Runbook · Most common issue #3

Network communication problems

Network

Symptom

PLC or HMI unreachable from Maxedge or from the service laptop, Moxa devices (serial gateways / switches) not accessible, traffic blocked between VLANs.

Investigate

Work in layers: link lights → IP/VLAN → firewall rules. Most cases are a laptop on the wrong port, a Moxa on a factory-default IP, or a firewall rule that was never added for the new VLAN plan.

Fix

# from the Maxedge VM (VLAN 30):
ping 192.168.30.20          # PLC
ping 192.168.30.21          # HMI
ping 192.168.30.30          # Moxa gateway
ip route
# from a service laptop (VLAN 99) — via firewall:
traceroute 192.168.30.20
# firewall rules / routing (Vault lh/crane/firewall):
show security policies from-zone service to-zone ot

VLAN 99 → VLAN 30 is only allowed for the Maxedge dashboard, SSH and the Proxmox UI. PLC/HMI/Moxa access from a service laptop needs a temporary rule from OT security.

Steps

Physical. Link lights on the switch ports (1–4 PLC/HMI, 5–6 Maxedge). Dead port → cable or switch. Moxa devices: power LED and the port on the switch they hang off.
From the Maxedge VM (same VLAN as the PLC): ping PLC, HMI, Moxa. Reachable from here but not from your laptop → firewall, not the device.
Moxa inaccessible. After replacement they come up on 192.168.127.254 (factory default). Set a laptop to that subnet on the same physical segment, log in, set the VLAN 30 address from the unit's Masterdata network sheet.
Firewall / routing. Log in to the crane firewall (Vault → lh/crane/firewall); check the policy from the source zone to the OT zone and the counters. Missing rule → request via the network-change runbook (lh/crane/network-change).
Laptop on the wrong port. Address must be 192.168.99.x; a 192.168.30.x address means you are on an OT port — unplug immediately (checklist).

Not resolved? Escalate to Product Engineering with docker ps -a, the relevant docker logs and the unit's Masterdata link.