Network Switch Configuration
for Pharma IQ
What Gets Verified and How

The Switch as a Validated Component

A managed switch in a pharma OT network is a validated system component — not an IT commodity device that can be swapped, upgraded, or reconfigured without change control. Its firmware version is documented in the HDS component register. Its configuration is a controlled baseline. Any change to VLAN assignments, port modes, or security settings after IQ completion requires formal change control, a configuration change record, and partial re-IQ of the affected ports.

This is a different mindset from IT network management, where switches are typically managed by a centralised operations team that applies patches and configuration changes as part of routine maintenance. In a validated OT context, the switch configuration is part of the validated state — it is locked at IQ, and any subsequent change is a change to a validated system.

What the HDS Must Specify Per Switch

For each managed switch in the validated system, HDS Section 1.3 (component register) and Section 7.1 (network topology) together must specify:

• Equipment tag (e.g. SW-OT-01), description, manufacturer, model number, firmware version, hostname, management IP address, physical location
• Every VLAN configured: VLAN ID, name, IP subnet, purpose
• Every physical port: port number or name, VLAN assignment, port mode (access or trunk), connected device tag and IP
• Security hardening settings: unused ports disabled, default credentials changed, management access restricted to management VLAN, SNMP v3 if used (not v1/v2c), SSH enabled / Telnet disabled
• NTP configuration: NTP server IP address, synchronisation verified
• Configuration backup: running config archived as IQ evidence, backup procedure in place

The IQ CLI Commands — What Gets Run

The IQ verifier will typically run the following commands on a Cisco IOS-based industrial switch (the command syntax varies by vendor but the information extracted is the same):

! Verify firmware version and hostname
show version
! Expected output: IOS version matches HDS §1.3, hostname matches HDS

! Verify all VLANs configured
show vlan brief
! Expected: VLAN 10 OT-CTRL active, VLAN 20 OT-SUP active, VLAN 30 MGMT active
! No additional VLANs beyond those in HDS §7.1

! Verify port-by-port VLAN assignments and mode
show interfaces switchport
! Expected: each port matches HDS §7.1 port assignment table
! OT-SUP devices on access ports VLAN 20, not trunk

! Verify specific port (e.g. SCADA server port)
show interfaces GigabitEthernet1/1 switchport
! Expected: Administrative Mode: static access
!          Access Mode VLAN: 20 (OT-SUP)

! Verify disabled ports
show interfaces status
! Expected: all unused ports in 'disabled' or 'notconnect' state
! No active ports that are not in HDS port table

! Verify NTP configuration
show ntp status
! Expected: Clock is synchronized, reference = [NTP server IP in HDS]

! Verify management access restrictions
show running-config | section line vty
! Expected: access-class restricts management to MGMT VLAN only
!          transport input ssh (Telnet not permitted)

! Archive running config as IQ evidence
show running-config
! Full output saved to file, signed by IQ engineer, attached to IQ protocol

The full running config export is the primary IQ evidence for the switch. It is saved as a text file, appended to the IQ protocol as an attachment, and signed by the IQ execution engineer. This is the configuration baseline — any subsequent change that modifies the running config must go through change control and re-IQ of the affected items.

Security Hardening — The IQ Checklist

Beyond VLAN configuration, the IQ verifies that basic security hardening has been applied to the switch. These are the settings that matter for a pharma OT switch:

PROFINET Field Switches — Additional Requirements

On projects using PROFINET for PLC-to-I/O communication, the field switches (located in junction boxes or the control panel, carrying PROFINET traffic) have additional requirements beyond standard OT managed switch configuration. PROFINET is sensitive to multicast and broadcast traffic — IGMP snooping must be enabled on any switch carrying PROFINET traffic to prevent multicast flooding from degrading network performance. For PROFINET ring topologies using MRP (Media Redundancy Protocol), the ring configuration must be documented in the HDS and verified at IQ by confirming the MRP role assignments and ring recovery time.

The PROFINET field switch IQ is also where the connection between network documentation and PLC I/O mapping documentation is most visible. The switch port that carries the PROFINET connection to a specific remote I/O station corresponds to the I/O mapping entries for all the signals on that station. If the switch port is wrong — wrong VLAN, wrong port — those I/O signals cannot communicate with the PLC. The IQ physical inspection of the switch port cabling is therefore a prerequisite for the IQ I/O signal verification tests.