Segmenting OT Networks: VLANs, DMZ and IEC 62443 Zones in Practice

A flat plant network — every PLC, HMI, camera and office PC in one broadcast domain — works until the day a contractor's laptop brings ransomware, a misconfigured camera floods multicast, or an engineer in another building accidentally downloads to the wrong CPU. Segmentation is the fix, and it does not have to disrupt production traffic.

The IEC 62443 model in one paragraph

Group assets into zones by function and risk: a machine cell, a water treatment process area, the SCADA servers, the office. Connect zones only through defined conduits — firewall rules or routed links — that allow exactly the traffic needed and nothing else. Assign each zone a target security level. That is the whole idea; everything else is implementation.

A practical blueprint

1. Level 0–1: machine and cell networks. One VLAN per machine or cell containing its PLC, HMI, drives and remote I/O. Cyclic traffic (PROFINET, EtherNet/IP, EtherCAT) stays inside; nothing routes through it. Managed switches such as the EDS-408A carry the VLAN tags.
2. Level 2: supervisory. SCADA servers, engineering stations and the historian collector in their own VLAN(s), reaching cell networks through a Layer-3 switch or firewall with explicit rules — SCADA polls the PLC; the PLC never initiates connections to the office.
3. Level 3.5: the industrial DMZ. Between OT and IT, a DMZ hosts anything both sides need to touch: historian mirror, patch and antivirus servers, file transfer, and the remote-access gateway. No direct IT-to-OT connection exists; everything passes through a DMZ host.
4. Level 4: office. Normal IT policy applies. Office users read dashboards from the DMZ, never from the PLC.

Remote access done right

Vendors and your own engineers need to reach PLCs. Give them a VPN into the DMZ with a jump host, named accounts, multi-factor authentication and session logging — never port forwarding to a PLC, and never TeamViewer on an HMI with a shared password. Edge devices with built-in VPN, such as the WAGO PFC200, can terminate secure tunnels at remote sites.

Switch and hardware requirements

• Managed switches throughout Level 1–2 with VLAN, IGMP snooping, port security and SNMP; the EDS-G4012 is certified to IEC 62443-4-2 for secure-by-design backbones.
• Disable unused ports; put uplinks on access lists.
• One time source (NTP) for every device, so logs line up during incident analysis.
• Change every default password at commissioning — PLCs, HMIs, switches, drives.

Rolling it out without stopping the plant

Document the current network first (what talks to what, on which ports — a week of switch statistics tells you). Create VLANs with everything still allowed, migrate cell by cell during planned stops, then tighten firewall rules one conduit at a time while watching for dropped connections. Big-bang cutovers are how segmentation projects earn a bad reputation.

We design segmented OT networks and the secure remote-access path for factories and utilities in Vietnam — see engineering services. Related: network redundancy on the plant floor and IIoT edge gateways.

Quick answers

Do we need a firewall between the office and the plant?

Yes. At minimum one firewall between IT and OT with explicit rules; preferably a DMZ hosting the historian, patch server and remote-access gateway, so no direct connection exists between the office and the control network.

Will segmentation break PROFINET or EtherNet/IP?

Not if each machine or cell network stays inside one VLAN. Cyclic I/O traffic never needs to cross a router; only supervisory traffic (SCADA, historian, engineering access) goes through the firewall.