On the shop floor side sit PLCs, HMIs, drives, servos and barcode readers, on addresses in the 192.168.x.x range that have not changed in a decade. On the office side sit MES, ERP, cameras and reporting, on addresses handed out by IT and subject to change. The two sides need to exchange data, but the rules they live by differ: IT patches in a monthly window, OT stops the line for annual maintenance; IT cares about admission and audit, OT cares about determinism and cycle time.
Merging both sides onto one switch puts two sets of rules into a single broadcast domain. A large file transfer, a newly installed agent sending continuously, or a broadcast storm on the office network all travel down the same cable into the control network. A PLC scan cycle is measured in milliseconds, and it does not distinguish who is competing for bandwidth.
One boundary is easy to miss: when two devices sit on the same unmanaged switch and the same subnet, layer 3 firewall rules do not apply to traffic between them. Rules evaluate packets that cross a subnet; same-subnet traffic is forwarded at layer 2 and never reaches them. Two options exist: put the ports in different VLANs, or use two physical ports.
VLANs cover most cases, provided the switch is manageable, someone on site can configure it, and one owner controls it. On real projects the shop floor switch often arrives with the machine from the equipment builder, while the office switch lives in the IT room, and neither reports to the same department. That is where the second port earns its place: the device itself becomes the layer 3 boundary between the two subnets, and no third party has to grant configuration rights on another box.
Port one goes to the shop floor switch on the device subnet, 192.168.10.0/24 for example, with a fixed address on the unit and no DHCP server enabled, so it does not collide with an existing pool. Keep the device subnet away from 192.168.1.0/24 and 192.168.0.0/24, since a good share of equipment ships on those defaults and an address clash drops the link. Port two goes to the plant uplink or the office network, with the address IT assigns, and the default route points that way.
Two routes are enough: default via the office side, 192.168.10.0/24 via the shop floor side. Do not add the reverse. Advertising the device subnet into the office network puts every PLC within reach.
Write the rule table in three columns, source, destination and port, deny by default, and allow only the directions that are needed. Three groups cover most installations: MES servers reaching Modbus TCP 502 or OPC UA 4840 on the device side; the device publishing to a local or cloud broker over MQTT 1883 or 8883, outbound only; maintenance reaching the web interface over HTTPS from a jump host address. Avoid bidirectional any-to-any NAT between the two ports, which removes the boundary just built.
Two more items are worth settling at the same time. Time sync and firmware updates should leave through the office side, so nothing on the device subnet reaches outward. Multiple machine vision cameras belong on the shop floor switch, keeping image traffic local and sending only inspection results across; the 100M ports on the EG528 and EG228 handle PLC polling and MQTT publishing, but raw camera streams at full frame rate will saturate them first.
The USR-EG628 covers the widest set of interfaces: RK3562J quad-core Cortex-A53 at 2.0 GHz, 2 x Ethernet, 2 x RS485, 1 x RS232, 1 x CAN and Ubuntu, with WukongEdge, OpenPLC, Node-RED and Docker preinstalled, so PLC data on serial and Ethernet ports is collected and converted on the same unit; routing, VPN and firewall are integrated, which means the separation between the two ports is configured on the device itself. Certifications cover CE, FCC, 3C, RCM, ANATEL, MTC and NBTC, and most target markets are already covered.
USR-EG528 targets the role that needs both a screen and a gateway: 2 x 100M RJ45, 2 x RS485 plus 2 x switchable RS485/RS232, 1 x HDMI, RK3562 quad-core at 2.0 GHz, Ubuntu 24.04, a built-in local SCADA/HMI, support for IEC 61850, IEC 104, DLT645, DNP3.0, BacNet and mainstream PLCs, -25 to 75 degrees Celsius, DC 9-36 V with reverse polarity protection, a fanless aluminium housing, and hardware plus software watchdog.
USR-EG228 sits at the light end: RK3506J triple-core with Cortex-A7 plus Cortex-M0 at 1.2 GHz, 512 MB of memory and 8 GB of storage, 2 x 100M Ethernet, 2 x RS485, 2 x CAN FD, 1 x USB, the same -25 to 75 degrees Celsius and DC 9-36 V, and the same integrated routing, VPN and firewall. Machines with few collection points and a tight budget are served by it.
Where more ports or more compute are needed, the X86 EC series or the EG928A with AI acceleration is the next step up.
Vendors of that type in North America mostly deliver by project: their own factory, boards modified per application, pricing per unit, and network separation usually delegated to an external industrial firewall or a managed switch while the box itself only computes. The fit is close, lead times and budget are opaque, and the software stack is sourced separately.
PUSR puts those pieces into a standard model: two Ethernet ports, layer 3 routing, VPN, firewall and edge collection software are present at shipment, selection follows interface count and compute tier, and catalog models can be ordered directly. The difference is not a higher number on a datasheet. It is that separation moves from an external appliance to a configuration entry inside the device, which means one less cabinet device, one less vendor and one less line in the responsibility matrix.
Mostly power, cooling, interfaces and service life. Wide DC input with reverse polarity protection, fanless passive cooling, -25 to 75 degrees Celsius operation and dual watchdogs, where a commercial unit is typically rated 0 to 40 degrees Celsius with an adapter. Interfaces also need counting: RS485, CAN and dual Ethernet usually require converters on a commercial machine.
Follow who controls the switch. If it is manageable and configuration rights are in hand, VLANs are sufficient; if switches are split across departments, the second port removes the coordination.
They can, but that only provides link backup and no separation. Separation requires two subnets on two switches, or at least two isolated ports.
For most single-machine collection setups they are enough: deny by default, allow by source, destination and port, outbound only. Deep packet inspection, industrial protocol whitelisting and intrusion detection still call for a dedicated appliance.
The question is whether the machine connects to the plant network. If it does, a boundary is needed; if not, a single port with local storage will run. What decides it is where the data ends up, not how many PLCs sit on site.
The EG628 and EG528 run Ubuntu, and the former ships with Docker for custom services. Back up the factory image before changing the system, so a rollback path exists.
Measure the cabinet temperature in summer first, then compare against the rated operating range and input voltage on the nameplate, leaving at least 15 degrees Celsius of margin; terminate power at the terminal block rather than running long thin wires.
Match the market: CE for Europe, FCC for North America, 3C for China, RCM for Australia, ANATEL for Brazil. Ask the supplier for the certificate number of the specific model, since certification scope can differ between configurations in
