How to configure VLAN Segmentation with Anybus Defender – HMS Support Portal

APPLICABLE PRODUCTS

Anybus Defender Series 4000 and up

VERSIONS USED IN THIS ARTICLE

Anybus Defender 2.5.2-2025111723

Anybus Defender – VLAN Setup Guide

This guide configures two VLANs on the Anybus Defender using the LAN interface as the VLAN trunk towards the switch, where the VLANs are configured on different ports.

Example:

VLAN 100: 192.168.100.0/24
Defender: 192.168.100.1

VLAN 200: 192.168.200.0/24
Defender: 192.168.200.1

1. Create VLAN 100

In the Defender GUI Go to:

Interfaces → Assignments → VLANs

Click Add.

Configure:

Parent interface: LAN / igb1
VLAN tag:         100
Description:      VLAN100

Save and apply the configuration.

2. Create VLAN 200

Go to:

Interfaces → Assignments → VLANs

Click Add.

Configure:

Parent interface: LAN / igb1
VLAN tag:         200
Description:      VLAN200

Save and apply.

The Defender now has two VLANs carried over the same physical LAN interface:

3. Assign VLAN 100 as an Interface

Go to:

Interfaces → Assignments

Select the VLAN 100 interface from Available network ports and click Add.

Open the newly created interface by click on the Blue Name.

Configure:

Enable interface:          Yes
Description:               VLAN100
IPv4 Configuration Type:   Static IPv4
IPv4 Address:              192.168.100.1 /24

Save and apply.

4. Assign VLAN 200 as an Interface

Repeat for VLAN 200, in Interfaces → Assignments:

Select the VLAN 200 interface from Available network ports and click Add.

Open the newly created interface by click on the Blue Name.

Configure:

Enable interface:          Yes
Description:               VLAN200
IPv4 Configuration Type:   Static IPv4
IPv4 Address:              192.168.200.1 /24

Save and apply.

The Defender now acts as the gateway for each of the two VLANs networks:

VLAN100 gateway: 192.168.100.1
VLAN200 gateway: 192.168.200.1

5. Check the Parent LAN Interface

Do not assign the same or overlapping subnet to both the physical LAN interface and a VLAN interface.

NOTE: The parent interface does not require it's own IP address, but it needs to be enabled.

6. Configure the Connected Switch

The managed switch connected to the Defender must now be configured for the same VLANs.

The switch port connected to the Defender should normally be configured as a Trunking port and carry:

VLAN 100: Tagged
VLAN 200: Tagged

The device-facing ports on the switch can then be configured as untagged/access ports for their respective VLANs.

7. Configure Firewall Rules

Creating VLAN interfaces does not automatically allow communication between them, the Defender will apply Deny-by-Default policy.

Firewall rules must be created for the required traffic to flow

For example:

Device in VLAN200:
192.168.200.20

Device in VLAN100:
192.168.100.40

If 192.168.200.20 must initiate communication with 192.168.100.40, go to:

Firewall → Rules → VLAN200

Create a rule:

Action:          Pass
Address Family:  IPv4
Protocol:        TCP
Source:          192.168.200.20
Source Port:     Any
Destination:     192.168.100.40
Destination Port: Modbus TCP (502)
Log:             Emabled

The rule is placed on VLAN200 because this is the interface where the connection enters the Defender.

Final Defender Configuration

Anybus Defender 6024

LAN / igb1
    |
    +-- VLAN100
    |     VLAN ID: 100
    |     IP: 192.168.100.1/24
    |
    +-- VLAN200
          VLAN ID: 200
          IP: 192.168.200.1/24

The important points are:

Create the VLANs on the Defender.
Use the physical LAN interface as the parent.
Assign each VLAN as its own Defender interface.
Give each VLAN a different subnet.
Use the Defender VLAN IP as the gateway for devices in that VLAN.
Configure the connected managed switch to carry the VLAN tags.
Put firewall rules on the VLAN interface where the connection originates.