Industrial networks grow by accretion: a machine here, a skid there, a link to the office. Schneider's ConneXium range tiers the infrastructure so each segment gets the honesty it needs — the TCSEFEC23FCF21-class industrial firewall/router with stateful detection and IDS for the boundary, managed switches like the TCSESL043F23F0 with RSTP ring recovery for the backbone, and unmanaged units such as the MCSESU053FN0 five-port switch for the honest edge. The discipline is matching capability to consequence, not spreading the expensive device everywhere.
The boundary: firewall with opinions
Where the plant network meets the office or the internet, the industrial firewall does more than NAT: stateful inspection of protocols, intrusion detection signatures, and segmentation enforcement. It is the one tier that must understand the traffic, because it is the tier that says no. Sizing it for the DMZ between cell areas and the wider world is the first network decision every modern plant makes.
The backbone: managed switches and rings
Managed ConneXium switches carry the backbone because two functions are non-negotiable there: redundancy (RSTP or ring recovery, so one cable cut costs milliseconds, not a shift) and visibility (VLANs, diagnostics, IGMP for the multicast traffic industrial protocols generate). The TCSESL-class units are where network engineering actually happens.
The edge: unmanaged and unashamed
A single machine's internal network — PLC, HMI, drive — needs no configuration, no redundancy, no management: five honest ports. The MCSESU-class unmanaged switch is the right answer precisely because it does nothing; its failure domain is one machine, which is an acceptable kingdom for a device with nothing to say.
The decision rule
Consequence by segment: boundary — firewall; backbone — managed with ring recovery; machine edge — unmanaged. The failure mode to design against is the flat network: one broadcast storm or one infected laptop reaching everything, because someone deployed edge switches where the backbone tier was needed.
Can unmanaged switches live on a ring?
No — ring recovery is a managed protocol conversation. A "ring" of unmanaged switches is a loop, and loops without RSTP are broadcast storms waiting for a schedule.
Does the firewall slow the network?
A sized-and-bypassed-for-realtime firewall does not touch the deterministic traffic it should protect. The mistake is putting it inline where it carries every packet — architecture, not the device, decides performance.
