Network Advice - Business and Process Network

Posted on 2012-03-31
Last Modified: 2012-03-31
My question concerns how we would add a Process network for our manufacturing company to mesh with our Business network.   Let me explain.   By Business network I mean the 20 people who use basically applications like MS Office and so forth which are all connected with an Action Directory domain controll traditional style of network.  We have a file server, sql server and about 20 workstations all defined within our domain.  This configuration works fine for the business side of the network.

Now lets move out onto the manufacturing floor where we have about 15 computers which manage different parts of our manu. process.  These computers use things like PLC networks but are not connected to each other at all.  Basically 15 standalone computers, each managing different machines on the floor.  We want to create a network for these Process computers.  To have these computers connected in a network would let us perform backups, transfer data to the business network, etc.

People are telling me we need two separate networks, that we do not want our Business and Process machines to be on the same network.  So here are my questions.   How do we create this second network for the process machines so that they are linked and are able to communicate with servers and computers on the business network ?   Can we have two networks in one domain or are we talking two domains here ?

We want to have a file server within the process network that can access the file server in the business network.  Do the two networks require a firewall between them.  As you can tell I am certainly not a networking expert.  Would appreciate any suggestions on how to put this network together.  Thanks much.
Question by:rhhunt
LVL 21

Expert Comment

ID: 37791838
You can have two networks within a single domain. Configure your subnets and sites through Active Directory Sites and Services.

Accepted Solution

PRRcomputers earned 500 total points
ID: 37791972
If the Process computers are not running Microsoft Windows - or even if they are - there may be limited advantages to incorporating them into Active Directory itself.  But you can put the Process computers on a network without it being a Windows domain network.

I would definitely recommend putting the Process computers on their own network (or subnet), not just adding them to your existing subnet.

Two basic things need to happen to "make" the Process network, once the machines are physically connected to a switch (give Process its own switch).
1)  A router is needed to define the network and direct traffic to/from it.
2)  A static route in your LAN gateway needs to be defined.  A static route basically does the job of telling the Business network: "Psst! If you are looking for the network with THESE ip addresses, ask THIS router for help."

The router in question needs to sit between the Business network and the Process one.  The router should be one which can be configured to allow / restrict traffic between the subnets to suit your needs.  Avoid an Internet Gateway style router, which is designed to sit between a trusted network (your LAN) and an untrusted one (the Internet).  Cisco has a number of routers which have the functionality you need.  If you've never configured a Cisco router, it would probably be a good idea to budget into this project a little consulting from a local Cisco-trained technician, who can not only help you select the hardware but can also help configure it quickly.  You most likely don't need a separate firewall appliance to sit between two LANs; a properly configured Cisco router will very likely provide the security you need there.

You'll need a router to sit between the networks whether you implement AD in Process or not.  And then the gateway on your LAN will need a static route configured on it so your Business computers know of the existence of that subnet.

This can all be done without messing with your Domain Controller at all.  You *could* make Process part of your domain, but there are some extra considerations you'll want to weigh there.  The biggest of these is, will the Process computers "like" the changes that will happen to them as a result of being joined to a domain.  Some of these computers that drive machinery are VERY sensitive to these sort of changes.  Extensive consultation and research with the machine vendors is highly recommended before proceeding.  That's actually true whether you make the new subnet Active Directory or not.  Talk to those vendors, explain what you intend to do, and ask them if there are any issues you should be aware of.  It's unlikely you're the first to do this with their equipment, so their knowledge will be invaluable.

In truth, the only machine on the Process side that will in my estimation have direct benefit to being part of the AD domain is the file server, esp. if it's going to synchronize with a counterpart on the Business side.  It's not absolutely necessary, but it'll make that sync easier in most respects.

Good luck!

Author Closing Comment

ID: 37791989
Excellent explanation, thank you very much.

Featured Post

Netscaler Common Configuration How To guides

If you use NetScaler you will want to see these guides. The NetScaler How To Guides show administrators how to get NetScaler up and configured by providing instructions for common scenarios and some not so common ones.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

The 6120xp switches seem to have a bug when you create a fiber port channel when you have a UCS fabric interconnects talking to them.  If you follow the Cisco guide for the UCS, the FC Port channel will never come up and it will say that there are n…
Hello All, I have been training on Multicast for a while now and whenever I start the topic , I find out that my friends /  Colleagues mention that they do not know how to test Multicast Joins. As most of the multicast would be video traffic and …
Two types of users will appreciate AOMEI Backupper Pro: 1 - Those with PCIe drives (and haven't found cloning software that works on them). 2 - Those who want a fast clone of their boot drive (no re-boots needed) and it can clone your drive wh…
Finds all prime numbers in a range requested and places them in a public primes() array. I've demostrated a template size of 30 (2 * 3 * 5) but larger templates can be built such 210  (2 * 3 * 5 * 7) or 2310  (2 * 3 * 5 * 7 * 11). The larger templa…

770 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question