Supporting IoT Without Sacrificing Security
Walk into any modern factory and you will see far more than people and production lines.
Robots, programmable logic controllers (PLCs), vision systems, IP cameras, building‑management sensors and handheld devices now all depend on the network to do their job.
On paper, this looks like a success story for Industry 4.0. In reality, many manufacturers are wrestling with a quieter problem: how to connect an exploding number of Internet of Things (IoT) devices without opening up new security holes or overwhelming already stretched IT teams.
This is where the right combination of edge networking and sd wan solutions becomes critical.
Why legacy networks buckle under IoT
Traditional plant networks were never designed for hundreds or thousands of small, “faceless” devices chattering away 24×7. They were usually built to connect a relatively stable set of PCs, servers and perhaps a few controllers, often using flat VLANs and simple firewall rules.
IoT changes that in several ways:
Volume and variety of devices – Everything from power meters and HVAC controllers to barcode scanners and IP cameras now wants network access, often powered over Ethernet and placed in awkward physical locations.
Different traffic and security profiles – Many devices send small, regular bursts of data, but some (like cameras or augmented‑reality headsets) are bandwidth‑hungry. Others come with weak or hard‑to‑patch firmware, increasing cyber risk.
Operational constraints – Downtime on a production line is measured in lost output and missed customer commitments, not just IT incidents. Network changes that are safe in an office can be unacceptable in a plant.
Trying to cope by bolting more VLANs and firewalls onto a legacy design leads to complexity, blind spots and inconsistent security controls between sites.
What a “cognitive” edge means for manufacturing
Arista’s Cognitive Unified Edge (CUE) reframes the problem by treating the edge network as a set of services rather than a pile of boxes. It brings together PoE switches, Wi‑Fi 6/7 access points, edge firewalls and cloud‑based operations into one coherent system, designed for locations such as factories, warehouses and service centres.
Key ideas that matter in a manufacturing context include:
Zero‑trust security at the edge – CUE supports integrated IDS, wireless intrusion prevention (WIPS), MACsec, advanced segmentation and URL filtering so that every user and device is treated as untrusted until proven otherwise.
Power and connectivity for smart devices – Compact PoE switches such as the CCS‑710 series provide adaptive power management and flexible mounting, ideal for powering access points, phones, IoT devices, cameras and building controllers in spaces without traditional comms rooms.
Wi‑Fi built for operations, not just offices – Arista Wi‑Fi 6/7 access points use a “controlless” architecture where management is cloud‑based but data and control planes stay local. This reduces single points of failure and keeps wireless services running even if the cloud link blips.
AI‑driven operations – CloudVision CUE uses machine learning to analyse connectivity, RF behaviour, DHCP/DNS/802.1X flows and application performance, providing “Client Journey” views that make it easier to diagnose whether a problem is Wi‑Fi, cabling, configuration or something else.
For manufacturers, this means the edge network can grow with new IoT use cases while remaining observable and manageable, rather than becoming an opaque tangle of unmanaged switches and consumer‑grade access points.
Where SD‑WAN fits in a manufacturing world
While CUE addresses what happens inside the site, VeloCloud SD‑WAN handles how those sites securely connect to each other, to data centres and to cloud services.
VeloCloud SD‑WAN is a cloud‑delivered platform that combines intelligent traffic steering, automation and built‑in security. It aggregates multiple WAN links—broadband, DIA, LTE, 5G or even satellite—and uses Dynamic Multipath Optimisation (DMPO) with deep application recognition to steer each flow over the best path in real time.
For sd-wan manufacturing environments, this matters because:
Plants and warehouses are often in locations where only certain carriers or access technologies are available. VeloCloud Edges can make diverse circuits behave like one logical, high‑performance WAN.
Many production applications, from MES to cloud‑hosted analytics, are latency‑sensitive. DMPO can remediate loss and jitter on the fly, improving user and machine experience even on commodity internet links.
Enhanced Firewall Service is built directly into the Edge, adding stateful inspection, IDS/IPS, URL filtering and malicious IP reputation filtering without separate branch firewalls.
In other words, VeloCloud is one of the sd wan solutions that goes beyond simple cost cutting to provide a secure, application‑aware fabric between your industrial sites and the cloud.
Securing industrial IoT without sacrificing production
The hidden challenge in manufacturing is not just getting IoT devices online, but doing so without making the network fragile or insecure.
Combining Arista CUE at the site with VeloCloud SD‑WAN at the WAN edge addresses this in several mutually reinforcing ways:
Segmentation by design
CUE and VeloCloud both support rich segmentation, using VLANs and VXLANs on the LAN side and data segments/VRFs in the SD‑WAN overlay. This allows you to separate corporate users, production systems, guest devices and third‑party access, and apply different firewall and URL policies to each segment.Zero‑touch, consistent security policies across sites
VeloCloud Orchestrator centrally manages firewall rules, IDS/IPS settings, URL categories and IP reputation filters for every Edge. CloudVision CUE does the same for Wi‑Fi, switching and access control policies. Together they give you a single source of truth, reducing the risk of misconfigurations that attackers love.Defence in depth from device to cloud
At the access layer, CUE uses 802.1X, WIPS and segmentation to enforce who and what can connect.
At the WAN edge, VeloCloud’s Enhanced Firewall Service adds stateful inspection, IDS/IPS and URL/malicious IP filtering.
For internet and SaaS access, VeloCloud integrates with leading Security Service Edge (SSE) platforms, creating a layered SASE architecture.
Operational visibility, not just logs
Hosted firewall logging and security dashboards in VeloCloud Orchestrator provide real‑time insight into threats detected, edges impacted and policies enforced. CloudVision CUE supplies complementary views for client journeys, RF issues and application quality. This combination moves you from reactive, ticket‑driven firefighting to proactive hygiene.
The result is an environment where IoT can expand—more sensors, more cameras, more automation—without turning each plant into an unmanaged security experiment.
Designing an architecture for sd-wan manufacturing
If you are evaluating sd wan providers for manufacturing, it helps to think in terms of a reference architecture rather than a collection of products.
A practical model could look like this:
Inside each plant or warehouse
Deploy Arista PoE switches as the wired edge, providing power and connectivity for access points, IP cameras, phones and industrial IoT devices.
Use Arista Wi‑Fi 6/7 access points for mobile workers, scanners and autonomous equipment, benefiting from local data/control planes and central configuration.
Apply zero‑trust access policies, authentication and segmentation through CloudVision CUE.
At the WAN edge
Install VeloCloud Edges as the secure, intelligent gateway from each site to the rest of the enterprise.
Terminate multiple WAN links (e.g. fibre plus 5G) and enable DMPO to maximise uptime and application performance.
Turn on Enhanced Firewall Service to remove the need for separate branch firewalls while still getting IDS/IPS, URL filtering and malicious IP protection.
Across the estate
Use VeloCloud Orchestrator to define business and security policies once and apply them everywhere, with templates for different site types.
Use CloudVision CUE for zero‑touch deployment, AI‑driven troubleshooting, location tracking and application performance monitoring in each site.
This pattern gives you a blueprint for sd-wan manufacturing that is repeatable as you open new plants or retrofit older facilities.
A day in the life of a connected plant
To bring this to life, imagine a mixed‑use manufacturing site with a production hall, warehouse and small office.
At 06:00, the first shift arrives. Their handheld scanners connect over Wi‑Fi 7, while environmental sensors on the line send small telemetry bursts over PoE‑powered switches. Authentication and segmentation policies silently place each device in the right network segment, without engineers needing to intervene.
At 09:30, a supplier needs remote access to a particular PLC for a firmware update. Instead of punching a hole in the firewall, operations create a time‑bound policy in CloudVision CUE and VeloCloud Orchestrator that grants access to just that device and data segment. Enhanced Firewall Service inspects the session for anomalies, and all logs flow automatically into central dashboards and, if required, an external SIEM.
At lunchtime, one of the broadband circuits degrades due to a carrier issue. DMPO on the VeloCloud Edge spots the increased loss and jitter, and silently steers critical traffic—including MES, ERP and quality systems—onto the remaining circuits, using remediation techniques where needed. Users notice little more than a brief blip.
In the afternoon, an IoT camera at the loading bay begins making unusual outbound connections. Malicious IP filtering on the Edge blocks the traffic based on reputation data, and security teams receive an alert pinpointing the device and site. Because the camera sits in an isolated segment, the risk of lateral movement into OT networks is dramatically reduced.
Throughout the day, CloudVision CUE continuously analyses client journeys and RF conditions. When it detects that one part of the warehouse has marginal signal quality for scanners, it recommends an AP power/channel adjustment, which can be pushed remotely outside production hours.
None of these events require site visits, ad‑hoc firewall changes or late‑night spreadsheet archaeology. The combination of a cognitive edge and intelligent SD‑WAN gives you predictable behaviour, even when the network is anything but simple.
Bringing it all together
For manufacturers, the real value of sd wan solutions and modern edge networking is not just cheaper circuits or shinier access points. It is the ability to keep adding connected devices, locations and cloud services without losing control of security or operational stability.
By pairing Arista Cognitive Unified Edge with VeloCloud SD‑WAN (SD-Branch Solution), you create a fabric where IoT can flourish safely: the edge becomes observable, the WAN becomes application‑aware, and security becomes an integral part of the design rather than an afterthought.
When you assess sd wan providers for manufacturing, look for this combination of site‑level intelligence and WAN‑level assurance. It is the most effective way to tackle the hidden network challenge of supporting IoT without sacrificing security—or production.