{"data":{"slug":"industrial-ip-vlan-design","title":"IP Addressing and VLAN Design for Industrial Networks","summary":"Every industrial network needs an address plan and a segmentation plan — and most plants have neither: PLCs on 192.168.0.x with default subnets, a flat LAN…","category":{"slug":"modern-connectivity","name":"Modern Connectivity"},"url":"https://wiki.aspotomasyon.com/article/industrial-ip-vlan-design","markdown_url":"https://wiki.aspotomasyon.com/article/industrial-ip-vlan-design.md","api_url":"https://wiki.aspotomasyon.com/api/v1/articles/industrial-ip-vlan-design","published":"2026-08-11T13:05:24+00:00","modified":"2026-09-13T11:07:23+00:00","reading_minutes":4,"word_count":861,"image":"https://wiki.aspotomasyon.com/assets/social/industrial-ip-vlan-design-7609d7239f1d.png","html":"<p>Every industrial network needs an address plan and a segmentation plan — and most plants have neither: PLCs on 192.168.0.x with default subnets, a flat LAN where any device can reach any device, and DHCP conflicts that appear when the next machine is added. <strong>IP addressing and VLAN design</strong> is the quiet discipline that makes industrial networks manageable, secure, and predictable. This article covers the address plan, the VLAN structure, and the rules that keep the network healthy as it grows.</p><figure class=\"article-figure\"><img src=\"https://wiki.aspotomasyon.com/assets/diagrams/modern-connectivity-context.svg\" width=\"1100\" height=\"460\" loading=\"lazy\" decoding=\"async\" alt=\"A generic industrial messaging path. A network or broker acknowledgment is not necessarily confirmation that a downstream business action succeeded.\"><figcaption>A generic industrial messaging path. A network or broker acknowledgment is not necessarily confirmation that a downstream business action succeeded. <a href=\"https://wiki.aspotomasyon.com/assets/diagrams/modern-connectivity-context.svg\" target=\"_blank\" rel=\"noopener\">View full size</a></figcaption></figure>\n\n<h2 id=\"the-ip-address-plan\">The IP Address Plan</h2>\n\n<ul>\n  <li><strong>Use a private range with structure</strong> — 10.x.x.x (RFC 1918) with a documented convention: e.g., 10.LINE.DEVICE.HOST, where the second octet is the line/area, the third the device type (PLC=10, HMI=20, drives=30, servers=40), and the fourth the instance. The plan is the network's map — every engineer can derive any device's address from its name.</li>\n  <li><strong>Assign by documentation, not by accident</strong> — a spreadsheet (or the asset register) holds every address with the device, VLAN, and owner; addresses are allocated from the plan, never improvised.</li>\n  <li><strong>DHCP for the right things</strong> — DHCP reservations for devices that may change (laptops, tablets) and static addressing for controllers and instruments; a PLC must never depend on DHCP state. Where DHCP serves OT, reservations are the rule.</li>\n  <li><strong>Avoid overlaps</strong> — two identical 192.168.1.x networks on one site (a machine delivered with its own subnet) are a routing and confusion disaster; the commissioning rule: every delivered machine's network is re-addressed into the plant plan (see the modernization article).</li>\n</ul>\n\n<h2 id=\"the-vlan-structure\">The VLAN Structure</h2>\n\n<p>VLANs segment the network at layer 2 — the foundation of the zone concept (see the IEC 62443 zones article):</p>\n\n<ul>\n  <li><strong>VLAN per function/trust level</strong> — typical plant structure: OT devices (PLCs/HMIs), OT servers (historians, engineering), SCADA clients, IT, guests, and the wireless (see the Wi-Fi article). Each VLAN has its own traffic rules and its own security posture.</li>\n  <li><strong>VLAN per area (optional)</strong> — large sites segment by area (line 1, line 2, utilities); the pattern combines with the trust-level structure (area VLANs are not trust boundaries, function VLANs are).</li>\n  <li><strong>Routing between VLANs</strong> — inter-VLAN traffic goes through the router/firewall (layer 3) where the rules live: OT-to-IT paths through the DMZ, engineering-to-controller paths through the engineering VLAN with the access controls (see the firewall article).</li>\n  <li><strong>Multicast management</strong> — industrial protocols use multicast (PROFINET discovery, EtherNet/IP IO, PTP): the VLAN design bounds the multicast domains (each VLAN is a domain), and IGMP snooping keeps the multicast traffic from flooding the network.</li>\n  <li><strong>QoS and traffic classes</strong> — the design marks the control traffic (priority) so that bursts of IT traffic cannot delay it; the QoS policy is part of the switch configuration, not an option.</li>\n</ul>\n\n<h2 id=\"design-rules-that-matter\">Design Rules That Matter</h2>\n\n<ol>\n  <li><strong>Subnet per VLAN</strong> — one subnet per VLAN, sized with headroom (a /24 per area is the common minimum); renumbering later is expensive, so the plan thinks in growth.</li>\n  <li><strong>Layer 3 at the core</strong> — routing (and the ACLs) at the core/distribution switches or firewalls, not per-access-switch; the control points are few and managed.</li>\n  <li><strong>Management separate</strong> — the network devices' management (switch management IPs, console access) on a dedicated management VLAN with its own access control (see the OT security articles).</li>\n  <li><strong>Time matters</strong> — NTP/PTP: the address plan includes the time sources, and the VLAN design carries the PTP traffic correctly (boundary clocks, multicast) — see the time synchronization practices in the network articles.</li>\n  <li><strong>Document the as-built</strong> — the address table, the VLAN map, and the routing rules are living documents; the annual network review reconciles them with reality.</li>\n</ol>\n\n<h2 id=\"renumbering-and-migration\">Renumbering and Migration</h2>\n\n<p>Plants with legacy flat networks migrate deliberately: define the target plan, build the new VLANs alongside, move devices per area (maintenance windows), and re-address per the plan with the I/O and program changes that IP changes require (PLC communication configs!). The migration is change-managed (see the change management article) and the network monitoring (see the OT monitoring article) verifies the result. The cost of the migration is paid once; the cost of no plan is paid forever.</p>\n\n<h2 id=\"summary\">Summary</h2>\n\n<p>Industrial IP design is an address plan plus a VLAN structure: structured private addressing with a documented convention, function-based VLANs with layer-3 control points, multicast and QoS management for the control traffic, and a separate management plane. Document the as-built, allocate from the plan, and migrate legacy networks deliberately. The address plan is the network's identity system; the VLANs are its security architecture — both deserve design, not accident.</p><section class=\"engineering-check\"><h2 id=\"apply-this-to-your-project\">Apply this to your project</h2><ul><li>Specify payload structure, units, identity, time semantics, access permissions, and protocol versions.</li><li>Test backlog growth, connection loss, duplicate delivery, and restart behavior at the consuming application.</li><li>Document how operators see failures and how the system distinguishes replayed data from current process state.</li></ul><p><a href=\"https://wiki.aspotomasyon.com/guides\">Follow an ASP project guide</a> to connect the fundamentals with implementation and acceptance.</p></section><figure class=\"article-figure\"><img src=\"https://wiki.aspotomasyon.com/assets/diagrams/modern-connectivity-review.svg\" width=\"1100\" height=\"460\" loading=\"lazy\" decoding=\"async\" alt=\"Engineering review sequence: Contract → Connect → Interrupt → Reconcile. Keep the recorded evidence with the accepted configuration.\"><figcaption>Engineering review sequence: Contract → Connect → Interrupt → Reconcile. Keep the recorded evidence with the accepted configuration. <a href=\"https://wiki.aspotomasyon.com/assets/diagrams/modern-connectivity-review.svg\" target=\"_blank\" rel=\"noopener\">View full size</a></figcaption></figure><h2 id=\"primary-references-and-further-reading\">Primary references and further reading</h2><p>Use the original specifications and product documentation for implementation details. The examples in this guide are illustrative engineering scenarios, not published project results.</p><ul><li><a href=\"https://docs.oasis-open.org/mqtt/mqtt/v5.0/mqtt-v5.0.html\" rel=\"noopener noreferrer\" target=\"_blank\">OASIS — MQTT 5.0 specification</a></li><li><a href=\"https://www.modbus.org/modbus-specifications\" rel=\"noopener noreferrer\" target=\"_blank\">Modbus Organization — Protocol specifications</a></li><li><a href=\"https://sparkplug.eclipse.org/specification/version/3.0/\" rel=\"noopener noreferrer\" target=\"_blank\">Eclipse Foundation — Sparkplug 3.0 specification</a></li></ul><!-- asp-editorial-202609 -->","markdown":"# IP Addressing and VLAN Design for Industrial Networks\n\n> Every industrial network needs an address plan and a segmentation plan — and most plants have neither: PLCs on 192.168.0.x with default subnets, a flat LAN…\n\n- Canonical URL: https://wiki.aspotomasyon.com/article/industrial-ip-vlan-design\n- Publisher: ASP OTOMASYON A.Ş. (ASP OTOMASYON Wiki)\n- Category: Modern Connectivity\n- Published: 2026-08-11 · Updated: 2026-09-13\n- Reading time: 4 min · Language: English\n\nEvery industrial network needs an address plan and a segmentation plan — and most plants have neither: PLCs on 192.168.0.x with default subnets, a flat LAN where any device can reach any device, and DHCP conflicts that appear when the next machine is added. **IP addressing and VLAN design** is the quiet discipline that makes industrial networks manageable, secure, and predictable. This article covers the address plan, the VLAN structure, and the rules that keep the network healthy as it grows.\n\n![A generic industrial messaging path. A network or broker acknowledgment is not necessarily confirmation that a downstream business action succeeded.](https://wiki.aspotomasyon.com/assets/diagrams/modern-connectivity-context.svg)\n\n*A generic industrial messaging path. A network or broker acknowledgment is not necessarily confirmation that a downstream business action succeeded.*\n\n## The IP Address Plan\n\n- **Use a private range with structure** — 10.x.x.x (RFC 1918) with a documented convention: e.g., 10.LINE.DEVICE.HOST, where the second octet is the line/area, the third the device type (PLC=10, HMI=20, drives=30, servers=40), and the fourth the instance. The plan is the network's map — every engineer can derive any device's address from its name.\n- **Assign by documentation, not by accident** — a spreadsheet (or the asset register) holds every address with the device, VLAN, and owner; addresses are allocated from the plan, never improvised.\n- **DHCP for the right things** — DHCP reservations for devices that may change (laptops, tablets) and static addressing for controllers and instruments; a PLC must never depend on DHCP state. Where DHCP serves OT, reservations are the rule.\n- **Avoid overlaps** — two identical 192.168.1.x networks on one site (a machine delivered with its own subnet) are a routing and confusion disaster; the commissioning rule: every delivered machine's network is re-addressed into the plant plan (see the modernization article).\n\n## The VLAN Structure\n\nVLANs segment the network at layer 2 — the foundation of the zone concept (see the IEC 62443 zones article):\n\n- **VLAN per function/trust level** — typical plant structure: OT devices (PLCs/HMIs), OT servers (historians, engineering), SCADA clients, IT, guests, and the wireless (see the Wi-Fi article). Each VLAN has its own traffic rules and its own security posture.\n- **VLAN per area (optional)** — large sites segment by area (line 1, line 2, utilities); the pattern combines with the trust-level structure (area VLANs are not trust boundaries, function VLANs are).\n- **Routing between VLANs** — inter-VLAN traffic goes through the router/firewall (layer 3) where the rules live: OT-to-IT paths through the DMZ, engineering-to-controller paths through the engineering VLAN with the access controls (see the firewall article).\n- **Multicast management** — industrial protocols use multicast (PROFINET discovery, EtherNet/IP IO, PTP): the VLAN design bounds the multicast domains (each VLAN is a domain), and IGMP snooping keeps the multicast traffic from flooding the network.\n- **QoS and traffic classes** — the design marks the control traffic (priority) so that bursts of IT traffic cannot delay it; the QoS policy is part of the switch configuration, not an option.\n\n## Design Rules That Matter\n\n1. **Subnet per VLAN** — one subnet per VLAN, sized with headroom (a /24 per area is the common minimum); renumbering later is expensive, so the plan thinks in growth.\n2. **Layer 3 at the core** — routing (and the ACLs) at the core/distribution switches or firewalls, not per-access-switch; the control points are few and managed.\n3. **Management separate** — the network devices' management (switch management IPs, console access) on a dedicated management VLAN with its own access control (see the OT security articles).\n4. **Time matters** — NTP/PTP: the address plan includes the time sources, and the VLAN design carries the PTP traffic correctly (boundary clocks, multicast) — see the time synchronization practices in the network articles.\n5. **Document the as-built** — the address table, the VLAN map, and the routing rules are living documents; the annual network review reconciles them with reality.\n\n## Renumbering and Migration\n\nPlants with legacy flat networks migrate deliberately: define the target plan, build the new VLANs alongside, move devices per area (maintenance windows), and re-address per the plan with the I/O and program changes that IP changes require (PLC communication configs!). The migration is change-managed (see the change management article) and the network monitoring (see the OT monitoring article) verifies the result. The cost of the migration is paid once; the cost of no plan is paid forever.\n\n## Summary\n\nIndustrial IP design is an address plan plus a VLAN structure: structured private addressing with a documented convention, function-based VLANs with layer-3 control points, multicast and QoS management for the control traffic, and a separate management plane. Document the as-built, allocate from the plan, and migrate legacy networks deliberately. The address plan is the network's identity system; the VLANs are its security architecture — both deserve design, not accident.\n\n## Apply this to your project\n\n- Specify payload structure, units, identity, time semantics, access permissions, and protocol versions.\n- Test backlog growth, connection loss, duplicate delivery, and restart behavior at the consuming application.\n- Document how operators see failures and how the system distinguishes replayed data from current process state.\n\n[Follow an ASP project guide](https://wiki.aspotomasyon.com/guides) to connect the fundamentals with implementation and acceptance.\n\n![Engineering review sequence: Contract → Connect → Interrupt → Reconcile. Keep the recorded evidence with the accepted configuration.](https://wiki.aspotomasyon.com/assets/diagrams/modern-connectivity-review.svg)\n\n*Engineering review sequence: Contract → Connect → Interrupt → Reconcile. Keep the recorded evidence with the accepted configuration.*\n\n## Primary references and further reading\n\nUse the original specifications and product documentation for implementation details. The examples in this guide are illustrative engineering scenarios, not published project results.\n\n- [OASIS — MQTT 5.0 specification](https://docs.oasis-open.org/mqtt/mqtt/v5.0/mqtt-v5.0.html)\n- [Modbus Organization — Protocol specifications](https://www.modbus.org/modbus-specifications)\n- [Eclipse Foundation — Sparkplug 3.0 specification](https://sparkplug.eclipse.org/specification/version/3.0/)\n\n---\n\nCite the canonical article: https://wiki.aspotomasyon.com/article/industrial-ip-vlan-design (IP Addressing and VLAN Design for Industrial Networks, ASP OTOMASYON, updated 2026-09-13).\n","headings":[{"id":"the-ip-address-plan","title":"The IP Address Plan"},{"id":"the-vlan-structure","title":"The VLAN Structure"},{"id":"design-rules-that-matter","title":"Design Rules That Matter"},{"id":"renumbering-and-migration","title":"Renumbering and Migration"},{"id":"summary","title":"Summary"},{"id":"apply-this-to-your-project","title":"Apply this to your project"},{"id":"primary-references-and-further-reading","title":"Primary references and further reading"}],"faq":[],"references":[{"name":"OASIS — MQTT 5.0 specification","url":"https://docs.oasis-open.org/mqtt/mqtt/v5.0/mqtt-v5.0.html"},{"name":"Modbus Organization — Protocol specifications","url":"https://www.modbus.org/modbus-specifications"},{"name":"Eclipse Foundation — Sparkplug 3.0 specification","url":"https://sparkplug.eclipse.org/specification/version/3.0/"}],"related":[{"slug":"industrial-network-troubleshooting-methodology","title":"Industrial Network Troubleshooting Methodology","summary":"Industrial networks are the nervous system of any automated facility. When they fail, production stops.","category":{"slug":"technical-guides","name":"Technical Guides"},"url":"https://wiki.aspotomasyon.com/article/industrial-network-troubleshooting-methodology","markdown_url":"https://wiki.aspotomasyon.com/article/industrial-network-troubleshooting-methodology.md","api_url":"https://wiki.aspotomasyon.com/api/v1/articles/industrial-network-troubleshooting-methodology","published":"2026-05-13T12:02:57+00:00","modified":"2026-09-13T11:07:23+00:00","reading_minutes":10,"word_count":2136,"image":"https://wiki.aspotomasyon.com/assets/social/industrial-network-troubleshooting-methodology-013c0b147d4e.png"},{"slug":"industrial-ethernet-switching-fundamentals","title":"Industrial Ethernet Switching Fundamentals","summary":"Industrial Ethernet switching is the backbone of modern automation networks. From a handful of PLCs on a production line to thousands of devices across a…","category":{"slug":"technical-guides","name":"Technical Guides"},"url":"https://wiki.aspotomasyon.com/article/industrial-ethernet-switching-fundamentals","markdown_url":"https://wiki.aspotomasyon.com/article/industrial-ethernet-switching-fundamentals.md","api_url":"https://wiki.aspotomasyon.com/api/v1/articles/industrial-ethernet-switching-fundamentals","published":"2026-08-06T12:26:37+00:00","modified":"2026-09-13T11:13:13+00:00","reading_minutes":4,"word_count":858,"image":"https://wiki.aspotomasyon.com/assets/social/industrial-ethernet-switching-fundamentals-2e98f695d20c.png"},{"slug":"modbus-tcpip-protocol-deep-dive","title":"Modbus TCP/IP Protocol: Deep Dive","summary":"Modbus is the oldest and most widely deployed industrial communication protocol in the world.","category":{"slug":"modern-connectivity","name":"Modern Connectivity"},"url":"https://wiki.aspotomasyon.com/article/modbus-tcpip-protocol-deep-dive","markdown_url":"https://wiki.aspotomasyon.com/article/modbus-tcpip-protocol-deep-dive.md","api_url":"https://wiki.aspotomasyon.com/api/v1/articles/modbus-tcpip-protocol-deep-dive","published":"2026-05-13T12:07:53+00:00","modified":"2026-09-13T11:07:23+00:00","reading_minutes":10,"word_count":2192,"image":"https://wiki.aspotomasyon.com/assets/social/modbus-tcpip-protocol-deep-dive-c377f0d645c1.png"},{"slug":"profinet-ethernetip-industrial-ethernet-protocols","title":"PROFINET and EtherNet/IP: Industrial Ethernet Protocols","summary":"Industrial Ethernet protocols have replaced legacy fieldbus systems (PROFIBUS, DeviceNet, ControlNet, Modbus RTU) as the dominant communication technology in…","category":{"slug":"field-devices-instrumentation","name":"Field Devices & Instrumentation"},"url":"https://wiki.aspotomasyon.com/article/profinet-ethernetip-industrial-ethernet-protocols","markdown_url":"https://wiki.aspotomasyon.com/article/profinet-ethernetip-industrial-ethernet-protocols.md","api_url":"https://wiki.aspotomasyon.com/api/v1/articles/profinet-ethernetip-industrial-ethernet-protocols","published":"2026-05-13T12:07:56+00:00","modified":"2026-09-13T11:07:23+00:00","reading_minutes":8,"word_count":1666,"image":"https://wiki.aspotomasyon.com/assets/social/profinet-ethernetip-industrial-ethernet-protocols-afc6e1014d6f.png"}],"citation":"ASP OTOMASYON. IP Addressing and VLAN Design for Industrial Networks. Updated 2026-09-13. https://wiki.aspotomasyon.com/article/industrial-ip-vlan-design"}}