OT Networks and Segmentation

Physical layer, addressing, segmentation and the security boundary between plant and enterprise. The layer blamed for everything and instrumented for nothing.

What lives in this layer

The OT network carries every conversation in the plant: controller to I/O, controller to controller, HMI and SCADA to controller, and eventually plant systems to the enterprise. On the plant floor that traffic is mostly EtherNet/IP on Rockwell sites and PROFINET on Siemens sites, running over industrial managed switches such as Rockwell Stratix (Cisco hardware with a Rockwell configuration layer), Cisco Industrial Ethernet, Phoenix Contact, Hirschmann and Moxa. Above the floor sit the layer 3 switches, firewalls and the industrial DMZ that should separate operations from the business network. This page covers the boundary at ISA-95 Level 3-4, but the cabling and switching decisions start at the machine.

Naming the layer matters, because the most expensive mistakes in modernization come from solving a problem at the wrong level of the stack. An intermittent I/O fault that looks like a bad module is often a network problem, and a network that looks slow is often a polling design problem.

The problems we see most

Flat networks. Every controller, HMI, camera, printer and laptop on one subnet and one broadcast domain. A fault or a broadcast storm on one line can reach every other line, and nobody can say which device talks to which.

Unmanaged switches in the panel. Cheap, quick, and invisible. They cannot do IGMP snooping, so multicast EtherNet/IP traffic floods every port, and they offer no diagnostics when something goes wrong. We wrote about the security side of unmanaged switches separately.

No documentation. IP addresses held in a spreadsheet that was last correct at startup, no drawing of how switches connect, and no record of which ports are in use. The first job of most network projects is finding out what is actually there.

Physical layer faults. Damaged or incorrectly terminated cable, unshielded runs beside VFD output cabling, and connectors that were never rated for the environment. These produce the intermittent faults that consume weeks of troubleshooting. Our guide to industrial Ethernet reliability covers the common causes.

An undefined IT and OT boundary. IT owns the firewall, controls owns the panel switches, and the space between them belongs to nobody.

The decisions this layer forces

Who owns the network. This decides more than any product choice. If the controls team will administer the switches, choose hardware that integrates with their tools. If IT will run it with existing standards and monitoring, choose what fits those standards. The answer has to be written down before switches are bought.

How to segment. Our position: segment around how the plant actually runs, line by line or area by area, and move toward a zones and conduits model in steps. A flat network will not become a reference architecture in one project, and trying usually stops production. Our guide to designing OT network architecture for a small or medium plant walks through the four stages a plant network usually grows through, and the trigger for each.

Where the boundary sits. Nothing on the enterprise network should reach a controller directly. Data leaves the plant through a defined path, normally an industrial DMZ, and remote access goes through one controlled route rather than a modem or a vendor’s remote desktop tool.

How it connects to the rest of the stack

The network sits under every other layer. Controls depend on it for I/O and interlocks, SCADA and historians depend on it for polling, and plant data and MES and batch depend on the boundary being designed rather than improvised. Edge and I/O devices are often the first thing to expose a weak network. Our article on modern plant network requirements sets out what a current plant network has to support.

Device-level networks

Below the plant network sits the device level, and in a lot of plants that still means a fieldbus installed twenty years ago. Those segments are usually working, usually undocumented, and usually the thing that blocks a project the moment somebody needs data off them.

• DeviceNet, the CAN-based device-level fieldbus behind a large North American installed base. How it works, the cable rules that cap its speed, what fails in the field, and how to decide whether to migrate or hold

Where Joltek helps

An OT network assessment records what is installed, how it is connected and where the risks are, and produces a staged plan rather than a wish list. When plant data needs to reach the business, IT/OT integration designs the boundary. On Rockwell sites, our page on Stratix switches and segmentation goes into switch selection and VLAN design in detail.

Platform position

Vendor-independent, but not opinion-neutral. When one switch platform is clearly better for a given plant, we will say which and why. When the honest answer is that the existing network is adequate and the money is better spent elsewhere, that is the recommendation.