Industrial Segmentation and Microsegmentation

L2Proxy provides a managed way to divide industrial access into controlled domains and then apply fine-grained policy to the traffic that crosses each enforcement point. The result combines network isolation, authenticated identity, equipment knowledge, industrial protocol meaning, stateful behavior, and traceable evidence.

Customer outcome: reduce unnecessary reachability and lateral movement while allowing each user, service, site, or operating function only the industrial communication required for its approved purpose.

Purpose and expected outcome

This section explains how L2Proxy supports industrial zoning, segmentation, and microsegmentation. After reading it, the customer should understand how protected domains are created, how communication between them is controlled, how identity and industrial operations refine policy, and how coverage is verified.

From zones to industrial microsegments

Control level	What it separates	Example
Zone segmentation	Broad plant or access areas	Enterprise access, engineering, SCADA, control, and field zones
Protected access domain	Users, sites, duties, or operating contexts	Vendor A, commissioning team, substation operations, quarantine
Network microsegment	Small groups of systems or communication paths	One production cell, feeder bay, package unit, or controller group
Identity-aware microsegment	Authenticated users and sessions	One maintenance engineer limited to assigned equipment
Protocol-aware microsegment	Industrial operations within an allowed connection	Monitoring allowed; unauthorized control or configuration blocked
Stateful microsegment	Multi-event operating behavior	Operate allowed only after valid authorization and within its time window

Figure — Industrial microsegmentation: control operations across zones, identities, and sessions—not only IP connectivity.

One policy chain

User / service / site identity
        ↓
Protected access domain
        ↓
Permitted destination and communication path
        ↓
Equipment, point, and industrial operation
        ↓
Value, sequence, time, and process prerequisites
        ↓
Record / Allow / Block
        ↓
Session-linked industrial evidence

Complementary enforcement layers

L2Proxy uses defense in depth rather than asking one rule type to perform every task:

• authenticated encrypted tunnels carry isolated access domains across the existing infrastructure as a secure overlay;
• isolated access domains and network paths reduce broad reachability;
• user, group, session, VLAN, and access policies constrain communication;
• L2Proxy Connect evaluates authenticated session traffic inside the managed access path;
• standalone L2Proxy services protect physical or routed OT boundaries;
• the Rule Engine evaluates decoded industrial operations and state;
• normalized events and the archive retain evidence for operations and investigation.

Customer value

• smaller attack and failure domains;
• reduced lateral-movement opportunity;
• industrial least privilege beyond IP address and port;
• different authority for monitoring, control, maintenance, and configuration;
• traceability from identity to equipment and operation;
• progressive migration from broad zones to precise microsegments;
• a common policy and evidence model across remote access and plant boundaries.

Secure overlay—not a conventional shared VPN

Protected access domains can be carried through authenticated encrypted tunnels. This allows a user, vendor, team, site, or temporary work activity to receive an isolated communication path without requiring extensive changes to the underlying plant network.

The tunnel supplies secure transport and session identity. L2Proxy Connect supplies the industrial control that follows authentication: which destination, application, protocol, equipment, operation, value, and sequence that session may use. The resulting capability is therefore more precise than granting general network access after VPN login.

Continue with Zones and Protected Access Domains or review Industrial Policy Examples.