Every industrial network needs an address plan and a segmentation plan — and most plants have neither: PLCs on 192.168.0.x with default subnets, a flat LAN where any device can reach any device, and DHCP conflicts that appear when the next machine is added. IP addressing and VLAN design is the quiet discipline that makes industrial networks manageable, secure, and predictable. This article covers the address plan, the VLAN structure, and the rules that keep the network healthy as it grows.
The IP Address Plan
- Use a private range with structure — 10.x.x.x (RFC 1918) with a documented convention: e.g., 10.LINE.DEVICE.HOST, where the second octet is the line/area, the third the device type (PLC=10, HMI=20, drives=30, servers=40), and the fourth the instance. The plan is the network's map — every engineer can derive any device's address from its name.
- Assign by documentation, not by accident — a spreadsheet (or the asset register) holds every address with the device, VLAN, and owner; addresses are allocated from the plan, never improvised.
- DHCP for the right things — DHCP reservations for devices that may change (laptops, tablets) and static addressing for controllers and instruments; a PLC must never depend on DHCP state. Where DHCP serves OT, reservations are the rule.
- Avoid overlaps — two identical 192.168.1.x networks on one site (a machine delivered with its own subnet) are a routing and confusion disaster; the commissioning rule: every delivered machine's network is re-addressed into the plant plan (see the modernization article).
The VLAN Structure
VLANs segment the network at layer 2 — the foundation of the zone concept (see the IEC 62443 zones article):
- VLAN per function/trust level — typical plant structure: OT devices (PLCs/HMIs), OT servers (historians, engineering), SCADA clients, IT, guests, and the wireless (see the Wi-Fi article). Each VLAN has its own traffic rules and its own security posture.
- VLAN per area (optional) — large sites segment by area (line 1, line 2, utilities); the pattern combines with the trust-level structure (area VLANs are not trust boundaries, function VLANs are).
- Routing between VLANs — inter-VLAN traffic goes through the router/firewall (layer 3) where the rules live: OT-to-IT paths through the DMZ, engineering-to-controller paths through the engineering VLAN with the access controls (see the firewall article).
- Multicast management — industrial protocols use multicast (PROFINET discovery, EtherNet/IP IO, PTP): the VLAN design bounds the multicast domains (each VLAN is a domain), and IGMP snooping keeps the multicast traffic from flooding the network.
- QoS and traffic classes — the design marks the control traffic (priority) so that bursts of IT traffic cannot delay it; the QoS policy is part of the switch configuration, not an option.
Design Rules That Matter
- Subnet per VLAN — one subnet per VLAN, sized with headroom (a /24 per area is the common minimum); renumbering later is expensive, so the plan thinks in growth.
- Layer 3 at the core — routing (and the ACLs) at the core/distribution switches or firewalls, not per-access-switch; the control points are few and managed.
- Management separate — the network devices' management (switch management IPs, console access) on a dedicated management VLAN with its own access control (see the OT security articles).
- Time matters — NTP/PTP: the address plan includes the time sources, and the VLAN design carries the PTP traffic correctly (boundary clocks, multicast) — see the time synchronization practices in the network articles.
- Document the as-built — the address table, the VLAN map, and the routing rules are living documents; the annual network review reconciles them with reality.
Renumbering and Migration
Plants with legacy flat networks migrate deliberately: define the target plan, build the new VLANs alongside, move devices per area (maintenance windows), and re-address per the plan with the I/O and program changes that IP changes require (PLC communication configs!). The migration is change-managed (see the change management article) and the network monitoring (see the OT monitoring article) verifies the result. The cost of the migration is paid once; the cost of no plan is paid forever.
Summary
Industrial IP design is an address plan plus a VLAN structure: structured private addressing with a documented convention, function-based VLANs with layer-3 control points, multicast and QoS management for the control traffic, and a separate management plane. Document the as-built, allocate from the plan, and migrate legacy networks deliberately. The address plan is the network's identity system; the VLANs are its security architecture — both deserve design, not accident.