Remote access of machine ethernet ?s

BinderNut said:

That is how our current plant-wide network is set up.
192.168.1.x is our "business" network.
192.168.2.x is another business network.
192.168.3.x is our process network.

Click to expand...

YUCK, why they have everything on a 192 network on the business side blows my mind. Business networks I've always seen 10.x.y.z or 172.x.y.z

BinderNut said:

The fun part will be the sales pitch to corporate IT (not just our plant) on getting more hardware

Click to expand...

Given the setup you have, good luck. In reality, a good IT group should be able to come up with a good solution w/o blinking an eye.

BinderNut said:

Some of our equipment that shipped with it's own OEM supplied machine network.
What options do we have to allow comms from an external connection (on our 192.168.3.x network) to the internal network on the machine without readdressing the OEM network.

Click to expand...

You want a Network Address Translation device, JohnCalderwood provided an example.Here is another

You need managed switches VLANs and a layer 3 managed switch to handle routing between the different VLANS.


192.168.1.x --> VLAN1
192.168.2.x --> VLAN2
192.168.3.x --> VLAN3
192.168.4.x --> VLAN4

A properly configured network with VLANs, the layer 3 switch can be configured to route VLAN3 and VLAN4 traffic giving you access to those networks but restricted access to the others. I hope there is a firewall at your SCADA/SQL server.

All of this consts $$$ and you need people competent to set it all up.

You say 192.168.3.x is isolated, but it is part of a plant wide network. So define isolated...

Paully, Our plant network(s) aren't in the 192.168 range. I just used your example numbers in my illustration. We do use 10.x.y.z

Sticking with my initial numbering example...Our "192.168.3.x" network has limited access to the business networks via port and MAC filtering. Only the SCADA server has access via MAC filter, and then only on certain ports. SCADA server is outbound reporting only.


Right now, we're just starting to look at more Ethernet devices on the plant floor. We're still in the planning stages of what we will possibly be seeing in the future as far as Ethernet devices on the process equipment. Our in-house IT staff is fairly green as far as process hardware goes, so we have been working heavily with the corporate IT staff that deals with our sister plants on what the company will allow as far as traffic between networks. Unfortunately, the E&I guys in our sister plants are even further behind the tech curve than our plant so we're winding up feeling like the guinea pigs.


The 1783-NATR will accomplish what we're looking to do to have the OEM machine networks tie into our current process network.


Thank you guys so much for indulging my naivety! I didn't do much networking theory in tech school. Besides, that was 25 years ago so I've forgotten much of what I learned then.