Plant Network VLAN and IP Addressing Plan Worksheet
A written VLAN and addressing plan makes every later task simpler, from firewall rules to audits and vendor onboarding. This worksheet gives you a table to fill in and calculates the usable host count so each subnet is the right size.
| VLAN ID | VLAN name | Zone | Network address | Prefix length | Usable hosts | Gateway | Purpose and owner | |
|---|---|---|---|---|---|---|---|---|
510 | ||||||||
254 | ||||||||
14 | ||||||||
254 | ||||||||
126 | ||||||||
126 | ||||||||
254 | ||||||||
254 |
Example addresses use private RFC 1918 ranges. Replace them with your own scheme. Usable hosts is 2 to the power of (32 minus prefix) minus 2, so a /24 gives 254 and a /28 gives 14. Leave room for growth, typically 30 to 50 percent, and document one gateway convention such as first or last usable address.
Segmentation plan review
Send your plan and get a short review of zone boundaries and sizing. Optional.
Optional. The tool and every export work without this. No spam.
How to use the worksheet
Start by listing every function that needs its own broadcast domain: office users, servers, DMZ, each production area or cell, safety systems, cameras, building controls, guests and device management. Give each a VLAN ID and a prefix that fits today's devices plus growth. Edit the example rows, add rows, and export to Excel to share with the network team, the controls group and the auditor.
- Use a consistent naming style such as ZONE-FUNCTION
- Keep IDs in ranges by zone, for example 100s for plant, 200s for building
- Record an owner for each VLAN
- Never reuse VLAN 1 for production traffic
The sizing rule
A subnet with prefix length p has 2 to the power of (32 minus p) addresses. Subtract the network and broadcast addresses to get usable hosts, so a /23 has 510, a /24 has 254, a /25 has 126, a /26 has 62 and a /28 has 14. Count every IP device in the area, including PLCs, drives, HMIs, scanners and cameras, then add growth. Smaller cell VLANs limit broadcast traffic and make it easier to contain an incident.
Zones and conduits
Segment in line with a zone model such as the Purdue reference architecture and IEC 62443 zones and conduits: enterprise, DMZ, plant operations and cell or line levels. Traffic between VLANs should go through a firewall or a layer 3 switch with access control lists, with only the required protocols permitted. Safety networks and building systems are often kept apart because they have different change control and risk.
Common mistakes
Common issues are one large flat plant subnet, overlapping ranges between sites that later need a VPN, and no record of static addresses. Vendors sometimes hard-code addresses such as 192.168.0.x on machines, which clash with your scheme, so plan a NAT or a dedicated machine network for them. Keep the sheet current as part of change control.
Frequently Asked Questions
How many usable hosts are in a /24?
A /24 has 256 addresses and 254 usable hosts after removing the network and broadcast addresses. A /25 has 126, a /26 has 62, a /27 has 30, and a /28 has 14. Plan growth on top of the current device count.
How should I number VLANs in a plant?
Pick ranges by function and keep them consistent across sites, for example 10 to 99 for IT, 100 to 199 for plant operations, 200 to 299 for building systems and 900 and up for guests. Document the scheme and avoid VLAN 1 for production.
Should every production cell have its own VLAN?
Often yes, because small broadcast domains and per cell access control limit how far a fault or malware can spread. Very small plants may combine cells, but keep safety, cameras and guest traffic separate.
Can I use public IP ranges inside the plant?
No. Use private ranges from RFC 1918: 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16. Pick a scheme that will not overlap with other sites, acquired companies or vendor VPNs.
Netray can use your documented network and ERP topology to build a private AI assistant that answers IT and OT support questions without leaving your network.
Related Tools
Industrial Protocol and Plant IT TCP/UDP Ports Reference
A searchable table of default ports for industrial protocols and the IT services a plant depends on, built for firewall rule requests and conduit reviews.
Compliance & ContractsPlant Ransomware Response Readiness Checklist
A practical checklist to test whether your plant can detect, contain and recover from ransomware across IT, ERP and OT.
ERP OperationsManufacturing IT Change Request and CAB Template
A change request form built for plants, with production impact, maintenance window, rollback plan and approval lines for IT, operations and quality.
ERP OperationsManufacturing IT Resilience Maturity Assessment
Answer ten questions about backups, redundancy, monitoring, patching and recovery to see how resilient your plant IT is and what to fix first.
More Industry Templates tools
See all- OEE Improvement A3 Charter Template
- Customer Order Change Request Form Template
- Plant Network Segmentation Checklist (Purdue Model)
- Server Room UPS Runtime and Sizing Calculator
- Server Room Cooling Load BTU Calculator
- Ransomware Downtime Cost Calculator for Manufacturers
- Plant Switch Port Budget Worksheet
- UPS Runtime and Sizing Calculator for Server Rooms
- Manufacturer Ransomware Readiness Assessment