Manufacturing Plant Network Design: Connecting OT and IT Safely
Manufacturing networks are different from office networks in three important ways: the consequences of downtime are measured in production output, not just inconvenience; operational technology (OT) devices like PLCs and SCADA systems were designed for reliability, not security; and the physical environments — EMI, vibration, temperature extremes, industrial-grade requirements — challenge standard commercial IT equipment.
## IT vs. OT: The Fundamental Difference
IT networks (Information Technology):
Business systems, email, ERP, file servers, workstations. Designed for general-purpose computing with regular patching and updates.
OT networks (Operational Technology):
PLCs, SCADA, HMIs, industrial robots, sensors, process control systems. Designed for real-time control with high reliability — often cannot be rebooted or patched during production.
The IT/OT network convergence — driven by Industry 4.0, IIoT, and enterprise integration needs — creates real security risks when the boundary between them is not carefully managed.
## The Purdue Model for Industrial Network Segmentation
The Purdue Model (IEC 62443) defines levels of industrial network architecture:
Level 0 — Field devices:
Sensors, actuators, motors — the physical production layer. Level 1 — Basic control: PLCs and RTUs that directly control field devices. Level 2 — Supervisory control: SCADA, DCS, HMIs that supervise multiple Level 1 systems. Level 3 — Manufacturing operations: MES, production scheduling, data historians. Level 3.5 — DMZ: Secure buffer between OT and IT networks. Contains shared services: data historian replicas, remote access, patching servers. Level 4 — Business systems: ERP, email, standard IT infrastructure. Level 5 — Enterprise/cloud: Corporate network, internet connectivity.
The DMZ at Level 3.5 is critical. Direct connections between Level 2/3 OT systems and Level 4 IT systems should not exist — all communication passes through the DMZ, which enforces data diodes or firewalling.
## Network Infrastructure for Industrial Environments
### Industrial vs. Commercial Switches Standard commercial switches are not rated for manufacturing environments. Industrial Ethernet switches (IES) offer: - Extended temperature range: -40°C to +85°C (vs. 0°C to 40°C for commercial) - DIN rail mounting for control cabinets - Conformal coating for dust and humidity resistance - Vibration and shock ratings (IEC 61850) - Redundant power inputs (dual PSU on a single device) - Ring topology support (MRP, ERPS) for sub-50ms failover
Recommended vendors for industrial switches:
Cisco IE series, Hirschmann, Moxa, Advantech.
### Fiber Backbone in Industrial Environments Industrial facilities have significant EMI from motors and high-voltage equipment. Copper Ethernet is susceptible — use fiber for all horizontal runs longer than 15 meters in production areas.
Armored fiber provides physical protection from forklifts, heavy foot traffic, and machinery vibration.
### Wireless in Manufacturing Wi-Fi in manufacturing uses the same protocols but has specialized requirements: - Wi-Fi 6 access points rated for industrial environments (IP54+ enclosure, extended temperature) - 802.11r fast roaming for AGV (Automated Guided Vehicle) fleets — vehicles moving between AP cells need seamless handoff - Dedicated SSID and VLAN for AGVs, separate from human device access - Interference survey required in RF-challenging environments (metal structures, motors)
## Security for OT Networks
OT security is evolving rapidly after high-profile attacks on industrial systems (Colonial Pipeline, Oldsmar water plant, manufacturing ransomware incidents).
Core OT security principles:
1. **Segment OT from IT** — No direct connection between corporate IT and OT systems
2. **Inventory all OT assets** — Many facilities have no accurate asset registry
3. **Restrict remote access** — OEM remote access via VPN, not direct internet exposure of HMIs
4. **Patch policy for OT** — Cannot patch as aggressively as IT; use risk-based approach and compensating controls
5. **Monitor, do not blindly block** — OT security monitoring tools (Claroty, Dragos, Nozomi) provide passive visibility without disrupting production
Immediate quick wins:
- Remove all PLCs and HMIs from direct internet exposure (they should never be internet-accessible) - Change default credentials on all network devices in the OT environment - Implement network monitoring to baseline normal OT traffic patterns - Segment production VLANs from SCADA VLANs — limit lateral movement scope
## Converged Infrastructure: Cameras + VoIP + OT
Modern manufacturing facilities run multiple technology systems over the same physical infrastructure:
- **IP security cameras:** PoE cameras on a separate surveillance VLAN, NVR on same VLAN
- **VoIP:** Plant floor phones, overhead paging, emergency notification systems — voice VLAN with QoS
- **OT equipment:** On isolated OT VLANs per zone (assembly, paint, shipping)
- **IT workstations:** Quality, ERP, administrative — corporate IT VLANs
The key is proper VLAN segmentation on industrial-grade switching infrastructure that can handle the physical demands of the environment.
Summit DNC designs and deploys IT/OT network infrastructure for manufacturing, warehousing, and industrial facilities across California, Nevada, and Arizona. We specialize in converged networks that meet both production reliability and IT security requirements.
Related Services
Related Comparisons
Industries We Serve
Related Articles
IoT Device Security: How to Protect Your Network from Smart Devices
IoT devices are the fastest-growing attack surface for businesses. Here is how to segment, secure, and monitor smart devices before attackers use them as entry points.
WirelessPrivate 5G Networks: What Businesses Actually Use Them For
Private 5G is moving out of carrier labs and into real enterprise deployments. Here are the use cases where it outperforms Wi-Fi, and what it costs to deploy.
RegionalBiotech Lab Network Design in South San Francisco: Cleanroom and Lab Cabling
Biotech and pharmaceutical labs in South San Francisco require specialized cabling, isolated OT networks, and cleanroom-rated installations. This guide covers the unique requirements.
Need Help With Your Infrastructure Project?
Summit DNC designs and deploys the systems covered in this article. Contact us for a free consultation.