Configuring the design of an industrial automation network

An apparatus, comprising:

• one or more network interfaces;
• a processor coupled to the network interfaces and adapted to execute one or more processes;
• and
• a memory configured to store a process executable by the processor, the process when executed operable to:
• receive a network policy based upon, at least in part, a physical network;
• and
• automatically configure a design of an industrial network overlay on the physical network based upon, at least in part, the network policy, the configuring including:
• determining a number of virtual local area networks (VLANs) within the industrial network overlay;
• identify which devices of the physical network are on which VLAN;
• determining placement of at least one virtual firewall within the industrial network overlay;
• determining at least one communication path for the industrial network overlay between at least two devices;
• and
• automatically setup the industrial network overlay based on the configuration.

A tangible, non-transitory, computer-readable media having software encoded thereon, the software when executed by a processor operable to:

• receive a network policy based upon, at least in part, a physical network;
• and
• automatically configure a design of an industrial network overlay on the physical network based upon, at least in part, the network policy, the configuring including:
• determining a number of virtual local area networks (VLANs) within the industrial network overlay;
• identifying which devices of the physical network are on which VLAN;
• determining placement of at least one virtual firewall within the industrial network overlay;
• and
• determining at least one communication path for the industrial network overlay between at least two devices;
• and
• automatically setting up the industrial network overlay based on the configuration.