How to Design a Segmented Industrial Ethernet Network

Prerequisites

Start with a complete list of every networked device on the line. Include Ethernet switches, PLCs, drives, HMIs, IP cameras, sensors, and any legacy fieldbus gateways. A factory network design fails fast when the team assumes a device is on the network and then discovers it is hardwired to a control cabinet.

Before drawing the architecture, confirm the physical environment. Industrial areas expose gear to vibration, heat, dust, and EMI. Use shielded cabling where needed, and route cables away from high current lines. The physical layout determines how much protection the network needs at each layer.

Next, define the operational goals. The network must support real time control, remote diagnostics, and production data collection. Some systems need deterministic timing. Others only need reliable file transfer. Matching network design to the actual process requirements prevents over building and under building at the same time.

Why Segmentation Matters

A single flat network gives every device equal access. A broken office laptop and a critical safety PLC share the same broadcast domain. That setup creates three problems. First, a broadcast storm from a misbehaving endpoint can starve the control loop. Second, a malware event in the office can move toward the plant floor. Third, troubleshooting becomes slow because every device sees the same traffic.

Segmentation limits the blast radius. A failure in one segment does not spread to the whole plant. Maintenance teams can isolate a faulty line without taking down the building. IT and OT teams can also apply different security rules. Office traffic follows standard corporate policy. Control traffic follows industrial safety requirements.

Fieldbus and industrial Ethernet often sit in the same cabinet. A fieldbus segment may carry deterministic sensor data. An Ethernet segment may carry historical logs. Separating them at the switch level keeps the control loop clean. It also makes the network easier to scale when new lines are added.

Layering the Architecture

Break the plant into logical layers. The bottom layer connects to machines and sensors. The middle layer connects to the production floor. The top layer connects to the office or data center. Each layer has a defined job.

The machine layer uses industrial Ethernet or fieldbus. It must handle high frequency data with low jitter. Keep this layer short and flat. Do not add too many hops. A PLC should not need to traverse five switches to reach a sensor.

The production layer aggregates the machine layer. It hosts local servers, HMIs, and line controllers. This layer is where the firewall between IT and OT usually lives. Traffic from the plant floor to the office passes through this boundary.

The office layer handles email, ERP, and cloud services. It does not need to touch the control loop. If the office needs production data, it should pull it from a dedicated server that sits in the production layer. That server translates data into a form the office can use.

Defining VLANs and Traffic Flow

Assign VLANs to each segment. Use one VLAN per line or per function. Do not use one VLAN for the entire building. If a line goes down, the VLAN should go down with it. That isolation speeds up recovery.

Plan the flow of data. Identify which devices need to talk to which devices. A HMI may need to read the PLC. A historian may need to read the PLC. An office dashboard may need to read the historian. Write these flows on paper before configuring the switches.

Use firewalls to enforce the flows. The firewall between production and office should allow only the necessary ports. Block everything else. If the historian needs to send data to the office, open one specific port on the historian. Do not open a broad range.

A table helps keep the VLAN plan clear. The table below shows a typical split.

Layer	Example Devices	Typical VLAN Use
Machine	PLCs, drives, fieldbus gateways	One VLAN per line or per function
Production	HMIs, local servers, line controllers	Shared production VLAN or per line
Office	Laptops, ERP, cloud services	Corporate VLAN
Management	Switches, firewalls, monitoring	Separate management VLAN

The management VLAN is often overlooked. Switches and firewalls need to be reachable for configuration. Put them in their own VLAN. Do not let office laptops manage the switches directly. Use a jump host or a dedicated management workstation.

Security and Access Control

Factory network design must include security at every boundary. The physical layer is the first control. Use locked cabinets and access control for switch rooms. A person can reconfigure a switch if they can touch the port.

The logical layer is the second control. Use VLANs to separate traffic. Use firewalls to filter traffic between layers. Use access control lists on switches to limit which devices can send traffic. A sensor should not be able to initiate a connection to the office.

Encryption matters where data leaves the plant. If production data goes to a cloud dashboard, encrypt it in transit. The control loop itself usually does not need encryption because the data is proprietary process data. But the path from plant to office should be protected.

Do not rely on a single firewall. Use defense in depth. A firewall at the boundary blocks most traffic. Access control lists on the switches block the rest. Monitoring catches what slips through. Each layer adds a check.

Common Mistakes

The first mistake is drawing the network by building area. The floor has a switch. The office has a switch. The two are connected. That design does not match the process. A line on the floor may need its own VLAN even if it is in the same building as another line.

The second mistake is underestimating fieldbus. Fieldbus segments are not Ethernet. They have different timing and fault behavior. A fieldbus gateway needs its own network segment. If the gateway is on the same VLAN as office traffic, a failure can mask the real problem.

The third mistake is skipping documentation. A factory network design is not complete until every device, cable, and switch setting is written down. When a line fails at 2 am, the engineer needs the drawing. Without it, the repair takes hours.

The fourth mistake is over trusting the IT team. IT knows office networks. OT networks are different. The control loop is not a web server. It does not tolerate latency spikes. The firewall must be tuned for industrial traffic.

Final Verification

Run a full verification before the line goes live. Start with a physical check. Confirm every cable is labeled and terminated correctly. Confirm the switch ports are assigned to the right VLAN. Confirm the firewalls are active.

Next, run traffic tests. Send a packet from the office to a device in the production layer. It should be blocked. Send a packet from the historian to the PLC. It should pass. Send a broadcast from a sensor. It should stay in the machine VLAN.

Capture packets on each segment. Look for traffic that should not be there. A device in the office VLAN should not appear in the machine VLAN. A fieldbus gateway should not send packets to the office.

Finally, document the test results. Save the packet captures. Save the firewall rules. Save the VLAN table. This document becomes the baseline for future changes. When a new line is added, the engineer starts from the known good state.

Final Notes

A good factory network design is boring on purpose. It separates the office from the plant. It separates the control loop from the data path. It labels every cable and documents every setting. The result is a network that stays up, stays secure, and is easy to fix when something breaks.

The design does not end at commissioning. As the plant grows, the network grows. New lines add new VLANs. New systems add new firewall rules. The documentation must stay current. A network that was clean at start up will drift if no one maintains it.

The goal is not the most complex architecture. The goal is a clear, controlled, and documented network. That is what keeps production running and keeps the team from chasing ghosts at 3 am.