OPC-UA Integration

Introduction​

OPC-UA (Unified Architecture) is the standard industrial communication protocol for secure data exchange between PLCs, SCADA systems, and cloud systems. Eziwan allows you to access OPC-UA servers on your OT network from anywhere via a secure OpenVPN tunnel.

Prerequisites​

On the automation side (OPC-UA server)​

PLCOPC-UA ServerMinimum Firmware VersionSystem Requirements
Siemens S7-1500Native, built-inFW 2.0 (2017)Enable in TIA Portal
Siemens S7-1200Not available—Use Modbus TCP instead
B&R AutomationNative (ArOpc)AR 4.34Enable in Automation Studio
Beckhoff TwinCATTF6100 (TwinCAT OPC UA Server)TwinCAT 3.1.4020TF6100 license required
Phoenix Contact PLCnextIntegratedFW 2020.0Enable via Web-Based Management
Schneider EcoStruxureNative (M262/M580)—Enable in SoMachine

Eziwan's Side​

  • Eziwan gateway with firmware version 2.3 or higher
  • The gateway must be on the same Ethernet network as the OPC-UA controller, or able to connect to it (same VLAN, no firewall blocking port 4840)
  • Default OPC-UA port: TCP 4840

Architecture: Access via a VPN tunnel​

Remote OPC-UA access via Eziwan follows this procedure:

The Eziwan gateway acts as an OPC-UA proxy: it receives connections from remote clients via the OpenVPN tunnel and forwards them to the OPC-UA server on the local OT network. The remote client does not have direct access to the OT network.

TIA Portal Configuration: Enable the S7-1500 OPC-UA Server​

Step 1: Open the CPU Properties​

  1. In TIA Portal, double-click the S7-1500 CPU in the hardware view
  2. Go to the OPC UA tab

Step 2: Start the server​

OPC UA
  └── Server
       [✓] Activate OPC UA server
       
       Port: 4840
       Max. sessions: 10
       Session timeout: 10 000 ms
       
       Security:
       [✓] No security (Basic256Sha256 is also recommended in production)
       [✓] Basic256Sha256 - SignAndEncrypt
       
       Access control:
       [ ] Allow anonymous access (disable in production)
       [✓] Enable user access control

Step 3: Create a server interface​

The server interface defines the variables exposed via OPC-UA:

OPC UA
  └── Server interfaces
       └── [New interface] → Nom: "Monitoring_Production"
            └── Drag & Drop from the project:
                 DB10.Temperature  → will be displayed as "Temperature"
                 DB10.Pressure     → will be displayed as "Pressure"  
                 DB10.ProductCount → will be exposed as "ProductCount"
                 DB10.Running → will be displayed as "Running"

Step 4: Create an OPC-UA User​

OPC UA
  └── Users
       └── [Add user]
            Username: eziwan_client
            Password: MotDePasseStrong2026!
            Role: Observer (read-only) or Operator (read/write)

Step 5: Compile and upload the hardware configuration​

Important: Only the hardware configuration needs to be recompiled and uploaded. The user program (OB, FC, FB) remains unchanged.

Menu: Build → Build All (or Ctrl+B)
Check for errors in the hardware compilation only
Menu : Online → Download to device → Hardware configuration

Connecting from a Remote OPC-UA Client​

Option 1: Prosys OPC UA Browser (free graphical interface)​

  1. Download Prosys OPC UA Browser from prosysopc.com
  2. Launch the software
  3. Enter the URL: opc.tcp://[IP_TUNNEL_EZIWAN]:4840
  4. Click "Connect"
  5. Select the security mode (None for testing, SignAndEncrypt for production)
  6. Navigate through the node tree to find your variables

Option 2: Python with asyncua​

import asyncio
from asyncua import Client
from asyncua import ua

# Configuration de connexion
OPC_UA_URL = "opc.tcp://[IP_TUNNEL_EZIWAN]:4840"
USERNAME = "eziwan_client"
PASSWORD = "MotDePasseStrong2026!"

async def lire_donnees_production():
    """Connect and read production data via Eziwan."""
    
    async with Client(url=OPC_UA_URL) as client:
        # Username Authentication
        client.set_user(USERNAME)
        client.set_password(PASSWORD)
        
        print(f"Connecté à {OPC_UA_URL}")
        
        # Method 1: Direct access via NodeId (if known)
        node_temp = client.get_node("ns=3;s=Monitoring_Production.Temperature")
        temp = await node_temp.read_value()
        print(f"Température : {temp} °C")
        
        # Method 2: Navigating the Tree Structure
        root = client.get_root_node()
        objects = await root.get_child(["0:Objects"])
        
        # List the child nodes
        children = await objects.get_children()
        for child in children:
            name = await child.read_browse_name()
            print(f"Nœud trouvé : {name.Name}")
        
        # Method 3: Value-Triggered Subscription
        handler = ChangementValeurHandler()
        sub = await client.create_subscription(period=1000, handler=handler)
        
        nodes_a_surveiller = [
            client.get_node("ns=3;s=Monitoring_Production.Temperature"),
            client.get_node("ns=3;s=Monitoring_Production.Pressure"),
            client.get_node("ns=3;s=Monitoring_Production.Running"),
        ]
        
        await sub.subscribe_data_change(nodes_a_surveiller)
        print("Abonnement actif. Ctrl+C pour arrêter.")
        
        try:
            while True:
                await asyncio.sleep(1)
        except KeyboardInterrupt:
            pass
        finally:
            await sub.delete()

class ChangementValeurHandler:
    """Gestionnaire des notifications OPC-UA."""
    
    def datachange_notification(self, node, val, data):
        print(f"[{data.monitored_item.Value.SourceTimestamp}] {node}: {val}")

asyncio.run(lire_donnees_production())

Option 3: Node-RED with node-opcua​

[
    {
        "id": "opc-ua-input",
        "type": "OpcUa-Client",
        "endpoint": "opc.tcp://[IP_TUNNEL_EZIWAN]:4840",
        "action": "subscribe",
        "deadbandtype": "a",
        "deadbandvalue": "1",
        "time": "1",
        "timeUnit": "s",
        "certificate": "n",
        "item": [
            {"name": "Temperature", "nodeId": "ns=3;s=Monitoring_Production.Temperature"},
            {"name": "Pressure", "nodeId": "ns=3;s=Monitoring_Production.Pressure"}
        ]
    }
]

OPC-UA Security: Modes and Certificates​

Available Security Modes​

ModeAuthenticationEncryptionRecommendation
NoneNoneNoneFor testing only, never in production
SignX.509 certificateNoMedium
SignAndEncryptX.509 certificateAES-256Required in production

Supported Security Policies​

  • Basic128Rsa15: 1024-bit RSA (obsolete; do not use)
  • Basic256: 2048-bit RSA + SHA-1 (acceptable)
  • Basic256Sha256: 2048-bit RSA + SHA-256 (recommended)
  • Aes128_Sha256_RsaOaep: AES-128 + SHA-256 (modern)
  • Aes256_Sha256_RsaPss: AES-256 + SHA-256 (most secure)

Certificate Management via Eziwan​

Eziwan automatically generates X.509 certificates for the OPC-UA connection:

  1. Eziwan Portal → Integrations → OPC-UA → Certificates
  2. Click "Generate a certificate"
  3. Export the certificate in .der format
  4. Import it into the OPC-UA server’s trusted list (TIA Portal → OPC UA → Trusted Clients)

Troubleshooting​

Problem 1: Connection Timeout​

Symptom: ServiceResultException: BadTimeout or connection failure.

Causes and Solutions:

CauseCheckSolution
Port 4840 blockedtelnet [IP_OT] 4840 from the gatewayOpen the port on the local OT firewall
OPC-UA server not enabledCheck in TIA Portal → OPC UA → ServerEnable and re-download the configuration
Incorrect gateway IPPing from gateway to PLCCheck gateway network configuration
Timeout too shortIncrease client timeoutclient.session_timeout = 30000 (asyncua)

Problem 2: Rejected Certificates​

Symptom: BadCertificateUntrusted or BadSecurityChecksFailed

Solutions:

  1. S7-1500 server side: TIA Portal → OPC UA → Trusted Clients → Add the Eziwan certificate
  2. Temporary mode: TIA Portal → OPC UA → Server → "Accept all certificates automatically" (disable after configuration)
  3. Regenerate the certificates: If the certificate has expired, regenerate it in the Eziwan portal

Problem 3: Nodes Not Found (BadNodeIdUnknown)​

Symptom: BadNodeIdUnknown when reading a node.

Causes:

  • The namespace (ns=X) is incorrect
  • The server interface has not been created in TIA Portal
  • The node name is misspelled

Solution: Use Prosys OPC UA Browser to navigate the actual tree structure and copy the exact NodeIDs.

Problem 4: Frequent Disconnections​

Symptom: The client regularly disconnects, error BadConnectionClosed.

Solutions:

  • Increase the keepaliveInterval on the client side
  • Check the stability of the network connection (OpenVPN keepalive configured)
  • Verify that the max_sessions limit on the S7-1500 server has not been reached (TIA Portal → OPC UA → Server → Max. sessions)

Diagnostic Commands from the Gateway​

From the Eziwan console (SSH or web interface → Terminal):

# Test connectivity to the OPC-UA server
nc -zv 192.168.20.10 4840

# Check the status of the OpenVPN tunnel
systemctl status openvpn-client@eziwan --no-pager

# OPC-UA connection logs (filtered for errors)
journalctl -u eziwan-opcua-client -n 50 --no-pager | grep -i error

Frequently Asked Questions​

OPC-UA or Modbus: Which Should You Choose for Data Upload?​

OPC-UA provides typing, units, node hierarchy, and certificate-based security; Modbus remains simpler for quick retrofits. For an S7-1500 or a recent SCADA system, choose OPC-UA; for an older, heterogeneous system, choose Modbus.

What is an OPC-UA node?​

The server's information unit: a variable (measurement, setpoint), an object, or a method, identified by a NodeId within a namespace. The Eziwan client traverses the tree structure and subscribes to the selected nodes.

How do I manage OPC-UA certificates?​

The client and server exchange X.509 certificates: the client's Eziwan certificate must be approved on the server side (TIA Portal, UaExpert), and an encryption policy must be selected (Basic256Sha256 recommended).

What devices does an OPC-UA server expose?​

Recent PLCs (Siemens S7-1500/S7-1200, Schneider M580, Beckhoff), SCADA systems (WinCC, Ignition, AVEVA), and numerous high-end sensors and drives. For the rest of the system, the gateway collects data via Modbus.