VLANs in Industrial Networks: How to Segment Equipment and PLCs Securely

The challenge of convergence between the factory floor and the office

In the past, factory machines communicated with each other using isolated cables and proprietary protocols that felt like secret dialects. Today, the scenario has changed completely with the advent of Industry 4.0, where standard computers, supervisory systems, and PLCs (Programmable Logic Controllers, which are the small electronic brains that trigger motors and valves on production lines) run on the same internet technology: the Ethernet protocol. In practice, this means the same network sending a corporate email can also carry the emergency stop command for a high-speed conveyor belt.

This union brought massive savings and incredible ease in extracting production data, but it opened a dangerous door for failures and intrusions. When an office computer is infected with malware, it can flood the network with garbage data packets and confuse industrial equipment. If PLCs lose communication due to this junk traffic, the entire factory can grind to a halt, causing staggering financial losses. This is precisely where network segmentation using VLANs comes into play.

What are VLANs and how do they work in industrial practice

A VLAN (Virtual Local Area Network) is a feature that allows dividing a single physical network device, like a switch (the centralizer connecting multiple network cables), into several completely independent networks. Think of it like a large commercial building where internal walls were built with smart partitions: although everyone is under the same roof, people from one company cannot enter the neighboring company's room without passing through a locked door. In engineering, this means we create virtual communication islands inside the same copper cables or fiber optics.

To make this work, engineers use the international standard IEEE 802.1Q. In practice, this protocol stamps each data packet traveling across the network with an invisible numerical tag. When a packet leaves a PLC, the switch reads this tag and knows exactly where it is allowed to go. If the packet comes from the accounting department and tries to enter the welding robot's VLAN, the switch simply blocks the passage, ensuring one department's traffic never disrupts the other's pace.

Network architecture: separating PLCs, supervision, and IT

Designing a secure industrial network requires separating devices into three major groups or functional layers. The lowest layer holds PLCs, remote I/Os, and sensors, which demand extremely fast response times and zero external interference. The middle layer contains SCADA supervisory servers (systems that collect data and display colorful factory status screens for operators) and human-machine interfaces. The top layer holds the traditional corporate network, with internet access, ERP, and engineering workstations.

By creating a dedicated VLAN for PLCs, we ensure no broadcast noise (the mass messages ordinary computers constantly send to find printers and servers) reaches the controllers. In practice, PLCs only talk to authorized supervisory servers and nothing else. If someone from the office needs to access a temperature parameter on the PLC, that communication must pass through an industrial router or firewall, which inspects the traffic and decides whether the security rule allows or denies passage.

Configuring access ports and trunk ports on switches

To implement this strategy in practice, we need to configure industrial switch ports using two fundamental concepts: access ports and trunk ports. An access port is where we connect a final device, such as a PLC or a supervisory computer. This port knows nothing about tags; it simply takes whatever the PLC says and injects it into its assigned VLAN. If we plug a PLC into port 5 configured for VLAN 10, everything that PLC sends automatically belongs to VLAN 10.

The trunk port, on the other hand, is the multi-lane highway connecting one switch to another switch or to the firewall. It must carry packets from multiple VLANs simultaneously without mixing things up. This is where 802.1Q tagging comes in: the trunk port groups tagged packets from VLAN 10, VLAN 20, and VLAN 30, sends them all over the same physical cable, and upon arrival at the other side, the destination switch untags and delivers each packet to its proper place. Here is a simplified configuration example on a managed switch:

vlan 10 name PRODUCTION_PLCS
vlan 20 name SCADA_SUPERVISION
vlan 30 name CORPORATE_NETWORK

interface GigabitEthernet0/1
 description Connection for Line 1 PLC
 switchport mode access
 switchport access vlan 10

interface GigabitEthernet0/24
 description Trunk to Main Firewall
 switchport mode trunk
 switchport trunk allowed vlan 10,20,30

This configuration snippet demonstrates how to structure basic VLANs and bind specific physical ports to strict industrial functions, maintaining the logical isolation needed to prevent packet conflicts.

Cautions and common pitfalls in industrial segmentation

Many professionals make the mistake of thinking that deploying VLANs solves all security problems automatically, forgetting about unused port configuration. In a factory environment, if we leave leftover switch ports active and configured on the default VLAN (usually VLAN 1), anyone with malicious intent can plug in a laptop and access the network core. The golden rule is to disable all free ports and move them to a blackhole VLAN where no traffic is routed.

Another critical point is the use of redundancy protocols like RSTP (Rapid Spanning Tree Protocol, which prevents looped cables from crashing the entire network). In networks with VLANs, RSTP must be configured correctly to operate on a per-VLAN instance basis (MSTP), otherwise, a failure in one VLAN can mistakenly bring down the infrastructure of other production areas. In practice, rigorous bench tests before applying any changes to production switches prevent catastrophic unplanned outages.

Final Considerations

The implementation of VLANs in industrial networks is no longer a luxury for large corporations but a basic requirement for operational survival and compliance. By isolating PLCs and supervisory systems into dedicated virtual networks, we eliminate unwanted interference, reduce performance bottlenecks, and build a solid barrier against accidental or intentional cyber attacks.

Understanding the concepts of access ports, trunks, and controlled routing allows engineering teams to maintain the high availability demanded by the factory floor without sacrificing modern connectivity. Investing time in proper network architecture planning ensures that industrial automation continues operating with pinpoint precision and absolute reliability for years to come.