Segment operational networks
Plant, building and refrigeration systems move onto their own segments, with FortiGate policy deciding what may pass between them and the office.
How we segmentOT network security
We secure the networks around operational technology (OT) on FortiGate, from PLCs and plant HMIs to building management systems and refrigeration controllers. Plant systems sit on their own segments, paths from the internet are closed and each supplier connects through named, time-limited access that we log and manage.
Plant network FortiGate policy at each boundary
Equipment supplier
OT DMZ FortiPAM Lands here
Site ops SCADA, BMS Named hosts
Control PLCs, HVAC Allow-list
Office network No route to control
OT network services
IT/OT segmentation · OT DMZ · Supplier remote access · FortiPAM · Virtual patching · BMS networks · FortiManager · Managed firewall
OT network services
Network security around your plant and building systems
Your engineers and equipment suppliers keep looking after the equipment itself. We secure the network it sits on, from one supplier connection or one site to your whole estate.
Control supplier access
Shared logins and permanent tunnels give way to named, time-limited access that reaches only the equipment each supplier maintains.
Supplier access optionsManage the network over time
We run the firewall policies, supplier accounts, FortiOS upgrades, OT signatures and logging across your sites, so the design holds as suppliers and sites change.
How we manage it Common gaps
What usually leaves plant equipment reachable
Exposure tends to build up over years of commissioning visits, supplier changes and quick fixes that stayed in place.
-
TCP 80/443 → controllerA port forward that outlived the job
Opened so a technician could reach a controller’s web page, then left in the firewall for years.
We change The forward goes, and the technician reaches the controller through a brokered session in the OT DMZ.
-
10.0.0.0/16 · one VLANOne flat network
Controllers share a subnet with office PCs, printers and guest Wi-Fi, so a compromised laptop can reach the plant.
We change Controllers move to their own VLANs, routed through FortiGate policy with named flows.
-
user: refrig_techShared supplier logins
One VPN account for a whole contractor team, with no MFA, no expiry and no record of who connected.
We change Each technician gets a named account, a FIDO2 key and an expiry date.
-
4G · not in the asset listA modem missing from the asset list
A 4G router fitted by the installer connects straight to the controller and bypasses your firewall.
We change The modem is terminated on a FortiGate interface or retired, agreed with the installer.
-
UDP 47808 · TCP 502Protocols without authentication
BACnet/IP (UDP 47808) and Modbus TCP (TCP 502) accept commands from any host that can reach them.
We change Named hosts alone may send BACnet or Modbus, with FortiGuard OT signatures on the traffic.
-
End of support dueA firewall past its support date
Older FortiGate models on out-of-support FortiOS miss current IPS and OT signatures.
We change FortiOS moves to a supported release, or the unit is replaced with a G-series model.
Segmentation
How we segment an OT network on FortiGate
OT network segmentation starts with zones built around what each system does and how critical it is, following the Purdue model and the zones and conduits of IEC 62443. Traffic between zones is routed through FortiGate policies, where named flows are allowed and the rest is dropped and logged.
Pick a connection to trace it through the network What one flat network lets through
Show the network diagram
A typical OT network design, with FortiGate policy at each zone boundary
Allowed and recorded
- FortiGate edge Named account, FIDO2 security key, inside the agreed window
- OT DMZ FortiPAM brokers the session and keeps the credentials in the vault
- Control zone A FortiGate policy allows the controller’s web interface from the FortiPAM broker only
- Record Session recorded for replay, connection logged in FortiAnalyzer
Allowed, one application
- FortiClient ZTNA Device posture checked before the session opens
- Authenticated gateway The console is reached through the gateway and stays unexposed to the internet
- BMS head-end Access to that one application, with no route to the controllers behind it
- Log Connection logged with who, when and what
Blocked and logged
- FortiGate policy Corporate IT has no policy into the control zone
- Drop The connection is dropped at the boundary
- Alert FortiAnalyzer records the attempt for review
Reads allowed, writes blocked
- Protocol control FortiGuard OT Security Service allows Modbus reads from the site historian
- Write attempt Modbus writes from the historian are blocked
- OT DMZ The historian replicates to a copy in the DMZ, which serves reporting to corporate IT
- Corporate IT Reports reach the office without a path back into the plant
Moved behind the FortiGate
- Found The modem is listed and its route to the controller removed
- Terminated The link ends on a FortiGate interface treated as external
- Supplier path The installer moves onto the same logged access as other suppliers
Reachable without crossing the firewall
- Office laptop to Line 2 PLC Same subnet, so a compromised laptop can send Modbus writes
- Installer 4G modem to HVAC controller A path into the plant that never crosses the firewall
- Shared supplier VPN to cold room controller One login for the whole contractor team, with no record of who connected
Zones and steps
What sits in each zone and how we build it
| Zone | What sits there | What may cross |
|---|---|---|
| Corporate IT | Office PCs, servers, Microsoft 365 traffic | Reporting data via the OT DMZ |
| OT DMZ | Jump host, FortiPAM, ZTNA gateway, historian copies, file transfer staging | Logged remote sessions in, replicated data out to corporate IT |
| Site operations | SCADA servers, site historian, engineering workstations, BMS head-end | Named protocols to the control zone, from named hosts |
| Control | PLCs, refrigeration and HVAC controllers, VSDs | Commands from the site operations hosts that need them, and approved supplier sessions brokered by FortiPAM |
| Safety | Fire, emergency and safety instrumented systems | Monitoring out, behind its own FortiGate policy boundary |
| Untrusted links | Supplier 4G modems, cloud monitoring connectors | Terminated on the FortiGate and treated as external |
-
Map what talks to what
FortiGate logs, the FortiOS asset view and FortiNAC device profiling show which hosts and protocols are in use, and we confirm the required flows with your equipment suppliers.
-
Create the segments
VLANs per system on FortiSwitch, routed through the FortiGate. VDOMs or VRFs separate sites or tenants on one appliance where needed.
-
Write allow-lists
Each policy names the source, destination, protocol and port. For example, the BMS head-end alone sends BACnet to the HVAC controller VLAN.
-
Inspect industrial protocols
FortiGuard OT Security Service identifies industrial protocols and restricts commands, such as Modbus reads from the historian with writes only from the SCADA server.
-
Close inbound paths
Port forwards and public interfaces to controllers are removed, and external connections terminate in the OT DMZ.
-
Plan the cutover around operations
We validate required communications with your equipment suppliers and schedule changes in agreed maintenance windows, with rollback procedures.
| Protocol | Port | Common in | How we control it |
|---|---|---|---|
| BACnet/IP | UDP 47808 | HVAC, refrigeration and BMS controllers | From the BMS head-end only, by named host |
| Modbus TCP | TCP 502 | PLCs, energy meters, refrigeration plant | Reads from named hosts, writes from the SCADA server only |
| KNXnet/IP | UDP 3671 | Lighting and building controls | Gateway reachable from the BMS head-end only |
| EtherNet/IP | TCP 44818, UDP 2222 | Production PLCs and drives | From the engineering station and SCADA server only |
| OPC UA | TCP 4840 | SCADA, historians and MES | Site historian to the DMZ copy, one direction |
| DNP3 | TCP 20000 | Utilities and remote telemetry | From named master stations only |
Supplier access
How suppliers connect to your equipment
Machine builders, BMS integrators, refrigeration technicians and other equipment vendors need remote access, often at short notice. ASD Essentials for OT sets out how it works. Remote access terminates in the OT DMZ first, is granted for a set period, uses phishing-resistant MFA and is logged with who connected, when and to what.
| Option | How the supplier connects | Strengths | Limits | Suits |
|---|---|---|---|---|
| Permanent site-to-site VPN | A tunnel from the supplier’s network, up around the clock | Simple for the supplier | Often reaches more than the job needs, and conflicts with ASD’s time-bound access | Tight restriction or retirement |
| Client VPN with MFA | FortiClient VPN with MFA, landing in the OT DMZ | Familiar and quick to set up | Network-level access, so policies must be tight to stop lateral movement | A few trusted technicians |
| Time-limited VPN | Account and policy enabled for an agreed window, then disabled automatically | Short exposure window | Needs an approval step with an owner | Scheduled maintenance |
| ZTNA | FortiClient ZTNA to one named application through an authenticated gateway, with a device check first | Applications are reached through the gateway, with access granted per application | Each supplier needs the client installed | Web-based HMIs and BMS consoles |
| Privileged access with session recording | FortiPAM in the OT DMZ brokers RDP, SSH and web sessions | Credentials stay in the vault, and sessions are monitored and recorded for replay | More components to run | Several suppliers, controller programming, audit needs |
What each supplier connection includes
- Named accounts per person, with no shared company logins
- Phishing-resistant MFA with FIDO2 security keys, managed through FortiAuthenticator
- Access limited to the controllers and ports for that supplier’s equipment
- Disconnection after a period of inactivity
- Connection logs in FortiAnalyzer, plus session recording where FortiPAM brokers the session
- A tested way to switch off supplier access across your sites quickly
- Notice to site operators before a supplier connects
Most sites use a mix, with FortiPAM recording for suppliers who change controller logic and ZTNA for those who view a console.
Legacy equipment
Protecting controllers you can’t patch or replace yet
Refrigeration controllers and PLCs often run older firmware for years, because an update means downtime, recommissioning or a warranty question. ASD Essentials for OT expects these assets to be registered with compensating controls, and many of those controls sit at the firewall.
Virtual patching
FortiGuard OT Security Service blocks exploit attempts against known OT vulnerabilities at the FortiGate, where FortiGuard has a signature for them.
Protocol command control
Each segment allows only the functions its systems use, for example read-only Modbus from the historian.
A smaller reachable surface
The device sits in its own segment with one or two permitted peers, and its web interface is reached through the jump host.
Change alerts
FortiAnalyzer alerts on new connections to the segment, logins outside agreed windows and policy changes.
We document the network controls in front of each legacy device for your asset register.
Building systems
A separate network for building management systems
HVAC, lighting, access control, lifts, metering and refrigeration plant are often installed by different contractors and looked after by facilities teams. Many end up on the office or tenant network, with the remote access the integrator arranged at handover.
| Segment | Systems | Talks to |
|---|---|---|
| BMS head-end | BMS server, supervisory software | Each BMS VLAN below, on named protocols |
| HVAC and refrigeration | Plant controllers, chillers, cold room controllers | BMS head-end only (BACnet/IP, UDP 47808) |
| Lighting and metering | Lighting controllers, energy meters | BMS head-end only (BACnet or Modbus TCP 502) |
| Access control and CCTV | Door controllers, NVRs | Their own management server |
| Fire and life safety | Fire indicator panel interfaces | Monitoring out, on its own segment |
- BMS devices stay off the internet and reach out only to the cloud service they report to, by named destination.
- BMS and refrigeration contractors connect through the same logged supplier path as other suppliers, with no private modem.
- KNX (UDP 3671) and LonWorks gateways get the same treatment where present.
- In multi-tenant buildings the BMS stays off tenant networks, including the base building’s own office.
Fortinet platform
The Fortinet products we deploy for OT networks
We use your existing FortiGate where it’s supported and sized for the work. Additional hardware, OT inspection and access components are added for the connections and controls each site needs.
Network protection and management
- FortiGate
- The boundary between zones, with segmentation, the OT DMZ, VPN and ZTNA gateway and IPS. Models past end of support move to G-series
- FortiGuard OT Security Service
- Industrial protocol identification and control for 70+ protocols, plus signatures that block exploit attempts against known OT vulnerabilities
- FortiManager and FortiAnalyzer
- Central policy management across sites, with logs of connections and policy changes, hosted in Australian data centres
Supplier and staff access
- FortiPAM
- Privileged access for suppliers and staff, with brokered sessions, vaulted credentials and session recording
- FortiClient ZTNA
- Per-application access through an authenticated gateway for suppliers who need one console
- FortiAuthenticator and FortiToken
- Phishing-resistant MFA for suppliers and staff with FIDO2 security keys, plus FortiToken where it suits
Plant and site hardware
- FortiGate Rugged
- DIN-rail firewalls for plant rooms, cold stores and outdoor cabinets with heat, dust or vibration
- FortiSwitch and FortiSwitch Rugged
- VLAN segments at the switch, managed from the FortiGate through FortiLink
- FortiNAC
- Identifies devices as they connect and keeps unknown laptops off equipment networks
- FortiAP
- Separate wireless for scanners and tablets that reach equipment networks, kept off corporate Wi-Fi
Licences and subscriptions come through us and renew with the rest of your Fortinet estate.
ASD Essentials
How the service maps to ASD Essentials for OT
ASD published Essentials for OT on 15 October 2026, part of the ASD Essentials series introduced to succeed the Essential Eight. Its first priority phase covers boundary services and critical processes and services, and the network work on this page sits in boundary services.
Priority phases
- Phase 1 Boundary services Critical processes and services This service
- Phase 2 Privileged environments Identity services
- Phase 3 Business systems
Governance and culture, and visibility and response, run across the three phases.
-
Use DMZs to isolate OT from networks you don’t solely control
An OT DMZ on the FortiGate between corporate IT, suppliers and the plant
-
Remote access terminates in the OT DMZ
Supplier VPN, ZTNA and FortiPAM sessions land in the DMZ
-
Time-bound access, no permanent connections, disconnection on inactivity
Scheduled accounts and policies, idle timeouts and permanent tunnels removed
-
Phishing-resistant MFA and a record of each session
FIDO2 security keys through FortiAuthenticator, connection logs in FortiAnalyzer and session recording through FortiPAM
-
Safety systems separated at a network boundary
A dedicated safety segment with its own FortiGate policy
-
Legacy assets registered with compensating controls
OT signatures, protocol control and documented network controls for each device
-
A rehearsed way to cut remote access quickly
A documented and tested way to switch off supplier access
Managed service
How we manage OT networks after go-live
Segmentation drifts when suppliers change, sites are added and temporary rules stay. We manage the FortiGates and supplier access as an ongoing service.
- Policy changes through change control, with your operations team consulted before a change reaches a control zone
- Supplier onboarding and offboarding, so a departing contractor loses access the same day
- FortiOS upgrades scheduled around production and plant maintenance windows
- FortiGuard OT signatures kept current
- Monthly reports on supplier sessions, blocked traffic and policy changes
- One configuration standard across your sites, managed from FortiManager hosted in Australian data centres
FAQ
Common questions about OT network security
What is IT/OT segmentation?
It separates the networks that run physical equipment from office IT, with a firewall controlling each connection between them. Named systems talk to each other on named protocols, and the rest is blocked and logged.
What is an OT DMZ?
An OT DMZ is a separate zone on the firewall between corporate IT, suppliers and the plant. Remote sessions, jump hosts and historian copies sit there, so outside connections stop in the DMZ and only brokered, logged sessions continue to the control zone.
How do I know if my refrigeration controller or BMS is reachable from the internet?
Look for port forwards or public addresses pointing at it in the firewall, check for 4G modems fitted by installers and test your public IP addresses for open BACnet (UDP 47808), Modbus (TCP 502) and web management ports. We check these on each FortiGate we take on.
Can our existing FortiGate do this, or do we need new hardware?
Often the existing FortiGate can, if it runs a supported FortiOS release and has the throughput to inspect traffic between zones. Models past end of support, or too small for internal inspection, are replaced with G-series. Check your model with our FortiGate lifecycle checker.
Do we need the FortiGuard OT Security Service?
Yes, for industrial protocol control and OT signatures. Segmentation and supplier access work without it, but the service lets the FortiGate restrict specific commands, such as Modbus writes, and block exploit attempts that FortiGuard has signatures for.
How should vendors and contractors get remote access to OT equipment?
Through a named account with phishing-resistant MFA, for an agreed time window, landing in an OT DMZ with the session logged or recorded. Shared logins, permanent tunnels and private modems are removed.
Will segmenting the network stop our supplier’s monitoring?
No. Their monitoring service is allowed out to its named destination, and the connection is defined, logged and limited to the equipment it monitors.
What if the equipment has its own 4G connection?
We bring it behind the FortiGate, by terminating the modem on a firewall interface or by moving the supplier onto access through your own connection, agreed with the supplier.
Will this cause downtime?
Changes are scheduled around production. We validate required communications with your equipment suppliers and plan each change in an agreed maintenance window, with rollback procedures.
Is VLAN separation enough?
No. VLANs separate the segments, and routing traffic between them through FortiGate policies is what allow-lists, inspects and logs each crossing.
How does this relate to ASD Essentials for OT?
Boundary services sit in the first priority phase of ASD Essentials for OT. The OT DMZ, time-bound supplier access, phishing-resistant MFA, logging and safety separation on this page are the network controls for that phase.
Can you manage this across multiple sites?
Yes. One configuration standard runs across your sites from FortiManager hosted in Australian data centres, so a supplier rule or policy change is made once and applied consistently.
Next step
Talk to us before the next supplier connects to your plant
Tell us about your sites, the plant and building systems on them and the suppliers who connect.