← lab guides · 2026-08-28 · 90m

Substation Field Network: Copper, Fiber, VLANs and VPN

Built like a utility field closet: fiber and copper to the patch panel, VLANs for SCADA vs corporate, static routing and a VPN back to the office.

topic: ics-ot, routing-switching · tool: cisco-ios, fortigate, hp-procurve · difficulty: beginner

TOPOLOGYFig. — lab diagram

[ LAB TOPOLOGY — add topology.svg to this bundle ]
  [ PC1 ]──[ SW1: vlan10 ]──[ R1 ]──[ FW ]── Internet
              └─ vlan99 MGMT  vlan20 OT (PLC/HMI)

On this page

Objective

You wire a small enclosure the way a substation or comms tower cabinet runs: separate the OT gear from corporate, prove L1 before you touch L3, and give the field a way home.

Topology

[OT: RTU/PLC/IoT]──[ 3750G VLAN 20 OT ]──┐
[Corporate/Cameras]──[ VLAN 10 CORP ]──┤──[ ASA/pfsense ]──[ VPN ]── Office
[Mgmt/Access Ctrl]──[ VLAN 99 MGMT ]──┘          │
                                    [ Cell GW / Wireless Bridge ]── Tower link

I used my home lab to model this: ASA 5516-X for NAT and firewall, 3750G stack for VLANs and trunking, and a Proxmox host to host the jump box. At client sites I ran the same pattern for HVAC IP devices and building sensors on isolated VLANs.

Steps

Prove L1. I tested copper with a cable verifier and checked SFP link lights. I punched copper to the patch panel, landed fiber to the SFP, and labeled everything at both ends. I did not move on until link showed and power was stable.
Patch and document. I landed the RTU/PLC/IoT handoffs on VLAN 20, corporate and camera drops on VLAN 10, and mgmt on VLAN 99. I updated the closet doc with port, VLAN, patch panel position and warranty tag.
Switch VLANs and trunking. I created the three VLANs on the 3750G, set access ports, and trunked to the firewall. I checked show vlan brief and show interfaces trunk.
L3 and VPN home. I set SVIs for each VLAN, a static route for the field subnet, and an IPsec VPN back to the office. I tested DHCP and DNS from each VLAN and passed traffic across the tunnel.
Lock and back up. I applied allow-only ACLs between VLANs (OT can talk to corporate only where required), saved show run to git, and logged the inventory: device, serial, config backup date and SFP type.

Gotchas

A bad patch cable looks like a VLAN problem. I lost time once on a native VLAN mismatch that was actually a crimp.
You must label both ends while you wire. You will not remember which white cable is which when you close the enclosure.
Save the config before you test the VPN. A reload without a save erases the tunnel.

Takeaways

Field work rewards attention at L1 and discipline at L2. You separate OT from corporate with VLANs, you give the field a VPN home, and you document so the next tech can find the port in the dark at a substation. That pattern held for my client sensor installs and it maps directly to substation and generation plant enclosures.

Modeled on FortiGate/Cisco ASA and HP ProCurve/Cisco 3750G with change control and rollback.

← Back to lab guides