0

I have been assigned to check the security aspect of the below network shown in image. When i asked question on security of individual modbus device, I was told to create individual vlans for each Modbus device and that shall suffice the security requirements.

But i feel this is not the correct method and below is myng (please correct me)

  1. vlans are not a means for security
  2. even if we create vlans with same network, control systems wont be able to communicate to the downstream devices due to vlan id in the ethernet packet. Can i simulate this in packet tracer (other than PCs and switches)

Please guide me.

Required Network architecture

1

vlans are not a means for security

VLANs alone are no means for security. Segregating hosts using VLANs and controlling the traffic between them by firewalls is.

if we create vlans with same network, control systems wont be able to communicate to the downstream devices due to vlan id in the ethernet packet

That is the purpose of a VLAN in a data link layer (L2). It separates its traffic from the rest of the network.

Separating hosts in L2 means they can only communicate using the network layer (L3), forcing them to use gateways/routers. Those gateways are where you control the traffic. Of course, hosts in different VLANs also need to be in different IP subnets for routing to work.

If you require contiguous L2 connectivity then you cannot separate those hosts using VLANs. Modbus can run on top of TCP/IP, so it can be routed.

In your case, the Tofino firewall (or an additional router) needs to connect the separated IP subnets. Using firewall rules, you permit specific, required connections and deny all other traffic.

On the switch, create the required VLANs and assign device ports as untagged. Towards the firewall, define a VLAN trunk with all VLANs tagged.

On the firewall's trunk interface, create tagging VLAN subinterfaces and assign the IP subnets. The north-facing port towards the control systems uses yet another subnet.

Then you define the firewalls rules, e.g. allowing a specific control system access to a defined Modbus device or subnet.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.