Zones and Protected Access Domains¶
Industrial segmentation begins by separating communication contexts with different owners, risks, duties, and operational purposes. L2Proxy calls these controlled contexts Protected Access Domains.
What a domain can represent¶
- a plant, site, production line, cell, or package unit;
- a substation, voltage level, feeder group, or protection function;
- a vendor, maintenance team, engineering group, or operator role;
- normal operations, commissioning, emergency work, or quarantine;
- a group of controllers, RTUs, IEDs, HMIs, or supporting services.
Each domain can have its own users, groups, sessions, network assignment, communication rules, connection methods, event policy, and administrative ownership.
Segmentation building blocks¶
| Building block | Industrial purpose |
|---|---|
| Separate virtual access domains | Create independent Layer-2 communication and administration scopes |
| User and group policy | Apply the approved access behavior consistently to assigned identities |
| VLAN assignment | Place users or groups into controlled network contexts |
| Access rules | Allow or block defined source, destination, protocol, and service communication |
| Privacy and client-isolation controls | Restrict unnecessary session-to-session communication |
| Local industrial connection | Join an approved domain to a physical OT segment |
| Routed or NAT connection | Provide controlled Layer-3 reachability without extending one broad Layer-2 domain |
| Site connection | Join approved domains across locations under explicit policy |
Figure — Zones and protected access domains used as segmentation building blocks.
Secure overlay delivery¶
An access domain can be delivered over an authenticated encrypted tunnel while remaining logically separate from other users, vendors, or operating purposes. The customer can therefore introduce segmentation without extending one shared remote-access network to every participant or redesigning the entire physical OT topology.
Examples include one tunnel-backed domain per vendor, per maintenance role, per site, or per commissioning activity. Network and access policy define reachability; L2Proxy Connect defines the permitted applications and industrial operations inside that path.
Recommended industrial zoning pattern¶
Remote users and service partners
↓
Role- or purpose-specific access domains
↓
Controlled communication policy
↓
Engineering / SCADA / maintenance zones
↓
Cell, area, substation, or equipment microsegments
Domains should be based on operating need and consequence, not created only to mirror an organizational chart. Communication between domains should be explicit, reviewable, and owned.
Example domain set¶
| Domain | Intended authority |
|---|---|
| Vendor diagnostics | Assigned equipment monitoring only |
| Protection engineering | Approved relay and protection operations |
| SCADA operations | Supervisory monitoring and authorized control |
| Commissioning | Time-bounded test equipment and procedures |
| Site-to-site operations | Approved communication between designated plant areas |
| Quarantine | Restricted investigation and recovery access |