VLANs in industrial networks
IEEE 802.1Q VLANs for plant networks: access and trunk ports, tagging, native VLAN, PCP priority for PROFINET/EtherNet/IP, inter-VLAN routing and common mistakes.
A VLAN (IEEE 802.1Q) splits one physical switched network into several logical broadcast domains. In plants VLANs separate machine/cell networks, SCADA/servers, engineering, video and IT traffic — limiting broadcast storms and supporting the zone/conduit model of IEC 62443.
Port types
| Port | Frames | Typical connection |
|---|---|---|
| Access (untagged) | Belongs to one VLAN; device sends normal frames | PLCs, HMIs, drives, PCs |
| Trunk (tagged) | Carries several VLANs with a 4-byte 802.1Q tag | Switch-to-switch, switch-to-router/firewall, hypervisors |
| Hybrid / general | Some VLANs untagged, others tagged | Vendor-specific; use carefully |
The 802.1Q tag contains the VLAN ID (1–4094) and a 3-bit PCP priority (0–7). PROFINET RT frames are sent with priority 6 and many switches map them to the highest queue; EtherNet/IP uses DSCP/PCP values recommended by ODVA.
Design rules
- Plan VLAN IDs and IP subnets together: one VLAN = one IP subnet.
- Do not use VLAN 1 for production traffic; change the native VLAN on trunks and prune unused VLANs.
- Keep real-time I/O traffic (PROFINET, EtherNet/IP I/O) inside a cell VLAN; route only what needs to leave it.
- Inter-VLAN routing belongs to a layer-3 switch or firewall with access rules — routing without filtering removes most of the security benefit.
- Document port assignments; a field device plugged into a trunk or wrong access port is a classic commissioning fault.
Typical mistakes
- PROFINET devices placed in different VLANs from their controller (DCP name assignment and RT traffic do not cross routers).
- Mismatched native VLAN on both ends of a trunk.
- Multicast flooding (EtherNet/IP) because IGMP snooping/querier is not configured.
Connections
Open in Knowledge Graph →Loading the map…
Sources
Updated 2026-10-04