Can the agent write a value to a PLC?

No. Every gateway protocol is read only: the drivers have no value writes and no method calls.

How do I connect a Siemens S7-1200 or S7-1500?

Preferably through their built-in OPC UA server: it serves symbolic tag names with their types. Over the S7 protocol these controllers answer only when their protection allows PUT/GET access and the data block's optimized access is off.

Is there DNP3 or IEC 61850?

No, the gateway has neither protocol. If the equipment serves data through a SCADA or an OPC UA server, connect those.

Equipment protocols

The gateway reads equipment over the protocols below, all read only. A connection is added on the Services tab under Integrations with the protocol's card, then assigned to a gateway on the Gateways tab. Protocol cards with their connection fields are in the integrations catalog.

What is supported

Protocol	What it reads	Tags	Alarms as events	Default port	Gateway platform
OPC UA	OPC UA servers: Kepware, Ignition, SCADA, PLCs	server tree browse	yes	from the server address	Windows, Linux
OPC DA (Classic)	OPC DA servers of legacy SCADA, such as KEPServerEX	server browse	no		Windows only
MQTT	broker topics, a UNS included	by topic	no	1883, with TLS 8883	Windows, Linux
Sparkplug B	Sparkplug B 3.0 node metrics: Ignition, HighByte, Litmus	by node metric	no	as for MQTT	Windows, Linux
Modbus TCP, RTU over TCP	registers by tag map	address list	no	502	Windows, Linux
Siemens S7	S7-300 and S7-400 by STEP 7 address, S7-200 and LOGO!	address list	no	102	Windows, Linux
EtherNet/IP	Rockwell Logix, Micro800, PLC-5 and SLC, Omron NJ/NX	Logix tag list or addresses	no	44818	Windows, Linux
Omron FINS	Omron CS, CJ, CP and NJ/NX by memory area	address list	no	9600	Windows, Linux
Mitsubishi SLMP	MELSEC Q, L, iQ-R, iQ-L and iQ-F by device	address list	no	from the connection address	Windows, Linux
MTConnect	an MTConnect agent's model and values	agent model	yes	from the agent address	Windows, Linux
FANUC FOCAS	FANUC CNC over FOCAS2	machine field set	yes	8193	Windows, Linux
Mitsubishi CNC (EZSocket)	M700 and M800 CNC	machine field set	yes	683	Windows only
BACnet/IP	building and boiler room controller objects	object list	no	47808	Windows, Linux
SNMP v1, v2c, v3	UPS, network, server room, climate sensors	standard MIBs	no	161	Windows, Linux
IEC 60870-5-104	substation and RTU telemetry	address list	no	2404	Windows, Linux
PI Web API	AVEVA PI and FactoryTalk Historian SE, archive and current values	historian points	no	from the server address	Windows, Linux
Ignition	Ignition tags and history through the WebDev module	Ignition tags	no	from the server address	Windows, Linux
ONVIF	IP cameras: a frame on request and motion	camera profiles	no	from the camera address	Windows, Linux

A Windows-only protocol on a Linux gateway says Gateway platform unsupported: assign the connection a gateway on Windows.

What to install at the site

OPC DA: OPC Core Components from the OPC Foundation on the gateway machine.
FANUC FOCAS: the site puts the licensed FANUC library into the focas folder of the gateway's data directory itself; it is not part of the delivery.
Mitsubishi CNC: the site installs the EZSocket library (FCSB1224W100) itself. It is 32-bit and is loaded by a 32-bit helper that ships with the gateway.

The FANUC, EZSocket and OPC DA libraries run in a separate process: their crash or hang breaks one read, not the whole service.

How tags appear

Browsing the source. OPC UA, OPC DA, MTConnect, PI, Ignition, MQTT and Sparkplug list their own tags: the gateway walks the tree, the topics or the model and declares what it finds. EtherNet/IP likewise reads a Logix controller's tag list, BACnet/IP a controller's object list, SNMP the standard MIBs.
Address list. Modbus, S7, FINS, SLMP and IEC 104 have no catalog: only the controller project knows what a register or byte means. Tags are listed in the connection settings by address and type, for example DB1.DBD8 real or M10.1 bool for S7.

If the browse hit a limit, the connection says Catalog incomplete: … with the reason. A tag the source gave no value for is named in the connection row with the reason, for example no such address or the device did not answer.

OPC UA: certificates and history

The gateway does not trust an unknown server certificate. For a secured connection put the server certificate into pki/opcua/trusted/certs of the gateway's data directory, or the certificate of the CA that issued it into pki/opcua/issuer/certs. A refused certificate lands in pki/opcua/rejected/certs, and the connection says Server certificate not trusted. The gateway creates its own certificate once, and the server trusts the gateway by it.

After the link to the server drops, the gateway reads what it missed from the server's history, if the server keeps one.

Machine state

The agent sees one state word for a machine: running, idle, stopped, interrupted, setup, maintenance, out of service or unavailable. The word is worked out the same way for every protocol:

The source's standard model: umati (OPC 40501) over OPC UA, an MTConnect agent's device, a FANUC FOCAS or Mitsubishi EZSocket controller. FOCAS and EZSocket machines report the same field set: state, program, part count, spindle and feed override, emergency stop, model and serial number.
A separate state tag: if a machine reports its state in a tag of its own, enter the machine name, the tag and the state values in JSON in the connection setting Machine state mapping.

The machine's raw tags go out beside that word; it does not replace them.

Cameras

An ONVIF camera connects through the gateway; the cloud cannot reach it. The agent can ask for a frame: the gateway takes it and sends it to the chat as a file. The camera reports motion as an event. The gateway does not carry a video stream. On a site closed for critical infrastructure no frame is taken.

What is not there

Writes to equipment: no setpoints, no commands, no method calls.
DNP3 and IEC 61850.
Modbus RTU over a serial port: only Modbus TCP and RTU over TCP, for example through a converter in transparent mode.
Camera video streams.