Industrial switches can take part in security protection, but they do not automatically encrypt data once connected. You should separately control who can connect, who can manage, which services may communicate, and how to recover after a fault. VLANs, access control, encryption, and physical protection have different roles; the specific supported capabilities must be checked in the model, firmware, and configuration documentation.
Do not confuse security with reliability
A metal enclosure, wide temperature range, and redundant power supply mainly address the on-site environment and operational reliability; they do not directly prove resistance to intrusion. Network security focuses on unauthorized access, incorrect configuration, malicious traffic, and data leakage; the two are related, but they cannot replace each other. First list the controllers, cameras, maintenance computers, and management platforms, and mark which ones must communicate with each other and which ones should not be connected. All subsequent configuration should be built around these real business relationships.
Port admission: first reduce unnecessary entry points
Close unused ports, limit access locations, and configure port authentication or other admission measures according to device capabilities. MAC limits can reduce arbitrary connections, but a MAC address is not an identity credential that cannot be forged. Using 802.1X also requires support from the endpoint, the authentication server, and the switch together; industrial endpoints without authentication capability need a clear exception policy, and you cannot pretend that enabling authentication covers the entire network. On-site cabinets, fiber distribution, and spare interfaces must also be managed.
VLANs divide boundaries, ACLs limit services
VLANs separate different services into different Layer 2 broadcast domains, but data is not automatically encrypted because of this; if routing is used for intercommunication, access rules are still needed. ACLs filter traffic by address, protocol, or port. When configuring them, allow only the paths that services truly need, and test both the permitted and denied cases. Industrial control protocols may use multiple ports or actively connect back, so you cannot write a rule based only on the name. When critical control networks are involved, they should form a system with firewalls, zone separation, and monitoring measures.
Protect the management plane; do not leave passwords in the default state
The management plane is the entry point for changing device configuration, and it should be separated from ordinary service traffic, with access sources and personnel restricted. When the model supports it, prefer protected management protocols, disable unused legacy services, and create separate accounts and permissions. Password updates, certificates, time synchronization, log retention, and firmware source verification must also be included in maintenance. Whether the management protocol is encrypted and whether service messages are encrypted are two different things and must not be confused.
Protection must undergo actual verification
Use permitted endpoints to confirm that production services remain continuously available, then use controlled test devices to confirm that prohibited paths are indeed blocked. Test broadcast storm control, configuration backup, power-off recovery, and administrator permissions, and save configuration versions and operation records. Before changing ACLs or VLANs, prepare a rollback method to avoid security configuration cutting off the maintenance channel as well. Switches cannot replace endpoint patches, application authentication, or backups; a truly usable solution requires people, devices, and processes to work together.
Example: a maintenance computer accesses only authorized controllers
Assume the same site has production controllers, video endpoints, and a maintenance computer. First divide the objects that need to communicate, then decide the VLANs, routing boundaries, and access rules; you cannot simply connect all devices and expect port authentication to automatically determine services later. The maintenance computer is allowed to access only the necessary management addresses, and the video endpoints should not thereby gain permission to modify control configurations. During verification, save evidence of permitted access and also save the results showing that prohibited paths are denied. Remote maintenance is accessed through an independent controlled entry point; do not directly expose the switch management port to the public network. After temporary maintenance ends, revoke temporary accounts and rules and update the records.
Principle reference:Official technical materials. The structural diagrams in this article do not represent specific product specifications; when selecting a model, check the model manual.
Translated from the Chinese technical article. Source first published: 2024-11-26. Source last revised: 2026-10-13T19:28:50+08:00. Read the Chinese source
