Securing a fully networked plant rests on three layered controls: subnet isolation, hardware-based boundary devices, and protocol-aware firewall rules, with no direct routing from corporate IT into PLC, HMI, or VFD segments [S1][S5].
The threat model is bidirectional: an infected office laptop can pivot into a PLC through a flat network, and a compromised CNC can propagate malware back to MES and ERP. Router-based separation plus strict allow-list traffic rules remains the baseline practice cited across plant integration guidance [S2][S5].
Subnetting and VLAN Layout for Plant, OT, and Machine Networks
Network isolation prevents direct Layer 3 (IP) communication between two distinct networks while allowing specific, controlled data passage, and a /24 subnet mask (255.255.255.0) is the typical segmentation unit cited in plant integration documentation [S1].
A practical layout puts the plant LAN on 192.168.32.0/24, the SCADA/MES OT segment on a separate range such as 10.10.10.0/24, and each machine island on its own private subnet, for example 192.168.1.0/24 per cell. VLANs deliver the same logical separation at Layer 2 inside a managed switch, but inter-VLAN traffic still requires a Layer 3 device, so VLANs alone do not equal isolation [S1]. Devices on the same subnet talk freely without a router; anything crossing subnets goes through the default gateway, which is exactly where firewall rules are enforced.
Hardware Boundary Devices: Dual-NIC PLC vs Industrial Router
Two hardware architectures dominate plant integration: a dual-NIC PLC acting as a bridge between plant and machine subnets, and a dedicated industrial router/firewall performing NAT plus stateful packet filtering between them [S1].
A dual-NIC PLC keeps physical separation simple. Rockwell ControlLogix with 1756-ENBT, EN2T, or EN3T modules, and CompactLogix L45E Series with up to two 1768 communication modules, are the typical platforms where one port carries the assigned 192.168.32.x plant address and the other sits on the private machine subnet [S1]. The PLC then proxies only the data points the plant actually needs, and every internal device stays invisible to the wider network. An industrial router or firewall, by contrast, performs Network Address Translation so the entire machine appears to the plant as a single IP, hides internal addresses, and supports VPN termination for remote service traffic [S1][S5]. For mixed-vendor cells or any cell with cloud telemetry, the router path is usually the lower-risk choice because firewall rules can be versioned and audited independently of the controller firmware.
Protocol and Access Controls on the Machine Segment
Network segmentation must be paired with explicit traffic allow-listing: MES, SCADA, and cloud channels each need a defined route, while everything else is denied by default [S4][S5].
On a CNC-heavy shop floor, MTConnect has crossed the 250,000-device mark across more than 50 countries and is the dominant open protocol for machine monitoring, while legacy FANUC FOCAS, Haas MNET, and Mazak Mazatrol connectors still dominate on the OEM side, and OPC-UA is the standards-based alternative for Siemens and modern controllers [S3]. Serial RS-232 remains common on older controllers, with a practical cable limit near 15 m (50 ft) per Campbell's application guidance, so serial-to-Ethernet converters or serial-to-WiFi adapters are how those machines join a segmented network without violating the isolation rules [S3]. DNC software is not optional in this picture: it controls program revisions, access authentication, and multi-machine transfers, all of which a flat switch and shared folder cannot provide [S3].
Comparison: Isolation Approaches Across Four Decision Criteria
Plant engineers picking an isolation architecture usually weigh four criteria: blast radius if a segment is breached, complexity of firewall rules, suitability for legacy equipment, and remote-service enablement. [S1]
A dual-NIC PLC minimizes blast radius to the single cell but pushes firewall logic into controller firmware, which is hard to audit. An industrial router/firewall with NAT keeps blast radius to one machine island, centralizes rules in an auditable appliance, supports both modern Ethernet and converted RS-232 nodes, and terminates VPN for OEM remote service [S1][S5]. A flat VLAN-only segment scores well on legacy compatibility but fails the blast-radius test, because any compromised device sees every broadcast domain [S1]. A full air-gap with data diode is the strongest posture but breaks real-time MES/SCADA data flow and is rarely compatible with modern IIoT analytics, so it tends to be reserved for safety-instrumented or regulatory islands rather than the whole plant [S4].
Operational Pitfalls and What to Verify on Site
The most common failure mode after segmentation is rule drift: temporary holes opened for a vendor and never closed, undocumented NAT entries, and unmanaged WiFi access points bridging machine and corporate subnets [S2][S4].
Before signing off any machine integration, run a network scanning tool from the plant side to confirm internal PLC, HMI, and VFD addresses are not reachable, validate that the only open ports across the boundary match the agreed MES, SCADA, and VPN list, and document the router or firewall firmware version alongside the rule set so future audits have a baseline [S1]. The factory side of the network should stay off the public internet wherever possible, with remote service traffic forced through the VPN termination on the industrial router rather than direct cellular paths that bypass the plant firewall [S2][S5]. For plants weighing how MES scope interacts with this boundary, the cloud vs on-premise MES decision matrix covers where each topology actually changes the firewall surface.
Two trackable signals to watch over the next two quarters: broader shipment of NAT-enabled industrial routers with built-in TLS 1.3 and OPC-UA pass-through, and rising inclusion of VLAN-aware, Layer 3 switching in mid-range PLC chassis modules so smaller cells can segment without a separate appliance [S1][S4].