Multiple subnets on a single VLAN?

[brinocerous]

Hello, crew.

I work at a small integration shop and recently we ran network drops from the office to the shop for the convenience of our programmers. We have a small office so our business network is on a single subnet 192.168.1.0/24. The entire office and shop physical network is comprised of two Cisco SG350X-48P switches, which are in turn connected to a router for internet access.

Now that the shop is connected to the switches, a disagreement has arisen on how to segregate the programmer’s PLC, HMI, and other automation devices from the business network, even though they share the same physical infrastructure. Obviously, these devices should not be visible to/from the internet so assigning them to the office subnet is out of the question. As I see it, this leaves the following two options:

(1) Leave all the switch ports on the same VLAN (as they are now), and simply use a different subnet (say 192.168.100.0/24) for the automation devices. The programmers can assign their computers static IP addresses on this new subnet. If the devices are not assigned a gateway, then they should be effectively hidden from the business network hosts. The downside is that both subnets will see each other’s broadcast traffic, but if the total number of hosts remains relatively low, this shouldn’t have much of an impact (hopefully).

(2) Assign a separate VLAN and designate switch ports for automation devices and programmers’ computers. As far as I understand, this means that we would have to run separate drops to each programmer’s desk so they could simultaneously access the PLC VLAN and the business VLAN. The benefit is that the business and PLC network can’t see each other’s broadcast traffic.

I have huge holes in my networking knowledge, so I’m sure I’m missing some subtlety here. PLCtalk, please educate me, which way is best to accomplish this goal?

 

[JaxGTO]

Your PC can have more than one IP address. I do this all the time when i setup a customers devices at the office. I have my regular static IP with gateway and DNS then. The static is like what you have 192.168.1.201. My customers devices are all 10.200.0.x. So I add that IP under Advanced on the network settings. Another customer has all 172.25.1.x so I have another one for that. As long as I dont put a gateway on the customer ones I can see all of the devices and get out on the office network no problem.



I am even starting to use batch files to do the setup now:
netsh int ip set address "adaptername" static 10.200.31.252 255.255.0.0


Set multiple IP addresses:
netsh int ip set address "adaptername" static 192.168.1.252 255.255.0.0
netsh int ip add address "adaptername" 10.200.0.252 255.255.255.0
netsh int ip add address "adaptername" 172.25.0.252 255.255.255.0


Or back to DHCP:
netsh int ip set address "adaptername" dhcp

 

[theColonel26]

Obviously, these devices should not be visible to/from the internet so assigning them to the office subnet is out of the question.

huh? how would they be "visible to/from the internet". They aren't accessible from the internet unless you configure your router to NAT or Port forward to them.


You should be able to Setup a route between the 2 VLANs so that the Programmer PCs don't have to have a second drop to them. If you want to only allow the Programmer PCs access to that VLAN assign them to a specific static range and only allow that range to route to the Shop VLAN.



As for if they have access to the internet why does it matter? I mean if you wanted to though you could configure the routing table in the switches to only allow traffic from the Shop VLAN to the Office VLAN and not through the internet gateway.


or maybe even easier. Just setup a RPi or old workstation with a second USB NIC. One for each VLAN and then install a SoftEther Server on it. Then put SoftEther Client on all the Programmer PCs. That way they have use a user name and password to VPN tunnel in to the Shop VLANs.

I have this setup on all of our Panel PC HMIs in our machines so I can connect to the Local IO LAN on each machine if need be.


There are probably other ways to do it too. That accomplish what you want.


oh also check out NetSetMan it's the utility I use for network configs.

 

[brinocerous]

Thank you both for your input and ideas. Maybe I was overthinking this.

 

[harryting]

Keep in mind that broadcast traffic will NOT hit the other subnet.... 198.168.1.0/24 broadcast will not hit 198.168.2.0/24.

How you segregate really depend what your goals are. I'm not even sure in your case that you need to segregate. I assume the only router you have is the router to the internet, in that case, simply leaving out the gateway address on a device will prevent that device from accessing the internet.

 

[nehpets]

+1 for the Netsetman, makes swapping networks simple.