I never touched a utility substation at my MSP. I did wire HVAC IP controllers and building sensors into client networks, put them on their own VLAN, and coordinated with the vendor to get them talking. That work maps to what a utility field network does, so I treated it like it.

Same jobs, different labels

A utility lists RTUs, PLCs, cellular gateways, wireless bridges, weather stations, cameras, access control and radio. I installed HVAC IP devices, Lone environmental sensors, cameras and access controllers. You both land an endpoint in the field, isolate it, and give it a path home.

How I handled it

Separate first. I placed OT-style devices on a dedicated VLAN (often VLAN 20) and kept corporate on VLAN 10. I trunked that VLAN to the firewall and wrote a single allow rule for the traffic the vendor required. Everything else stayed blocked. I applied the same pattern I used for my 3750G lab and later for an OT segmentation lab.

Test L1, then L2. I verified copper and fiber at the patch panel, checked SFP link, and labeled both ends. I did not touch DNS or routes until the link light stayed solid. At a substation you work in an enclosure. You want the same habit.

Give it a path home. For remote sites I used a wireless bridge or a cell gateway and an IPsec VPN back to the office. I set a static route for the field subnet, allowed the VPN at the firewall, and confirmed I could poll the device from the NOC. I backed up the config and logged the device, SFP type and warranty.

Coordinate and document. I worked with HVAC contractors directly. They told me the port and protocol, I told them the VLAN and firewall rule, and we tested together. I left a one-page doc: port, VLAN, patch panel, IP, rule and contact. The next tech could find it without calling me.

What stuck

Field work does not reward speed. It rewards labeling, change control with a rollback, and a habit of saving show run to git before you test the tunnel. You isolate the OT VLAN, you prove L1, and you document so someone can fix it at 2 a.m. at a comms tower. That is the work that held for sensors in an office closet, and that is how I would approach a substation or generation plant cabinet.

Past work drawn from Philantech3/CleverPath client installs and my ASA 5516-X / 3750G home lab. I modeled the Purdue separation and vendor coordination you use at substations and towers.