What is Converged Plantwide Ethernet (CPwE)?
Converged Plantwide Ethernet (CPwE) is a validated reference architecture from Rockwell Automation and Cisco that describes how to design, segment, make redundant and secure an industrial Ethernet and IP network for an entire plant, and how to connect it safely to the enterprise network. CPwE brings IT and OT networks together in one coherent architecture without making control of the production process dependent on the office network. It is built on Cisco’s Ethernet-to-the-Factory design and the Integrated Architecture of Rockwell Automation.
CPwE is not a formal standard but a series of design and implementation guides that both companies have tested in their labs. The core document is the Design and Implementation Guide (DIG), of which Rockwell Automation announced version 2.0 in April 2010. More than twenty additional guides have been published alongside it, covering the IDMZ, resiliency, wireless networks, NAT, time synchronisation and security monitoring, among other topics.
🧠 How is the CPwE architecture structured?
CPwE follows the levels of the Purdue Model and divides the network into zones, each with its own function and security level:
| Zone | Purdue level | What lives here? | Characteristics |
|---|---|---|---|
| Cell/Area Zone | 0–2 | PLCs, I/O, drives, HMIs, sensors | Layer 2, real-time traffic, small and well-bounded segments |
| Site Operations | 3 | SCADA servers, Historian, MES, engineering, AD, DNS, NTP | Layer 3, routing between cells, plant-wide services |
| Industrial DMZ (IDMZ) | 3.5 | Proxies, replication servers, remote desktop gateway, patch server | Buffer zone: all IT-OT traffic terminates here |
| Enterprise Zone | 4–5 | ERP, email, office applications, internet connection | Traditional IT management and IT availability requirements |
The Cell/Area Zone is the building block of CPwE. Each production cell or machine gets its own VLAN and subnet, so a fault or broadcast storm in one cell does not affect the others. Distribution switches route between the cells, and a core switch connects everything to Site Operations. CPwE thereby lays the foundation for segmentation according to the zones and conduits model of IEC 62443.
🔧 Which components and technologies does CPwE use?
| Component | Role in CPwE |
|---|---|
| Cell/Area Zones | Local segments grouping production assets such as PLCs and sensors |
| Industrial DMZ | Buffer zone between IT and OT networks with strictly controlled access |
| Layer 2/3 switching | Segmentation and routing via managed industrial switches and VLANs |
| Firewalls and ACLs | Industrial Firewall rules and ACLs that control traffic between zones |
| Resiliency | Ring and star protocols such as REP, DLR, PRP and EtherChannel for high availability |
| Remote access | Secured VPN and a jump server for remote access to OT systems |
| QoS and time synchronisation | QoS marking of IP traffic and Precision Time Protocol for CIP Sync and CIP Motion |
| Identity and access | 802.1X and NAC to decide which devices and users may join the network |
The application protocol in CPwE is EtherNet/IP with CIP. The switches classify that traffic using the default DSCP values from the CIP QoS object, for example 55 for urgent and 47 for scheduled I/O, so that control traffic takes priority over, say, a large backup. For EtherNet/IP multicast you enable IGMP snooping; otherwise I/O traffic floods every port in the VLAN.
🔄 How does CPwE handle resiliency and recovery times?
An industrial network has to absorb a cable break before the PLC drops its connections. CPwE therefore ties the choice of topology to the recovery (convergence) time an application can tolerate. The 2014 REP design guide from Cisco and Rockwell gives this classification:
| Protocol | Topology | Typical recovery time | Use in CPwE |
|---|---|---|---|
| STP (802.1D) | Ring or star | Tens of seconds | Legacy; not suitable for I/O |
| RSTP / MSTP | Ring or star, multi-vendor | More than 250 ms | HMI and explicit messaging, I/O with an RPI of 100 ms or more |
| EtherChannel (LACP) | Redundant star | Under 250 ms | Bundled uplinks between access and distribution switches |
| Flex Links (Cisco) | Redundant star | 50–150 ms | Fast star redundancy with unicast or multicast I/O |
| REP (Cisco) | Switch ring | 50–150 ms | Switch rings with CIP I/O that tolerates about 100 ms |
| DLR (ODVA) | Device-level ring | 1–3 ms | CIP Motion, CIP Safety, redundant controllers |
| PRP | Two parallel LANs | No interruption | Critical processes that cannot tolerate frame loss |
The rules of thumb from the guides: use fibre for all links between switches, keep the controller’s default Requested Packet Interval (RPI), and never choose a connection timeout close to the network’s convergence time. At Layer 3, first-hop redundancy protocols such as HSRP or VRRP keep a cell’s default gateway available. See also Redundancy and Ring Redundancy.
🔐 How does CPwE secure the boundary between IT and OT?
The core of CPwE security is the IDMZ. Rockwell Automation and Cisco set out a number of design principles for it:
- Traffic terminates in the IDMZ - there is no direct path between the Enterprise Zone and the Industrial Zone; every session stops in the IDMZ.
- No common protocols - a protocol that enters the IDMZ from the IT side does not leave it unchanged on the OT side.
- EtherNet/IP stays inside - control traffic never enters the IDMZ and remains within the Industrial Zone.
- No permanent data - the IDMZ stores no data permanently and hosts no primary services.
- Functional sub-zones - separate segments for, for example, IT services, operations and trusted partners.
- Can be unplugged - a well-designed IDMZ can be disconnected if it is compromised, while production keeps running.
Around this, CPwE applies a defence-in-depth model aligned with ISA/IEC 62443 and NIST SP 800-82:
| Layer | Security measures |
|---|---|
| Physical | Locked cabinets and rooms, port security on switches |
| Network | VLANs, ACLs, firewalls, NAT, deep packet inspection |
| Computer and application | Hardening, application whitelisting, patch management |
| User | Roles, access control, multi-factor authentication (MFA) |
| Monitoring | Logging, SIEM, IDS/IPS, passive OT monitoring and anomaly detection |
Inside the Cell/Area Zone, later guides add per-cell industrial firewalls and CIP Security, with which EtherNet/IP devices authenticate each other using certificates and encrypt traffic. This fits with microsegmentation and Zero Trust.
🏗️ How do you implement CPwE in practice?
CPwE was designed for industrial automation with Rockwell and Cisco equipment, but its principles are vendor-neutral. A practical five-step approach:
- Inventory - map all assets, connections and data flows; without an up-to-date inventory you cannot segment meaningfully.
- Define zones - group assets per production cell and per risk, based on a risk assessment according to IEC 62443-3-2.
- Choose topology and resiliency - determine per cell which recovery time the process can tolerate and choose star, REP ring, DLR or PRP accordingly.
- Build the IDMZ - place historian replication, the patch server and the remote desktop gateway in the IDMZ and allow only traffic that terminates there.
- Monitor and manage - connect switches, firewalls and OT monitoring to a SIEM or OT SOC and include the OT network in central incident response.
Typical applications are real-time data transport between PLC, SCADA, historian and MES, making process data available to analytics platforms, secure remote maintenance via a jump server in the IDMZ, and central logging within the OT network.
Dutch and EU context. For organisations covered by the Cybersecurity Act, the Dutch implementation of NIS2 that entered into force on 15 August 2026, CPwE provides a concrete way to implement network segmentation, access control and logging. CPwE does not make you compliant automatically, however: the law also requires risk management, incident reporting and management accountability, and for management systems you still need a framework such as ISO 27001 or IEC 62443-2-1.
⚠️ What mistakes are common in CPwE deployments?
- ❌ No clear segmentation between IT and OT traffic, or one large plant-wide VLAN
- ❌ Unused switch ports left open or undocumented
- ❌ Remote access without strong authentication or logging
- ❌ Misconfigured ACLs, VLANs, routers or firewalls, such as a default native VLAN 1 or an overly broad any-any rule
- ❌ No monitoring of the industrial DMZ
- ❌ An IDMZ that still lets direct connections through “because it is easier”
- ❌ No integration with central incident response procedures
Such mistakes open the door to cyber incidents: attacks on vulnerable OT components via the IT network, malware spreading across poorly segmented VLANs, data theft via a historian or unmonitored remote access, and DDoS attacks or broadcast storms that block HMI traffic on a switch.
🔁 What is the difference between CPwE and a traditional OT network?
| Traditional OT network | Converged Plantwide Ethernet (CPwE) |
|---|---|
| Flat network topology, often a single subnet | Segmented, scalable architecture with cells and zones |
| Limited or ad hoc integration with IT | Controlled IT integration via the IDMZ |
| No or limited security | Defence in depth with ACLs, firewalls and DMZs |
| Unmanaged switches, no redundancy | Managed switches and validated resiliency protocols |
| Difficult to manage | Central management following documented best practices |
❓ Frequently asked questions
Who developed Converged Plantwide Ethernet?
Converged Plantwide Ethernet was developed jointly by Rockwell Automation and Cisco. CPwE builds on Cisco’s Ethernet-to-the-Factory design and Rockwell Automation’s Integrated Architecture. Panduit contributed to the guides on physical infrastructure and fibre cabling.
Is CPwE an official standard?
No, CPwE is a reference architecture with tested designs from two vendors, not a standard from IEC, ISO or ISA. The CPwE security approach is, however, aligned with ISA/IEC 62443 and NIST SP 800-82. Many organisations therefore use CPwE as a practical way to implement those standards.
Can I use CPwE without Rockwell or Cisco equipment?
Yes, the principles of CPwE, such as cells and zones, an IDMZ and choosing resiliency based on recovery time, are vendor-neutral. Some parts are vendor-specific, such as Cisco’s REP protocol. In an environment with ProfiNET or Siemens switches you translate those parts into alternatives such as MRP or RSTP.
What is the difference between CPwE and the Purdue model?
The Purdue model is a conceptual reference model with levels 0 to 5 for control and business systems. CPwE uses those levels and adds a concrete network design, with VLANs, switches, resiliency protocols, firewalls and the IDMZ at level 3.5. Purdue says what belongs where; CPwE describes how to build the network for it.
What recovery time does a CPwE network achieve?
The recovery time of a CPwE network depends on the chosen resiliency protocol. According to the Cisco and Rockwell design guides, a REP switch ring recovers in 50 to 150 ms, a device-level DLR ring in 1 to 3 ms, and PRP loses no frames at all because every message travels over two networks simultaneously. With RSTP or MSTP, recovery takes more than 250 ms according to the same guides.
Does CPwE help with NIS2 and the Dutch Cybersecurity Act?
CPwE helps with NIS2 and the Dutch Cybersecurity Act because it describes concrete measures for segmentation, access control, logging and secure remote access. CPwE does not, however, deliver compliance by itself. You have to organise risk management, reporting procedures and management accountability separately.
📌 In summary
Converged Plantwide Ethernet is the validated reference architecture from Rockwell Automation and Cisco for a segmented, resilient and secure plant network, with an IDMZ as the only controlled bridge between IT and OT.
CPwE divides the plant into Cell/Area Zones, Site Operations, an IDMZ and the Enterprise Zone, ties the choice of resiliency to the recovery time the process can tolerate, and secures the whole with defence in depth in line with IEC 62443 and NIST SP 800-82. It is not a standard, but it is a widely used blueprint for OT convergence and Industry 4.0 in manufacturing.