NETWORKING / INDUSTRIAL NAT / OT

Industrial NAT Design: Connecting Multiple Identical OEM Machines to a Factory OT Network

INDUSTRIAL NATPLCOT NETWORKOEMSEGMENTATION

Connecting one OEM machine to a factory network is usually straightforward. Connecting several identical machines becomes more difficult when every PLC and HMI arrives with the same IP address. Industrial NAT provides a practical way to preserve each machine's internal configuration while giving factory systems a unique address for every required device.

Topics: Industrial NAT, PLC, OEM machines, OT networking, network segmentation

Scope of this article

This article explains the network design approach for integrating multiple OEM machines with overlapping internal IP addresses into a factory OT network. It covers address mapping, segmentation and maintenance considerations. The addresses are illustrative; device-specific NAT configuration and industrial protocol compatibility must be checked for the actual deployment.

1. Why identical OEM machines often use identical IP addresses

In modern manufacturing environments, OEM machines are increasingly delivered as complete automation units. A typical skid may include a PLC, an HMI, an industrial switch, a remote maintenance interface and vendor-specific control applications.

To simplify engineering and maintenance, many OEM vendors use a standardized internal network configuration. For example, each machine may contain the following addresses:

Component	OEM-side IP address
PLC	192.168.1.10
HMI	192.168.1.20
Industrial switch	192.168.1.254

This design works well while each machine operates on its own isolated network. The challenge appears when the factory needs to connect several identical production units to shared SCADA, monitoring or engineering systems.

2. The IP conflict problem in multi-OEM deployments

Imagine a factory installs eight identical packaging machines. Every machine contains a PLC at 192.168.1.10, while the factory OT address space uses 10.50.0.0/16.

Machine	Internal PLC address	Factory integration problem
Machine 1	192.168.1.10	Address overlaps with the other machines
Machine 2	192.168.1.10	Address overlaps with the other machines
Machine 3	192.168.1.10	Address overlaps with the other machines

From the OEM perspective, this is normal standardization. From the factory integration perspective, the devices need to be distinguishable. Connecting these internal networks directly into one shared Layer 2 network can introduce duplicate IP addresses, ARP conflicts and PLC communication failures.

Even when the machines remain in separate network segments, shared systems still need an unambiguous way to reach each PLC. Otherwise, SCADA identification and remote maintenance become difficult.

3. Why not simply change every PLC IP address?

Assigning a unique subnet to every machine can work technically. However, in many industrial projects, changing the PLC address also requires reviewing HMI configurations, engineering software, PLC communication settings and remote support procedures.

OEM vendors usually maintain a standard machine template. Changing that template for every installation can increase commissioning work and maintenance complexity. Instead of supporting one familiar configuration, engineers must track a different addressing plan for each machine.

Machine	Example of a redesigned internal subnet
Machine A	192.168.10.0/24
Machine B	192.168.20.0/24
Machine C	192.168.30.0/24

A network redesign may be appropriate when the factory and OEM agree on it. When preserving the delivered machine configuration is a priority, a translation boundary provides another option.

4. Use industrial NAT at the machine boundary

A common approach is to place a NAT router or industrial firewall between each OEM network and the factory OT network. Each machine keeps its original internal subnet, while the NAT device exposes unique factory-facing addresses for the devices that require access.

Factory OT address space	Machine boundary	Isolated OEM network
10.50.0.0/16	NAT-1	Machine 1: 192.168.1.0/24
10.50.0.0/16	NAT-2	Machine 2: 192.168.1.0/24
10.50.0.0/16	NAT-3	Machine 3: 192.168.1.0/24

The following mappings give SCADA a unique address for each PLC, even though all three PLCs retain the same internal address:

Machine	OT-side mapped address	OEM-side PLC address
Packaging Line 1	10.50.1.10	192.168.1.10
Packaging Line 2	10.50.2.10	192.168.1.10
Packaging Line 3	10.50.3.10	192.168.1.10

The duplicate addresses remain inside separate machine networks. Factory systems use the unique mapped addresses. The factory-side routing and the return path through each NAT device must support these mappings.

5. What this design improves

Keep the OEM configuration consistent

The vendor can continue using 192.168.1.10 for the PLC in every machine. Where the communication requirements and NAT behavior support it, the factory can integrate the machines without changing their internal device addressing.

Create a controlled access boundary

When the NAT device also provides firewall policy enforcement, the machine boundary can restrict which systems are allowed to communicate with the PLC. Address translation itself should not be treated as an access-control policy.

Source	Destination	Example policy
Authorized SCADA server	Mapped PLC address	Allow required communications
General office network	Mapped PLC address	Block direct access

Simplify expansion

Adding another machine can follow the same pattern: retain its internal configuration, allocate unique OT-side mappings and apply the required routing and firewall rules. This reduces the need to redesign existing machine networks as production grows.

6. Why VLANs and Proxy ARP are not complete substitutes

VLANs separate networks but do not create unique destination addresses

Putting each machine into a separate VLAN prevents their identical addresses from conflicting on the same Layer 2 segment. However, VLAN separation alone does not give a shared SCADA system a unique destination address for each PLC.

Segment	PLC address	What remains unresolved
VLAN 10	192.168.1.10	Shared-system access to overlapping addresses
VLAN 20	192.168.1.10	Shared-system access to overlapping addresses

VLANs remain useful for segmentation, but the overall design still needs a way to distinguish the overlapping networks when central systems access them.

Proxy ARP does not provide the required address mapping

Proxy ARP can help in some routing scenarios, but by itself it does not assign a unique factory-facing identity to each device using 192.168.1.10. It therefore does not replace the translation or separate routing context required to handle overlapping machine networks.

7. Industrial NAT compared with other approaches

Method	Result and trade-off
Modify every PLC IP address	Can resolve overlap, but requires coordination with the OEM and updates to dependent configurations.
Put all machine networks in one VLAN	Leaves duplicate addresses in one shared Layer 2 network and can cause conflicts.
Put each machine in a separate VLAN	Provides Layer 2 separation, but alone does not resolve shared access to overlapping destinations.
Use Proxy ARP alone	Does not provide unique per-machine translated addresses.
Use industrial NAT at each machine boundary	Preserves internal addressing and exposes unique mapped addresses, subject to routing and protocol compatibility.

8. Practical design and maintenance considerations

Select a suitable industrial device

Evaluate NAT, firewall, routing and logging capabilities against the actual machine communication requirements. VPN support may also be needed if the boundary device handles remote maintenance. The device should be suitable for its installation environment.

Document every address mapping

Keep the machine name, original OEM address and OT-side mapped address together in the network documentation. The mapping table in Section 4 provides a simple starting point. Clear records help engineers distinguish machines that otherwise have identical internal configurations.

Control remote access

Avoid exposing PLC networks directly to the Internet. A controlled maintenance path can use an authenticated VPN connection followed by an industrial firewall policy that permits access only to the intended machine and required services.

The access path is: remote engineer, VPN, industrial firewall, then the authorized OEM machine. Document this path alongside the address mappings so maintenance staff know which machine they are reaching.

9. Preserve the machine design while making factory access unambiguous

Duplicate IP addressing is a common integration challenge when multiple identical OEM machines join a factory OT environment. Changing every PLC address can resolve the overlap, but it may also increase maintenance work and disrupt the vendor's standardized configuration.

Industrial NAT provides a practical alternative: keep each OEM network isolated, give the required devices unique OT-side addresses and enforce access through a defined firewall boundary.

The key is to preserve a predictable configuration inside each machine while making every factory-facing connection clearly identifiable. With suitable routing, compatible protocols and documented mappings, the same design can be repeated as additional production units are installed.