# Plant Network VLAN and IP Addressing Plan Worksheet

> Source: https://netray.co/tools/plant-network-vlan-ip-addressing-plan-worksheet
> Publisher: Netray (netray.co), AI and integration engineering for ERP and manufacturing systems.
> Section: Free Tools

## Short answer

Plan VLANs and subnets for office, servers, OT cells, cameras and guests, with usable host counts calculated from each prefix length.

## Category

industry-templates

## Industry

Discrete Manufacturing

## Audience

- IT manager
- Network engineer
- Controls engineer
- Plant IT

## Tool

**Kind:** worksheet

**Mode:** editable

**Columns:**

#### VLAN ID

**Key:** vlan

**Type:** number

#### VLAN name

**Key:** name

**Type:** text

#### Zone

**Key:** zone

**Type:** select

**Options:**

- Corporate IT
- Server
- DMZ
- Plant operations
- Cell or line
- Safety
- Building
- Guest
- Management

#### Network address

**Key:** subnet

**Type:** text

#### Prefix length

**Key:** prefix

**Type:** number

#### Usable hosts

**Key:** hosts

**Type:** number

**Expr:** max(0, pow(2, 32 - prefix) - 2)

#### Gateway

**Key:** gateway

**Type:** text

#### Purpose and owner

**Key:** purpose

**Type:** text

**Rows:**

#### CORP-USERS

**Vlan:** 10

**Zone:** Corporate IT

**Subnet:** 10.10.10.0

**Prefix:** 23

**Gateway:** 10.10.10.1

**Purpose:** Office workstations, IT

#### SERVERS-ERP

**Vlan:** 20

**Zone:** Server

**Subnet:** 10.10.20.0

**Prefix:** 24

**Gateway:** 10.10.20.1

**Purpose:** ERP, SQL and application servers, IT

#### DMZ-MES-GW

**Vlan:** 30

**Zone:** DMZ

**Subnet:** 10.10.30.0

**Prefix:** 28

**Gateway:** 10.10.30.1

**Purpose:** Historian and MES gateway, IT and OT

#### PLANT-HMI

**Vlan:** 100

**Zone:** Plant operations

**Subnet:** 10.20.100.0

**Prefix:** 24

**Gateway:** 10.20.100.1

**Purpose:** SCADA, HMI and engineering stations, OT

#### CELL-MACH-A

**Vlan:** 110

**Zone:** Cell or line

**Subnet:** 10.20.110.0

**Prefix:** 25

**Gateway:** 10.20.110.1

**Purpose:** CNC and PLC cell A, Controls

#### CELL-MACH-B

**Vlan:** 120

**Zone:** Cell or line

**Subnet:** 10.20.120.0

**Prefix:** 25

**Gateway:** 10.20.120.1

**Purpose:** Assembly line B, Controls

#### CCTV

**Vlan:** 200

**Zone:** Building

**Subnet:** 10.30.200.0

**Prefix:** 24

**Gateway:** 10.30.200.1

**Purpose:** Cameras and recorder, Security

#### GUEST-WIFI

**Vlan:** 900

**Zone:** Guest

**Subnet:** 172.16.90.0

**Prefix:** 24

**Gateway:** 172.16.90.1

**Purpose:** Visitors, Internet only

**Totals:**

#### Total usable hosts planned

**Key:** hosts

**Agg:** sum

**Format:** integer

**Summary:**

#### VLANs planned

**Key:** vlan_count

**Expr:** count

**Format:** integer

#### Average usable hosts per VLAN

**Key:** avg_hosts

**Expr:** avg_hosts

**Format:** integer

**Notes:** Example addresses use private RFC 1918 ranges. Replace them with your own scheme. Usable hosts is 2 to the power of (32 minus prefix) minus 2, so a /24 gives 254 and a /28 gives 14. Leave room for growth, typically 30 to 50 percent, and document one gateway convention such as first or last usable address.

## Content

**Intro:** A written VLAN and addressing plan makes every later task simpler, from firewall rules to audits and vendor onboarding. This worksheet gives you a table to fill in and calculates the usable host count so each subnet is the right size.

**Sections:**

#### How to use the worksheet

**Body:** Start by listing every function that needs its own broadcast domain: office users, servers, DMZ, each production area or cell, safety systems, cameras, building controls, guests and device management. Give each a VLAN ID and a prefix that fits today's devices plus growth. Edit the example rows, add rows, and export to Excel to share with the network team, the controls group and the auditor.

**Bullets:**

- Use a consistent naming style such as ZONE-FUNCTION
- Keep IDs in ranges by zone, for example 100s for plant, 200s for building
- Record an owner for each VLAN
- Never reuse VLAN 1 for production traffic

#### The sizing rule

**Body:** A subnet with prefix length p has 2 to the power of (32 minus p) addresses. Subtract the network and broadcast addresses to get usable hosts, so a /23 has 510, a /24 has 254, a /25 has 126, a /26 has 62 and a /28 has 14. Count every IP device in the area, including PLCs, drives, HMIs, scanners and cameras, then add growth. Smaller cell VLANs limit broadcast traffic and make it easier to contain an incident.

#### Zones and conduits

**Body:** Segment in line with a zone model such as the Purdue reference architecture and IEC 62443 zones and conduits: enterprise, DMZ, plant operations and cell or line levels. Traffic between VLANs should go through a firewall or a layer 3 switch with access control lists, with only the required protocols permitted. Safety networks and building systems are often kept apart because they have different change control and risk.

#### Common mistakes

**Body:** Common issues are one large flat plant subnet, overlapping ranges between sites that later need a VPN, and no record of static addresses. Vendors sometimes hard-code addresses such as 192.168.0.x on machines, which clash with your scheme, so plan a NAT or a dedicated machine network for them. Keep the sheet current as part of change control.

**Cta:** Netray can use your documented network and ERP topology to build a private AI assistant that answers IT and OT support questions without leaving your network.

**Faq:**

#### How many usable hosts are in a /24?

**Answer:** A /24 has 256 addresses and 254 usable hosts after removing the network and broadcast addresses. A /25 has 126, a /26 has 62, a /27 has 30, and a /28 has 14. Plan growth on top of the current device count.

#### How should I number VLANs in a plant?

**Answer:** Pick ranges by function and keep them consistent across sites, for example 10 to 99 for IT, 100 to 199 for plant operations, 200 to 299 for building systems and 900 and up for guests. Document the scheme and avoid VLAN 1 for production.

#### Should every production cell have its own VLAN?

**Answer:** Often yes, because small broadcast domains and per cell access control limit how far a fault or malware can spread. Very small plants may combine cells, but keep safety, cameras and guest traffic separate.

#### Can I use public IP ranges inside the plant?

**Answer:** No. Use private ranges from RFC 1918: 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16. Pick a scheme that will not overlap with other sites, acquired companies or vendor VPNs.

## Search terms

vlan plan template, ip addressing plan excel, plant network design worksheet, subnet planning worksheet, ot network vlan plan, factory network ip scheme, vlan numbering plan, subnet host calculator

---
Talk to an engineer: https://netray.co/contact?intent=erp_ai | Machine catalog: https://netray.co/agent/catalog.json