I am looking to setup a plant network as part of a job I am currently working on and I wanted to get some advice on how I am planning on doing it as well as some information at a point where I need a little magic to happen.

So as an overview, in the plant we have 40 machines, each one of these machines will have 9 networked devices in them connected to a local switch on the machine. Each one of these will then be fed back to an overall equipment switch which will then have dedicated VLANS setup for each machine. This equipment switch will then also be connected back to a main plant switch. There is also another switch and multiple access points on the network but they are not of concern for the moment.

What I want to be able to do is set a local IP of each of the 9 devices on the local machine switch and have these the same for all machines. i.e. What I also need to have is the ability to access some of the devices on the local machine switch by devices on the main plant switch and have this done in the local switch if it is possible, for example if I queried on VLAN 1 that it forwarded me to on the local switch. The main plant switch will be a layer 3 managed and I'm unsure if I can do what I need to do at the machine side with a layer 2 switch.

To summarize end goal would be:

40 machines where corresponding devices in each machine have the same local IP (local network on machine 10.10.1.x)

Each machine switch fed back to a central equipment switch on the 10.10.100.x range for example

Equipment switch fed back to a main plant switch which has the higher level control devices on the 10.10.200.x range for example (it is possible to have dual NIC's on higher level control devices so dual IP possible)

Higher level control devices on the main plant switch being able to access some of the lower level devices on the local machine switches

I'm a noob when it comes to multilayer networking with a relatively substantial number of devices and I am unsure if this is a possibility or if I am going in the wrong direction with how I am looking to set this up. Any advice on this would be greatly appreciated or if I have not been clear enough or not provided enough information on the system to form an opinion on it please let me know.


Visual Indicator of what I am trying to achieve: enter image description here

  • 1
    You will run into serious problems trying to use the same network on multiple VLANs. You could look into using one private VLAN to keep the switches isolated. Also, if you are using a transport protocol other than TCP or UDP as some industrial devices may do, then NAT is out of the question.
    – Ron Maupin
    Apr 6, 2021 at 9:21
  • Hi Ron, thanks for the answer, I am using Ethernet/IP, I would need to check if it is NAT compatible since it is TCP based Apr 7, 2021 at 11:59
  • 1
    NAT is something to be avoided if at all possible. You use it when you connect private to public addressing. and when you have overlapping addressing, but overlapping addressing should be temporary until you get it re-addressed. It sounds like you simply want to use a private VLAN and standard routing. Trying to create your kludge can come back to bite you later. Remember to keep it simple.
    – Ron Maupin
    Apr 7, 2021 at 12:13
  • So for example the best approach may be to use a VLAN for each one of the machines on the equipment switch and then possibly use the two NIC's on the devices on the machine local switch to address for higher level communications and local comms i.e. device to device at the device level? Apr 7, 2021 at 12:32
  • 1
    Standard addressing and routing. Using TCP on IP means the traffic can be normally routed.
    – Ron Maupin
    Apr 7, 2021 at 12:55

2 Answers 2


... and have these the same for all machines. i.e.

That is a very, very bad idea generally. Ambiguous addressing makes your life very hard. It requires an elaborate NAT setup that can be a major PITA. Since an L3 switch can't NAT, you'd require an additional NAT router capable of handling ambiguous addressing.

Instead, use a common addressing scheme for all machine VLANs but enumerate some address part across the VLANs, e.g.,, and so on. You'd need that kind of addressing outside the NAT scheme anyway - as you've already noticed.

With a reasonable addressing scheme you could also put all devices in a single VLAN but disable any traffic between them using a private VLAN aka port isolation or source-port filter.

To make life even easier you should use DHCP to assign the (reserved) IP addresses to the machines. That way, changing around components doesn't require much configuration.

So, there's no magic required here if you don't start out the wrong way.

  • I'm afraid on the machine side the IP address cannot be dynamic due to there being safety devices on the network and fixed IP is needed so then it would have just made things easier if I could have device 1 on machine 1 = and device 1 on machine 2 be and have these network isolated from each other. This network would contain devices that don't need to communicate on a higher level and only 2 for example would need to. Is it not possible then to get the lower level switch on the machine level to forward queries for to then for example? Apr 7, 2021 at 11:39
  • Can't you simply use DHCP reservations? No, you can't "forward queries" with a switch. You talk about NAT which a normal switch doesn't do (requires a NAT router or an L4 switch w/ NAT option).
    – Zac67
    Apr 7, 2021 at 11:47
  • Thanks for the answer Zac67, I don't know enough to give an answer on the DHCP reservations but I can take a look and see. So if I was to integrate a NAT device on the machine level then is what I am talking about possible to do, or even make sense to do? Apr 7, 2021 at 12:01
  • Of course it's possible, but NAT should only be used as a last resort, when it's impossible to use a reasonable addressing scheme.
    – Zac67
    Apr 7, 2021 at 14:50

I appreciate all of the very useful feedback to the question. A different route was taken in which the automation network was swallowed into the customers network setup and standard addressing on all the the individual devices was used. A second NIC was then used specific devices to communicate to the isolated part of the system.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.