OT/IT Segmentation: What Plant Floors Actually Need

Published 22 April 2026 · Industry 4.0 · ~7 min read

When we walk into a manufacturing site for the first time, the question we ask is rarely "do you have segmentation." We ask: "show me the path a packet takes from the office laptop to the PLC." Nine times out of ten, the answer is: a flat /22 with VLAN 1 untagged everywhere. The HMIs talk to the engineering workstations talk to the file server talk to Active Directory talk to the Internet — over the same broadcast domain.

That is not a network. That is a single failure plane.

This piece walks through the segmentation pattern we deploy on plant floors across Andhra Pradesh and Telangana. It is opinionated and deliberately not the Purdue Reference Model in textbook form, because the textbook assumes greenfield builds and we are almost always brownfield.

The four zones, in one paragraph

Level 4 is the corporate IT zone — your AD, mail, ERP, CAD workstations. Level 3.5 is a DMZ — file shares, jump hosts, the engineering sandbox. Level 3 is operations — the HMI, the SCADA console, the historian. Level 2 is control — PLCs, RTUs, drives, robotic arms. The point is not the numbering; the point is that traffic between any two adjacent zones passes through a stateful firewall, and traffic between non-adjacent zones is by default denied. A CAD operator in Level 4 cannot reach a PLC in Level 2. They reach the historian in Level 3 through a published service, and the historian publishes a sanitized view back to Level 3.5.

What this looks like on real hardware

We typically land one of three stacks, depending on what the client already owns:

Fortinet stack. A FortiGate at the L4/L3.5 boundary in NAT/route mode, a second FortiGate at L3.5/L3 in transparent mode (so we don't renumber the OT side), FortiSwitch at L2 with FortiLink so VLAN policy is enforced at the access port, and FortiAnalyzer pulling logs back to the Level 4 SOC. Industrial signatures live in the IPS profile applied at the L3.5/L3 firewall.

Cisco stack. A Catalyst Industrial 9300 series at the L2 access layer, a pair of Catalyst 9400s at the distribution layer, and Cisco Cyber Vision sensors mirrored from the access ports for OT visibility. The firewall is typically a Cisco Secure Firewall (formerly Firepower) at L3.5 — and yes, you can use a third-party firewall here if politics demand it.

Hybrid OEM stack. Aruba CX at the L2 access layer (we like CX 6300 for the per-port profiling), with a Palo Alto NGFW at L3.5/L3 for the Industrial OT signatures. This combination is what we end up with most often when there is an existing Aruba campus footprint and the security team wants Palo's threat intel.

There is no "best" of these three. There is "what survives the next site survey," which is the stack the client's own engineers can manage at 11 PM on a Sunday.

The five rules that actually matter

1. No DHCP across zone boundaries. A device that gets its IP across a firewall is a device that will fail in surprising ways. Every zone has its own DHCP scope and its own DNS resolver. 2. Allowlists, not blocklists. The L3.5/L3 firewall policy starts as "deny all" and adds explicit allows for the historian protocol (OPC UA), the engineering protocol (FactoryTalk, TIA Portal, Studio 5000), and the time service. Anything else is logged and dropped. 3. No outbound Internet from L2 or L3. Period. If a PLC needs a firmware update, the file is staged in the L3.5 jump host and pushed inward over the published service. The PLC never speaks to the Internet directly. 4. Read-only historian replication into L3.5. The L3 historian replicates a sanitized subset to a Level 3.5 mirror. Office BI tools query the mirror, not the production historian. This is the single change that has unlocked the most brownfield projects we have seen — once procurement realizes they can dashboard plant data without anyone in IT touching a PLC, the segmentation budget appears. 5. A real change-control workflow. The L3.5/L3 firewall policy is owned by the OT engineering manager, not the IT security manager. IT has read access. OT has write access. This is a culture change as much as a network change.

What you should ask of your SI

When evaluating a system integrator on this work, three questions cut through the deck:

• "What's the rollback if your firewall replacement bricks the line?" — There should be a documented bypass and a measured failover time, not a shrug.
• "Show me the policy generated for our protocols, not a sample policy." — Anyone can show you a sample. The work is in mapping your specific HMIs and PLCs to specific allow rules.
• "Who owns the policy after go-live?" — If the answer is "we do," you are renting segmentation. If the answer is "your OT manager, with our quarterly review," you are buying it.

We segment plant floors because the alternative is a single failure plane shared with the office wifi. The patterns above are the ones that actually survive.

— SRI INFOIT, Visakhapatnam · OT/IT practice