Configuring Stratix Switches

Hi,

I am currently expanding our fiber network to cover all three production lines and would like someone with a little more experience to maybe give me some pointers on a couple of questions I have.

The attached drawing show's an existing network on one line that I had installed in 2014 and commissioned, but before I configure the other lines it would be good to know it's setup in the best manner.

Each piece of equipment has it's own VLAN and IP address range, for instances 10.3.10.11 is a PLC on VLAN 310 (made up from 1st and 2nd Octet). The IP addresses are arranged as follows: first Octet remains 10 throughout, second is the line number, third is machine number in that line, and forth is a sequential number starting from 10 for each device.

The computers/servers etc are in a different range, like 10.10.5.xx, and each switch in the network either backbone or machine level is configured as VLAN 1, 10.10.5.xx throughout the line. The CIP side of the switch is configured with an IP address/VLAN that matches the machine IP address range i.e. 10.3.10.10.

So my question is.....Is the machine level switches configured in the best manner, or should the native/managment side of the switch have the same VLAN and IP address as the CIP side?

Regards

Rob

Impressive network. Looks like some good planning and budget was invested in this infrastructure, which doesn't seem to happen enough down here.

I think what you are doing is good practice. I would keep management on a dedicated VLAN and not on the machine VLAN's as you seem to be doing.

The only thing I would recommend is changing your native management VLAN to be something other than default VLAN 1. This is a security risk and is commonly used as a way to target networks.

What redundancy protocol are you using between your backbone switches? I would suggest REP if not already configured.

I have just arranged for the remaining 3 Stratix switches not shown on here, to be connected into the fiber ring. This will triple the amount of machine level switches. The fiber on its own is costing £10k to install!

At the moment it isn't configured as a REP ring, but in the process of changing it over before the additional switches are brought into the network.

As far as VLAN Management, and not using the native VLAN 1, I happen to read about that in a RA network architecture document and is also something that is going to happen shortly.

So keeping a separate CIP and management IP address/VLAN for the switches is the way to go????

Rob

I would keep management VLAN / IP's on their own management VLAN.

I would then only enable CIP on the VLAN that has the local controller to the switch, so you can add it to the IO tree for diagnostics and alarming.

Thanks for the recommendation