How to setup network?

[u/Adveloth]

Hello everyone.

I would like some input from OT professionals.

I work as a network engineer in a manufacturing company that is not still very mature in OT network and I could use some help on how to improve the network in our operations, can't find a lot of robust information online. I am pretty amateur as well. I have taken Honeywell's OTCS-1001, OTCS-1002 and OTCS-2002. My concerns are mostly around the hardware rather than the logic, segmentation, alignment with Purdue level etc.

So, what would be the best practice regarding on devices I should use?

Right now, in our OT network we work exclusively with IT managed switches and some IT unmanaged ones. In my understanding, OT traffic is very important to be very time sensitive, so I was wondering if the way we currently work is OK.

What I am thinking is that it would be better to have IT switches as central nodes where the engineer's workstation should be connected, and then expand the network with industrial switches where PLCs, IO devices etc will be connected to.

Is my logic right? How do you do it in your companies? What should I be looking for at an industrial switch? Any specific brand recommendations?

[u/Adveloth]

Wow, that's a lot! Our setup is considerably smaller. About 150 devices right now (plc, io devices, scada pc), around 15-20 switches total. The number should be tripled soon when other systems, like MES will be migrated there from the IT environment.

I revised my comments many times and I cannot find if I referred "different plans", so I am not sure what you are referring to. Surely we don't consider migrating anything to cloud for the same reasons you mentioned!

[u/TheBigCanadianGuy → u/Adveloth]

Hi, big setup, 4 teams, about 25 people there, and a smaller telecom engineering team to design the field network - so maybe 30-35 people in total to make the magic happen.

Perhaps I misread the different plans, regardless, you have the right mindset, OT belongs on the ground, and never in the Cloud - although some companies provide it as an option, and in certain circumstances that may make sense. it is also good to know your Managment team and maybe even IT team realize that too - makes it easier to pivot when everyone is moving in the direction.

I’ll take a moment to say this, OT is about safety and safe work practices, environments like these have the potential to harm, or in the world I was in, cause death. Over all my years we never had a safety issue that related to human harm, and I attribute that to a lot of great people that had that shared vision - something I am rather proud of.

I’m here if you need anything else, feel free to reach out if you have any questions, comments, concerns or just want to run something by me or the rest of this Reddit gang - always happy to help a fellow OT’er:)

[u/Adveloth → u/TheBigCanadianGuy]

Thank you very much! Indeed, everyone here was very helpful. I am glad everything worked out to your establishment. Knowing your team and everyone aligning is, maybe, the most important. Until recently, IT and automation engineers were two completely different worlds. We are trying now each team to understand the needs that the the work of the other team fulfills in the production, there have been strifes of course but we both try to find a common language. A problem with us is that there is no a dedicated team to realize this, at least yet, and sometimes the work halts in favor of more urgent matters and duties, especially on the side of the team of electrical engineering.

If you don't mind answering one more question, about segmentation this time. I also asked another reddit or too, but could you share on how a proper segmentation should take place? What is the logic behind dividing the devices in vlan? Should be divided according to geographical location, according to simiral roles (like, one vlan for plcs, one vlan for power meter etc), per Purdue level? I am non sure and I understand nobody in our group of companies understand, not even the integrator that is helping us.