport voice vlan dot1p

2. Trunk Port:

Switch(config)# default interface 0/16
Switch(config)# interface GigabitEthernet 0/16
Switch(config-if)# switchport trunk allowed vlan 101
Switch(config-if)# switchport native vlan 101

With these approaches I'm pretty sure that Profinet devices will work on non industrial Cisco switches when these devices are directly hooked to the same switch. I need to make it work with Profinet devices connected to an Industrial Siemens Switch which is connected to a Cisco switch.

I've also checked the Cisco switch MAC address table and ARP table on Port Gi 0/16 and the device is not showing up:

cisco# show mac address-table interface gigabitEthernet 0/16
          Mac Address Table
-------------------------------------------

Vlan    Mac Address       Type        Ports
----    -----------       --------    -----
 101    000e.8c87.5b71    DYNAMIC     Gi0/16
 101    000e.cf1b.1288    DYNAMIC     Gi0/16
Total Mac Addresses for this criterion: 2
cisco#

Im still not able to ping the PLC even allowing VLAN 0 through the voice VLAN and Trunking. I don't know where to check if the Cisco switch is actually dropping traffic. I've checked debug arp and so far see no issue

Has anyone encountered a similar issue or could provide guidance on what might be wrong? Any specific configurations or checks I should perform on the Cisco C2960 to ensure Profinet traffic is passing through correctly?

Thanks in advance for your help!

Answer 1

Generally, you should not configure a VLAN trunk on a port connecting an unmanaged switch, or an end node, unless you know for sure that that end node handles tagged VLANs correctly. You should always use an access port instead.

Trying to pass tagged VLANs across an unmanaged switch is a dangerous setup. Some unmanaged switches filter tagged frames, interrupting VLAN connectivity. Others pass them transparently, creating the risk for any device on that switch to access any VLAN on the trunk. Another risk is that a hardware replacement later on breaks your VLAN setup.

Accordingly, you should only use access ports towards unmanaged switches. If an end node beyond that switch requires a tagged VLAN then use a managed switch with an appropriate setup.

And VLAN 0 isn't a thing. VLAN IDs 0 and 4095 cannot be used in a trunk, those values are reserved. If a Q tag carries 0x000 in the VID field, then that frame's VLAN isn't tagged (indicating the native VLAN) and just PCP and DEI are used. 0xFFF cannot be used on the wire at all, it's for a device's internal use only (sometimes indicating 'any VLAN').

Answer 2

The issue you're facing likely relates to the Cisco switch not properly handling VLAN 0 traffic, crucial for Profinet real-time communication. Even though you've configured the switch to allow VLAN 0 using both voice VLAN and trunk port methods, it's possible the switch is still dropping these frames.

First, verify that the voice VLAN configuration is correctly applied, ensuring the switch isn't filtering out VLAN 0 traffic. For the trunk port, make sure it's set up to pass all necessary VLANs, particularly ensuring the native VLAN is configured correctly and that VLAN 0 priority traffic isn't being dropped.

Next, consider the SCALANCE X108 switch. Since it's unmanaged, confirm that it's not altering or dropping VLAN 0 traffic, which could affect connectivity when passing through to the Cisco switch.

Using Cisco's debugging tools like debug ip packet or debug ethernet might help identify if VLAN 0 frames are being dropped or mishandled. If the issue persists, you could set up a dedicated VLAN for Profinet traffic, ensuring all switches, including the SCALANCE, handle this VLAN consistently. If needed, consider using industrial-grade switches that natively support Profinet or contact Cisco support for further assistance.