Taking Catalyst to the Factory Floor: OT Switching

Industrial and OT Switching: Extending Catalyst to the Factory Floor

For thirty years, the factory floor ran its own network, and IT was not invited. The control systems, the sensors, the machines on the line spoke their own protocols over their own cabling, managed by automation engineers who answered to operations, not to the CIO.  

That arrangement is ending. The same business that wants real-time data from its machines also wants those machines patched, segmented and defended, and the person being handed that job is you, the IT head, whether or not the floor was ever in your remit. 

So you face a network you did not build, in an environment your usual switches cannot survive, carrying processes that cannot be taken down for a maintenance window. The good news is that you do not need a separate skill set and a separate vendor to bring it under control. Cisco lets you extend the Catalyst architecture you already run in the campus onto the factory floor, with hardware built for the conditions and a security model designed for industrial reality. Here is how that works and where to begin. 

What Is an Industrial Ethernet Switch? 

An industrial Ethernet switch is a switch built to run reliably in conditions that would kill an office switch: extreme heat and cold, dust, vibration, electrical noise and no air conditioning. Cisco's Catalyst Industrial Ethernet range is fanless and convection-cooled, with no moving parts to fail, and rated to operate from −40°C to +75°C in the harsh settings of manufacturing, energy, transport and mining (Cisco Catalyst IE3300 data sheet). 

The form factor differs too. Many industrial switches mount on a DIN rail inside a control cabinet rather than in a server rack, take DC power, and on heavy-duty models carry sealed, water- and dust-resistant enclosures for outdoor or washdown areas. They are designed to sit next to the machines they connect, in the cabinet on the line, not in a clean, cooled comms room. That physical difference is the first reason the floor needs its own hardware. 

Why Can't You Use a Normal Catalyst Switch on the Factory Floor? 

Three reasons, and each on its own is decisive. The environment is the obvious one: a standard switch has fans and a temperature range suited to an office, and it will fail early in the heat, dust and vibration of a plant. Put consumer-grade or campus-grade hardware in a cabinet beside a furnace and you are scheduling its death. 

The second reason is availability. A production line cannot stop for a reboot. OT networks are engineered for continuous operation, often in ring topologies that heal in milliseconds when a link breaks, because a few seconds of downtime can halt a line or spoil a batch. The third reason is the traffic itself: the floor speaks industrial protocols such as Modbus, EtherNet/IP and others, with timing requirements an office network never has to honour. A switch on the floor must understand that this is not email and a delayed packet is not a minor inconvenience. Industrial switches are built around these three demands. Office switches are not, and no amount of careful configuration changes the hardware. 

What Is the Cisco Industrial Ethernet Switch Range? 

Cisco's industrial line mirrors the campus range in logic, scaling from a small cabinet switch to a rugged aggregation box, all running the same operating system as your Catalyst estate:

The IE3300 expands with modules and supports fibre uplinks; the IE3400 adds the advanced features and the OT security capabilities discussed below; the IE9300 aggregates many access switches in a compact, rugged unit (Cisco industrial switching portfolio). The point is not the model numbers. It is that the range covers a whole plant, from the cabinet on the line to the aggregation point, without leaving the Cisco architecture. 

Can You Manage OT and IT Switches the Same Way? 

Yes, and this is the argument that makes the whole approach worth it. The Catalyst Industrial Ethernet switches run Cisco IOS XE, the same operating system as your campus Catalyst switches, with the same secure boot, image signing and trust features. So the floor is not a foreign country with its own tools. It is an extension of the network you already operate, manageable through the same platforms and the same skills. 

That unification is the real prize of IT/OT convergence done well. One operating system, one management approach, one security model stretched from the office to the line, rather than two disconnected networks run by two teams who blame each other when something breaks. Your engineers do not have to learn an alien system, and your security policy does not stop at the door of the plant. The question for an IT head inheriting the floor is not "how do I learn a completely new world?" but "how do I extend the world I already run into it?" With Cisco, that is the supported design rather than a workaround. 

How Do You Secure an OT Network? 

By seeing it first, then dividing it. The governing standard is IEC 62443, which models an industrial network as zones and conduits: you group assets with common security needs into zones, and you control the communication between zones through defined conduits, rather than letting everything on the floor talk freely to everything else (Cisco IEC 62443 guidance).  

This builds on the long-established Purdue model, which separates the network into levels, with the lower levels running the physical process and the upper levels belonging to IT. 

The practical problem is that most OT networks are flat and undocumented; nobody has a current map of what talks to what. Cisco Cyber Vision solves the visibility half. Activated as a software feature on switches such as the IE3300 and IE3400, it inspects industrial traffic at the edge, identifies devices and protocols, and builds a live map of the assets and their communication, without adding hardware or slowing the switch. That map then feeds Cisco ISE, which turns the OT context into network access policy and enforces the segmentation. You cannot defend what you cannot see; Cyber Vision makes the floor visible, and the switch becomes the sensor. 

Why Is IT/OT Convergence a Security Risk? 

Because connecting two networks joins their attack surfaces. The same links that let you collect machine data and manage the floor also give an attacker who lands in IT a path toward OT, where the consequences are physical: a halted line, a damaged batch, a safety system interfered with. As the office and the factory network merge, a vulnerability in an ordinary IT system can become a route to the controllers running a plant. 

This is why segmentation is not optional once you converge. A flat OT network, or an OT network bridged carelessly to IT, means a single compromised laptop can reach a programmable controller. Zoned correctly, that same intrusion hits a wall at the conduit between zones and goes no further. The convergence is worth doing, the data and the unified management are real gains, but only if you bring the security model with it. The benefit and the risk arrive together, and the segmentation is what keeps the first without inheriting the second. How far could an attacker who phished an office user travel toward your production line today? 

What Should an IT Head Do First? 

Start with visibility, not a redesign. Before you can segment or secure anything, you need an accurate map of the OT network you have inherited, the devices, the protocols and the traffic, because the documentation almost never matches reality. Turning on visibility, through Cyber Vision on capable switches, gives you that map and usually a few unwelcome surprises about what is connected and talking. 

From there the path is incremental: define zones based on what you have learned, introduce segmentation through the network and ISE, and replace ageing or unmanaged switches with industrial Catalyst hardware as you go, building the floor toward the same standard as your campus. You do not convert a working plant in one move any more than you would a campus; you sequence it, protecting the most exposed and most critical zones first. The mistake is to wait for a breach or an audit to force the issue. The floor is already on your network, whether or not you have looked at it. 

Bridging Two Worlds Without Two Vendors 

The reason IT/OT projects stall is rarely the technology. It is that the floor and the office have historically been bought, built and run by different people, and few partners are genuinely fluent in both. Extending Catalyst to the factory floor needs someone who understands the campus network and the industrial environment, the IOS XE management and the IEC 62443 security model, and who will not treat the plant as an afterthought to the office. 

Proactive Data Systems has spent 35 years building and running networks for Indian enterprises across more than 1,500 customers, as a Cisco Preferred Partner in Networking, Security, Collaboration, Cloud and AI, and Services. We extend the Catalyst architecture you run in the campus onto the floor with the right industrial hardware, bring visibility with Cyber Vision, design the zones and segmentation to IEC 62443, and operate the result from a 24x7 NOC in India with CCIE-led design and security expertise in the same team. One partner for both worlds, so the floor stops being the gap in your network nobody owns. 

Inherited a factory network you did not design and are not sure what it contains? Ask Proactive to start with a visibility assessment. The map alone changes the conversation.