The TIA instructions are MB_SERVER and MB_CLIENT, I think.
Here are a couple of Github repos that have an S7-1200 acting a Modbus server using the MB_SERVER instruction; I imagine the Modbus client instruction would be similar.
Which commercial Modbus Master/clients do support Function Code 23H? I have yet to run into one that does.
There are slave/server devices that support FC 23 and there's one odd-ball that supports only FC 23, which display a remarkable ignorance of market conditions in my opinion.
@danw
Most HMIs and VFDs I use support it. Mitsubishi and Codesys based PLC use it. It makes life much easier for programmer when you can read and write in one cycle.