A Guide to Networking Rockwell Devices

Imagine you are a controls engineer who has just been hired to help set up a new factory. You are responsible for integrating more than 10 machines from different OEMs into one happy manufacturing line.

There is just one problem: no one on the company’s IT team has experience with machines or industrial networking, so you are also responsible for making the major OT network design decisions.

Fortunately, you have one thing working in your favor: every OEM was required to use Rockwell Automation control hardware.

Unfortunately, none of the machines are the same.

Your goal is to design a secure, scalable network that is appropriately segmented, enables communication between machines when required, connects manufacturing operations software to the production line, aligns with modern industrial networking architectures, and can support future growth.

So, what do you do when the OEMs show up with completely different ideas about what a “network” should look like?

Let’s take a look at a few common scenarios.

The Prepared OEM

The most prepared OEMs arrive with a control panel containing a Rockwell Stratix 5200 managed switch, such as the 1783-CMS10DN.

This is a powerhouse of an industrial Ethernet switch. It provides a level of functionality far beyond what many machines need, and it can support advanced network architectures, including Device Level Ring (DLR) and Parallel Redundancy Protocol (PRP).

For this particular manufacturing operation, however, that level of redundancy may not be necessary at the machine access layer. None of the automation is life-critical, and the plant already has redundancy built into its higher-level network infrastructure.

The resulting architecture might look something like this:

How it Works

The key features of this design are:

• The PLC, VFDs, HMI, and other machine devices reside on the machine’s VLAN and subnet.
• The Stratix access switch provides connectivity between the machine devices and the plant network.
• The access switch has a trunk connection to a distribution switch, such as a Cisco Catalyst switch located in an IDF.
• The distribution layer connects to redundant industrial core switches over redundant fiber connections.
• On the access switch, a spare trunk port is configured but not used unless the primary trunk fails. This minimizes downtime if a switch port fails.

The Stratix switch itself has an IP address on a dedicated network-management VLAN. In this design, only one of the PLC’s two NICs is utilized since all the machine’s devices would be on the same subnet in the plant network scheme.

This network design offers major advantages.

1. Central management

Because the Stratix switch is managed, the team can configure and monitor it alongside the rest of the plant’s managed network infrastructure.

Instead of treating every machine as its own little island, the network team can manage the infrastructure from a central location.

2. Network visibility

Having a managed switch so close to the industrial edge allows traffic to be duplicated and monitored by network visibility software (such as Microsoft Defender for IoT, Claroty CTD, Cisco Cyber Vision, etc.)

That visibility becomes increasingly valuable as the number of connected machines grows.

3. Remote access

Because the machine is integrated into the plant’s OT network, it can also take advantage of the plant’s centralized remote-access architecture.

Rather than giving an OEM direct access to an individual machine, the plant can control remote access through its established security controls and access mechanisms.

Segmentation Matters

Putting a machine on the plant network does not mean putting every machine on the same flat network.

Each machine should have its own VLAN and subnet, providing logical segmentation from the rest of the plant.

If a device on one machine needs to communicate with another machine or an industrial server, that communication can be explicitly permitted through a Layer 3 device, such as an industrial firewall or router.

Default gateways should be configured appropriately so that routing can be implemented when required.

This approach provides a useful balance: the machine is integrated into the broader OT environment while still maintaining logical boundaries between systems.

Why Not Just Isolate Every Machine?

At first glance, completely isolating each machine might seem like the most secure approach. However, modern industrial networks increasingly rely on centralized IT and OT security practices. Network monitoring, vulnerability management, centralized authentication, secure remote access, and other security capabilities are much easier to implement when devices are connected to a properly designed plant network.

An isolated machine network can reduce exposure, but it can also reduce visibility and make centralized security controls more difficult to implement.

The goal is therefore not simply to isolate everything. The goal is to control and monitor the connections that actually need to exist.

Don’t Forget Physical Security

The network design should also account for physical access.

Unused ports on the Stratix switch should be disabled where practical, including unused programming or maintenance ports. Engineering access should be restricted to authorized workstations or secure remote-access solutions.

After all, no matter how sophisticated the firewall architecture is, if someone can walk up to the control panel and plug their laptop into an open Ethernet port.

Scaling the Design

One of this architecture’s biggest advantages is how easy it is to scale.

When the next OEM machine arrives, it doesn’t need an entirely new networking strategy. The machine can be assigned its own VLAN and subnet, connected to the plant’s distribution infrastructure, and incorporated into the existing security and monitoring architecture.

No daisy-chaining. No mystery switches. No Ethernet spaghetti.

Just plug the next machine into the network and keep moving. No other craziness required!

The Cost-Conscious OEM

Unfortunately, not every machine arrives with a shiny Stratix managed switch.

Machine builders have budgets, and one of the easiest places to save a few dollars is often the network hardware. As a result, you still often see an unmanaged Ethernet switch inside industrial control panels.

That doesn’t necessarily mean the machine has to become a networking nightmare. The architecture is below.

How it Works

In this architecture, both Ethernet ports on the ControlLogix PLC are utilized to separate machine-level and plant-level communications. One network interface connects directly to the plant OT network, while the second connects to an isolated machine network.

This allows the PLC to serve as the communication bridge between the machine’s local network and the broader plant infrastructure. As a result, the remaining machine devices communicate exclusively within the isolated machine network, simplifying network segmentation while still enabling the data exchange required for production operations. This architecture offers several interesting advantages

1. The PLC remains visible

The PLC connects directly to the plant OT network, so network visibility and security tools can monitor it. You can monitor the most important device without exposing every device inside the machine to the plant network.

2. The machine network has a boundary

The unmanaged switch is isolated from the plant infrastructure.

If someone were to gain physical access to that switch, they would not automatically gain a direct connection to the plant’s core OT network.

Likewise, an attacker who gained access to the plant network would not automatically have access to the machine’s local network.

3. It is a practical compromise

The compromise is visibility for isolation. The plant gains a controlled connection to the PLC while keeping the rest of the OEM’s network isolated, but devices behind the unmanaged switch become harder to monitor and manage from the plant network.

When Is This Design Appropriate?

This approach works well when the plant needs to connect the PLC to the OT network while keeping the rest of the OEM’s devices isolated.

In other words, you don’t have to replace every unmanaged switch that an OEM installs. Sometimes you just need to put a boundary in the right place.

The Challenging OEM

And then there is the OEM that is not particularly interested in conforming to your carefully planned network architecture.

Maybe the machine has a PLC with only one Ethernet interface. Maybe the OEM insists on using its own IP addressing scheme. Maybe the machine was designed years ago, and nobody wants to touch it.

The plant still has to connect it.

One NIC, One Network

Consider a machine built around a PLC with a single NIC, such as a Compact GuardLogix controller.

If the PLC needs to communicate with both the rest of the machine and the plant network, the plant network may have to connect directly to the unmanaged switch serving the machine.

In this architecture, the PLC and other machine devices are placed on the plant network’s IP addressing scheme.
It works, but it comes with a significant tradeoff: the unmanaged switch is now directly connected to the plant network.

The Security Challenge

This creates a physical and logical security concern.

If an unauthorized device is connected to the unmanaged switch, that device may have direct access to the same network as the PLC and potentially other plant systems.

There are ways to mitigate this risk.

For example, sticky MAC address port security can be configured on the upstream distribution switch to allow only known devices to connect through the port serving the unmanaged switch.

Physical security is also important. Mounting the unmanaged switch inside a locked control panel helps prevent unauthorized users from physically connecting devices to the network.

An unmanaged switch doesn’t inherently make a network insecure; it just means you need to implement security controls like port security, segmentation, and physical access controls elsewhere in the network architecture.

When the OEM Brings Its Own IP Addressing Scheme

In some cases, OEMs will not (or cannot) conform to plant IP schemes. In this case, layer 2 NAT can come to the rescue! A Layer 2 NAT device can bridge the gap by translating addresses between the OEM’s machine network and the plant network. This allows the machine to be integrated into the plant without requiring the OEM to redesign its existing addressing scheme.

This approach is particularly useful for OEM machines, repeated machine designs, legacy equipment, skids and packaged systems, and machines with overlapping IP address spaces. However, the convenience comes with a tradeoff: network visibility generally extends only to the NAT device itself. Devices and traffic behind the NAT device are typically hidden from plant-level monitoring and diagnostic tools, which can make troubleshooting and asset visibility more challenging.

Networking’s Not So Bad After All

As these examples show, networking Rockwell devices is not a one-size-fits-all exercise. Even when every machine uses Rockwell hardware, each OEM may arrive with a different network architecture.

The goal isn’t to force every machine into the same design. It’s to build a plant network that accommodates those differences while maintaining security, visibility, reliability, and scalability.

A few principles can help:

• Segment machines with VLANs, subnets, and security zones where practical.
• Use managed networking when the application benefits from greater visibility and control.
• Secure OEM connections with appropriate firewalls, port security, and access controls.
• Explicitly design communication between machines, servers, and manufacturing systems.
• Design for visibility so the network can be monitored and troubleshot.
• Plan for growth so adding the next machine doesn’t require redesigning the entire network.

The most complicated network isn’t necessarily the most secure. The best architecture is one that provides the connectivity the process needs while minimizing unnecessary exposure.