As a new plant electrician/SCADA specialist at a water department, I am seeking advice on how to improve our current setup. Our two water treatment facilities are constantly facing issues with the T1 line, impacting our services. After exploring alternatives, it seems that utilizing a third-party internet service with a VPN tunnel and firewalls is the most feasible solution. Our IT department has already extended the network to the facility and set up a VLAN for SCADA. However, the challenge lies in the fact that our current SCADA system is on the same network between the two plants (192.168.254.xxx). Despite attempts at NATing, changing the IPs of the equipment at the second location seems to be the only solution. This task is complicated by the buggy FactoryTalk system and the independent SCADA computers at both sites communicating with all PLCs. How would you approach connecting PLCs and SCADA computers at two locations over a third-party internet connection? What specific products would you recommend using, and how would you structure the networks for optimal performance? Your insights are appreciated as we strive to improve our network setup. Thank you for any advice provided.
Finding the optimal solution for network setup requires attention to detail. In the past, T1 lines were used with MPLS setups to extend ethernet networks between sites, acting as a VPN facilitated by the ISP. Nowadays, software allows for the same functionality with regular internet connections, utilizing VPN tunnels for secure connections. It is recommended to have a Point-2-Point VPN tunnel for business users and a separate firewall for OT space, with devices having VPN tunnels between them. To ensure proper routing, it is essential to have distinct networks for effective traffic flow. Network segmentation is crucial for cybersecurity, limiting the spread of viruses and malware. PLC vendors are increasingly using I/O networks with unique subnetting to ensure easy connectivity. Implementing a wireless bridge for sites in close proximity can eliminate the need for routing. By following these best practices, your network can operate efficiently and securely.
Operating on a "Private Verizon Network", our company spans across three states. Any hardware requiring connection to our Scada (Ignition) system utilizes this secure network. While there is a limitation of 327675 IP addresses on the network, Verizon offers the flexibility to expand as needed.
These plants are located approximately 14 miles apart, with terrain that poses challenges for implementing a point-to-point radio or line-of-sight solution. Currently, all devices in the network have unique .254.x IP addresses, indicating that a network split may be the most effective long-term solution. We are essentially creating the network structure you have described. A VPN tunnel is already established for the office network, but the SCADA system operates on a separate VLAN without a dedicated physical firewall. The SCADA system, which utilizes Factorytalk, requires minimal changes. Recently, I successfully transitioned 99% of the equipment from .254.x to 225.x IP addresses. However, I encountered a challenge when changing the IP address of the virtual machine hosting the SCADA project, as the client machine failed to reconnect to the Factorytalk directory. Despite attempting various troubleshooting methods, I was unable to resolve the issue due to my limited expertise in this area.
I am not quite sure what a SIS system is. Can you provide more information about it?
Are there standardized IP address schemes commonly used in networks? It appears that 192.168.x.x is a frequently used address scheme, along with the 10.0.x.x scheme. Another common one is a 174.43.x x or similar scheme. What is the reason behind the popularity of these schemes? I am contemplating creating a network design and gradually transitioning everything to it. For instance, utilizing a system like 192.168.x.x where the third set of numbers is unique to each location and setting up standard ranges in the fourth set of numbers. For example, reserving .10 through .30 for plcs, .40 through .60 for hmis, and .70 through .90 for vfds. This plan would require rebuilding the entire system, but it appears to be a solid foundation for the future.
It seems like you're grappling with a complex task. Transitioning to a third-party internet service with a VPN tunnel and firewalls sounds like a logical solution, given your challenges. Considering the SCADA situation, my preliminary advice would be to avoid changing all the IPs at the second location if possible because of the inevitable downtime and potential for unresolved bugs which could disrupt your system further. You might want to look into Layer 2 VPN (L2VPN) providers as they allow users on different networks to appear as if they're on the same local network, maintaining the same IP addressing scheme. Some recommendable L2VPN providers include NordVPN and ExpressVPN. When it comes to structuring your network for optimal performance, it could be beneficial to implement Software Defined Networking (SDN) to manage network services. This method allows networks to be centrally managed and improves their agility and flexibility, ultimately leading to increased productivity. Good luck with the process!
✅ Work Order Management
✅ Asset Tracking
✅ Preventive Maintenance
✅ Inspection Report
We have received your information. We will share Schedule Demo details on your Mail Id.
Answer: - Answer: Consider utilizing a third-party internet service with a VPN tunnel and firewalls to address connectivity issues.
Answer: - Answer: Challenges may include network structure, IP addressing conflicts, system compatibility issues, and ensuring optimal performance.
Answer: - Answer: Changing the IP addresses of equipment at the second location may be necessary to resolve conflicts and ensure smooth communication between SCADA systems.
Answer: - Answer: Consider using VPN tunnels, firewalls, VLANs, and reliable networking equipment to enhance network performance and security.
Answer: - Answer: Ensuring proper network segmentation, configuration, and compatibility testing can help improve communication between SCADA systems and PLCs at separate locations.
Join hundreds of satisfied customers who have transformed their maintenance processes.
Sign up today and start optimizing your workflow.