Need Custom Pricing? Request a Quote!
Request a free quote for bulk orders or repairs—response in 24 hours. Or get tailored advice and a quote for your automation needs.
Get Your Free Quote!
The Siemens 6GK5636-2GS00-2AC2 is the SCALANCE SC636-2C industrial security appliance, a managed Layer 3 firewall and VPN router built for protecting automation cells and remote stations on plant networks. It carries six gigabit copper ports plus two combo Gigabit SFP slots, runs SINEC OS, and is rated for cabinet installation in production environments where IT-grade firewalls cannot survive the temperature, vibration, or DIN-rail mounting requirements.
Maintenance teams typically deploy it at the perimeter between an OT cell (PLCs, HMIs, drives) and the corporate network, or as a VPN concentrator for service technicians dialing into a remote skid. If you are looking to replace a failed unit, expand a SCALANCE S615 deployment, or add a managed firewall to a SINUMERIK or S7-1500 line, the SC636-2C is the current-generation answer.
Technical Specifications
| Parameter | Specification |
|---|---|
| MLFB / Order number | 6GK5636-2GS00-2AC2 |
| Product family | SCALANCE SC-600 (SC636-2C) |
| Operating system | SINEC OS |
| Electrical ports | 6 x 10/100/1000 Mbit/s RJ45 |
| Combo ports | 2 x Gigabit SFP / RJ45 combo |
| Routing | Static and dynamic (RIPv2, OSPFv2) |
| Firewall | Stateful Layer 3/4 packet filter, NAT (1:1, MASQ, NAPT) |
| VPN | IPsec (IKEv1/IKEv2), OpenVPN client/server |
| VPN tunnels | Up to 200 IPsec tunnels |
| Security | RADIUS, 802.1X, brute-force prevention, syslog |
| Power supply | 2 x 24 V DC redundant (range 19.2 - 28.8 V DC) |
| Typical current draw | Approx. 0.5 A at 24 V DC |
| Operating temperature | -40 degC to +70 degC |
| Storage temperature | -40 degC to +85 degC |
| Humidity | 95% non-condensing |
| Degree of protection | IP30 |
| Mounting | DIN rail (35 mm) or wall mount |
| Dimensions (W x H x D) | 60 x 147 x 127 mm |
| Approvals | cULus, CE, FM Class I Div 2, marine (DNV, BV, LR) |
Configuration is done through a Web Based Management (WBM) interface, CLI over SSH, or by importing a CLI script for fleet rollouts. Configuration backup uses the C-PLUG removable media so a swap-out unit inherits the previous device's full config without a laptop visit.
SCALANCE SC-600 Same-Series Comparison
The SC-600 family covers three port counts. Pick by the number of OT segments you need to terminate, not by performance, since all three share the same firmware and throughput class.
| Model | MLFB | Copper ports | SFP combo | Typical role |
|---|---|---|---|---|
| SC622-2C | 6GK5622-2GS00-2AC2 | 2 | 2 | Single-cell perimeter firewall |
| SC632-2C | 6GK5632-2GS00-2AC2 | 2 | 2 | Routing variant for two-network segmentation |
| SC636-2C | 6GK5636-2GS00-2AC2 | 6 | 2 | Multi-segment cell, VPN concentrator |
| SC646-2C | 6GK5646-2GS00-2AC2 | 6 | 2 | SC636 plus DMZ/extra zones licence |
Within this list, SC636-2C is the standard choice when you need more than two internal subnets or when a service VPN must coexist with a production link without sharing the same physical port.
Common Pairings and Compatible Components
- SCALANCE XC / XR managed switches downstream of the SC636 to fan out to PROFINET cells.
- SIMATIC S7-1500 and S7-1200 CPUs on the protected side; the firewall passes PROFINET RT/IRT, S7 communication, and OPC UA when rules are configured.
- SIPLUS / SINUMERIK CNC controls behind a dedicated firewall zone for service-only access.
- SFP modules: 6GK5991-1AD00-8AA0 (1000Base-SX), 6GK5991-1AE00-8AA0 (1000Base-LX), depending on fibre run.
- C-PLUG 6GK1900-0AB00 for configuration mirroring on cold-spare units.
- 24 V DC power supply: SITOP PSU8200 or PSU100S, dual-fed for the redundant input.
Common Use Cases
- Cell protection: isolate a packaging line, robot cell, or test stand from the plant network with stateful firewall rules.
- Remote service VPN: terminate IPsec or OpenVPN tunnels from OEM service engineers and route them only to the machine they are commissioned for.
- NAT for duplicated IP ranges: 1:1 NAT lets identical OEM skid IP plans coexist on one plant network without renumbering the PLCs.
- DMZ for data historians: route OPC UA traffic from the OT side into a historian DMZ without exposing the PLC network.
- Replacement for end-of-life SCALANCE S612 / S623: SC636-2C is the migration target for the legacy S-series firewalls.
Why Buy Your 6GK5636-2GS00-2AC2 from Rabwellplc
We stock the SCALANCE SC636-2C ready to ship from US inventory, with the latest hardware revision and SINEC OS firmware available out of the box. Each unit is bench-checked, packed with original Siemens documentation, and backed by a one-year warranty. If you also need replacement Siemens controllers or HMI parts, we cover the full Siemens PLC and networking catalog, including matching Allen-Bradley hardware when your line is mixed-vendor.
Need help confirming this is the right firewall for your topology, or sourcing the matching SFP and C-PLUG accessories? Send your single-line drawing and our application desk will spec the bundle the same business day.
Check 6GK5636-2GS00-2AC2 stock and pricing ->
Frequently Asked Questions
Is 6GK5636-2GS00-2AC2 a switch or a firewall?
It is a Layer 3 industrial security appliance, meaning it acts as a router and stateful firewall, not a Layer 2 switch. If you only need switching, look at the SCALANCE XC or XR series instead.
What is the difference between SC636-2C and SC646-2C?
SC636-2C and SC646-2C share hardware, but the SC646 ships with a licence that enables a DMZ zone and unlocks additional security functions. If you need a dedicated DMZ for a historian or remote-access jump host, choose SC646.
Does the SC636-2C support OpenVPN as well as IPsec?
Yes. The device runs both an OpenVPN client and server alongside IPsec IKEv1/IKEv2, so it can dial out to a cloud VPN concentrator while also accepting site-to-site IPsec tunnels.
Can I migrate a SCALANCE S612 or S623 configuration directly?
The configuration concepts map across, but the rule syntax and firmware are different. Siemens provides a migration guide; in practice, expect to rewrite firewall rules from scratch and import only IP plans and certificates.
What power supply do I need for redundant operation?
Two independent 24 V DC sources, each within 19.2 - 28.8 V DC, wired to the L1+ and L2+ terminals. SITOP PSU8200 24 V / 5 A units in parallel are the standard pairing on Siemens lines.