◇ OpenCyber Academy
Technical · Chapter 3 · English

Chapter 3 — Network basics on the line

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 3 — Network basics on the line

Lesson map

Lesson 03 published. Map, example, EX009.

flowchart TD
  N0["Learning outcomes"]
  N1["3.1 Addresses and subnets"]
  N2["3.2 Switches and VLANs"]
  N3["3.3 Firewalls"]
  N4["3.4 Unmanaged switches and wireless"]
  N5["3.5 Addresses you should not assume"]
  N6["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6
  N6 --> EX["Worked example"]
  EX --> Q["Exercise EX009"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["3.1 Addresses and subnets"]
  N2["3.2 Switches and VLANs"]
  N3["3.3 Firewalls"]
  N4["3.4 Unmanaged switches and wireless"]
  N5["3.5 Addresses you should not assume"]
  N6["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> Q["EX009"]

[Learning outcomes]
    |
    v
[3.1 Addresses and subnets]
    |
    v
[3.2 Switches and VLANs]
    |
    v
[3.3 Firewalls]
    |
    v
[3.4 Unmanaged switches and wireless]
    |
    v
[3.5 Addresses you should not assume]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX009]

Learning outcomes

You will (1) read an IP address and subnet mask; (2) explain what switches, VLANs and firewalls do on a plant network; and (3) sketch the HPFL network from a description.

3.1 Addresses and subnets

Every networked device has an IP address such as 10.20.1.11. A /24 mask means the first three numbers name the network and the last names the device, so 10.20.1.11 and 10.20.1.12 are neighbours on 10.20.1.0/24. Devices on the same subnet can talk directly; traffic to another subnet goes through a router or firewall.

At HPFL the line devices share 10.20.1.0/24, so PLC-FILL, PLC-WRAP, HMI-1 and VIS-CAM can reach each other directly. Offices sit on 10.10.0.0/16, and traffic between the two must pass FW-1. Knowing this tells Tomás that a firewall rule is what decides whether an office PC can reach a PLC.

3.2 Switches and VLANs

A switch connects devices with cables. A VLAN splits one physical switch into separate logical networks, so the line devices and office PCs can share hardware without sharing traffic. A mistake in a VLAN setting can quietly connect two networks that were meant to be apart, which is why switch changes need the same care as PLC changes.

At HPFL the line is on VLAN 20 and offices on VLAN 10. If a port on a shared switch were set to the wrong VLAN, an office PC plugged into it would land on the line network without passing FW-1. Report any doubt about a port's VLAN to the network owner rather than testing it.

3.3 Firewalls

A firewall forwards or blocks traffic between networks according to rules: source, destination, port and action. On a plant, the important firewall sits between the office network and the line. Good rules name specific hosts and ports; "any to any" rules defeat the purpose.

At HPFL, FW-1 should allow ENG-LT to reach the PLCs and little else. Each rule should have a comment saying why it exists and who owns it. Chapter 12 shows how to read FW-1's table and what to do with a rule that has no owner.

3.4 Unmanaged switches and wireless

Small unmanaged switches inside cabinets and wireless bridges are common and are often missing from drawings. They matter because they create connections nobody reviews.

Look for them during walk-downs: a small switch inside a cabinet with more cables than expected, or a wireless bridge on a mast. Photograph what you find and report it with its location. A device that joins the line network to another network without passing FW-1 makes the firewall rules irrelevant for that path. Ask the network owner whether each one is known and approved.

3.5 Addresses you should not assume

Devices can have a second network card, a serial port or a cellular modem that does not show on the drawing. Ask the owner for every interface, not just the main address.

Record each one in the register. A cellular modem added by a machine builder for remote support is a common example, and it can bypass FW-1 entirely. If the owner does not know whether a device has other interfaces, check the manual or ask the supplier before assuming it does not.

Worked example (synthetic HPFL)

The controls engineer tells Tomás: line devices use 10.20.1.0/24 on VLAN 20, offices use 10.10.0.0/16 on VLAN 10, a firewall FW-1 joins them, and only ENG-LT may reach the PLCs. Tomás draws two boxes, puts PLC-FILL (10.20.1.11), PLC-WRAP (10.20.1.12), HMI-1 (10.20.1.21) and VIS-CAM (10.20.1.31) in the line box, and writes the one allowed rule on FW-1.

Synthetic case — HPFL. Addresses and VLAN numbers are invented.

Errors and limits

A drawing describes intent; actual cabling may differ. Confirm against switch configuration with the network owner, never by probing devices.

Exercises

Synthesis

Addresses, VLANs and firewall rules decide who can talk to a controller; mistakes in them silently open paths.

Continue studying — chapter 03 of 18

← Chapter 02 (draft) · Course chapter index · Chapter 04 (draft) →