# How do I segment IT and OT with VLANs and access lists?

Use VLANs to separate the networks and a firewall, not only switch access lists, to control what crosses between them. Put production controllers, HMIs and SCADA servers in their own VLANs, place a firewall between them and the office network, and add a small DMZ for the systems both sides need, such as a historian copy or a remote-access gateway. Write the rules as an allow list: which office host may reach which OT host, on which port, and nothing else; deny and log the rest. Switch access lists are useful for simple separation inside OT, but they keep no connection state and are easy to get wrong at scale. Plan the change with the OT engineer and a maintenance window, because a missed dependency can stop a line. Then watch the boundary: from the Pro plan, NetSenX flags traffic that crosses levels of the plant network, from a SPAN or TAP port, without probing any OT device.

FAQ: [Zero trust, identity and segmentation](https://netsenx.com/en/faq/zero-trust) · https://netsenx.com/en/faq/how-to-segment-it-and-ot-with-vlans-and-acls

## Read next

- https://netsenx.com/en/ot-network-monitoring
- https://netsenx.com/en/detect-lateral-movement-c2-beaconing

## Related questions

- [What is microsegmentation, and do small companies need it?](https://netsenx.com/en/faq/what-is-microsegmentation)
- [Is a VLAN a security boundary?](https://netsenx.com/en/faq/is-a-vlan-a-security-boundary)
- [How do I check that guest Wi-Fi cannot reach our internal network?](https://netsenx.com/en/faq/how-to-check-guest-wifi-cannot-reach-the-internal-network)
- [Is a separate guest Wi-Fi enough for security?](https://netsenx.com/en/faq/is-a-separate-guest-wifi-enough)
- [Can someone plug a device into a free network socket in our office?](https://netsenx.com/en/faq/can-someone-plug-a-device-into-a-free-network-socket)