The short answer
VLAN Segmentation
A VLAN divides one physical switch into separate broadcast domains, and a control network uses them to give each security zone its own segment on the switches the plant already has: control, supervisory, remote I/O, DMZ, and management each on their own VLAN with their own subnet. Devices in different VLANs cannot talk unless something routes between them, and in a control network that something is the firewall, whose rules define the conduits; a layer 3 switch that routes between VLANs bypasses the firewall unless it is configured with access lists that nobody maintains. VLANs are configured with trunks that carry only the VLANs they need, a native VLAN that carries nothing, switch management in its own VLAN, and no device ports on VLAN 1. They are a logical separation that a misconfiguration or a compromised switch can undo, so the highest-consequence boundaries, such as between the control network and the office or a safety system, are physically separate hardware rather than VLANs on a shared switch.
Key points
- A VLAN is a separate segment on a shared switch; it is a zone boundary only when a firewall sits between VLANs.
- One VLAN per zone, one subnet per VLAN, the same numbering at every site.
- Route between VLANs at the firewall; a layer 3 switch that routes bypasses the rules.
- Trunks carry only the VLANs they must; the native VLAN is unused; nothing lives on VLAN 1; management has its own VLAN.
- VLAN hopping and switch compromise cross VLANs; the configuration rules exist to prevent the first, and physical separation answers the second.
- Office to control, and control to safety, are physical boundaries, not VLANs on the same switch.
What a VLAN does
A switch forwards frames between its ports as if they were all on one wire. A VLAN tags each port with a segment number, and the switch forwards frames only between ports in the same segment; a device in VLAN 10 cannot see a device in VLAN 20 on the same switch any more than if they were on separate switches. Frames carried between switches on a trunk carry the segment number in a tag so that the far switch keeps them separate. What a VLAN does not do is decide whether the segments may communicate: that is routing, and whatever routes between them, a firewall or a switch with a routing function, is the boundary. The security of VLAN segmentation is therefore the security of the router between the VLANs plus the correctness of the switch configuration.
Zones to VLANs
| Zone | VLAN | Subnet | Members | Routed to |
|---|---|---|---|---|
| Control | 10 | 10.S.10.0/24 | Controllers, local HMIs | Supervisory, through the firewall |
| Remote I/O | 30 | 10.S.30.0/24 | I/O adapters, drives, Ethernet instruments | Control only, or nothing beyond the controller |
| Supervisory | 20 | 10.S.20.0/24 | SCADA servers, historian collector, operator stations | Control, DMZ, through the firewall |
| Engineering | 25 | 10.S.25.0/24 | Engineering workstations, programming tools | Control and supervisory, through the firewall, with programming allowed from here only |
| DMZ | 40 | 10.S.40.0/24 | Historian replica, jump host, file transfer, time server | Supervisory inward one way; office outward |
| Management | 99 | 10.S.99.0/24 | Switch and firewall management interfaces | Engineering only |
| Native | 999 | none | No members | Nowhere |
Configuration rules
- Device ports are access ports in one VLAN, with trunk negotiation disabled, so a device cannot become a trunk and see every VLAN.
- Trunks between switches and to the firewall carry an explicit list of VLANs; a trunk that carries all VLANs by default extends every mistake to every switch.
- The native VLAN on every trunk is an unused number with no members, so untagged frames from a misconfigured device land nowhere.
- VLAN 1 has no ports, no management interface, and is not carried on trunks; it is the default that every reset switch returns to.
- Switch management interfaces are in the management VLAN, reachable only from the engineering zone, and the switch has no address in any other VLAN.
- Unused ports are shut down and assigned to an unused VLAN; a live port in the control VLAN in an empty office is an invitation.
- Routing between VLANs is done by the firewall with a sub-interface per VLAN; layer 3 switches have routing disabled, or their access lists are treated as firewall rules under change management.
- Configurations are backed up after every change and compared with the baseline on a schedule.
How VLANs fail
| Failure | How | Prevention |
|---|---|---|
| VLAN hopping by double tagging | A device on the native VLAN sends frames with two tags; the first switch strips one and forwards into the VLAN of the second | Native VLAN unused and not assigned to any port |
| VLAN hopping by trunk negotiation | A device negotiates its port into a trunk and sees every VLAN | Trunk negotiation disabled on every access port |
| Routing on a layer 3 switch | The switch routes between VLANs without rules; the firewall is decoration | Routing disabled on switches, or access lists managed as firewall rules |
| Compromised switch | An attacker with switch management access reassigns ports or adds trunks | Management in its own VLAN, strong credentials, logging, configuration baselines |
| Unmanaged switch in the path | It passes tagged frames or puts every device into its uplink VLAN, unpredictably | No unmanaged switches on segmented networks |
| Misconfigured port | A device patched into the wrong VLAN during maintenance | Port descriptions, the IP schedule, and a switch port audit |
Where VLANs are not enough
A VLAN boundary depends on the switch being correctly configured and not compromised, and on the firewall between VLANs being correct. For most boundaries inside a plant that is acceptable, and it is far better than a flat network. For the boundaries whose failure would be catastrophic, the design uses separate hardware: the office network and the control network on different switches with only the firewall between them, a safety instrumented system on its own switch with a firewall or nothing between it and the control network, and a DMZ on its own switch where the utility can afford it. Separate hardware cannot be crossed by a tagging trick or a switch configuration error, and the cost of a second switch is small against the consequence it prevents.
Frequently asked questions
- Can VLANs replace a firewall?
- No. VLANs separate; a firewall decides what may cross. Two VLANs with no routing between them are isolated, which is fine for I/O that talks only to its controller. Any two zones that must exchange data need a firewall between their VLANs, with rules, or the separation is only as good as the switch configuration.
- Is a layer 3 switch acceptable as the router between VLANs?
- Only with access lists that implement the same rules a firewall would, maintained under change management, logged, and reviewed. Most utilities cannot sustain that on a switch, and the firewall is the better tool: it logs, it understands protocols, and its rules are what everyone expects to review.
- We have unmanaged switches at remote sites. Can we segment there?
- Not with VLANs. A remote site with an unmanaged switch is one segment, and the segmentation is at the site firewall or router that connects it to the rest of the system. Replace the unmanaged switch when the site is upgraded; until then, treat the site as a single zone.
- How many VLANs does a small plant need?
- Control, supervisory, management, and a DMZ, with remote I/O in the control VLAN if the controllers are few. Four or five. The number grows with the plant, but the discipline of one VLAN per zone matters more than the count.
Related topics
- How to Configure VLANs on a Control NetworkTurn a zone plan into switch configuration: a VLAN per zone with its own subnet, access ports for devices, tagged trunks between switches, a native VLAN that carries nothing, a separate management VLAN, and routing between VLANs only through the firewall.
- Zones and ConduitsThe IEC 62443 way to segment a control system: grouping assets into zones with a shared security level, inventorying every conduit between them, and turning the drawing into firewall rules. With a worked water utility example.
- Industrial DMZ DesignThe buffer zone between the business network and the control system: what goes in it, the no-direct-path rule, push-not-pull data flows, the firewall pair, and the services a utility actually needs to place there.
- Firewall Rule DesignWriting the rule set for a control network boundary: default deny, one rule per conduit with its reason, hosts not subnets, protocol and port and function, direction and initiator, logging on every rule, and the review that removes forgotten rules.
- How to Assign IP Addresses on a Control NetworkBuild an addressing plan before the first device is configured: one subnet per zone and site, a fixed block layout so an address says what the device is, static addresses on everything that controls a process, and a schedule that is kept current.
- Segmenting a Remote SiteA lift station, a well, or a tank site as its own zone: the site firewall and what it permits, the modem as transport with no public address, cameras and extras off the control segment, engineering access through the plant, and local control without the link.
Direct contact
Have a controls question?
Reach Eric Sullivan directly about anything on this site, a controls or automation topic, or one of his personal projects.