Professional Documents
Culture Documents
Industrial Ethernet
Infrastructures
Mark Wylie
November 2014
• The Interstate System has been called the Greatest Public Works
Project in History.
• From the day President Dwight D. Eisenhower signed the Federal
Aid Highway Act of 1956, the Interstate System has been a part of
our culture—as construction projects, as transportation in our daily
lives, and as an integral part of the American way of life.
• Every citizen has been touched by it, if not directly as motorists,
then indirectly because every item we buy has been on the
Interstate System at some point.
• The infrastructure was critical to the success of the Interstate.
• Segments of roads
• Connections from city to city
• Sometimes “private” or toll roads
• Controlled (secure) ingress and egress
• Provision for parallel routes through or around
• Provision for crossing rivers, mountains, valleys
• Standards of construction
• Documented maps and routes
• Established rules and norms
Dock 1
Make 2
Control Room
HMI
HMI
Engineer
WorkStation
Shipping
Line 1
Dock 2
Line 2
Line 3
Dock 1
Make 2
“ad-hoc network,
evolved without design”
Control Room
HMI
HMI
PLC
Dock 2
P
Line 2
C
“fieldbuses
Line 3 - migrate to
Ethernet”
Project Engineer
Time (corrosive,
Sync moisture) Accessory
10G 1G 10/100 PoE PoE (1588, 2x Redun USB Conformal Ether- Profi- special Catalog
Use Location /Name L2 L3 ports ports ports ports Watts SNTP) IP-67 power nets memory Coating Net/IP net requirements Model Catalog Number Accessories Numbers
Subnet A Subnet B
Device Device
Layer 2 Layer 2
Switch Switch
Device Device
Device Device
Device Device
Layer 2 Layer 2
Switch Switch
Device Device
Device Device
Subnet A Subnet B
Device Device
Layer 2 Layer 2
Switch Switch
Device Device
Device Device
Devices on the
same subnet Layer 2 Layer 2
Device Device
easily talk Switch Switch
Device Device
Device Device
Layer 2 Layer 2
Switch Switch
Device Device
Device Device
Device Device
Layer 2 Layer 2
Switch Switch
Device Device
Device Device
Reliability, Management,
Maintenance
One subnet can be stopped without
Device Device
affecting others Layer 2 Layer 2
Switch Switch
Device Device
Device Device
Devices on the
Device Layer 2 Layer 2 Device
same subnet Switch Switch
easily talk
Device Device
Reliability, Management,
Maintenance
One subnet can be stopped without
Device Device
affecting others Layer 2 Layer 2
Switch Switch
Device Device
Device Device
Subnets are great for isolating:
• High performance
• High bandwidth traffic (video,
motion control)
Dock 1
Make 2
Control Room
HMI
HMI
Engineer
WorkStation
Shipping Line 1
Dock
Line 2
2
Line 3
Dock 1
Make 2
Control Room
HMI A – Create physical groups based on function
and location for maintenance ease and security
HMI
Engineer
WorkStation
Shipping Line 1
Dock
Line 2
2
Line 3
Dock 1
Make 2
Control Room
HMI
HMI
Engineer
WorkStation
• Several subnets
Line 3
For this example, we’ll do it as follows…
© 2014 Belden Inc. | belden.com | @BeldenInc 22
Segment communications into groups
(subnets)
Example 1
to Enterprise
Receiving Make 1
Dock 1
Make 2
Control Room
HMI
HMI
Engineer
WorkStation
Shipping Line 1
Dock
Line 2
2
Line 3
Subnet A Subnet B
Device Device
Layer 2 Layer 2
Switch Switch
Device Device
Device Device
Device Device
Layer 2 Layer 2
Switch Switch
Device Device
Device Device
Subnet A Subnet B
Device Device
Layer 2 Layer 2
Switch Switch
Device Device
Device Device
Devices in the
same VLAN can
easily talk Device Device
Layer 2 Layer 2
Switch Switch
Device Device
Device Device
Subnet A Subnet B
Layer 3 Switch / Router are used
• To configure VLANs Device Device
Layer 2 Layer 2
• Limits data in/out of VLAN Switch Switch
• Provides security to VLAN Device Device
Device Device
Rule of thumb
80% traffic stays in VLAN
20% traffic travels in/out
Devices in the
same VLAN can
easily talk Device Device
Layer 2 Layer 2
Switch Switch
Device Device
Device Device
Devices in the
same VLAN can
easily talk Device Device
Layer 2 Layer 2
Switch Switch
Device Device
Device Device
Subnet A Subnet B
Layer 3 Switch / Router are used
• To configure VLANs Device Device
Layer 2 Layer 2
• Limits data in/out of VLAN Switch Switch
• Provides security to VLAN Device Device
Device Device
Rule of thumb
80% traffic stays in VLAN
20% traffic travels in/out
Devices in the
same VLAN can
easily talk Device Device
Layer 2 Layer 2
Switch Switch
Device Device
Dock 1
Make 2
(VLAN - 1)
Line 2
Line 3
Dock 1
Make 2
(VLAN - 1)
Line 2
Line 3
Dock 1
Make 2
(VLAN - 1)
Line 2
Line 3
Dock 1
Make 2
(VLAN - 1)
Line 2
Line 3
Dock 1
Make 2
Control Room
HMI
HMI
Engineer
WorkStation
Shipping Line 1
Dock 2
Line 2
Line 3
Subnet A Subnet B
Device Device
Layer 2 Layer 2
Device Switch Switch Device
Device Device
Device Device
Layer 2 Layer 2
Device Switch Switch Device
Device Device
Device Device
Device Device
Layer 2 Layer 2
Device Switch Switch Device
Device Device
Device Device
Layer 2 Layer 2
Device Switch Switch Device
Device Device
Device Device
Devices
Devices Devices
Devices Devices
Make 2
Devices Devices
Devices
Devices
Control Room
Devices Devices
MI
H
Devices
MI
H
Devices
Devices
Engineer
WorkStation
Devices
Devices Devices Devices
Shipping Line 1
Devices
Line 2
Devices
Devices Devices
Devices Devices
Devices Devices
Devices
Line 3
Devices
L2 L2
Devices
Devices Devices
Devices Devices
L2 L2 Devices
Make 2
Devices
Devices
Devices
Control Room L2 L2
Devices Devices
MI
H
Devices
MI
H
L2
Devices
Devices
Engineer
L2 WorkStation
Devices
Devices Devices Devices
Shipping Line 1
Devices L2 L2 L2
Devices Devices
L2 Devices
Dock 2
Line 2
Devices
L2 L2 L2
Devices Devices
Devices Devices
Devices Devices
L2 Line 3
Devices
L2 – Use layer 2 switches inside a
Devices
L2 L2 L2 subnet to connect to all of that
Devices Devices Devices subnet’s Ethernet devices. OK to
connect layer 2 switches together.
L2 L2
Devices
Devices Devices
Devices Devices
L2 Make 2 L3
L2 Devices Devices
Devices
Devices
Control Room L2 L2
Devices Devices
MI
H
Devices
MI
H
L2 L3
Devices L3 – Use layer 3 switches
Devices
Engineer (routers) to connect physical
L2 WorkStation groups (subnets) together.
Devices
Devices Devices Devices
Shipping Line 1
Devices L2 L2 L2
Devices Devices
L2 Devices
Dock 2
Line 2
Devices
L2 L2 L2 L3
Devices Devices
Devices Devices
Devices Devices
L2 Line 3
Devices
L2 – Use layer 2 switches inside a
Devices
L2 L2 L2 subnet to connect to all of that
Devices Devices Devices subnet’s Ethernet devices. OK to
connect layer 2 switches together.
L2 L2 high-speed/high
Devices
Devices Devices
Devices Devices throughput
L3 switches -
L2 L2 Devices
Make 2
Devices
BB including
Devices
Devices connections to
Control Room L2 L2 Enterprise and
Devices Devices
other facilities on
MI
campus
H
Devices
MI
BB
H
L2 L3
Devices L3 – Use layer 3 switches
Devices
Engineer (routers) to connect physical
L2 WorkStation groups (subnets) together.
Devices
Devices Devices Devices
Shipping Line 1
Devices L2 L2 L2
Devices Devices
L2 Devices
Dock 2
Line 2
Devices
L2 L2 L2 L3 BB
Devices Devices
Devices Devices
Devices Devices
L2 Line 3
Devices
L2 – Use layer 2 switches inside a
Devices
L2 L2 L2 subnet to connect to all of that
Devices Devices Devices subnet’s Ethernet devices. OK to
connect layer 2 switches together.
Traditional Approach
Line Power Power Power In
Source
Traditional Approach
Line Power Power Power In
Source
PoE Approach
(4-pair copper)
Coax Cable Signal Out 2. Identify the power consumption (in watts) of each
device and total the power for all PoE devices wired
to one PoE switch
• Most devices are “standard” PoE – up to 13 Watts
Pan/Tilt/Zoom Signals – Serial Cable • Some devices are “PoE+” - up to 25.5 Watts.
PoE Approach
Common Examples of PoE Devices
• Fewer pieces/lower cost
• Mix in existing network
infrastructure
Switch
• Low voltage with isolation
With
PoE
(4-pair copper)
Control Room
HMI
HMI
sw
Engineer
WorkStation
Shipping
Line 1
Dock 2
Line 2
sw Line 3
Control Room
HMI
2. Identify the power consumption (in watts) of each
device and total the power for all PoE devices wired
to one PoE switch
HMI
Engineer
WorkStation
MACH1000
MACH4000
Shipping
Line 1
MACH100
Magnum 10KTS
Dock 2
Line 2
RS 20/30/40
MS 20/30
Spider II
sw Line 3 Octopus IP67
Without QoS
With QoS
Why?
• Ensure industrial network infrastructure devices will survive in their environments
• Ratings can enable installation without control cabinets, reducing cost and space
Magnum 6KM
Octopus On-Machine Ethernet Switches
Ethernet Connectors Ethernet Switches Our other switches are IP20
and Cordsets
Hirschmann and GarrettCom switches with extreme IP ratings
Subnet A Subnet B
Device Device
Layer 2 Layer 2
Switch Switch
Device Device
Device Device
Device Device
Layer 2 Layer 2
Switch Switch
Device Device
Device Device
Device Device
Layer 2 Layer 2
Switch Switch
Device Device
Device Device
Remote
Access
Protection
Remote
Access HERE
© 2014 Belden Inc. | belden.com | @BeldenInc 58
Add network security Best
Practice 7
Add Network Security (based on risk assessment)
Perimeter
Protection
Configure subnets & vLANs
Device Device
Layer 2 Layer 2
Network Security is part of Switch Switch
Defense in Depth: Device Device
• Policies & procedures
Device Device
• Physical security
Remote
• Network security Access
• Computer security Protection
Remote
• Device security Access HERE
© 2014 Belden Inc. | belden.com | @BeldenInc 59
Add Network Security
Add network security Example 7
Receiving
Make 1
L2
Dock 1
L2 L2
L2 Make 2 L3 BB
L2
Control Room L2 L2
MI
H
MI
H
L2 L3 A
BB
Enginee
L2 r
WorkSt
ation
Shipping Line 1
L2 L2 L2
L2
Dock 2
Line 2
L2 L2 L2 L3 BB
L2 Line 3
L2 L2What would you
L2 do?
• Eagle20 is a router and security device (remote access)
• Eagle30 is a router, security device & 4-port switch (perimeter security)
• Eagle Tofino is a security device only (zone security)
…here is one option
© 2014 Belden Inc. | belden.com | @BeldenInc 60
Add Network Security
Add network security Example 7
1. Enable security features in
layer 3 switches & routers
Receiving 2. Configure subnets & vLANs
Make 1
L2 3. Enable switch security features
Dock 1
L2 L2 in layer 2 switches
L2 Make 2 L3 BB
L2
Control Room L2 L2
MI
H
MI
H
L2 L3 A
BB
Enginee
L2 r
WorkSt
ation
Shipping Line 1
L2 L2 L2
L2
Dock 2
Line 2
L2 L2 L2 L3 BB
L2 Line 3
L2 L2What would you
L2 do?
• Eagle20 is a router and security device (remote access)
• Eagle30 is a router, security device & 4-port switch (perimeter security)
• Eagle Tofino is a security device only (zone security)
…here is one option
© 2014 Belden Inc. | belden.com | @BeldenInc 61
Add Network Security
Add network security Example 7
1. Enable security features in
layer 3 switches & routers
Receiving 2. Configure subnets & vLANs
Make 1
L2 3. Enable switch security features
Dock 1
L2 L2 in layer 2 switches
L2 Make 2 L3 BB
L2
E30
Control Room L2 L2
Protect the perimeter
MI
E30
H
L2 L3 A
BB
Enginee
L2 r
WorkSt
ation
E20 Shipping Line 1
L2 L2 L2
L2 E30
Dock 2
Line 2
L2 L2 L2 L3 BB
L2 Line 3
L2 L2What would you
L2 do?
• Eagle20 is a router and security device (remote access)
• Eagle30 is a router, security device & 4-port switch (perimeter security)
E20 • Eagle Tofino is a security device only (zone security)
External points of entry …here is one option
© 2014 Belden Inc. | belden.com | @BeldenInc 62
Add Network Security
Add network security Example 7
1. Enable security features in
layer 3 switches & routers
Receiving 2. Configure subnets & vLANs
Make 1
L2 3. Enable switch security features
Dock 1
L2 L2 in layer 2 switches
T
L2 Make 2 L3 BB
L2
T E30
T Room
Control L2 L2
Protect the perimeter
MI
E30
H
T
H
L2 L3 A
BB
Protect Zones
Enginee (next slide for another example)
L2 r
WorkSt
T ation
E20 Shipping Line 1
L2 L2 L2
L2 T E30
Dock 2
Line 2
L2 L2 L2 T L3 BB
L2 Line 3 T
L2 L2 L2
E20
External points of entry
© 2014 Belden Inc. | belden.com | @BeldenInc 63
Add Network Security
Add network security Example 7
1. Enable security features in
layer 3 switches & routers
Receiving 2. Configure subnets & vLANs
Make 1
L2 3. Enable switch security features
Dock 1
L2 L2 in layer 2 switches
L2 Make 2 E30
L3 BB
L2
E30
Control Room L2 L2
Protect the perimeter
MI
E30
H
L2 E30
L3 A
BB
Protect Zones
Enginee Replace Layer 3 with EAGLE 30
L2 r Alternate Solution (combination Firewall + Router + 4
WorkSt port switch)
ation
E20 Shipping Line 1
L2 L2 L2
L2 E30
Dock 2
Line 2
L2 L2 L2 L3
E30 BB
L2 Line 3
L2 L2 L2
E20
External points of entry
© 2014 Belden Inc. | belden.com | @BeldenInc 64
Polling Question
How confident are you that the industrial security you have today
will reasonably protect your company from today's threats?
• Very
• Somewhat
• Not confident
• Not sure
Make 2
BB
A
Control Room
C
Losing the backbone affects
MI
H
all production!
MI
H
C A
BB
Enginee
C r
WorkSt
ation
Shipping Line 1
Dock 2
Line 2
BB
A
Line 3
C
Many expensive chemicals destroyed BB
A
Make 2
if we lose communications here
Control Room
C
Losing the backbone affects
MI
H
all production!
MI
H
C A
BB
Enginee
C r Lose the control room and we lose our “eyes”
WorkSt
ation
Shipping Line 1
Dock 2
Line 2
BB
A
Line 3
C
Many expensive chemicals destroyed BB
A
Make 2
if we lose communications here
Control Room
C
Things that move (motors, pumps, robots, conveyors, etc.) Losing the backbone affects
MI
H
all production!
MI
H
C A
BB
Line 2
BB
A
Line 3
C
Many expensive chemicals destroyed BB
A
Make 2
if we lose communications here
Control Room
C
Things that move (motors, pumps, robots, conveyors, etc.) Losing the backbone affects
MI
H
all production!
MI
H
C A
BB
Line 2
BB
A
WhateverLinethe
3 forklift runs into!
Input Power #1
Redundant • Power Supply
Power options for any
Supplies Hirschmann switch
Input Power #2
Power Supply #2
Input Power #1
Redundant • Power Supply
Power options for any
Supplies Hirschmann switch
Input Power #2
Enterprise Edge FW x
NorthEast Edge FW x Expecting electrical noise near
SouthEast Edge FW x
some very large drives in these
L2 Make 1 East x 8 x x x x x areas
Make 1 West x 8 x x x x
Make 2 East x 16 1 7 x x x x x
Make 2 West x 6 x x x x
Line 1 East x 6 x
Line 1 Central x 10 x electrical noise?
Line 1 West x 20 x x
Line 2East x 10 x
Line 2Central x 10 x electrical noise?
Line 2 West x 20 x x
Line 3 East x 12 x
Line 3 Central x 12 x electrical noise?
Expecting huge temp extremes
Line 3 West x 20 x x in dock areas
Control Room North x 20 x ring 2 x x x
Control Room South x 20 3 21 x ring 2 x x x
Receiving West x 12 x temp extremes
Receiving NorthEast x 12 3 21 x temp extremes
Receiving SouthEast x 12 x temp extremes
Shipping North x 10 x temp extremes
Shipping South x 10 2 8 x temp extremes
Nonbonded Bonded-
-Pair Pair
or Washdown
• Point‐to‐point wiring
• Detailed electrician work
• Lowest hardware cost
• Challenges:
• Wiring in the field
• Testing
• System expansion
• Panel to actuator cables
• Can incorporate patch panels
• Challenges:
• May still involve field wiring
• System expansion
• Configure and monitor network ‐
• All Belden products
• Many other manufacturers
• Automatically create network maps
• Benefits:
• See everything from one window
• Consistent network infrastructure
configurations easily
• Complete network design and
status at one spot
Which of these parts of your project lifecycle would you benefit most
from outside help ... check all that apply?
• Plan
• Design
• Install
• Configure
• Startup
• Upgrade
Belden: www.belden.com
Belden’s Blog: www.belden.com/blog
© 2014 Belden