Migrating Legacy IACS
Networks to a Converged
Plantwide Ethernet
Architecture
Rockwell Automation and
Cisco Four Key Initiatives:
• Common Technology View:
A single system architecture, using open,
industry standard networking
technologies, such as Ethernet and IP, is
paramount for achieving the flexibility,
visibility and efficiency required in a
competitive manufacturing environment.
• Converged Plantwide Ethernet
Architectures:
These manufacturing focused reference
architectures, comprised of the Rockwell
Automation Integrated Architecture® and
Cisco’s Ethernet to the Factory, provide
users with the foundation for success to
deploy the latest technology by addressing
topics relevant to both engineering and
IT professionals.
White Paper
November 2015
• Joint Product and Solution
Collaboration:
Stratix 5700™, Stratix 5400™ and Stratix
5410™ Industrial Ethernet switches
incorporating the best of Cisco and the best
of Rockwell Automation.
• People and Process Optimization:
Education and services to facilitate
Operational Technology (OT) and
Information Technology (IT) convergence
and allow successful architecture
deployment and efficient operations
allowing critical resources to focus on
increasing innovation and productivity.
Document Reference Number:ENET-WP040A-EN-P
Migrating Legacy IACS Networks to a
Converged Plantwide Ethernet Architecture
The prevailing trend in Industrial Automation and Control System (IACS) networking is the convergence of
technology, specifically IACS Operational Technology (OT) with Information Technology (IT). Converged
Plantwide Ethernet (CPwE) helps enable network technology convergence through the use of standard
Ethernet and Internet Protocol (IP) technology. A converged IACS network technology enables the Industrial
Internet of Things and helps to facilitate:
•
Multi-discipline application convergence, including discrete, continuous process, batch, drive, safety,
motion, power, time synchronization, supervisory information, asset configuration/diagnostics and
energy management
•
Standard IT technology that is future-ready, with increased sustainability and reduced risk of deployment
•
Better asset utilization through a common network infrastructure that can also help support lean
initiatives
•
Common toolsets and required skills/training, including assets for design, deployment and
troubleshooting, as well as human assets
•
Standard and established IT security technology, best practices, policies and procedures
•
Seamless plant-wide/site-wide information sharing due to IP pervasiveness—routability and portability
across data links (such as Ethernet and Wi-Fi)
Although technology has been the enabler behind OT and IT convergence, business aspects have also
sustained a continual trend:
•
Integration—Converging business systems with plant-wide/site-wide systems for more Key
Performance Indicators (KPIs), regulatory compliance (such as genealogy and track and trace) and
supply chain management
•
Connectivity—More IACS devices connected for better IACS asset utilization, optimization and
management
•
Applications—Expanded application support (such as energy management and sustainability initiatives)
•
Collaboration—OT and IT groups, who previously had little interaction, are now collaborating to share
standards, best practices, innovations and security policies, procedures and technology
The Migrating Legacy IACS Networks to CPwE Cisco Validated Design (CVD), which is documented in the
Migrating Legacy IACS Networks to CPwE Design and Implementation Guide (DIG) outlines one application
use case for migrating a traditional IACS network architecture to a standard Ethernet and IP network
Migrating Legacy IACS Networks to a Converged Plantwide Ethernet Architecture
ENET-WP040A-EN-P
1
Migrating Legacy IACS Networks to a Converged Plantwide Ethernet Architecture
IACS Migration Use Case Requirements
technologies. CPwE is the underlying architecture that provides standard network services for control and
information disciplines, devices and equipment found in modern IACS applications. The CPwE architecture
(Figure 1) provides design and implementation guidance that can help to achieve the real-time
communication, reliability, scalability, security and resiliency requirements of the IACS.
The Migrating Legacy IACS Networks to CPwE CVD is brought to market through a strategic alliance
between Cisco Systems® and Rockwell Automation. The Migrating Legacy IACS Networks to CPwE CVD
highlights the key IACS application requirements, technology and supporting design considerations to help
with the successful design and deployment of migration use cases within the framework of CPwE.
Figure 1
CPwE Architectures
Wide Area Network (WAN)
Internet
Enterprise
Physical or Virtualized Servers
External DMZ/
Firewall
ERP - Business Systems
Email, Web Services
Security Services - Active Directory (AD), Identity Services (AAA)
Network Services – DNS, DHCP
Call Manager
Enterprise Zone
Levels 4 and 5
Plant Firewalls
Physical or Virtualized Servers
•
•
•
•
•
•
•
•
•
Patch Management
AV Server
Application Mirror
Remote Desktop Gateway Server
• FactoryTalk Application Servers and
Services Platform
• Network & Security Services – DNS,
AD, DHCP, Identity Services (AAA)
• Storage Array
Level 3 - Site Operations
(Control Room)
Standby
Industrial Zone
Levels 0–3
Distribution
Switch Stack
Active
Wireless
LAN Controller
(WLC)
Industrial
Demilitarized Zone
(IDMZ)
Core
Switches
RADIUS
(AAA) Server
Physical or Virtualized Servers
Active/Standby
Inter-zone traffic segmentation
ACLs, IPS and IDS
VPN Services
Portal and Remote Desktop Services proxy
Remote
Access
Server
Cell/Area Zone
Levels 0–2
Distribution
Switch Stack
Cell/Area Zone
Levels 0–2
LWAP
Camera
IES
LWAP
IES
LWAP
CAPWAP
SSID
2.4 GHz
IES
IES
IES
SSID
5 GHz
Safety
Controller
IES
SSID
5 GHz
HMI
IES
CAPWAP
Phone
WGB
AP
CAPWAP
IES
(Plant-wide Network)
IES
Soft
Starter
IES
IES
WGB
Drive
Safety
I/O
IES
Instrumentation
Controller
I/O
Controller
Controller
Cell/Area Zone - Levels 0–2
Redundant Star Topology - Flex Links Resiliency
Unified Wireless LAN
(Lines, Machines, Skids, Equipment)
WGB
IES
Cell/Area Zone - Levels 0–2
Ring Topology - Resilient Ethernet Protocol (REP)
Unified Wireless LAN
(Lines, Machines, Skids, Equipment)
Servo
Drive
HMI
Safety
I/O
Robot
Cell/Area Zone - Levels 0–2
Linear/Bus/Star Topology
Autonomous Wireless LAN
(Lines, Machines, Skids, Equipment)
375400
•
•
•
•
•
IACS Migration Use Case Requirements
An IACS is deployed in a wide variety of discrete and process manufacturing industries such as automotive,
pharmaceuticals, consumer goods, pulp and paper, oil and gas, mining and energy. IACS applications are
made up of multiple control and information disciplines such as continuous process, batch, discrete and
hybrid combinations.
Manufacturers traditionally deployed multiple disparate network technologies (Figure 2) for their IACS
applications to address multiple control and information disciplines. One of the challenges facing
manufacturers is the complexities of migrating traditional IACS network technologies to standard Ethernet
and IP networking technologies (Figure 3) to take advantage of the business benefits associated with the
Industrial Internet of Things.
Migrating Legacy IACS Networks to a Converged Plantwide Ethernet Architecture
2
ENET-WP040A-EN-P
Migrating Legacy IACS Networks to a Converged Plantwide Ethernet Architecture
IACS Migration Use Case Requirements
Figure 2
Disparate IACS Network Technologies
Plant/Site Network
I/O Network
Safety Network
Drive Network
Figure 3
375779
Controller
Single IACS Network Technology
Plant/Site
HMI
I/O
IES
Safety
Controller
Safety
I/O
VFD
Drive
375780
I/O
Servo
Drive
The Migrating Legacy IACS Networks to CPwE CVD outlines the concepts, requirements and technology
solutions for one specific application use case that was tested, validated and documented by Cisco and
Rockwell Automation to migrate a traditional IACS network architecture (Figure 4) to a converged
EtherNet/IP™ architecture (Figure 5).
The Migrating Legacy IACS Networks to CPwE CVD promotes the following (Figure 4):
•
Maintain existing Programmable Automation Controllers (PAC) and replace Network Interface Cards
(NIC)
•
Maintain existing PAC subnet and IP addressing schema
•
Maintain existing plant-wide virtual LAN (VLAN) structure for inter-PAC communications
•
Maintain existing IACS input/output (I/O) platform and replace NICs and/or I/O adapter modules:
– Migrate legacy IACS I/O network (non IP) to EtherNet/IP
•
Maintain existing IACS devices, replace NICs - such as Variable Frequency Drives (VFD),
instrumentation and Human Machine Interface (HMI):
– Migrate legacy IACS device network (non IP) to EtherNet/IP
•
For maintenance simplification, maintaining identical IP addressing for I/O and IACS devices across
each skid/machine such as I/O, VFD, instrumentation and HMI
•
For maintenance simplification, support by IACS OT personnel such as plant engineer, control system
engineer and maintenance engineer
•
Keep IACS I/O traffic local
•
Keep IACS PAC traffic local
•
Support plant-wide data acquisition
•
Support plant-wide IACS asset management
•
Support plant-wide network management
Migrating Legacy IACS Networks to a Converged Plantwide Ethernet Architecture
ENET-WP040A-EN-P
3
Migrating Legacy IACS Networks to a Converged Plantwide Ethernet Architecture
IACS Migration Technology
Figure 4
Use Case—Legacy IACS Network Architecture
Industrial Zone
Levels 0-3
Distribution
Switch
(Plant-wide Network)
VLAN 30
10.10.30.0/24
IES
Line PAC
10.10.30.5
10.10.30.6
10.10.30.7
I/O Traffic
PAC
1
I/O
12
I/O
13
PAC Traffic
VFD
14
VFD
14
Skid / Machine #1
I/O
13
I/O
12
HMI
11
Information / Management Traffic
Skid / Machine #2
Cell/Area Zone - Levels 0-2
375781
HMI
11
PAC
1
IACS Migration Technology
A variety of standard Ethernet and IP networking technology was applied to the Migrating Legacy IACS
Networks to CPwE CVD to accomplish the requirements of specific application use cases (Figure 5):
•
EtherNet/IP—Single IACS Network Technology
•
Layer 2 Industrial Ethernet Switches (IES)
•
Network Address Translation within the Layer 2 IES
•
Routing within the Layer 2 IES—Connected and Static
The Migrating Legacy IACS Networks to CPwE CVD builds atop Network Address Translation (NAT)
defined in the Deploying Network Address Translation in a Converged Plantwide Ethernet Architecture DIG.
NAT within CPwE enables the reuse of IP addressing without introducing a duplicate IP address error into
the IACS architecture. NAT translations have two forms: one-to-one (1:1) and one-to-many (1: n). The
Migrating Legacy IACS Networks to CPwE CVD includes tested and validated use cases utilizing one-to-one
NAT, implemented from the Allen-Bradley® Stratix 5700™ or Cisco IE 2000 Layer 2 IES.
NAT within the Layer 2 IES helps to address the use case requirements of:
•
For maintenance simplification, must maintain identical IP addressing for I/O and IACS devices across
each skid/machine such as I/O, VFD, instrumentation and HMI
•
For maintenance simplification, must be capable of being supported by IACS OT personnel such as plant
engineer, control system engineer and maintenance engineer
The Migrating Legacy IACS Networks to CPwE CVD introduces routing, specifically connected and static
routing, within the Layer 2 IES to help keep control and information traffic closer to the edge of the IACS
application. Routing helps to:
•
Forward IACS control and information traffic between IACS devices on different IP subnets
•
Create smaller broadcast domains by connecting yet segmenting multiple Layer 2 VLANs
Migrating Legacy IACS Networks to a Converged Plantwide Ethernet Architecture
4
ENET-WP040A-EN-P
Migrating Legacy IACS Networks to a Converged Plantwide Ethernet Architecture
IACS Migration Technology
Table 1 describes the different types of routing. Note that only connected and static routing are included in
the Migrating Legacy IACS Networks to CPwE CVD.
Table 1
Routing Types
Type
Network Path
Routing Paths
Supported by
Connected
Network path is automatically
populated into the routing table
when subnets are manually assigned
to the local interface ports of the IES
Limited to routing between subnets directly connected to the IES
(example - Figure 5, Skid/Machine #2):
Layer 2 and Layer 3
IES
Network path is manually entered
into the routing table and remains
static until manual updates are made
Supports routing to local and remote subnets (not directly connected to
the IES) (example - Figure 5, Skid/Machine #2)
Dynamically learns remote network
paths and automatically populates
the paths into the routing table
Handshaking protocol between Layer 3 switches and routers to
determine optimal network topology/path to subnets, and forwarding
packets along those paths - that is, OSPF (Open Shortest Path First) and
EIGRP (Enhanced Interior Gateway Routing Protocol)
Static
Dynamic
• Subnets 10.10.30.0/24 and 192.168.1.0/24 are connected to the
Layer 2 IES
• The Layer 2 IES forwards (routes) I/O traffic between the PAC and
I/O connected subnets
• The Layer 2 IES forwards (switches) PAC traffic between the PACs
Layer 2 and Layer 3
IES
• Static route is required to forward (route) information to plant-wide
subnets beyond 10.10.30.0/24
Layer 3 IES
Connected and static routing within a Layer 2 IES helps provide a cost effective and simplified solution that
addresses the use case requirements of:
•
Maintaining existing PAC subnet and IP addressing schema
•
Maintaining existing plant-wide virtual LAN (VLAN) structure for inter-PAC communications
•
Keeping IACS I/O traffic local
•
Keeping IACS PAC traffic local
•
For maintenance simplification, must be capable of being supported by IACS OT personnel such as plant
engineer, control system engineer and maintenance engineer
•
Supporting plant-wide data acquisition
•
Supporting plant-wide IACS asset management
•
Supporting plant-wide network management
Use Case—Converged EtherNet/IP Network Architecture
Outside
VLAN 30
10.10.30.0/24
Line PAC
VLAN 30
10.10.30.5
HMI
.11
HMI
.11
CR-NAT
PAC
VLAN 30
10.10.30.6
I/O
.13
Inside
192.168.1.0/24
VLAN 10
(Plant-wide Network)
IES-1
CR-NAT
I/O
.12
Industrial Zone
Levels 0-3
Distribution
Switch
PAC
VLAN 30
10.10.30.7
I/O
.13
VFD
.14
VFD
.14
Skid / Machine #1
I/O
.12
Inside
192.168.1.0/24
VLAN 20
I/O Traffic
PAC Traffic
Information / Management Traffic
Skid / Machine #2
Cell/Area Zone - Levels 0-2
375782
Figure 5
Migrating Legacy IACS Networks to a Converged Plantwide Ethernet Architecture
ENET-WP040A-EN-P
5
Migrating Legacy IACS Networks to a Converged Plantwide Ethernet Architecture
Layer 2 Industrial Ethernet Switches
Connected routing, when used in conjunction with NAT functionality, helps enable routing between several
NAT-connected IACS applications (skids, machines and lines) within the Cell/Area Zone. Several use cases
have been tested and validated, allowing for architectural selections to be made based upon small
(skid/machine) to large-scale (Line or Cell/Area Zone) plant-wide deployments.
Layer 2 Industrial Ethernet Switches
The Allen-Bradley Stratix 5400™, 5700 and Cisco Industrial Ethernet 2000 and 4000 IES support routing
(connected and static) routing and NAT today. IES that supports Layer 2 spans nine models of the
Allen-Bradley Stratix and Cisco IES, including:
•
Select models of the Cisco IE 2000 and IE 4000 series IES
•
Select models of the Allen-Bradley Stratix 5400 and 5700 series IES
Connected routing and NAT are network switch functions that allow control system engineers to build IACS
applications using reused IP (IPv4) addresses behind separate IES, while also allowing those IACS
applications to integrate into the larger plant-wide architecture where unique IP addressing is required. With
NAT, the IES is configured to translate only specific IP addresses from inside the IACS application to the
outside plant-wide architecture.
Connected routing within the CPwE architecture also addresses two key challenges:
•
Limiting Layer 2 broadcast domains by segmenting with VLANs within the Cell/Area Zone
•
Keeping all control traffic local, by routing locally between the VLANs within the IACS application such
as skid/machine or Cell/Area Zone
•
Reusing IP addresses across multiple skids/machines while providing direct access from the plant-wide
network by using NAT within the Layer 2 IES
Summary
The Migrating Legacy IACS Networks to CPwE CVD outlines use cases for migrating a traditional IACS
network architecture to standard converged Ethernet and IP network technologies. A converged IACS
network enables the Industrial Internet of Things and helps to facilitate convergence across many industrial
segments where manufacturers traditionally deploy multiple disparate network technologies for their IACS
applications. CPwE helps to overcome complexities introduced by such disparate networks through network
convergence based upon standard Ethernet and IP technology. Connected Routing and NAT, which are switch
functions supported in select IES, enable the reuse of IP addressing, thus overcoming IP address challenges
commonly found during the process of network migration and convergence. The Migrating Legacy IACS
Networks to CPwE CVD helps to maintain existing IP addressing schemas while simplifying operations for
the plant engineer, control system engineer and maintenance engineer.
Migrating Legacy IACS Networks to a Converged Plantwide Ethernet Architecture
6
ENET-WP040A-EN-P
Migrating Legacy IACS Networks to a Converged Plantwide Ethernet Architecture
Cisco is the worldwide leader in networking that transforms how people connect, communicate and collaborate. Information about Cisco can be found at www.cisco.com. For ongoing news,
please go to http://newsroom.cisco.com. Cisco equipment in Europe is supplied by Cisco Systems International BV, a wholly owned subsidiary of Cisco Systems, Inc.
www.cisco.com
Americas Headquarters
Cisco Systems, Inc.
San Jose, CA
Asia Pacific Headquarters
Cisco Systems (USA) Pte. Ltd.
Singapore
Europe Headquarters
Cisco Systems International BV
Amsterdam, The Netherlands
Cisco has more than 200 offices worldwide. Addresses, phone numbers, and fax numbers are listed on the Cisco Website at www.cisco.com/go/offices.
Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this URL:
www.cisco.com/go/trademarks. Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between
Cisco and any other company. (1110R)
Rockwell Automation is a leading provider of power, control and information solutions that enable customers to get products to market faster, reduce their total cost of ownership, better
utilize plant assets, and minimize risks in their manufacturing environments.
www.rockwellautomation.com
Americas:
Rockwell Automation
1201 South Second Street
Milwaukee, WI 53204-2496 USA
Tel: (1) 414.382.2000, Fax: (1) 414.382.4444
Asia Pacific:
Rockwell Automation
Level 14, Core F, Cyberport 3
100 Cyberport Road, Hong Kong
Tel: (852) 2887 4788, Fax: (852) 2508 1846
Allen-Bradley, Integrated Architecture, Stratix, Stratix 5400, Stratix 5700, Stratix 8000 and Rockwell Automation are
trademarks of Rockwell Automation, Inc. EtherNet/IP and CIP are trademarks of the ODVA.
© 2015 Cisco Systems, Inc. and Rockwell Automation, Inc. All rights reserved.
Europe/Middle East/Africa:
Rockwell Automation
NV, Pegasus Park, De Kleetlaan 12a
1831 Diegem, Belgium
Tel: (32) 2 663 0600, Fax: (32) 2 663 0640
Publication ENET-WP040A-EN-P - November 2015