Plant Network Setup

Question

I am looking to setup a plant network as part of a job I am currently working on and I wanted to get some advice on how I am planning on doing it as well as some information at a point where I need a little magic to happen.

So as an overview, in the plant we have 40 machines, each one of these machines will have 9 networked devices in them connected to a local switch on the machine. Each one of these will then be fed back to an overall equipment switch which will then have dedicated VLANS setup for each machine. This equipment switch will then also be connected back to a main plant switch. There is also another switch and multiple access points on the network but they are not of concern for the moment.

What I want to be able to do is set a local IP of each of the 9 devices on the local machine switch and have these the same for all machines. i.e. 10.10.1.1-10.10.1.9. What I also need to have is the ability to access some of the devices on the local machine switch by devices on the main plant switch and have this done in the local switch if it is possible, for example if I queried 10.10.100.1 on VLAN 1 that it forwarded me to 10.10.1.1 on the local switch. The main plant switch will be a layer 3 managed and I'm unsure if I can do what I need to do at the machine side with a layer 2 switch.

To summarize end goal would be:

40 machines where corresponding devices in each machine have the same local IP (local network on machine 10.10.1.x)

Each machine switch fed back to a central equipment switch on the 10.10.100.x range for example

Equipment switch fed back to a main plant switch which has the higher level control devices on the 10.10.200.x range for example (it is possible to have dual NIC's on higher level control devices so dual IP possible)

Higher level control devices on the main plant switch being able to access some of the lower level devices on the local machine switches

I'm a noob when it comes to multilayer networking with a relatively substantial number of devices and I am unsure if this is a possibility or if I am going in the wrong direction with how I am looking to set this up. Any advice on this would be greatly appreciated or if I have not been clear enough or not provided enough information on the system to form an opinion on it please let me know.

Thanks

Visual Indicator of what I am trying to achieve:

Answer 1

... and have these the same for all machines. i.e. 10.10.1.1-10.10.1.9

That is a very, very bad idea generally. Ambiguous addressing makes your life very hard. It requires an elaborate NAT setup that can be a major PITA. Since an L3 switch can't NAT, you'd require an additional NAT router capable of handling ambiguous addressing.

Instead, use a common addressing scheme for all machine VLANs but enumerate some address part across the VLANs, e.g. 10.10.1.1-9, 10.10.2.1-9, and so on. You'd need that kind of addressing outside the NAT scheme anyway - as you've already noticed.

With a reasonable addressing scheme you could also put all devices in a single VLAN but disable any traffic between them using a private VLAN aka port isolation or source-port filter.

To make life even easier you should use DHCP to assign the (reserved) IP addresses to the machines. That way, changing around components doesn't require much configuration.

So, there's no magic required here if you don't start out the wrong way.

Answer 2

I appreciate all of the very useful feedback to the question. A different route was taken in which the automation network was swallowed into the customers network setup and standard addressing on all the the individual devices was used. A second NIC was then used specific devices to communicate to the isolated part of the system.