Virtual LANs: a real advance for control systems?
14 October 2024 
Virtual local area networks are well-established in the IT sector, but do they offer potential benefits to the industrial control industry as well? Henry Martel, a field application engineer with Antaira Technologies, argues that they do.
Since the late 1990s, the virtual local area network, or VLAN, has been a crucial component of modern network strategies. Before the development of the VLAN, network engineers had to create multiple networks and build physically separate LANs whenever an organisation needed to partition and isolate multicast network traffic. VLANs enabled engineers to group end-stations into segments at the data link layer, essentially portioning a single physical LAN into multiple logical or virtual LANs, each with their own broadcast domain.
Consequently, broadcast messages could be constrained to a limited number of devices, facilitating granular access control over who could access what within the network.
Today, VLANs are used widely in mid-to-large commercial networks to ease traffic congestion, improve network security, and to simplify network configuration, administration and expansion.
Like many networking techniques, VLANs have found their way to industrial facilities. In this article, I’ll examine the many advantages VLANs can bring to industrial environments.
What is VLAN?
Put simply, VLANs are isolated, virtual networks within a physical network infrastructure. Each VLAN acts independently as a self-contained network with its own set of rules, security policies, network resources and broadcast domains. Devices are grouped into a VLAN based on factors such as department, function or security requirements.
To illustrate the concept better, let’s consider the example of a small manufacturing company. Assume that the company’s single physical LAN is segmented into three isolated VLAN networks: one each for production, sales and accounting. For simplicity’s sake, we are also going to assume that each of these three departments has two network devices that need to be connected to the company’s 12-port VLAN-enabled managed switch.
VLANs can take various forms depending on operational needs. Port-based VLANs – the most popular type – group devices based on their physical connection to a network switch. A more flexible method is provided by MAC-address-based VLANs, which divide the network according to the MAC address of the device. Though less common, protocol-based VLANs offer network protocol-based segmentation, enabling more precise traffic control.
For this example, we are using a port-based VLAN implementation. Here, the network administrator accesses the switch’s management interface to create new VLANs – for example, VLAN 10 for production, VLAN 20 for sales and VLAN 30 for accounting – and then assigns two relevant ports of the 12-port switch to one VLAN for each department.
The administrator then plugs each device from the three departments into their assigned VLAN port and associates them with their corresponding VLAN ID. To mark messages as VLAN traffic, the switch inserts a VLAN tag into the frame of the IP layer header. Each VLAN has a unique VLAN ID, which is an embedded 12-bit value (from 1 to 4,095) in the VLAN tag.
Ports can be either access ports or trunk ports. Host devices are connected through access ports, which are part of a single VLAN, as is the case in this example. Trunk ports are those that can be assigned to many VLANs.
To transport traffic for many VLANs over a single physical connection using network equipment such as switches or routers, we usually create a VLAN trunk, which is a link or connection that can carry multiple VLANs simultaneously. Known as inter-VLAN routing, this involves creating sub-interfaces for each VLAN on a router and assigning IP addresses to them.
As a company expands, new segments can be added easily to the same network, or old ones reconfigured without needing to disrupt the entire network or to invest in additional hardware. VLANs enable a network to scale swiftly and cost-effectively.
VLANS in ICS
In industrial control systems (ICSs), it is not uncommon to have hundreds of connected I/O devices, such as RTUs, PLCs, sensors, HMI, relays, and servers for applications, engineering, front-end and archiving.
As the number of devices connected to an ICS increase, the volume of broadcast messages soars to the point at which it starts to consume more of the processing bandwidth of the devices, causing congestion and impeding network performance.
In a challenging environment of this sort, VLANs emerge as a key tool in your network arsenal, meeting the dual needs of network administrators for traffic management and security:
- ICS traffic management ICS responsiveness and operational productivity are directly impacted by the efficiency of network traffic management. By segmenting a network, VLANs reduce unnecessary broadcast traffic, which can be especially disruptive in ICS environments. As a result, vital applications can run more smoothly on the network and experience less congestion. Real-time control systems depend on the prompt transmission of control commands and real-time data, which is made possible by the ability to prioritise traffic for vital systems via VLANs.
- ICS cybersecurity By dividing a physical network into many isolated virtual networks, VLANs help to enforce cybersecurity policies, regulate access and restrict the spread of malicious activities to a limited area by establishing virtual boundaries. An ICS typically has a multitude of different systems and devices, all with varying levels of sensitivity and security requirements. An administrator can tailor security measures to the differing needs of each segment, improving security without compromising the network’s operational efficiency. Additionally, VLANs can be set up to limit access according to user roles and responsibilities, which lowers the possibility of insider threats or unintentional disruption of vital systems.
Getting Started
For all their advantages, VLANs require more configuration and management than the subnetting or routing techniques that you may be more familiar with. A complete understanding of the network infrastructure and operating requirements of an ICS is necessary before implementing VLANs on it.
Your first step is to assess the network, which includes identifying critical assets and figuring out the best approach to segment them using VLANs. Identifying network traffic patterns will show which devices need to communicate with each other. To prevent inter-VLAN routing delays, devices requiring real-time communications must be connected to the same VLAN. Remember, because VLANs are not limited by proximity or physical location, devices belonging to the same VLAN can be distributed throughout the ICS physical network and still function as though they are linked to the same local network switch.
Striking a balance between satisfying every requirement and avoiding complexity could be your toughest task. VLAN configurations that are too complicated may be hard to manage and monitor, which could result in security flaws.
Once in place, it is important to regularly update and examine a VLAN configuration. Changes in the ICS environment, such as the addition of new devices or the repurposing of existing ones, will require the VLAN setup to be adjusted.
