Segmenting BACnet IP networks, which method do you use?


Recently on larger IP networks I’ve wanted to segment things out, to prevent devices from talking to each other that don’t need to.

Sometimes I’ve used multiple UDP ports (maybe one per floor, or a separate port for the boiler/chiller system, etc).

I’ve got a job where all my servers (Distech EC-Net/Niagara Supervisors) are on a single subnet on customer hosted VMs.

Each supervisor servers a different area and doesn’t need to cross talk.

Each area is on a unique IP subnet.

Everything is on standard BACnet UDP port 47808. (supervisors and building controllers).

There are some 3rd party bacnet devices as well.

The supervisors are hosting some bacnet objects in their export table which needs to be read by some other BACnet device.

Right now I’m doing the conventional one BBMD per subnet. It works, but everything can see everything which isn’t ideal since problems could propagate too.

I’m experimenting with setting up the supervisors as foreign devices and just having them register with a BBMD on the subnet that relevant to them.

This seems to work ok, but relies on FDR.

If I set each subnet and supervisor to a unique UDP port can I enable multiple BBMDs on the server subnet without causing chaos? (Note I’m managing the BDTs to be as trim as possible so control subnets will only have the single supervisor in their BDTs).

Basically I’m curious what others have done. There are multiple ways to keep things separate but they all have their own pros and cons.

Personally I don’t think having all the BACnet devices on a single BBMD broadcast domain makes sense, you only want broadcasts to propagate when necessary.

Can you use a BBMD to cross UDP ports? I notice you always specify a UDP port, but could I put controllers on say 47810 and the supervisor on UDP 47808 and bridge them with BBMD?