Question about plant networks / VLANS
- Thread starter russg
- Start date
The other reason for wanting to do this is because it is obviously good to keep devices like servo drives on a separate network due to reliability. I'm always wondering how important this is though? Would it be ok to have one production line with multiple machines all connected on one network / VLAN? There must be a limit which could possibly slow things down?
The other reason which I've hardly looked into is security.
The other reason which I've hardly looked into is security.
https://www.practicalnetworking.net/stand-alone/routing-between-vlans/
I'm unsure how big your network is but the vlan direction is the "safer" bet but takes a bit of work to get it setup.
If you have a small network might consider a single vlan and have multiple sub-nets.
If you can you might reach out to Rockwell, they have a good network team and they work with sites on setting up OT networks.
They'll show you how to layer your network
example
- Layer 1 - PLCs, HMIs, Remote IO and VFDs
- Layer 2 - workstations and items that talk directly with layer 1 and layer 3
- Layer 3 - Servers/Historians/domains/active directory
Then they can give a plan for scaling to infinity and how to setup VLANs and or subnets on VLANs.
Depending on your network and if you eventually run out of VLANs and what to do next etc. (I have no experience at this point and would rely on IT heavily.)
You might want to talk with your IT department (IT is our friends) and get a plan and see what they do for network monitoring. Claroty is pretty neat but I don't have any experience, and solarwinds is really neat but I think it has a funny license issue.
But networks is a cool area to get good at but at the same time it can be frustrating as hell when the network gets a ghost/bug.
They'll show you how to layer your network
example
- Layer 1 - PLCs, HMIs, Remote IO and VFDs
- Layer 2 - workstations and items that talk directly with layer 1 and layer 3
- Layer 3 - Servers/Historians/domains/active directory
Then they can give a plan for scaling to infinity and how to setup VLANs and or subnets on VLANs.
Depending on your network and if you eventually run out of VLANs and what to do next etc. (I have no experience at this point and would rely on IT heavily.)
You might want to talk with your IT department (IT is our friends) and get a plan and see what they do for network monitoring. Claroty is pretty neat but I don't have any experience, and solarwinds is really neat but I think it has a funny license issue.
But networks is a cool area to get good at but at the same time it can be frustrating as hell when the network gets a ghost/bug.
stretch_af
Member
harryting
Lifetime Supporting Member
I tell myself that they mean well. But...
Great. Thank you.
I'm impressed with all the documentation from Rockwell, but we are a Siemens factory, so I may need to work with the equivalent Siemens team.
And yes, I'm working with the IT team, and actually trying to understand all this better so the IT infrastructure team can put it in place.
I'm impressed with all the documentation from Rockwell, but we are a Siemens factory, so I may need to work with the equivalent Siemens team.
And yes, I'm working with the IT team, and actually trying to understand all this better so the IT infrastructure team can put it in place.
On my Allen Bradley controllers I can have multiple Ethernet cards installed so I can have separate networks. One card will be for the machine network and the other card will be for the plant network. I have never messed around with Siemens controls before, but I bet you can put more than one Ethernet card in the rack.
rankhornjp
Member
I used to do the same. However, the down side of this approach is that you can't access the network on the other cards from your desk.
Example:
Card 1 is your plant network
Card 2 is machine network
If you want to connect to an Ethernet device (hmi, drive, instrument) to make changes you would have to go out to the controller and plug into the local switch that's attached to Card 2.
With a VLAN/NAT you can access anything on the network from the engineering station.
cardosocea
Member
The setup I inherited is now a jumbled mess of systems and the guy before me was planning to install everything on VLANs.
The way we would have our engineering station accessing all VLANs was by having all of the "computers" as Virtual machines inside a large server with... off the top of my head 8 network ports. Inside the server you can set up virtual switches that then link the virtual machine to whichever virtual switches you need.
Personally, although there are sizeable benefits in creating VLANs to put all your equipment in them, I dislike the approach as it can put a lot of your processes dependent on the entire network. So I prefer to physically segregate the IO from the whole network.
The other, although not that common, benefit is that if something in the network were to fail, good old bubba can just put pretty much any network switch and it works. With VLANs, it's certain that a cable will go in the wrong port and you'll be called in to fix the problem.
And it doesn't even have to be the top end processor to do that...
The way we would have our engineering station accessing all VLANs was by having all of the "computers" as Virtual machines inside a large server with... off the top of my head 8 network ports. Inside the server you can set up virtual switches that then link the virtual machine to whichever virtual switches you need.
Personally, although there are sizeable benefits in creating VLANs to put all your equipment in them, I dislike the approach as it can put a lot of your processes dependent on the entire network. So I prefer to physically segregate the IO from the whole network.
The other, although not that common, benefit is that if something in the network were to fail, good old bubba can just put pretty much any network switch and it works. With VLANs, it's certain that a cable will go in the wrong port and you'll be called in to fix the problem.
And it doesn't even have to be the top end processor to do that...
504bloke
Lifetime Supporting Member
I always refer to IT as "In Trouble"......
504bloke
Lifetime Supporting Member
Similar Topics
Hi everyone,
I have started on a questIon involving a bottling plant using LADSIM.
However, so far, I can only fill one bottle.
I am...
Hi,
We are in a car company. For the PLC, HMI and SCADA programmation we do not have any standards. For the old body we setted up a SCADA system...
Good Evening,
I am curious to know, if its possible to use PlantPax graphics, face plates in Factory Talk View without utilizing its Add On...
The last two days our automation has just stopped randomly at different spots. Everything that has stopped, is thru DeviceNet.We have about 5...
Hello again..trying something on an existing poorly written program and just wanted to double check something
system is an A-B MicroLogix 1200
In...