This could get interesting!We have 3 sites that are around 10 miles from eachother. We were sold on the idea that we could use a mesh VPN tunnel to connect the 3 of them together. The topology would be 1 ProPlus at the main site with 3 PK controllers and 3 workstations spread across the 3. So, each of the 2 satellite sites just have a workstation and PK controller. This necessitates that the control networks, primary and secondary be connected in some way. This proposal was made by people from Emerson as well as our/their impact partner. The technology and how to actually accomplish such a task was not detailed for us. Fast forward a couple months and talking with our IT department and they had major concerns about being able to do this because of the way the NAT worked and the common subnet at each site. All a little outside my expertise. But, in general, the idea is that it wouldn't work because the NAT would require a different subnet at the different sites and of course our primary and secondary addresses for nodes is defined in the configuration for us 10.4.x.x and 10.8.x.x and we can not change that basic requirement.
We went back to our customer (this is a new project, new system) and told them the issue and proposed the solution of a dark fiber lease through the ISP that would allow us to essentially connect all 3 locations through a single fiber pair, which would allow us to VLAN the networks as needed where the fiber enters the site from the ISP. They didn't want to pay the lease each year... very upset about that proposal...
They came back to the idea and questioning why we wouldn't use VPN.. I had to explain to them how these nodes aren't just some HMI or server that you can address and install client software on. They have to communicate "natively". It didn't sink in. They challenged me and even behind my back said they were going to contact Emerson directly and ask why they can't use OpenVPN.......
So... here we are. I know that a software VPN solution like OpenVPN is clearly not possible. But, are there hardware VPN solutions that would work? I'm thinking our only choice would be to have VPN routers at each of the sites that have the PK controller and workstations connected to. Then the proplus could have the client/configuration software on it at the main site.
I've learned quite a bit about IP technology in the past few weeks, but this is still a problem to understand for even our IT guys. let alone a controls person. I'm hoping this can either be shut down immediately... "DeltaV can't do it.. here's why".. or "this has been done and here is exactly how"... I don't think it's feasible to present a cheaper solution if it means we are trying something new and just crossing our fingers hoping to get it to work.. We will also probably have to support this technology for at least the first year.
Oh.. and save the replies about security and reliability.. that was my very first comment I made on why we should choose a dark fiber lease and they immediately crapped on that reasoning.. So,... i guess this is going to be the pill they want to swallow. We are just the EPC... we don't own any of it. We'd NEVER do this sort of thing at our own plants.
Thanks....
Disclaimer: This is my opinion and not Emerson's opinion and this is probably not a supported installation, but it does interest me. There is something you can do with routers called a layer 2 tunnel or layer 2 bridging. You have routers that are VPN'ed together with each of their own subnets on either side. Then underneath that you can create a bridge between two other networks. This makes use of the l2tp (en.wikipedia.org/.../Layer_2_Tunneling_Protocol). This might give you something to look into for more research. Hope this helps!
In reply to Donald Dron:
In reply to TreyB:
In reply to RickV:
Andre Dicaire
In reply to Andre Dicaire: