Network & access
Crane network topology
OT securityCyber-security network segregation is being rolled out on all cranes: traffic is separated into VLANs on the managed e-house switch. Service engineers — check the VLAN plan and switch-port map below before plugging in. Switch credentials: Vault → lh/crane/switch.
Topology
Internet / MaxCloud AWS
outbound TLS only
eHawk jump host
remote support VPN
↕
PERIMETER
Crane firewall / router
inter-VLAN routing + rules · 192.168.30.1
↕
Managed switch (e-house)
802.1Q trunk · VLANs 10 / 30 / 40 / 99
│
│
│
│
VLAN 10 · MGMT
Proxmox host · switch mgmt
192.168.10.0/24
VLAN 30 · OT
Crane PLC · Maxedge VM · HMI
192.168.30.0/24
VLAN 40 · CUSTOMER
Datasharing OPC UA / Modbus
192.168.40.0/24
VLAN 99 · SERVICE
Service laptop access
192.168.99.0/24 · DHCP
VLAN plan
| VLAN | Purpose | Subnet | Devices | Access rules |
|---|---|---|---|---|
| 10 | Management | 192.168.10.0/24 | Proxmox host mgmt, switch mgmt, firewall mgmt | IT/engineering only; reachable from VLAN 99 with rule |
| 30 | OT / Crane | 192.168.30.0/24 | Crane PLC, Maxedge VM (192.168.30.111), Proxmox host (192.168.30.110), HMI | No inbound from customer network; outbound TLS to MaxCloud only |
| 40 | Customer datasharing | 192.168.40.0/24 | OPC UA + Modbus TCP endpoints (Maxedge second NIC) | Customer SCADA → Maxedge datasharing ports only (4840, 502) |
| 99 | Service access | 192.168.99.0/24 | Service laptops (DHCP), port 12 | Time-limited; access to dashboards + SSH via firewall rules |
Switch-port map — where to connect
Service laptops connect to port 12 (VLAN 99) only. Never plug into OT ports. Real cabinet photos go into the placeholders below.
Photo: switch front, ports labeled
E-house switch — front
Ports 1–4: PLC / OT (VLAN 30) · 5–6: Maxedge IPC trunk · 9–10: customer datasharing (VLAN 40) · 12: service access (VLAN 99)
Photo: service port 12, marked yellow
Service port 12 (VLAN 99)
Marked yellow in the cabinet. DHCP — laptop gets a 192.168.99.x address; firewall permits access to Maxedge dashboard and Proxmox UI.
Photo: e-house cabinet overview
Cabinet layout
Switch and Maxedge IPC location in the e-house cabinet. Firewall/router sits top-left of the network rail.
| Port | VLAN | Connected device | Who may use it |
|---|---|---|---|
| 1–4 | 30 | Crane PLC, HMI | Nobody on site — OT only |
| 5–6 | trunk | Maxedge IPC (2 NICs: OT + customer) | Fixed cabling |
| 9–10 | 40 | Customer SCADA uplink | Customer IT, by agreement |
| 12 | 99 | — (yellow, free) | Service engineers |
| 24 | trunk | Firewall / router uplink | Fixed cabling |
Segregation rules
Segregation rule: no device may bridge VLANs. Do not connect a laptop to OT ports (1–4), and never patch customer network directly into VLAN 30. Changes to VLAN config require approval from OT security (see Vault runbook
lh/crane/network-change).