Isolating Your Fanuc Robot Cell: A $100 Managed Switch, VLANs, and ACLs to Stop Ransomware Crossing from the Office to the Factory Floor
A billing clerk in a Canadian automotive parts plant clicked a link in an email that appeared to be from DHL. That single click encrypted the company’s Windows file server. Because the plant operated on a single flat Layer 2 network, the ransomware broadcasted cross-subnet, found the Fanuc robot controller’s open SMB shares, and encrypted the robot’s program files and configuration backups. Production halted for three days. The cost of downtime alone exceeded $350,000.
This is not a hypothetical. It is the direct consequence of treating the factory floor network like an extension of the office LAN. The good news is you don’t need a $20,000 industrial firewall or a team of network engineers to prevent it. You need a $99 TP-Link managed switch, a clear understanding of VLANs and ACLs, and about 30 minutes of configuration time.
This guide provides the exact configuration walkthrough to isolate your Fanuc robot cell (or any OT equipment) onto its own VLAN, lock down inter-VLAN traffic with Access Control Lists, and verify the isolation using Wireshark and Modbus TCP polls. No fluff. Just the hard operational reality of securing your production network.
The Problem: Flat Networks and the Blast Radius of Modern Ransomware
Most small-to-mid-sized manufacturers run a single flat IP network. The receptionist’s PC, the CNC machine, the Fanuc robot controller, and the ERP server all share the same broadcast domain. This is convenient for IT, but catastrophic for OT security.
Ransomware strains like Ryuk and LockBit propagate laterally using SMBv1 vulnerabilities and brute-forced administrative shares. A Fanuc R-30iB controller running a standard Windows-based HMI is particularly vulnerable. It often has SMBv1 enabled for legacy file transfers. On a flat network, there is nothing stopping the ransomware from jumping from the billing department directly into the robot’s program memory.
The solution is network segmentation. Virtual LANs (VLANs) split a single physical switch into multiple isolated broadcast domains. An Access Control List (ACL) on the switch then enforces exactly what traffic, if any, can cross between those domains.
The $99 Solution Architecture
The hardware choices for this build are driven by cost and availability. The TP-Link TL-SG108E is an 8-port Gigabit Easy Smart Switch available for under $100 at any Canadian electronics distributor (Memory Express, Canada Computers, Amazon.ca). It supports 802.1Q VLAN tagging, ingress ACL filtering, and a basic web management interface.
Physical Topology:
- Port 1: Uplink to the existing office router (Trunk port carrying both VLANs).
- Port 2: SCADA workstation (on Automation VLAN).
- Port 3: Fanuc robot controller (on Automation VLAN).
- Ports 4-8: Office PCs, printers, file servers (on Office VLAN).
VLAN Taxonomy:
- VLAN 10 (Office): 192.168.1.0/24
- VLAN 20 (Automation): 192.168.20.0/24
The SCADA workstation (192.168.20.10) will be the only device allowed to initiate communication to the Fanuc robot controller (192.168.20.50). All traffic originating from VLAN 10 destined for VLAN 20 will be silently dropped by the switch ACL. This includes SMB, RDP, ICMP, and any broadcast traffic.
Configuration Walkthrough: Zero Fluff, Just Syntax
Power on the TL-SG108E, connect your laptop to Port 1, set a static IP in the 192.168.0.x subnet (default IP is 192.168.0.1), and log into the web interface.
Step 1: VLAN Configuration (802.1Q)
The first step is to define the VLANs and assign port membership. We use 802.1Q tagging. The trunk port (Port 1) must be a tagged member of both VLANs. The access ports (Ports 2-8) are untagged members of their respective VLANs.
Table 1: Port Assignment and VLAN Membership
| Port | VLAN ID | Tagged / Untagged | PVID | Purpose |
|---|---|---|---|---|
| 1 | 10, 20 | Tagged | 1 | Trunk to Office Router |
| 2 | 20 | Untagged | 20 | SCADA Workstation |
| 3 | 20 | Untagged | 20 | Fanuc Robot Controller |
| 4 | 10 | Untagged | 10 | Office LAN (Default) |
| 5 | 10 | Untagged | 10 | Office LAN |
| 6 | 10 | Untagged | 10 | Office LAN |
| 7 | 10 | Untagged | 10 | Office LAN |
| 8 | 10 | Untagged | 10 | Office LAN |
How to implement in the TP-Link GUI:
- Navigate to VLAN > 802.1Q VLAN.
- Create VLAN 10. Add Ports 4-8 as Untagged members. Add Port 1 as a Tagged member.
- Create VLAN 20. Add Ports 2-3 as Untagged members. Add Port 1 as a Tagged member.
- Navigate to VLAN > Port Config. Set the PVID for Ports 4-8 to 10. Set the PVID for Ports 2-3 to 20. Set Port 1 PVID to 1 (or leave as default).
Step 2: Access Control List (ACL) – Locking Down Inter-VLAN Traffic
A VLAN alone is not enough. The switch must explicitly block routing between VLAN 10 and VLAN 20. Since the TL-SG108E is a Layer 2 switch, inter-VLAN routing happens on your router/firewall. However, we can implement ingress ACLs on the switch ports to drop unwanted traffic before it even reaches the router.
For a true isolation policy, we will configure an ACL that permits only TCP/4840 (OPC UA) from the SCADA IP to the Robot IP, and denies all other inter-VLAN traffic. TCP/4840 is the standard protocol for Fanuc’s OPC UA server. If your cell uses Ethernet/IP or Modbus TCP, adjust the protocol number accordingly.
Table 2: ACL Rules (Applied Ingress on Ports 4-8 – Office VLAN)
| Rule ID | Action | Source IP | Dest IP | Protocol | Port | Log |
|---|---|---|---|---|---|---|
| 1 | Permit | 192.168.20.10 (SCADA) | 192.168.20.50 (Robot) | TCP | 4840 | Enable |
| 2 | Deny | 192.168.1.0/24 | 192.168.20.0/24 | Any | Any | Enable |
| 3 | Permit | Any | Any | Any | Any | Disable |
Critical Implementation Note: The TP-Link Easy Smart Switch applies ACLs based on the rule ordering. Rule 1 must be placed above Rule 2. The implicit deny at the end of the ACL list is replaced by our explicit Deny rule, ensuring only SCADA-to-Robot traffic is permitted. Traffic from the Robot to the SCADA (response packets) is allowed because the SCADA initiated the connection. If you need the robot to initiate outbound connections (e.g., to a data center), you will need a stateful firewall, which is beyond the scope of this Layer 2 isolation guide.
How to implement in the TP-Link GUI:
- Navigate to Security > ACL.
- Create an IP ACL. Add Rule 1 (Permit), Rule 2 (Deny), Rule 3 (Permit any).
- Navigate to ACL Binding. Bind this ACL to Ports 4-8 with an Ingress direction.
- This ensures that any packet arriving on an office port destined for the automation subnet is checked against the ACL. If it is not from the SCADA IP going to the Robot IP on port 4840, it is dropped.
Verification Regime: Prove the Isolation Works
Configuration without verification is just hope. You must prove that the blast radius is contained. Here is the exact verification protocol:
Test 1: Ping Test (Must Fail)
From a workstation on VLAN 10 (Office), open a command prompt and attempt to ping the Fanuc robot controller at 192.168.20.50.
- Expected Result: Request timed out. This confirms that ICMP (ping) traffic is blocked by the ACL.
- Failure Mode: If the ping succeeds, the ACL is not applied correctly to the ingress ports. Double-check the ACL binding.
Test 2: Modbus TCP / OPC UA Poll (Must Succeed)
From the SCADA workstation on VLAN 20 (192.168.20.10), open your Modbus scanner or OPC UA client. Attempt to connect to the robot controller at 192.168.20.50 on port 4840.
- Expected Result: Connection established. Data read/write operations succeed.
- Failure Mode: If the connection fails, check the robot’s OPC UA server configuration and ensure the SCADA workstation is on the correct VLAN and has the correct IP address.
Test 3: Wireshark Capture (Definitive Proof)
This is the definitive test. Install Wireshark on the SCADA workstation. Capture traffic on the network interface. While capturing, initiate a scan from an Office PC (VLAN 10) pings to the robot VLAN. Then, perform a normal OPC UA transaction from the SCADA.
- Expected Result: You should see zero SMB, RDP, or ICMP packets originating from the Office subnet (192.168.1.x) on the capture. You should only see TCP/4840 packets from the SCADA (192.168.20.10) to the Robot (192.168.20.50). The broadcast traffic (ARP, DHCP) from the Office VLAN should also be absent.
- Failure Mode: You see broadcast storms from the office or SMB traffic. This indicates the VLAN or ACL is misconfigured. The switch may be configured as a hybrid port (e.g., PVID mismatch allowing untagged traffic to leak).
Operationalizing Network Isolation for Continuous Compliance
A VLAN is only secure if it is configured correctly on every port, every time. Human error during rush jobs or maintenance windows introduces drift. A technician unplugs the robot to run a firmware update and accidentally plugs it into an office port. A new intern sets up a secondary switch without VLAN configuration. Within minutes, the flat network is restored, and the ransomware blast radius expands back to its original footprint.
This is where the Ryxen Ecosystem locks in the ROI of your $99 network isolation investment. Manual, periodic audits fail because they rely on human memory and paper checklists. Software-defined compliance is permanent.
Ryxen’s SafeDesk and ShopDocs modules map your live network topology against the intended ACL and VLAN policy nightly. If a device fails to respond on the correct VLAN, or if a port that should be blocked receives traffic from an unauthorized subnet, the system flags the configuration drift and alerts the plant manager via SMS. The audit trail is captured automatically, providing the documentation required for WorkSafeBC or CSA Z432 machinery safety audits.
By integrating network isolation with an automated compliance engine, you transform a one-time configuration task into a continuous, enforced state. The $99 switch becomes an immutable part of your safety system, and the $350,000 failure mode is permanently engineered out of your plant.
The alternative is hoping that no billing clerk clicks a bad link tomorrow. In Canadian manufacturing, hope is not a strategy. Isolation is.