# US 10,122,589 B2 · Configuring the design of an industrial automation network > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,122,589 B2 - Document ID: US10122589B2 - Status: Granted - Kind: B2 - Application number: 15/094,230 - Filed: 2016-04-08 - Published: 2017-10-12 - Granted: 2018-11-06 - Earliest claimed: 2016-04-08 - Assignees: Cisco Technology, Inc. - Applicants: Cisco Technology, Inc. - Inventors: Xuechen Yang; Rudolph B. Klecka, III; Pascal Thubert; Patrick Wetterwald; Eric Levy-Abegnoli - Web page: https://patentgrep.com/patent/US10122589B2 ## CPC - H04L 41/145: {involving simulating, designing, planning or modelling of a network} - H04L 12/4641: {Virtual LANs, VLANs, e.g. virtual private networks [VPN] (LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272)} - H04L 41/0894: Policy-based network configuration management - H04L 41/12: Discovery or management of network topologies - H04L 67/12: specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract In one embodiment, a device receives a network policy based upon, at least in part, a physical network, and configures a design of an industrial network overlay on the physical network based upon, at least in part, the network policy. The configuring, according to the techniques herein, may generally include: determining a number of virtual local area networks (VLANs) within the industrial network overlay; determining which devices of the physical network are on which VLAN; determining placement of at least one virtual firewall within the industrial network overlay; and determining at least one communication path for the industrial network overlay between at least two devices. ## Claims ### Claim 1 A method, comprising: receiving, at a device, a network policy based upon, at least in part, a physical network; and automatically configuring, by the device, a design of an industrial network overlay on the physical network based upon, at least in part, the network policy, the configuring including: determining, by the device, a number of virtual local area networks (VLANs) within the industrial network overlay; identifying, by the device, which devices of the physical network are on which VLAN; determining, by the device, placement of at least one virtual firewall within the industrial network overlay; determining, by the device, at least one communication path for the industrial network overlay between at least two devices; and automatically setting up, by the device, the industrial network overlay based on the configuration. ### Claim 2 (depends on 1) The method as in claim 1, wherein receiving the network policy comprises: receiving tag configuration data from each device included within the industrial network overlay. ### Claim 3 (depends on 1) The method as in claim 1, further comprising: determining a number of switches to include within the industrial network overlay. ### Claim 4 (depends on 1) The method as in claim 1, further comprising: adding a controller and associated devices to the VLAN within the industrial network overlay. ### Claim 5 (depends on 1) The method as in claim 1, further comprising: deriving a firewall policy for flow between controllers of different VLANs within the industrial network overlay. ### Claim 6 (depends on 1) The method as in claim 1, wherein configuring the design of an industrial network overlay comprises: abiding by a rule that if a controller outputs to an I/O block as the owner, the controller and the I/O block must be on the same VLAN. ### Claim 7 (depends on 1) The method as in claim 1, wherein configuring the design of an industrial network overlay comprises: abiding by a rule that two controllers must be on separate VLANs if there is no overlap between I/O modules owned by each controller and tags consumed by each controller. ### Claim 8 (depends on 1) The method as in claim 1, wherein configuring the design of an industrial network overlay comprises: abiding by a rule that if a controller consumes a Base Tag produced by an I/O device as the one and only owner, the controller and the I/O device must be on the same VLAN. ### Claim 9 (depends on 1) The method as in claim 1, wherein configuring the design of an industrial network overlay comprises: abiding by a rule that if a controller consumes a Base Tag produced by an I/O device as one of the owners, and an I/O value from the I/O device is not buffered, the controller and the I/O device must on the same VLAN. ### Claim 10 (depends on 1) The method as in claim 1, wherein configuring the design of an industrial network overlay comprises: abiding by a rule that if a controller consumes a Base Tag produced by an I/O device as one of the owners, but an I/O value from the I/O device is buffered, the controller and the I/O device can be on the same VLAN or a different VLAN. ### Claim 11 (depends on 1) The method as in claim 1, wherein configuring the design of an industrial network overlay comprises: abiding by a rule that a firewall must be created for each controller with a policy that only allows data flow between a given controller and associated I/O devices. ### Claim 12 An apparatus, comprising: one or more network interfaces; a processor coupled to the network interfaces and adapted to execute one or more processes; and a memory configured to store a process executable by the processor, the process when executed operable to: receive a network policy based upon, at least in part, a physical network; and automatically configure a design of an industrial network overlay on the physical network based upon, at least in part, the network policy, the configuring including: determining a number of virtual local area networks (VLANs) within the industrial network overlay; identify which devices of the physical network are on which VLAN; determining placement of at least one virtual firewall within the industrial network overlay; determining at least one communication path for the industrial network overlay between at least two devices; and automatically setup the industrial network overlay based on the configuration. ### Claim 13 (depends on 12) The apparatus as in claim 12, wherein the process when executed to receive the network policy is further operable to: receive tag configuration data from each device included within the industrial network overlay. ### Claim 14 (depends on 12) The apparatus as in claim 12, wherein the process when executed is further operable to: determine a number of switches to include within the industrial network overlay. ### Claim 15 (depends on 12) The apparatus as in claim 12, wherein the process when executed is further operable to: add a controller and associated devices to a particular VLAN within the industrial network overlay. ### Claim 16 (depends on 12) The apparatus as in claim 12, wherein the process when executed is further operable to: derive a firewall policy for flow between controllers of different VLANs within the industrial network overlay. ### Claim 17 (depends on 12) The apparatus as in claim 12, wherein the process when executed to configure the design of an industrial network overlay is further operable to abide by one or more rules selected from a group consisting of: if a controller outputs to an I/O block as the owner, the controller and the I/O block must be on the same VLAN; two controllers must be on separate VLANs if there is no overlap between I/O modules owned by each controller and tags consumed by each controller; if a controller consumes a Base Tag produced by an I/O device as the one and only owner, the controller and the I/O device must be on the same VLAN; if a controller consumes a Base Tag produced by an I/O device as one of the owners, and an I/O value from the I/O device is not buffered, the controller and the I/O device must on the same VLAN; if a controller consumes a Base Tag produced by an I/O device as one of the owners, but an I/O value from the I/O device is buffered, the controller and the I/O device can be on the same VLAN or a different VLAN; and a firewall must be created for each controller with a policy that only allows data flow between a given controller and associated I/O devices. ### Claim 18 A tangible, non-transitory, computer-readable media having software encoded thereon, the software when executed by a processor operable to: receive a network policy based upon, at least in part, a physical network; and automatically configure a design of an industrial network overlay on the physical network based upon, at least in part, the network policy, the configuring including: determining a number of virtual local area networks (VLANs) within the industrial network overlay; identifying which devices of the physical network are on which VLAN; determining placement of at least one virtual firewall within the industrial network overlay; and determining at least one communication path for the industrial network overlay between at least two devices; and automatically setting up the industrial network overlay based on the configuration. ### Claim 19 (depends on 18) The computer-readable media as in claim 18, wherein the software when executed to receive the network policy is further operable to: receive tag configuration data from each device included within the industrial network overlay. ### Claim 20 (depends on 18) The computer-readable media as in claim 18, wherein the process when executed to configure the design of an industrial network overlay is further operable to abide by one or more rules selected from a group consisting of: if a controller outputs to an I/O block as the owner, the controller and the I/O block must be on the same VLAN; two controllers must be on separate VLANs if there is no overlap between I/O modules owned by each controller and tags consumed by each controller; if a controller consumes a Base Tag produced by an I/O device as the one and only owner, the controller and the I/O device must be on the same VLAN; if a controller consumes a Base Tag produced by an I/O device as one of the owners, and an I/O value from the I/O device is not buffered, the controller and the I/O device must on the same VLAN; if a controller consumes a Base Tag produced by an I/O device as one of the owners, but an I/O value from the I/O device is buffered, the controller and the I/O device can be on the same VLAN or a different VLAN; and a firewall must be created for each controller with a policy that only allows data flow between a given controller and associated I/O devices.