Network segmentation (IT/OT separation) in SCADA systems - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to define a VLAN for the OT network segment.

SCADA systems

vlan [1] {
  name "OT_Network"
}

Drag options to blanks, or click blank then click option'

A10

B30

C20

D40

Attempts:

3 left

💡 Hint

Common Mistakes

Choosing VLAN ID 10 which is often used for IT networks.

The OT network VLAN is commonly assigned VLAN ID 20 to separate it from IT networks.

2fill in blank

medium

Complete the firewall rule to allow only Modbus TCP traffic from IT to OT segment.

SCADA systems

firewall rule allow_modbus {
  source vlan IT
  destination vlan OT
  protocol [1]
  port 502
}

Drag options to blanks, or click blank then click option'

Audp

Bicmp

Chttp

Dtcp

Attempts:

3 left

💡 Hint

Common Mistakes

Using UDP or ICMP which are not correct for Modbus TCP.

Modbus TCP uses TCP protocol on port 502, so the protocol must be set to tcp.

3fill in blank

hard

Fix the error in the ACL to block all traffic except SSH from IT to OT.

SCADA systems

acl it_to_ot {
  permit [1] any any eq 22
  deny ip any any
}

Drag options to blanks, or click blank then click option'

Atcp

Budp

Cicmp

Dip

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'ip' or 'udp' which do not match SSH protocol.

SSH uses TCP protocol on port 22, so the permit rule must specify tcp.

4fill in blank

hard

Fill both blanks to create a subnet for the OT network and set the correct mask.

SCADA systems

subnet [1] [2] {
  description "OT subnet"
}

Drag options to blanks, or click blank then click option'

A192.168.50.0

B255.255.255.0

C255.255.0.0

D10.0.0.0

Attempts:

3 left

💡 Hint

Common Mistakes

Using 10.0.0.0 which is usually for IT or other segments.

The OT subnet uses 192.168.50.0 with a mask of 255.255.255.0 for a typical /24 network.

5fill in blank

hard

Fill all three blanks to define a firewall rule allowing HTTPS from IT to OT with logging enabled.

SCADA systems

firewall rule allow_https {
  source vlan [1]
  destination vlan [2]
  protocol [3]
  port 443
  log enable
}

Drag options to blanks, or click blank then click option'

AIT

BOT

Ctcp

Dudp

Attempts:

3 left

💡 Hint

Common Mistakes

Using UDP protocol or reversing source and destination VLANs.

HTTPS traffic is TCP on port 443 from IT VLAN to OT VLAN, so source is IT, destination OT, protocol tcp.