Primary ports can access all other ports, community ports can communicate within their group and with primary ports, and isolated ports can only communicate with their primary port. Korenix's private VLAN technology separates devices within a VLAN group to achieve higher security than traditional VLANs. It establishes three types of VLANs - primary, community, and isolated - to finely separate devices and limit traffic paths according to device behavior. Configuring a private VLAN involves creating the VLAN, assigning secondaries to primaries, and assigning ports, providing easier management than traditional VLAN tables.

1. Primary
Secondary
(Community)
Secondary
(Isolated)
Challenges
Primary
Primary
3. Primary ports can access to all other
ports including Primary, Community
and Isolated.
2. Community ports is allowed to
communicate within the same
Community group and its Primary.
Access to other groups are forbidden.
1. Isolated ports are isolated individually.
It is only allowed to communicate with
its Primary. Access to all the other ports
or the other groups are forbidden.
Effective Network Security
Against Cyber Threats
Cybersecurity is considered as one of the most critical issues for today and future industrial automation control
systems. To raise the level of security, Industrial automation security standard IEC62443 suggests network
separation essential to against rapid spreading of cybersecurity threats. Legacy VLAN technology is commonly
used to separate a network into several VLAN (Virtual LAN) groups. However, there is no separation among
devices within a VLAN group. Any compromised device can easily affect the others in the same group.
Our Solution And How It Works
Korenix solves this issue by its unique Private VLAN technology, which can separate devices within a VLAN
group. By finely separating the devices and limiting the traffic paths according to device behavior, Private VLAN
achieves the highest level of LAN security.
Three types of VLAN are available for
different application scenarios:
Secondary
(Community)
Secondary
(Isolated)
Secondary
(Community)
Secondary
(Isolated)
INDUSTRIAL DATA COMMUNICATION www.korenix.com

2. Configuration Made Easy
Primary
Community Isolated
Perfect Fit For Industrial Application Behaviour
Devices like control workstations
that receive data or manage the
whole system, or PLCs that acquire
data from Isolated devices and feed
data to Community devices.
PLC HMI SCADA I/O Drive Camera ReaderWorkstation
3 steps achieve finer separation and higher security without the complexity setting of legacy VLAN table. This
unique feature is supported by our managed Ethernet switch (JetNet), and managed PoE switch (JetPoE).
Step 1
Create vlan and specify type
Step 2
Assign secondary to primary
* Supports multiple primary, community,
isolated groups and relationships.
Step 3
Assign ports to vlan (Done!)
Host
Host
Host
Host
Promiscuous
Promiscuous
Host
Host
4
4
3
3
2
2
4
4
Isolated
Community
Primary
Devices like HMI, SCADA in a
Community are allowed to
communicate, share, backup data
with each other and are accessible
from Primary. They do not need,
and are forbidden to access devices
in Isolated.
Devices such as I/Os, drives, IP
cameras, readers, and sensors are
isolated individually. They do not
need, and are forbidden to reach
other. They are only allowed to
send data to corresponding server
in Primary.
Private VLAN finely divides an automation network into parts. By keeping traffic flows on correct paths and
blocking unnecessary paths, Private VLAN makes the network more secure than ever.
INDUSTRIAL DATA COMMUNICATION www.korenix.com