Protocol-Aware Industrial Microsegmentation¶
Traditional segmentation normally controls addresses, ports, and broad services. L2Proxy adds the meaning of the industrial operation carried inside an allowed connection.
Policy from Layer 2 through Layer 7¶
The Rule Engine can combine controls across the communication stack:
Figure — Protocol-aware microsegmentation examples across industrial access and cell isolation scenarios.
| Policy depth | Examples of available context |
|---|---|
| Access domain and session | Authenticated user, group, session, connection type, and work context |
| Layer 2 | Source and destination MAC, VLAN, direction, and Ethernet protocol |
| Layer 3 | Source and destination address, subnet, and IP protocol |
| Layer 4 | TCP/UDP ports and connection direction |
| Application and Layer 7 | Detected application or parser-supported protocol, functions, services, fields, objects, and values |
| Industrial semantics | Equipment, point, command, setpoint, operating range, sequence, feedback, and process prerequisite |
This means policy can begin with a familiar port or application restriction and become more precise when the L2Proxy Dissector exposes Layer-7 and industrial context. An allowed port does not automatically authorize every operation carried over it.
Industrial decision depth¶
Network segment
+ authenticated identity and session
+ protocol and function
+ equipment and point
+ command, value, or requested state
+ sequence, timing, and prerequisite
= industrial microsegmentation decision
Representative controls¶
- allow monitoring while blocking control;
- allow control for one assigned asset but not adjacent equipment;
- permit only reviewed Open, Close, Pulse, Reset, or Acknowledge operations;
- prevent a setpoint outside the approved engineering range;
- require Select-Before-Operate or another valid command sequence;
- bind a multi-step authorization to the same user and session;
- detect configuration change, restart, or unexpected recovery behavior;
- record unknown devices, points, functions, or communication relationships;
- block an operation that violates equipment or process prerequisites.
Why this matters in OT¶
Two messages can use the same endpoints and TCP port while carrying very different industrial consequences. Protocol-aware microsegmentation keeps necessary connectivity available while applying different policy to observation, control, maintenance, configuration, file transfer, and recovery operations.
The Equipment and Protection Library supplies asset meaning. Protocol portfolios supply stable semantic helpers and policy examples. Stateful protection supplies bounded multi-event context. Customer policy retains authority over site-specific equipment, limits, timing, and final decisions.
Multi-protocol industrial examples¶
| Protocol or application | Example session policy |
|---|---|
| DNP3 | Permit monitoring; require a valid Select-Before-Operate sequence for assigned controls; block direct operation outside policy |
| Modbus | Permit approved reads; block writes to protected coils or registers and reject values outside the reviewed range |
| S7comm | Permit diagnostics and selected reads; restrict controller stop, download, or write activity to the approved engineering session |
| IEC 60870-5-104 | Permit telemetry and expected acknowledgements; restrict control commands to assigned stations and operating authority |
| OPC UA | Permit approved browse and read activity; restrict write, method, or configuration services according to the maintenance role |
| Administrative applications | Permit only required management applications and destinations; record or block unexpected application use inside the industrial session |
The exact fields and semantic depth are stated in each protocol portfolio and qualified against representative customer traffic.