Water Utility Greenfield Segmentation With Cellular Wells
A regional water authority is building a new telemetry architecture across a treatment plant, 14 remote pump stations, and a headquarters control room. Each pump station has a PLC speaking Modbus TCP and a cellular router; a local HMI must remain on-site for manual operation. The plant has a flat 10.20.0.0/16 network with engineering workstations, historians, and PLCs; the authority cannot re-address any device during the first year. SCADA polls each PLC every 2 seconds, and the historian is dual-homed to the plant and enterprise networks. Corporate IT will connect through an existing FortiGate at HQ. IEC 62443 SL2 is the target, and the board wants remote engineering access without VPN appliances at every well. The CISO asks you to propose zones and conduits, decide where FortiGate Rugged devices belong, and explain how to phase segmentation without interrupting 24x7 operations. Only a four-hour maintenance window is available monthly.
1. Define the zones, conduits, and enforcement points. Justify where you would place FortiGate Rugged firewalls versus relying on HQ FortiGate policies.
Read the worked answer
Treat IEC 62443 zones as Enterprise (L4), OT DMZ (L3.5), Plant Operations (L3), Supervisory/SCADA (L2), and per-pump-station Control (L1/L0). The enterprise-to-plant conduit must terminate in an OT DMZ, not directly on the SCADA VLAN.
Place a central FortiGate Rugged at the plant as the hub for the 14 wells and the plant/DMZ enforcement point. Place a FortiGate Rugged 70F at each well only if the well has a local HMI and the cellular router cannot enforce OT policy. The well firewall should terminate IPsec, protect the local HMI/PLC, and allow only required Modbus master/slave flows to plant SCADA. At HQ, use the existing FortiGate for IT-to-DMZ policy, but do not let it become the only OT enforcement point.
Justification: SL2 needs least privilege and monitored conduits at each zone boundary. A single HQ firewall leaves the cellular paths and local HMIs outside the zone model. If budget forces a choice, prioritize firewalls at wells with local HMI and at the plant hub; use provider ACLs and IPsec only as a temporary compensating control.
2. The plant network cannot be re-addressed for a year. Explain a phased segmentation approach that improves security without breaking Modbus polling or the dual-homed historian.
Read the worked answer
Phase 1, monitor only: span or TAP the plant uplink and historian legs, inventory every Modbus master/slave pair and polling interval, and build allowlists by asset role. Do not block.
Phase 2, insert transparent-mode interface pairs at cell boundaries during the monthly window; keep policies permit-any with logging and OT IPS in monitor mode. Transparent mode avoids IP and gateway changes. For the dual-homed historian, validate which side initiates polling. If it creates a bypass, place its enterprise-facing NIC behind a separate VDOM/interface and permit only the required replication flow, or temporarily disconnect the unused leg during a window.
Phase 3, tighten rules to observed flows, keep Modbus read/write exceptions per PLC, and enable blocking only for high-confidence OT signatures and policy violations. The 2-second polling means you must test latency and session persistence before blocking. Rollback is the previous permit-any policy and bypass switch. This phases risk while preserving 24x7 operations.
3. Remote engineering access is required. Compare an IPsec hub-and-spoke design from the wells with a ZTNA-style access model, and state which you recommend under SL2 and why.
Read the worked answer
Use IPsec site-to-site from each well FortiGate Rugged to the plant hub for telemetry; this is deterministic, supports SLA monitoring, and keeps the cellular link always-on. For human remote engineering, do not extend the OT LAN over VPN.
Terminate vendor and engineer access in an OT DMZ behind the plant FortiGate, require MFA, map users to specific PLC/HMI destinations with least privilege, and record sessions. A ZTNA-style model is preferable for humans because it grants per-application access rather than network-level reachability, but it still needs an OT DMZ broker and approval workflow.
Under SL2, the deciding factors are authentication, role separation, and auditability, not the tunnel name. If a vendor insists on a site-to-site tunnel to a well, terminate it on the well FortiGate with a narrow policy, not on the cellular router; otherwise the router becomes an unmonitored conduit. Recommend hybrid: IPsec for machine telemetry, ZTNA/SSL VPN with MFA and session recording for engineers.