Scenario 5 – Retrieving OT Network Traffic from Ring Network

If a switch is connected with other OT devices in a ring topology, deploying a Network Passive Sensor (NPS) on the switch is not sufficient, as traffic can traverse from the other side of the ring without going through the switch. In such cases, the important information can be lost.

Qualys recommends the following activities in this scenario:

Case 1 - Simple Ring Architecture

• An engineering station needs to be connected to the existing switch
• Perform asset scanning across the OT network from the engineering station
• Configure mirroring and deploy the Network Passive Sensor (NPS) in the switch

Case 2 - Simple Ring and Sub- ring Architecture

• Remote SPAN (RSPAN) traffic from all the switches connected with OT devices
• Configure mirroring and deploy the Network Passive Sensor (NPS) in the core switch
• Perform Asset discovery across the OT network from an engineering station connected to the core switch