Part of the PROTECT Playbook ← Return to Hub
Phase: Protect All vessels
Satisfies: E26E27IEC 62443-3-3IMO MSC-FAL.1BIMCO v5

VLAN & ACL Configuration: Implementing the 3-Zone Model

This guide provides a step-by-step implementation of VLAN tagging and Access Control List configuration for a three-zone maritime OT model — Bridge, Engine and Cargo — with a governing industrial DMZ.

The 3-Zone Network Segmentation Model is the engineering standard for protecting a vessel’s Essential Services. By establishing firewalled boundaries between Operational Technology (OT), Corporate IT, and Untrusted guest networks, we ensure that a compromise in one zone cannot propagate to critical ship functions.

Critical Limitation: VLANs Are Not a Zone 1 Boundary

VLANs provide logical broadcast domain separation at Layer 2 only. They do not inspect packets, enforce stateful policy, or satisfy the conduit requirement under IACS UR E26 §4.2.1.1 and IEC 62443-3-3 SR 5.1. VLAN tagging in this guide applies to internal Zone 2 separation (admin vs. crew vs. guest) and to organising traffic before the firewall. The boundary between Zone 1 (OT Essential Services) and all other zones must always be enforced by a routed stateful firewall interface — never by the switch alone. Step 2 below is mandatory, not optional.

Step 1: Logical Isolation via VLAN Tagging

The first step is to logically segment the physical switch fabric into three distinct broadcast domains. This prevents “flat network” risks where a single infected device can see the entire vessel’s traffic.

Zone / Functional Group VLAN ID IP Subnet Policy Posture
1. OT Zone (Essential Services) 10 192.168.10.0/24 Strict Isolation. No Direct Internet.
2. IT Zone (Administrative) 20 192.168.20.0/24 Monitored. Proxy access only.
3. Untrusted (Crew/Guest) 30 192.168.30.0/24 Sandboxed. Direct to WAN only.

Step 2: The Firewall as the “Conduit” Enforcer — Mandatory

This step is not optional. Without it, the VLAN configuration above provides no meaningful Zone 1 protection.

In accordance with IEC 62443 and IACS UR E26 §4.2.1.1, traffic between zones must pass through a secure conduit — a stateful firewall performing full packet inspection. All inter-VLAN routing must be disabled on the switches and handled exclusively by the firewall (Router-on-a-Stick or multi-interface). If a managed switch is performing inter-VLAN routing, your Zone 1 boundary does not exist in any meaningful security sense — an attacker on VLAN 20 can reach VLAN 10 through the switch fabric. The firewall is the conduit. The switch is only the cable organiser.

Step 3: Access Control List (ACL) Strategy

The following technical ruleset translates high-level policies into a granular firewall configuration, specifically designed for IACS UR E26 compliance by brokering all essential services through the iDMZ:

ID Source Zone Dest. Zone Protocol/Port Purpose Action
01 OT Zone iDMZ TCP 443 / 8530 WSUS / AV Updates ALLOW
02 iDMZ (Jump Host) OT Zone TCP 3389 / 22 Remote Maintenance ALLOW
03 OT Zone iDMZ UDP 123 NTP Time Sync ALLOW
04 IT/Guest Zone OT Zone ANY Unauthorized Access REJECT
99 ANY ANY ANY Explicit Cleanup Rule DENY ALL
Implementation Guidance for Surveyors

When a Class Auditor (DNV/ABS) asks how you enforce these rules, you should be prepared to demonstrate the following three “Hardening” steps:

1. Stealth Logging

Every “Drop” or “Reject” action in the ruleset above must be logged. This provides the auditable evidence required for IACS UR E26 Section 4 (Detection).

2. No “Any/Any” Rules

Even within the OT Zone, if you have multiple vendors (e.g., Kongsberg and Wärtsilä), they should ideally be in separate sub-VLANs with rules preventing them from “talking” to each other unless technically necessary.

3. MAC Filtering (Optional)

For static OT assets like PLC controllers, bind the IP address to the MAC address on the firewall to prevent “IP Spoofing” if someone plugs an unauthorized laptop into a machinery space network port.

Auditor Tip: Be ready to pull a “live log” of rejected packets to prove these rules are active and monitored in real-time.

🛡️
Interactive tool
CBS Network Risk Assessor

Before finalising your VLAN design, map your CBS topology and check whether your segmentation holds up against E26/E27 requirements. The tool specifically assesses whether VLAN-only boundaries constitute adequate zone separation — or whether a routed firewall interface is required.

Open CBS Risk Assessor →

Next Section

Wireless & Bluetooth Hardening

Wireless & Bluetooth Hardening This guide covers the security controls required for all wireless communication on bo...

Scroll to Top