we are developing an industrial network where we must to guaranteed three separated LAN (LAN1, LAN2 and LAN3, please see the attached image below).

Our client want the networks to be separated, so packets from one of the LAN shouldn't be transmitted on the other two LAN, except for several Modbus TCP/IP connections between elements (PC and a ADAM IO module) placed on diferent LAN.

  • Is this possible via managed Switch? VLAN would be the correct way? Can I configure three VLAN and some port forwarding for this modbus tcp links?

We will use the EKI-7656 managed switch from Advantech.

Keeping separated networks is our main client requirement and I'd like to ensure this with a correct switch configuration.

Our network scenario

  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin
    Aug 17, 2017 at 5:18

3 Answers 3


I would assume your customer wants the separation due to security reasons. In this case VLAN will not do the desired separation. What you probably need is Firewall that will control what is allowed to pass and what should be prevented. The device you mentioned supports IP Access List so you need to check if ACL can address your filtering needs.


You can use VLAN to separate your 3 networks, but with only the EKI-7656C switch, which is layer 2 only, you have no way to allow the Modbus connection between the VLAN

To do so you need a router or a firewall that will perform inter-VLAN routing and filter which traffic is allowed between the 3 VLANs.

Another way would be to have the modbus device multi-homed, I.E. having a separate interface in each network, but this require those devices to have several interfaces, and it is not recommended (this would somewhat break the isolation between the networks).


Note that by themselves, VLANs do not enhance security. They simply limit broadcast domains.

If the world was only as big as your diagram above, sure, traffic would always be isolated within a single VLAN. In the real world, traffic needs to be routed in order to be useful. You must control traffic between the VLANs with a layer-3 aware device such as a layer-3 switch, router or firewall.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.