Separating Plant (OT) and Office (IT) Networks
The Risks of a Flat Network
On a flat network, office PCs, controllers and HMIs share one network, so malware on an office laptop can reach the plant floor.
Separation puts controllers, HMIs and engineering workstations on their own VLANs, with a firewall controlling every path between plant and office.
Security Standards and Guidelines
'Segment IT and OT networks' is one of the five primary OT mitigations published by CISA, the FBI, EPA and DOE on 2025-05-06, and includes a DMZ for passing control data to business systems.
The Coast Guard rule, s.101.650(h), requires MTSA facilities to implement segmentation between IT and OT networks and to log and monitor all connections between them.
NIST SP 800-82 Rev. 3, Guide to OT Security, was published 2023-09-28 and covers OT network topologies and safeguards.
IEC 62443 groups assets with shared security needs into zones and controls the paths between them, called conduits.
CISA's 'Adapting Zero Trust Principles to OT' (2026-04-29) states that IT zero-trust tools cannot simply be applied to OT.
CISA advisory AA26-231A asks owners of Siemens S7 controllers to segment OT and IT with a DMZ and block TCP port 102 at the perimeter.
Hardware and Configuration
The UCG-Industrial gateway provides a zone-based stateful firewall, a Layer 7 application firewall and a 5 Gbps IDS/IPS.
The UniFi industrial DIN-rail switches support 1,000 VLANs, 802.1X, DHCP snooping, port isolation, ACLs and storm control.
Routing between zones happens at the gateway; the DIN-rail switches are Layer 2 only.
Firewall rules between zones are written by address and port, for example allowing only the engineering workstation to reach the controllers.
Traffic crossing between zones is logged at the gateway, the record the Coast Guard rule asks for.
EtherNet/IP I/O traffic can be multicast, so IGMP snooping is turned on at the switches; ODVA recommends switches with IGMP snooping for EtherNet/IP.
System Limitations
No UniFi page says the gateway firewall or IDS/IPS understands industrial protocols such as Modbus/TCP, EtherNet/IP, S7comm, PROFINET or DNP3; rules between zones are written by address and port.
No UniFi product is certified to IEC 62443; a design can follow the standard's zones-and-conduits approach, but nothing is described as 62443 certified.
The UniFi industrial switches list STP and RSTP only; they support no ring redundancy protocol such as ERPS, MRP (PROFINET) or DLR (EtherNet/IP), so redundancy comes from dual power inputs and paired uplinks, not a ring.
Implementation Process
Re-addressing a controller is coordinated with whoever maintains its program, because a changed IP address can break HMI and peer connections.
The work is done zone by zone during planned downtime, so production keeps running.
CloudCentric is a managed IT provider in Mount Pleasant, South Carolina, serving businesses across Charleston and the Lowcountry. Call us at (844) 422-7000 to discuss separating your networks.