Ethernet - 3000V Isolation
It may be interesting for you:


Isolation ratings are not added but the minimum is selected instead. For example, if your have 10 kV, 20 kV, and 30 kV rated insulation black boxes connected in series, the resulting insulation level will be min{10,20,30}=10kV instead of 10+20+30=60kV as you presumed.
Pulse Eng. # HX1224NL Ethernet transformer (for example again) has 4kVrms @ 50/60Hz A.C. rated insulation level. You need to clearly distinct between A.C. and D.C. insulation. Ethernet specifies the A.C. one.
To protect your scheme properly, you need to ground the center taps of the additional insulation transformer at the side connected to the equipment being protected. It is to eliminate the weak (1.5kVrms) insulation level of the controller module from the result.


P.S. All listed above is on so called basic insulation (provided during 60 secs typ after shock, used for safety) not other(s).