How to Protect the Machines You Run and Secure the Ones You Build

Most production machines were engineered to run reliably, not to defend themselves.

A packaging line or CNC cell built a decade ago typically sits on a flat network, still runs with default credentials, and uses controllers that trust any device that talks to them. That was acceptable while machines stayed isolated. Once they are linked to MES, remote service tools, and plant-wide analytics, every connected machine becomes a possible entry point, and the controller behind it rarely has a way to push back.

The pressure is not only technical. Plant operators need connectivity and visibility without exposing production. Machine builders face customers who now write security requirements into purchase specifications, and export markets such as the EU are adding cybersecurity obligations for machinery and connected products through the Machinery Regulation and the Cyber Resilience Act.

There is no single fix, because the right approach depends on where a machine is in its life. Equipment already in service needs protection placed around it, with no change to how it operates. A machine still in design can have protection chosen into each networked component. This guide covers both paths with Moxa hardware available through ManuAuto and shows exactly where each device sits inside a real machine.

For installed machines

Need to Lock Down Machines Fast?

Looking to protect machines already running on the plant floor? Roll out security upgrades without changing PLC configurations or stopping production.

Recommended: NAT / EDF Series

Find Out More ➞

For new machine builds

Designing a New Machine From Scratch?

Building a new machine? Specify secure-by-design devices so security is part of your architecture from the very first drawing.

Recommended: NPort G2 / MGate G2 / ioLogik / SDS Series

Find Out More ➞

LEGACY MACHINE PROTECTION

Secure Legacy Machines Without Touching PLC Code

NAT-102 Series

2-port industrial Network Address Translation (NAT) devices

NAT-G102 Series

2-port industrial Network Address Translation (NAT) devices with 1GbE ports

NAT-108 Series

8-port industrial Network Address Translation (NAT) devices

Industrial NAT Devices

NAT-(G)102 / NAT-108 Series

NAT-(G)102 and NAT-108 devices use 1:1 NAT mapping to remove IP address conflicts, so rollouts across the plant stay smooth and predictable.

Easier IP Management

Connect machines that share identical subnets to the factory network safely, even on existing infrastructure.

Hands-Free Network Access Control

Automatically learns and locks IP/MAC addresses, blocking unauthorized traffic with no complex firewall setup.

Ultra-Compact Design

At less than 30 mm wide, the unit fits easily on a crowded DIN rail.

Industrial LAN Firewalls

EDF-G1002-BP Series

EDF-G1002-BP Series firewalls help OEMs build cyber-resilient equipment, keeping integration simple while production stays online.

Transparent Filtering Mode

Operates as an invisible Layer 2 bridge, inspecting OT traffic without affecting existing network operations.

Industrial DPI Technology

Built-in deep packet inspection (DPI) analyzes and filters OT protocol traffic.

IPS and DoS Protection

Blocks cyberthreats and traffic flooding so machines keep running reliably.

EDF-G1002-BP Series

Next-gen industrial LAN firewalls with 2 Gigabit ports