How to Design SCADA Network Architecture: Key Steps and Example

To design a SCADA network architecture, organize it into layers: field devices, control network, and enterprise network. Use segmentation and firewalls to secure communication between layers and ensure reliable data flow with redundant paths and protocols like Modbus or DNP3.

Syntax

A typical SCADA network architecture includes these parts:

• Field Devices: Sensors and actuators collecting data.
• RTUs/PLCs: Remote units controlling field devices.
• Control Network: Connects RTUs/PLCs to SCADA servers.
• SCADA Servers: Central system processing data and sending commands.
• Enterprise Network: Connects SCADA to business systems.
• Security Layers: Firewalls and VLANs to isolate and protect.

Each part must be connected securely and reliably.

plaintext

Field Devices <-> RTUs/PLCs <-> Control Network <-> SCADA Servers <-> Enterprise Network

Security: Firewalls, VLANs, VPNs between layers

Protocols: Modbus, DNP3, OPC UA for communication

Example

This example shows a simple SCADA network design using VLANs and firewalls to separate layers and secure communication.

plaintext

# Define VLANs for network segmentation
vlan 10 name Field_Devices
vlan 20 name Control_Network
vlan 30 name Enterprise_Network

# Assign ports to VLANs
interface GigabitEthernet0/1
 switchport mode access
 switchport access vlan 10
!
interface GigabitEthernet0/2
 switchport mode access
 switchport access vlan 20
!
interface GigabitEthernet0/3
 switchport mode access
 switchport access vlan 30

# Configure firewall rules (pseudo-commands)
firewall allow from vlan10 to vlan20 protocol modbus
firewall allow from vlan20 to vlan30 protocol tcp/443
firewall deny all other traffic

# Setup redundant paths
interface Port-channel1
 description Redundant link between Control Network and SCADA Servers
 switchport mode trunk
 switchport trunk allowed vlan 20,30

Output

VLANs 10, 20, 30 created and assigned to ports.
Firewall rules allow Modbus between Field and Control, HTTPS between Control and Enterprise.
Redundant trunk link configured for reliability.

Common Pitfalls

• Mixing networks: Not separating field devices from enterprise network risks security breaches.
• Weak security: Missing firewalls or VPNs exposes control systems to attacks.
• No redundancy: Single points of failure cause downtime.
• Unsupported protocols: Using incompatible or unsecured protocols can cause communication failures.

plaintext

# Wrong: No VLAN separation
interface GigabitEthernet0/1
 switchport mode access
 switchport access vlan 1

# Right: VLAN separation
interface GigabitEthernet0/1
 switchport mode access
 switchport access vlan 10

Quick Reference

• Use VLANs to separate field, control, and enterprise networks.
• Apply firewalls and VPNs to secure communication.
• Implement redundant network paths for reliability.
• Choose industrial protocols like Modbus, DNP3, or OPC UA.
• Regularly update and monitor network devices for security.

Key Takeaways

Segment SCADA networks into field, control, and enterprise layers using VLANs.

Secure communication with firewalls and VPNs between network layers.

Use redundant links to avoid single points of failure.

Select appropriate industrial protocols for reliable data exchange.

Regularly monitor and update network components to maintain security.