Configuring the design of an industrial automation network

1. A method, comprising:

receiving, at a device, a network policy based upon, at least in part, a physical network; and

automatically configuring, by the device, a design of an industrial network overlay on the physical network based upon, at least in part, the network policy, the configuring including:

determining, by the device, a number of virtual local area networks (VLANs) within the industrial network overlay;

identifying, by the device, which devices of the physical network are on which VLAN;

determining, by the device, placement of at least one virtual firewall within the industrial network overlay;

determining, by the device, at least one communication path for the industrial network overlay between at least two devices; and

automatically setting up, by the device, the industrial network overlay based on the configuration.

2. The method as in claim 1 , wherein receiving the network policy comprises:

receiving tag configuration data from each device included within the industrial network overlay.

3. The method as in claim 1 , further comprising:

determining a number of switches to include within the industrial network overlay.

4. The method as in claim 1 , further comprising:

adding a controller and associated devices to the VLAN within the industrial network overlay.

5. The method as in claim 1 , further comprising:

deriving a firewall policy for flow between controllers of different VLANs within the industrial network overlay.

6. The method as in claim 1 , wherein configuring the design of an industrial network overlay comprises:

abiding by a rule that if a controller outputs to an I/O block as the owner, the controller and the I/O block must be on the same VLAN.

7. The method as in claim 1 , wherein configuring the design of an industrial network overlay comprises:

abiding by a rule that two controllers must be on separate VLANs if there is no overlap between I/O modules owned by each controller and tags consumed by each controller.

8. The method as in claim 1 , wherein configuring the design of an industrial network overlay comprises:

abiding by a rule that if a controller consumes a Base Tag produced by an I/O device as the one and only owner, the controller and the I/O device must be on the same VLAN.

9. The method as in claim 1 , wherein configuring the design of an industrial network overlay comprises:

abiding by a rule that if a controller consumes a Base Tag produced by an I/O device as one of the owners, and an I/O value from the I/O device is not buffered, the controller and the I/O device must on the same VLAN.

10. The method as in claim 1 , wherein configuring the design of an industrial network overlay comprises:

abiding by a rule that if a controller consumes a Base Tag produced by an I/O device as one of the owners, but an I/O value from the I/O device is buffered, the controller and the I/O device can be on the same VLAN or a different VLAN.

11. The method as in claim 1 , wherein configuring the design of an industrial network overlay comprises:

abiding by a rule that a firewall must be created for each controller with a policy that only allows data flow between a given controller and associated I/O devices.

12. An apparatus, comprising:

one or more network interfaces;

a processor coupled to the network interfaces and adapted to execute one or more processes; and

a memory configured to store a process executable by the processor, the process when executed operable to:

receive a network policy based upon, at least in part, a physical network; and

automatically configure a design of an industrial network overlay on the physical network based upon, at least in part, the network policy, the configuring including:

determining a number of virtual local area networks (VLANs) within the industrial network overlay;

identify which devices of the physical network are on which VLAN;

determining placement of at least one virtual firewall within the industrial network overlay;

determining at least one communication path for the industrial network overlay between at least two devices; and

automatically setup the industrial network overlay based on the configuration.

13. The apparatus as in claim 12 , wherein the process when executed to receive the network policy is further operable to:

receive tag configuration data from each device included within the industrial network overlay.

14. The apparatus as in claim 12 , wherein the process when executed is further operable to:

determine a number of switches to include within the industrial network overlay.

15. The apparatus as in claim 12 , wherein the process when executed is further operable to:

add a controller and associated devices to a particular VLAN within the industrial network overlay.

16. The apparatus as in claim 12 , wherein the process when executed is further operable to:

derive a firewall policy for flow between controllers of different VLANs within the industrial network overlay.

17. The apparatus as in claim 12 , wherein the process when executed to configure the design of an industrial network overlay is further operable to abide by one or more rules selected from a group consisting of:

if a controller outputs to an I/O block as the owner, the controller and the I/O block must be on the same VLAN;

two controllers must be on separate VLANs if there is no overlap between I/O modules owned by each controller and tags consumed by each controller;

if a controller consumes a Base Tag produced by an I/O device as the one and only owner, the controller and the I/O device must be on the same VLAN;

if a controller consumes a Base Tag produced by an I/O device as one of the owners, and an I/O value from the I/O device is not buffered, the controller and the I/O device must on the same VLAN;

if a controller consumes a Base Tag produced by an I/O device as one of the owners, but an I/O value from the I/O device is buffered, the controller and the I/O device can be on the same VLAN or a different VLAN; and

a firewall must be created for each controller with a policy that only allows data flow between a given controller and associated I/O devices.

18. A tangible, non-transitory, computer-readable media having software encoded thereon, the software when executed by a processor operable to:

receive a network policy based upon, at least in part, a physical network; and

automatically configure a design of an industrial network overlay on the physical network based upon, at least in part, the network policy, the configuring including:

determining a number of virtual local area networks (VLANs) within the industrial network overlay;

identifying which devices of the physical network are on which VLAN;

determining placement of at least one virtual firewall within the industrial network overlay; and

determining at least one communication path for the industrial network overlay between at least two devices; and

automatically setting up the industrial network overlay based on the configuration.

19. The computer-readable media as in claim 18 , wherein the software when executed to receive the network policy is further operable to:

receive tag configuration data from each device included within the industrial network overlay.

20. The computer-readable media as in claim 18 , wherein the process when executed to configure the design of an industrial network overlay is further operable to abide by one or more rules selected from a group consisting of:

if a controller outputs to an I/O block as the owner, the controller and the I/O block must be on the same VLAN;

two controllers must be on separate VLANs if there is no overlap between I/O modules owned by each controller and tags consumed by each controller;

if a controller consumes a Base Tag produced by an I/O device as the one and only owner, the controller and the I/O device must be on the same VLAN;

if a controller consumes a Base Tag produced by an I/O device as one of the owners, and an I/O value from the I/O device is not buffered, the controller and the I/O device must on the same VLAN;

if a controller consumes a Base Tag produced by an I/O device as one of the owners, but an I/O value from the I/O device is buffered, the controller and the I/O device can be on the same VLAN or a different VLAN; and

a firewall must be created for each controller with a policy that only allows data flow between a given controller and associated I/O devices.