Industrial & OT Networking

How It Works & Technology Overview

Industrial/OT networking is the network as part of the machine: switching, routing, and wireless carrying control traffic (PLC I/O, drives, HMIs, vision, safety systems) where a dropped connection stops production. Architecture follows the Purdue-model instinct — enterprise IT, an industrial DMZ, control-layer networks, and device-level segments — with the OT/IT boundary being both a technical design (firewalls, conduits, one-way flows for some data) and a political one (IT owns the core, controls engineering owns the PLCs; the integrator needs both at the table). Industrial protocols shape the design: EtherNet/IP (CIP, heavy multicast/IGMP dependency), Profinet (with its own conformance classes and timing), Modbus TCP, plus the legacy serial estate (RS-232/485 device servers) every real plant still carries. Hardware is environmentally rated: DIN-rail switches, extended temperature ranges, IP/NEMA-rated enclosures, DC power off panel supplies, vibration and washdown tolerance. The two labor dominators: work windows (production-safe vs. hard downtime windows with fixed close times) and safety overhead (site orientation, LOTO participation, hot-work permits, PPE) that taxes every on-site hour.

Common Deployment Scenarios

• Plant-floor network refresh: replacing aging/unmanaged switches with managed ruggedized gear; discovery and documentation of the undocumented is the real project.
• OT/IT segmentation: building the DMZ and zoned architecture; requires asset inventory first and controls-engineer partnership throughout.
• New line / cell buildout: greenfield networking for a new production line under the machine builder's schedule; commissioning alongside the controls integrator.
• Warehouse/DC networking: high-bay wireless for scanners and AGVs/AMRs, dock-door coverage, conveyor-system networking — RF in metal-everywhere environments.
• Remote access & OT security overlays: secure vendor access, monitoring sensors (Claroty/Nozomi-class), and policy enforcement — phased engagements, never checkbox add-ons.

Products, Vendors & Characteristics

• Ruggedized switching: Cisco IE series, Hirschmann (Belden), Moxa, Phoenix Contact, Stratix (Rockwell-branded Cisco — preferred where Rockwell controls dominate because of Studio 5000 integration and support alignment).
• Environmental ratings gate selection: extended temp (-40 to +75°C classes), DIN-rail vs. rack mount, IP67 for washdown/outdoor, DC power inputs — port-count matching without environmental matching is the classic procurement failure.
• Protocol behavior matters at the switch level: EtherNet/IP's multicast needs IGMP snooping/querier configuration done right; Profinet wants conformance-class-appropriate gear; casually substituting switch models is a line-down risk.
• Wireless: industrial APs and client bridges (Cisco, Siemens Scalance, Moxa) for AGVs and mobile equipment; fast-roaming design is mandatory for anything that moves.
• Serial/legacy: device servers (Moxa, Digi) bridging RS-232/485 into IP — the archaeology layer nobody documents; OT security platforms (Claroty, Nozomi, Dragos) ride SPAN ports and need switch capability planned for.

What Makes It Hard (Gotchas & Failure Modes)

• The plant does not stop for us: hard downtime windows (nights, weekends, seasonal shutdowns) close on schedule whether work is done or not — staging, rehearsal, and parallel crews are the plan, not luxuries.
• Undocumented everything: static IPs set by long-gone vendors, unmanaged switches zip-tied in panels, port assignments in nobody's records — "switch swap" jobs are discovery projects with a swap at the end.
• Touching control traffic without the controls house: the systems integrator of record must bless changes; a crashed line traced to our switch change is a relationship-ending event.
• Safety overhead is real labor: orientation (per tech, per site), daily permits, LOTO participation, escort rules — 10–20% on every on-site hour, and it's zero in every naive estimate.
• Environment kills office assumptions: 130°F panel interiors, washdown zones, forklift-height cable routes, VFD-adjacent tray inducing noise into data runs — separation rules and armored/rated cable are design requirements.
• Wireless in metal canyons: racking, tanks, and machinery demand production-condition surveys; AGV roaming failures surface only under load.
• Segmentation without inventory is fiction: you cannot zone what you haven't enumerated; asset discovery is the unskippable first phase of any OT security scope.

Effort & Estimation Patterns

• Ruggedized switch install (panel-mounted, DC-powered, configured, cut over): 2–4 hours per switch in production-safe windows; inside hard downtime windows, price the window (staging + rehearsal + parallel crew), not the task.
• Plant-floor cabling: 1.5–2× office rates for identical footage — rated cable, conduit in traffic zones, lifts around live equipment, permit overhead.
• Site safety onboarding: 2–4 hours per tech per site, before any work — a named line item on every industrial estimate, multiplied across multi-site programs.
• Discovery/documentation phase: ~a day per line or cell starting point on undocumented networks; the as-built deliverable is half the engagement's value.
• Downtime cutovers: planning/MOP/rehearsal hours ≥ window hours; rollback defined in writing; everything pre-configured and labeled before the window opens.
• Wireless surveys: mandatory, priced, and performed during production — the RF environment with the line running is the real one; AGV paths walked with the vehicles.
• OT segmentation programs: phase as asset inventory → architecture design → zone-by-zone migration in change windows — each phase its own SOW; never fixed-bid the whole from a diagram.
• Recurring: OT networks pair naturally with monitoring/support contracts (switch health, config backup, spares management) — plants value uptime insurance and buy it readily.