S7 protocol error 0x81/0x04 on ALL data access (DB, Merkers, Inputs) — CPU 1510SP-1 PN, firmware V2.9.4, TIA Portal V17

[AnassGE]

Summary

I cannot find any location in TIA Portal V17 to enable "Permit access with
PUT/GET communication from remote partner" for a CPU 1510SP-1 PN running
firmware V2.9.4. As a result, every third-party read via python-snap7 fails
with the same S7 protocol error, except basic device identification.

Hardware / Software

• CPU: SIMATIC ET200SP, CPU 1510SP-1 PN
• Firmware: V2.9.4
• Engineering software: TIA Portal V17
• Python: 3.14.2
• python-snap7: 3.1.2
• Connection: client.connect(ip, 0, 1) — Rack 0, Slot 1, direct Ethernet, ping OK (<1ms)

CPU configuration confirmed

• Access level: Full access (no protection) — confirmed twice, including after a full hardware+software rebuild and redownload
• DB1 (DB_Camera_IA): Optimized block access UNCHECKED (standard access)
• Protection & Security > Connection mechanisms: "Only allow secure PG/PC
  and HMI communication" is UNCHECKED
• No "Permit access with PUT/GET communication from remote partner"
  checkbox is visible anywhere on the Connection mechanisms page, nor
  anywhere else in Protection & Security, regardless of window size,
  scrolling, or toggling the secure-communication checkbox on/off.
• Security settings > Users and roles > Users: only shows
  "" — no "Anonymous" user exists (this system appears to
  only apply from TIA Portal V19 / firmware V3.1 onward, per Siemens FAQ
  109925755, which does not seem to apply to this V17/V2.9.4 combination).

Diagnostic performed

Full download + hardware/software rebuild + memory reset (MRES) + CPU
restart performed before testing. Confirmed CPU in RUN, ERR LED off, no
diagnostic buffer errors related to configuration.

Ran a diagnostic script testing multiple read operations:

Test	Result
get_cpu_info() (identification)	OK
get_cpu_state()	S7 protocol error (0x81/0x04)
mb_read(0, 1) (Merker)	Same error
eb_read(0, 1) (physical input)	Same error
list_blocks()	Same error (USERDATA 0x8104)
db_read(1, 0, 6)	Same error
db_read(1, 2, 2) (target read)	Same error

Exact error message:
S7 protocol error (class=0x81, code=0x04): This service is not implemented
on the module or a frame error was reported

Question

1. On TIA Portal V17 with CPU firmware V2.9.4, where exactly is "Permit
   access with PUT/GET communication from remote partner" located, if not
   on the standard Connection mechanisms page?
2. Could this be related to S7CommPlus becoming the default protocol for
   firmware >= V2.9, requiring a different client/protocol on the Python
   side instead of classic PUT/GET?

Any pointer to the exact menu path or an alternative approach compatible
with this firmware would be greatly appreciated. Thank you.

[AnassGE]

Update: found the root cause and a reproducible bug.

The CPU indeed has classic PUT/GET disabled by default (firmware V2.9.4). Switched to s7commplus.Client with use_tls=True (installed from the master branch since S7CommPlus support isn't on PyPI yet):

from s7commplus import Client
client = Client()
client.connect("172.25.212.1", use_tls=True)
data = client.db_read(1, 2, 2)

TLS connection succeeds. client.browse() works perfectly and correctly lists all DB1 variables, including:

{'name': 'DB_Camera_IA.Compteur_Total', 'access_sequence': '8A0E0001.F', 'data_type': 'INT', 'opt_address': 2, 'opt_bitoffset': 0, 'nonopt_address': 2, 'nonopt_bitoffset': 0}

But db_read(1, 2, 2) — using that exact same nonopt_address — fails with:

_parse_read_response: PLC returned error 0xA201BB002C37FF88
Read returned no data

DB1 has "Optimized block access" unchecked (standard/non-optimized access), confirmed in TIA Portal. Is db_read() in the s7commplus client expecting a different addressing scheme (e.g. the access_sequence string) rather than raw db_number/offset for S7CommPlus connections? Happy to test any suggested code.

[AnassGE]

Update 2: write operations also broken, same pattern as db_read().

Both write_symbolic() and write_area() fail with the exact same
undocumented error code when trying to write to the same DB1.Compteur_Total
tag that read_symbolic() reads successfully:

from s7commplus import Client
from snap7.util import set_int

client = Client()
client.connect("192.168.50.1", use_tls=True) # tested on PLCSIM Advanced

buffer = bytearray(2)
set_int(buffer, 0, 77)

client.write_symbolic(access_area, [lid], bytes(buffer))

Write failed with return value 16285730935238164450 (0xe2028a000675ffe2)

client.write_area(access_area, 2, bytes(buffer))

Write failed with return value 16285730935238164450 (0xe2028a000675ffe2)

same error code for both methods

Read operations (read_symbolic, browse) work perfectly on the same tag/PLC.
Only write operations seem affected. Confirmed on PLCSIM Advanced
simulation (not just physical hardware) to rule out any physical-PLC-
specific access restriction.

Is write support simply not yet implemented in this protocol version, or
is there a different required call sequence (e.g. a subscription/session
setup) before writes are accepted?