The short answer
Network Drawings
A control network is documented with a logical drawing and a physical drawing. The logical drawing shows the security zones, the VLANs and subnets in each, the firewalls and routers between them with the conduits they permit, the servers, controllers, and remote sites as members of their zones, and the paths to the office, the DMZ, and the outside. The physical drawing shows every switch with its ports, the cables and fiber between them with their identifiers and media, the patch panels, the radios and modems with their links and frequencies, and the remote sites with their equipment. Both carry the addresses and identifiers that the network schedule holds in full, both are marked as sensitive because together they are the attacker map, and both are revised through change management so that the drawing, the schedule, the switch port descriptions, and the firewall rules agree.
Key points
- Logical: zones, subnets, VLANs, firewalls, conduits. Physical: switches, ports, cables, fiber, radios, sites.
- The logical drawing is the segmentation design made visible; every firewall rule should be a line on it.
- The physical drawing is what a technician uses to find a cable and what an outage is diagnosed from.
- The network schedule holds the detail; the drawings show the structure and reference it.
- The drawings are sensitive: access-controlled, not in the bid set, not on the shared drive.
- Change management revises the drawing, the schedule, the port descriptions, and the rules together.
The logical drawing
| Element | Shown as | Detail carried |
|---|---|---|
| Security zones | Bounded regions, labeled with the zone name and level | Control, supervisory, engineering, DMZ, office, remote sites |
| Subnets and VLANs | Labels inside each zone | Network address and mask, VLAN number |
| Firewalls and routers | Symbols on the zone boundaries | Name, management address, the interfaces to each zone |
| Conduits | Lines crossing a boundary through a firewall, labeled | Protocol, direction, source and destination groups; each is a rule set |
| Servers and workstations | Symbols in their zone | Name, role, address |
| Controllers and remote units | Symbols in the control zone, grouped by area or site | Name, address, protocol |
| Remote sites | A zone per site with its link | Link type, the site boundary device, the site subnet |
| Paths outward | Lines to the DMZ, the office, the cloud, the vendor | What crosses, through what |
The logical drawing is the picture of the segmentation design. A reader should be able to look at it and say what can talk to what and through which firewall, and the firewall rule set should correspond to the conduits drawn. When the drawing and the rules disagree, one of them is wrong, and the review finds which. It changes rarely, when a zone is added or a conduit opened, and it is the drawing shown to the assessor, the insurer, and the new engineer on the first day.
The physical drawing
| Element | Shown as | Detail carried |
|---|---|---|
| Switches | A symbol per switch with its port layout | Name, model, location, management address, uplinks |
| Cables | Lines between ports, labeled | Cable identifier, media, length, the port at each end |
| Fiber | Lines with a distinct style | Cable identifier, strand numbers used, type, patch panel and port at each end |
| Patch panels | Symbols at each end of a fiber or a structured cable run | Panel name, port numbers |
| Radios and modems | Symbols with their links drawn as paths | Frequency or carrier, antenna, the link partner |
| Firewalls, routers, servers, controllers | Symbols at their ports | Name and the switch port they connect to |
| Remote sites | A site box with its switch, controller, radio, and the link | Site name, equipment, link |
| Power | The UPS and power source for network equipment where relevant | Which UPS feeds which switch |
The physical drawing is the one opened during an outage: which switch is the device on, which port, which cable, which fiber pair, which patch panel. It is also the one that tells a technician whether a cable can be unplugged and what will drop if it is. It changes every time a device is added or moved, which is often, and it is the drawing most likely to be out of date. The switch port descriptions, set from the same data, are the copy of it that lives inside the switch.
Producing them
- 1
Start from the inventory and the schedule
Every device with its address, VLAN, switch, and port is in the network schedule; the drawings are views of it.
- 2
Draw the zones first
The logical drawing from the segmentation design, with the conduits from the firewall rule design.
- 3
Draw the switches and links
The physical drawing from the switch configurations, the cable and fiber schedules, and the site walk.
- 4
Reconcile
Every device on one drawing is on the other and in the schedule; every conduit has rules; every port with a description has a line on the drawing.
- 5
Mark and protect
Both drawings marked as security-sensitive, stored with the security documentation, issued to those who need them, and removed from bid sets and general drawing indexes.
- 6
Revise through change management
A change record that touches the network includes the drawing revision, the schedule update, the port description, and the rule change.
Telemetry systems
A radio or cellular telemetry system gets its own physical drawing: the master radio and its antenna, the repeaters, each site with its radio, the paths drawn with their frequencies or carriers, and the path study results such as signal margin recorded beside each link. The drawing is what the radio technician uses to diagnose a site that stopped talking and what the utility uses to plan a new site. Cellular sites show the carrier, the private network or the tunnel, and the modem. The logical drawing shows the same sites as zones with their conduits; the telemetry drawing shows how the bits get there.
Frequently asked questions
- We have one drawing that mixes logical and physical. Is that acceptable?
- For a very small system, a single drawing that shows the firewall, the switches, and the devices with addresses can serve both purposes. Beyond a handful of switches, the mixture becomes unreadable, and the two drawings are separated: structure on one, cabling on the other.
- What symbols should we use?
- A consistent set: the project standard defines a symbol for each device type and a line style for each medium, and every drawing uses them. Vendor icon sets are fine for the physical drawing; the logical drawing benefits from plain boxes and labeled boundaries that anyone can read.
- How much detail goes on the drawing versus the schedule?
- The drawing shows names, addresses, and identifiers enough to find a device; the schedule holds every field. A drawing that tries to hold every MAC address and firmware version is unreadable and always out of date; a schedule holds them naturally.
- Who is allowed to see the network drawings?
- The control system staff, the integrator under contract, the assessor under agreement, and management on request. Not the general drawing index, the shared drive, or the bidders as a matter of course. The drawings are the map of the system; treat them as the security documentation they are.
Related topics
- Network SchedulesThe tables behind the network drawings: the address schedule of every device, the switch port schedule of every port, the VLAN table, and the conduit list of what the firewalls permit. How they are built, kept as the single source of truth, and protected.
- Zones and ConduitsThe IEC 62443 way to segment a control system: grouping assets into zones with a shared security level, inventorying every conduit between them, and turning the drawing into firewall rules. With a worked water utility example.
- Firewall Rule DesignWriting the rule set for a control network boundary: default deny, one rule per conduit with its reason, hosts not subnets, protocol and port and function, direction and initiator, logging on every rule, and the review that removes forgotten rules.
- Fiber SchedulesThe record of every fiber strand between every pair of patch panels: cable identifiers, strand numbers and the standard color sequence, fiber type, connectors, what each strand carries, splices, lengths, and test results, with the labeling that matches it.
- How to Assign IP Addresses on a Control NetworkBuild an addressing plan before the first device is configured: one subnet per zone and site, a fixed block layout so an address says what the device is, static addresses on everything that controls a process, and a schedule that is kept current.
- Building an OT Asset InventoryThe list of everything in the control system with a network interface or a program, and how to build one that is right: what counts, the fields to record, the site walk, the switch tables and passive listening that find the rest, and keeping it current.
Direct contact
Have a controls question?
Reach Eric Sullivan directly about anything on this site, a controls or automation topic, or one of his personal projects.