Compact Logix on Multiple Networks

I am reviewing a proposal where a Compact Logix processor needs to be on three (3) separate Ethernet networks. For the sake of argument, say that these networks will will be these IP address ranges: 192.168.x.x, 172.16.x.x, and 10.x.x.x.

In the past we have generally used Control Logix, where each network gets its own ENxT module. All is good with this approach, but that is not an acceptable option for (non-technical) reasons in this case.

This proposal calls for a 5370 processor, which only has a single IP address. In these cases we use one of the Rockwell NAT devices for a second network. When the integrator was questioned about the third network, the answer was to "just" add a second 1783-NATR to the 192.168 network.

This has me a bit nervous about whether it will actually work. For example, when using a single NAT on a private network, its private-side address is the gateway for the devices on the network. This implies one-NAT-per-private network to work as expected (implicit messaging, OPC, remote program access).

It's not too late to re-design with a 5380, but this also has resistance for non-technical reasons.

Questions:
. Has anyone ever used multiple Rockwell NAT devices to provide access to a single private network from more than one external network?
. Can the dual IP addresses of a 5380 be used, functionally, like two ENxT modules in a Control Logix system (e.g., do they separately appear in the I/O tree)? If so, will the NAT allow access to the processor from the third network?
. Not that I want to go here: But is there a way to accomplish this more-than-two network capability for a 5370 processor using Stratix switch(es) or third-party equipment?

I know it could be done with a small router or layer 3 switch. I believe the 8300 is a level 3. Not sure about the smaller versions.

I would use the Stratix 5800. Layer 3 switching. New switch.

Thanks for the feedback. Sounds like it's time to get the "Network Team" involved. Ugh.

Mispeld said:

It's not too late to re-design with a 5380, but this also has resistance for non-technical reasons.

Click to expand...

Why waste anymore time when the obvious solution is a 5380 and 1783-NATR? Do this and move on.

Mispeld said:

Questions:
. Has anyone ever used multiple Rockwell NAT devices to provide access to a single private network from more than one external network?
. Can the dual IP addresses of a 5380 be used, functionally, like two ENxT modules in a Control Logix system (e.g., do they separately appear in the I/O tree)? If so, will the NAT allow access to the processor from the third network?
. Not that I want to go here: But is there a way to accomplish this more-than-two network capability for a 5370 processor using Stratix switch(es) or third-party equipment?

Click to expand...

As others have said layer 3 switch will probably do the trick.

What others haven't asked. What is the current load on the network card(s)? ENBT cards are pretty good for "low" traffic but I've found that I've had to upgrade a few to EN2T. So you might want to make sure you're not within 20% of your limit.

I've had 3 network cards in a rack and its been fine but I was under any CPU and network card limits.

Paullys50 said:

Why waste anymore time when the obvious solution is a 5380 and 1783-NATR? Do this and move on.

Click to expand...

Not having used the 5380, and none available for testing, I am nervous about whether these ports behave like independent ENxT modules in the Control Logix platform. It seems like they should, in that one of the two ports can interact with the NATR, while the other's network remains isolated. I will have to look at the docs more carefully and/or see if we can get a loaner from our Rockwell distributor.

VAN said:

As others have said layer 3 switch will probably do the trick.

What others haven't asked. What is the current load on the network card(s)? ENBT cards are pretty good for "low" traffic but I've found that I've had to upgrade a few to EN2T. So you might want to make sure you're not within 20% of your limit.

I've had 3 network cards in a rack and its been fine but I was under any CPU and network card limits.

Click to expand...

This is a new machine, but I can say two of the networks will be on the lower traffic side, mainly consisting of data-oriented messaging and supervisory control (as opposed to I/O and motion on the third network).

I've wondered if the limited network capability of the Compact Logix platform is marketing- or technical-driven. It sure would be nice it there was an Ethernet module available with functionality like the 1756-ENxT.

CompactLogix is less complex, less fast, and less capable, and probably always will be. It's an architecture and feature matter, not a marketing issue.

For a machine that needs multiple networks for multiple purposes, ControlLogix is the way to go.

If your client isn't comfortable with the skills of their "network team", do they want to make functionality of the system dependent on standalone network devices instead of PLC modules ?

I suppose I'm far enough along in my career that I can say "take my advice on architecture or find someone else to take the risks for you. I'll be here if you need help, but not if you ignore my professional judgement."

Ken Roach said:

For a machine that needs multiple networks for multiple purposes, ControlLogix is the way to go.

Click to expand...

Thank you for helping to break through the mindset going into the project that all the ancillary machines will be CompactLogix. That direction made sense until the communications requirement-creep pushed the limit of that platform. Fortunately, in this case, the physical size and incremental cost differences are not show-stoppers for considering ControlLogix.

Some commentary on the other points:

"Marketing" was maybe not the best term for what I was getting at. Your answer implies not offering "unlimited" network capability is as much or more a technical limit as it is a motivation to push the presumably higher margin products.

Regarding the Network Team, it is not a matter of skills -- they are good at what they do -- it is more that when you start to ask "can I use this network infrastructure device," the answer is generally "no" before you finish. They are very protective of their turf, and for good reason. That said, with Stratix being so closely tied to Cisco, they have been granted exceptions. Just to add, the Rockwell NAT devices are grudgingly accepted because they got in before things got locked down, and are seen more like PLC modules.

I'm straying out of my lane on these Ethernet architecture decisions, having been brought up in the "simpler" times when there was ControlNet, DeviceNet, and Sercos (as well as DH+/RIO), each for its own purpose. Need to find the time to get more up-to-date since Ethernet seems to have crowded out just about everything else.

Ken Roach said:

CompactLogix is less complex, less fast, and less capable, and probably always will be. It's an architecture and feature matter, not a marketing issue.

For a machine that needs multiple networks for multiple purposes, ControlLogix is the way to go.

.......

Click to expand...

One thing to consider is that the integrated LAN port of a CompactLogix won't rely on the meagre 5MB/s bandwidth of "ControlBus" to give it's birth name, but everyone (Including Rockwell Software) calls it the ControlLogix "Backplane".

To be honest, I don't know the bus speed of the bus dedicated for comms modules on a CompactLogix, and perhaps I should ....

Note to self, look it up tomorrow ....

Mispeld said:

I am reviewing a proposal where a Compact Logix processor needs to be on three (3) separate Ethernet networks. For the sake of argument, say that these networks will will be these IP address ranges: 192.168.x.x, 172.16.x.x, and 10.x.x.x.

...

This proposal calls for a 5370 processor, which only has a single IP address. In these cases we use one of the Rockwell NAT devices for a second network. When the integrator was questioned about the third network, the answer was to "just" add a second 1783-NATR to the 192.168 network.

Click to expand...

I want to follow-up here because, for reasons beyond my control, the decision was made to use the 5370 and two NATRs. It was based on a design provided on Rockwell letterhead and assurance that it would work. ("It's on letterhead, so it must be correct.")

That design, which showed the private ports on both NATRs on the 192.168 network, did not work -- as far as I tried to make it work. However, there is a solution that so far meets the inter-processor communication requirements: RS-Linx access from 10.x to 192.168, and produced/consumed between 192.168 and 172.16.

Before describing it, I want to be clear this was not my first choice, and actually thought we were going to have to merge the 192.168 and 172.16 networks.

But it turns out that "nesting" the NATRs does seem to work. By this I mean one NATR translates from the 10.x (public) to the 172.16 (private) network, and the second translates from the 172.16 (public) to the 192.168 (private) network. Studio 5000, on 10.x has no problem routing through two NATRs to access the 5370 on the 192.168 network. Not ideal, but workable, and seemingly as responsive as being Studio 5000 running directly on the 192.168 network.

The key is to make sure gateway settings are correct, particularly the "inner" NATR must specify its public gateway to be the private-side IP of the "outer" NATR. Makes me wonder if there is a limit to how many NATRs could be nested like this.