So I'm new around here but I come looking for advice or suggestions to research. Im the plant electrician/SCADA guy for a water department. We have two water treatment facilities connected by a T1 line. Long story short the T1 line goes down all the time and service is terrible.

We have been looking for alternatives and the only real viable solution is to utilize the third party internet service with a VPN tunnel and firewalls and such. IT already extended the general network to this facility and they have a VLan set up for SCADA. However here is the sticky bit, our current SCADA system is all set up on the same network between the two plants, 192.168.254.xxx. IT originally thought they could do some NATing and make this all work. Turns out they couldn't and are now telling me I need to change the IPs of all the equipment at the second location to a different subnet. In theory this isn't that difficult but it's a very buggy FactoryTalk system and initial tests proved to be unpredictable. In this case there is an independent SCADA computer running at both locations which talks to all the PLCs at both locations, sorta a redundant setup.

I guess my question is, if you had to connect PLCs and SCADA computers at two locations across a third party internet connection, how would you do it? What products would you use ? How would you structure the networks? I'm far from an IT guy but have a general idea how things work.

Thanks

 

However here is the sticky bit, our current SCADA system is all set up on the same network between the two plants, 192.168.254.xxx.

It may not be a problem if the networks use the same subnet. You could use a layer 2 VPN bridge to connect them as if they are all on the same, local subnet. Of course, the actual problem is if the equipment on one site uses the same IP addresses as the equipment on the other. Then this approach would not work, as you would have duplicate IP addresses on the bridged network.

If there are duplicate IP addresses, a common solution, would be to use NAT. Here is an article explaining two methods of achieving this.
https://www.practicalnetworking.net/stand-alone/vpn-overlapping-networks/

But it seems your IT already tried doing NAT. Why couldn't they get it to work?