Networking
VLAN and subnet boundaries for controls networks
Distinguish Layer 2 VLAN membership from Layer 3 IP subnetting when a controller, HMI, remote I/O device, or engineering workstation cannot reach its peer.
- Product
- Managed industrial Ethernet networks
- Level
- Advanced
- Read time
- 12 min
- Reviewed
- 2026-07-15
What to establish before troubleshooting
A VLAN defines a Layer 2 broadcast domain; an IP subnet defines a Layer 3 address boundary. They are commonly aligned one-to-one, but they are not the same mechanism.
Two endpoints need both a valid IP relationship and a valid Layer 2 or routed path. Matching IP prefixes cannot overcome ports placed in different VLANs without routing.
Abbreviated worked example
Compare two /24 controls cells
PLC A is 192.168.10.10/24 in VLAN 10 and HMI B is 192.168.20.20/24 in VLAN 20.
- 1Their network addresses are 192.168.10.0 and 192.168.20.0, so the traffic is not local.
- 2Communication requires configured gateways, inter-VLAN routing, and any required security policy.
Result: A Layer 3 path is required between VLAN 10 and VLAN 20.
Caution: Do not widen the masks to avoid routing; overlapping or oversized control subnets create harder failures and security problems.
Full troubleshooting guide requires Pro.
The complete safety notes, quick checks, field procedures, diagnostic groups, evidence checklist, escalation guidance, related links, and source references remain inside the paid knowledge-base library.
Knowledge base troubleshooting library
Article titles, summaries, categories, and source counts remain visible as previews.
Full troubleshooting procedures, diagnostic groups, evidence lists, and source references require Pro Toolkit access.
- Full article procedures
- Diagnostic groups
- Evidence and escalation checklists
Entitlement store: unavailable. No saved presets, saved settings, or customer tool history are stored in V1.