A VLAN, or virtual LAN, is a way to divide one set of physical switches into several separate logical networks. In an OT network it lets a control engineer keep PLC traffic, HMI traffic, cameras, and vendor laptops in their own lanes even when they share the same switch hardware. This page explains what a VLAN does, how OT teams use it to segment a plant, and where its separation stops and a firewall's begins.
OT VLAN in one line: A VLAN is a logical grouping of switch ports into a separate broadcast domain, so devices in one VLAN cannot see broadcast traffic from another even though they share physical switches. OT teams use VLANs to split PLC, HMI, camera, and vendor traffic into isolated segments, which reduces broadcast noise and limits how far a problem can spread at layer 2.
A VLAN turns one physical switch into several logical networks by tagging each port with a VLAN membership. Ports assigned to VLAN 10 behave as one network and ports assigned to VLAN 20 behave as a completely separate one, even though both sets of ports live in the same box. Devices only share a broadcast domain with others in the same VLAN, so a broadcast sent on VLAN 10 is never heard on VLAN 20.
This matters because a broadcast domain is where certain traffic reaches everyone at once. In a flat network with no VLANs, every device hears every broadcast, discovery message, and misbehaving chatterbox, and a broadcast storm on one device can drag down the whole network. Splitting the network into VLANs contains that noise, so each segment only carries the broadcast traffic of its own members and stays quieter and more predictable.
The practical payoff for OT is that a single set of managed switches can serve many logical networks without running separate physical cabling for each. Instead of buying and wiring a dedicated switch for every function, an engineer carves the existing switches into VLANs, which saves hardware while still keeping traffic classes apart at layer 2. The separation is defined in configuration rather than in copper.
OT teams commonly slice a plant network into VLANs by function. Controllers and I/O go in a PLC VLAN, operator stations in an HMI VLAN, surveillance in a camera VLAN, and any equipment a vendor plugs in gets its own vendor VLAN. Each class of traffic then lives in its own broadcast domain, so the bandwidth-hungry camera stream and a vendor's noisy laptop do not share a lane with time-sensitive control traffic.
This separation does real work for both stability and containment. Keeping cameras off the control VLAN means their heavy, bursty traffic cannot crowd out PLC communication, and putting vendor gear in a dedicated VLAN means an unknown laptop is not sitting in the same broadcast domain as the controllers. When something on one VLAN misbehaves, its effect is contained to that segment rather than rippling across every device in the plant.
Traffic that genuinely needs to cross between VLANs, such as an HMI reading data from a PLC, is routed deliberately rather than flowing freely. That routing point is where an OT team applies rules about which VLAN may talk to which, turning the VLAN boundaries into checkpoints. Designing those allowed flows carefully is what makes VLAN segmentation a security measure and not just a tidiness exercise.
It is important to understand what a VLAN does not do. A VLAN provides logical separation at layer 2: devices in different VLANs cannot reach each other directly by broadcast, and traffic between them must pass through a routing point. But a VLAN is not, by itself, a firewall. If the device that routes between VLANs permits traffic to flow, then the VLANs are separated in name but connected in practice.
True isolation comes from inspecting and filtering the traffic that moves between segments, which is a firewall's job. A firewall can enforce that only specific devices, ports, and protocols cross a boundary, log what passes, and deny everything else, whereas a plain VLAN boundary only decides membership, not policy. Relying on VLANs alone to keep an attacker or a fault out of the control segment is a common and dangerous overestimate of what they provide.
The sound pattern is to use both for what each is good at. VLANs give a clean, low-cost way to carve the network into functional segments and cut broadcast noise, and a firewall between the segments that matter enforces the actual rules about who may talk to whom. VLANs organize the traffic; the firewall controls it. Treating VLAN separation as logical grouping rather than as a security wall keeps the design honest about where real isolation lives.
In a SCADA network, VLANs are a foundational tool for keeping the control level clean. Separating PLC and I/O traffic from HMIs, engineering workstations, cameras, and any corporate or vendor access means the controllers sit in a quiet, well-defined broadcast domain, which improves both the reliability of polling and the ability to reason about what should ever appear on that segment. Anything unexpected on the PLC VLAN is immediately suspicious.
VLANs also help shape what leaves the site for cloud monitoring. By placing the edge gateway or data-collection host so it can reach only the VLANs whose values need to travel upstream, an engineer limits the gateway's exposure to the rest of the plant. The dashboard in the cloud ends up fed by a narrow, intentional slice of the network rather than by a flat pool where the gateway can see everything.
For field and remote sites this discipline pays off in visibility and safety together. Well-planned VLANs make the network map legible, so a small team can see how traffic is meant to flow and spot deviations quickly, and they set up the natural chokepoints where a firewall then enforces the real rules. Combined with a gateway that forwards a curated feed to the cloud, VLAN segmentation gives remote operators both a cleaner network to watch and a smaller attack surface to defend.
A broadcast domain is the set of devices that hear each other's broadcast traffic. In a flat network every device shares one domain, so noise and broadcast storms reach everyone. A VLAN splits the network into separate broadcast domains, so each segment only carries its own members' broadcast traffic, which keeps it quieter and more predictable.
No. A VLAN provides logical separation at layer 2, so devices in different VLANs cannot reach each other directly, but the traffic that does cross between VLANs is not inspected or filtered by the VLAN itself. A firewall enforces which devices, ports, and protocols may cross a boundary. VLANs organize traffic while firewalls control it, and secure designs use both.
They typically split traffic by function, giving PLCs, HMIs, cameras, and vendor equipment their own VLANs on shared switches. This keeps heavy or untrusted traffic out of the control lane, contains problems to one segment, and creates clear checkpoints where routing between VLANs can be controlled. It saves hardware compared with running separate physical switches for each function.
Merobix reads your field devices into a cloud SCADA - the real thing behind these terms, live in days from any browser.