A NAT device is useful when you find that integrating Programmable Logic Controllers (PLCs) into broader enterprise networks presents challenges, particularly concerning IP address management and network security.

Any production monitoring system or SCADA depends on communicating between different machines, so this comes up often. Here's how to solve it with a NAT device.

Troubleshooting flow for UNAVAILABLE data
NAT mapping diagram

Why You May Need a NAT Device for Your OT Network

Network Address Translation (NAT) devices offer solutions to these challenges by:

Preserving Existing IP Address Schemes

Manufacturers often standardize IP address configurations across multiple machines for consistency and ease of deployment. Without NAT, integrating these machines into a plant-wide network would require reassigning unique IP addresses to each device to prevent conflicts—a process that is both time-consuming and error-prone.

NAT devices translate private IP addresses within the machine network to unique public IP addresses on the plant network, allowing the original IP configurations to remain unchanged.

Segregating OT from IT Networks

Separating OT and IT networks is crucial for enhancing security and ensuring reliable operations. By using NAT devices, the OT network remains isolated, minimizing exposure to potential cyber threats from the IT environment. This separation not only fortifies security but also allows for tailored management of each network segment, accommodating their distinct operational requirements.

In summary, utilizing NAT devices enables organizations to integrate PLC networks into larger infrastructures without the complexities of IP reconfiguration and supports the critical separation of OT and IT systems, thereby enhancing both operational efficiency and security.

How to Configure the Allen-Bradley 1783-NATR (NAT)

Understanding the 1783-NATR

Functionality: Performs Network Address Translation (NAT) to allow communication across different networks.

Features:

Physical Setup

Power Up:

Verify DIP Switch Settings:

Laptop Configuration

Ensure your laptop is on the same network as the NATR:

  1. Open the Ethernet Adapter Properties on your laptop.
  2. Assign a static IP (e.g., 192.168.1.10) and subnet mask (255.255.255.0) in the same range.

Access the NATR Web Interface

Open a web browser and enter http://192.168.1.1.

Default credentials:

On the first login:

Public IP Configuration

Navigate to Configuration > Public Network:

  1. Enter the desired public IP address (e.g., 10.10.10.2).
  2. Click Apply Changes.
  3. Acknowledge any warnings about disruptions.

Private IP Configuration

Navigate to Configuration > Private Network:

  1. Change the private IP address, if necessary (e.g., 192.168.1.2).
  2. Click Apply Changes.

Note: The gateway address of connected devices (e.g., PLC) must match the NATR private IP.

Network Address Translation Setup

Verify that NAT Enable is turned on (default setting).

Add a translation rule:

  1. Go to Add New Rule:
    • Public IP: Enter the desired public-facing IP (e.g., 10.10.10.11).
    • Private IP: Enter the current IP of the device (e.g., 192.168.1.11).
    • Provide a description (e.g., "PLC").
    • Ensure the Enabled checkbox is checked.
  2. Save the rule.

Verify Connections

Restart the NATR module to apply configuration changes:

Ensure the status indicators show the following:

Validate the PLC's gateway settings:

Testing Communication

Switch your PC to the public network:

Plug the laptop into the public port on the NATR.

Use a tool like FactoryTalk Linx to verify:

Troubleshooting Tips