1

I have a legacy automation system which will be replaced by a newer version. As an fallback option, the new system will be installed in parallel to the old one. But only one will be "in control".

Due to the current network layout and the state of the other communication partners, both systems must have the same IP address.

An easy way would be simply to change the plug on the switch. But that would have some disadvantages.

Would it be possible to configure a switch in such a way that it would divide packets to this automation-IP and send to both (legacy and new) but packets from the systems to the communication partners only from a particular one?

enter image description here

Typically we use an Cisco Catalyst 2960L-24PS switch within our automation server.

  • No, IP addresses in the same routing domain must be unique. – Ron Maupin Apr 1 at 6:22
  • Have you looked at destination NAT - using the "unique" IP as virtual address and map to where required? – Zac67 Apr 1 at 6:26
  • if you can provide diagram, question will be more clear – infra Apr 1 at 6:29
  • i Included a diagram of the required routes – why.n0t Apr 1 at 6:41
1

Due to the current network layout and the state of the other communication partners, both systems must have the same IP address.

You cannot use the same IP address twice in a given network at the same time.

Would it be possible to configure a switch in such a way that it would divide packets to this automation-IP and send to both (legacy and new) but packets from the systems to the communication partners only from a particular one?

That won't work. IP nodes are required to check for IP address collision and that setup will land on your feet if both nodes see each other.

However, if the nodes can't see each other and only one is connected to the rest of the network at any time this is possible. You can either deactivate the "spare" device's port in the switch or put it in a dummy VLAN of its own. When going into failover, you deactivate the "in-control" port, active the "spare" port and once the other end nodes re-ARP the IP address the spare device is integrated. Likewise with VLANs, you move the in-control port to the dummy VLAN and move the spare port to the production VLAN.

Directing some traffic to the one device and other traffic to the other device might also be possible, depending on your switch's filtering features (ACLs, port isolation, ...), but simply put, I wouldn't seriously try that. Chances are you'll burn your fingers.

A potentially better solution is to isolate each device and its communication partners in a VLAN of its own. A much better solution is to redesign what's necessary to give each device its own IP address.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.