How to Set Up BACnet BBMD for Multi-Subnet Discovery

You have a building with BACnet/IP controllers on two or more subnets. Your workstation is on one subnet, but you need to discover and communicate with controllers on the other. You run a WHO-IS scan and get nothing back from the remote subnet. The problem is simple: BACnet/IP uses broadcast packets for device discovery, and broadcast traffic does not cross subnet boundaries.

The BACnet-standard answer is the BACnet Broadcast Management Device (BBMD). A BBMD forwards broadcast traffic between subnets so that WHO-IS/I-AM discovery works across your entire BACnet network. This guide covers how BBMDs work, how to configure them step by step, and how to avoid the common mistakes that cause broadcast storms or missing devices.

Why BACnet discovery stops at subnet boundaries

BACnet/IP device discovery relies on broadcast. When your workstation sends a WHO-IS request, it sends a UDP packet to the broadcast address of its local subnet (for example, 192.168.1.255) on port 47808. Every BACnet device on that subnet receives the broadcast and responds with an I-AM packet.

Routers and Layer 3 switches do not forward broadcast traffic between subnets. This is by design — forwarding every broadcast to every subnet would flood the network. But it means your workstation on 192.168.1.x cannot discover BACnet devices on 192.168.2.x through a standard scan.

This becomes a real problem when buildings implement network segmentation for security. The HVAC controllers on one VLAN, lighting on another, and the BAS supervisor on a third — all need to discover each other, but the VLANs prevent broadcast from crossing.

What a BBMD does

A BBMD is a BACnet function (usually running on a BACnet/IP controller or a dedicated device like a Contemporary Controls BASrouter) that listens for broadcast BACnet packets on its local subnet and forwards them as directed (unicast) packets to BBMDs on other subnets. The remote BBMD then re-broadcasts the packet on its local subnet.

The result: a WHO-IS broadcast on subnet A reaches every device on subnet B, and vice versa, without flooding the entire network with uncontrolled broadcast traffic.

Each BBMD maintains a Broadcast Distribution Table (BDT) that lists the IP addresses and subnet masks of all BBMDs on the BACnet network. When a BBMD receives a local broadcast, it sends a copy to every other BBMD in its BDT. Those BBMDs re-broadcast on their local subnets.

Step-by-step: configuring BBMDs on a two-subnet network

Consider a building with two BACnet/IP subnets:

• Subnet A: 192.168.1.0/24 — BAS supervisor and HVAC controllers
• Subnet B: 192.168.2.0/24 — Lighting controllers and energy meters

You need a BBMD on each subnet. Many BACnet/IP controllers have built-in BBMD capability — check your controller documentation.

Step 1: Identify BBMD-capable devices

On subnet A, select one device to serve as the BBMD. For example, the BAS supervisor at 192.168.1.10. On subnet B, select another — perhaps the lighting controller at 192.168.2.20. You need exactly one BBMD per subnet.

Step 2: Configure the BDT on each BBMD

On the BBMD at 192.168.1.10, add the following BDT entries:

• 192.168.1.10 / 255.255.255.0 (itself)
• 192.168.2.20 / 255.255.255.0 (the BBMD on subnet B)

On the BBMD at 192.168.2.20, add the same BDT:

• 192.168.1.10 / 255.255.255.0 (the BBMD on subnet A)
• 192.168.2.20 / 255.255.255.0 (itself)

Both BBMDs must have identical BDTs. This is the most common misconfiguration — technicians add the remote BBMD to one device but forget to update the other.

Step 3: Verify firewall rules

The router or firewall between the subnets must allow UDP port 47808 (BACnet/IP) traffic between the two BBMD addresses. BBMD forwarding uses unicast (directed) packets, not broadcast, so standard firewall rules that allow UDP 47808 between the two IPs are sufficient. For a detailed breakdown of BACnet firewall requirements, see our BACnet remote access guide.

Step 4: Test discovery

From your workstation on subnet A, run a WHO-IS scan. You should now see I-AM responses from devices on both subnets. If devices on subnet B do not appear, check the BDT configuration on both BBMDs and verify that the firewall allows UDP 47808 between them.

Foreign device registration

Not every device that needs to access multiple subnets should be a BBMD. BACnet defines a Foreign Device Registration (FDR) mechanism for devices that need temporary access to a BBMD's broadcast distribution.

A foreign device registers with a BBMD and receives all forwarded broadcasts from that BBMD for a specified time-to-live (TTL). This is commonly used for:

• Engineering workstations that need to discover devices across subnets during commissioning
• BACnet clients on a management VLAN that need visibility into multiple BAS subnets
• Remote access sessions where a technician connects to a single subnet but needs discovery across the building

To configure FDR, your BACnet client (workstation software) registers with a specific BBMD by sending a Register-Foreign-Device request with a TTL value (in seconds). The BBMD adds the foreign device to its Foreign Device Table (FDT) and forwards broadcasts to it until the TTL expires.

Important: The TTL must be refreshed before it expires, or the registration drops and the workstation stops receiving forwarded broadcasts. Most BACnet workstation software handles this automatically, but verify that the re-registration interval is less than half the TTL.

Common BBMD mistakes

Mismatched BDTs

The BDT must be identical on every BBMD. If BBMD-A has BBMD-B in its table but BBMD-B does not have BBMD-A, broadcast forwarding works in one direction only. Discovery appears to work from one subnet but not the other.

Missing subnets

When a third subnet is added to the building, every existing BBMD must be updated to include the new BBMD in its BDT. Forgetting to update one BBMD means that subnet has no visibility to the new subnet.

Multiple BBMDs on the same subnet

Only one BBMD should exist per subnet. Two BBMDs on the same subnet both receive the same local broadcasts and both forward them, resulting in duplicate packets on every remote subnet. This doubles broadcast traffic and can cause device timeouts.

Broadcast storms

If BDT entries are misconfigured (for example, if a BBMD's broadcast address is entered instead of its unicast address), forwarded packets can loop between BBMDs, creating a broadcast storm that saturates the network. Always use the BBMD's unicast IP address in BDT entries, not the subnet broadcast address.

Firewall blocking UDP 47808

BBMD forwarding requires UDP 47808 to be open between all BBMD pairs. A common oversight: the firewall allows BACnet traffic within each subnet but blocks it between subnets. BBMD traffic is inter-subnet by definition.

Testing your BBMD setup

After configuring BBMDs, verify with these tests:

• WHO-IS from each subnet: Run a WHO-IS scan from a workstation on each subnet. You should see I-AM responses from devices on all subnets.
• Read property across subnets: Attempt to read a BACnet property (such as Object_Name or Present_Value) from a device on a remote subnet. If WHO-IS works but ReadProperty fails, check that the unicast path is open (not just broadcast forwarding).
• Packet capture: If discovery still fails, capture traffic on UDP 47808 at the BBMD. You should see incoming broadcast packets and outgoing forwarded-NPDU packets to remote BBMDs.
• Foreign device table: If using FDR, check the BBMD's FDT to verify your workstation is registered and the TTL has not expired.

When BBMD is not enough: the case for Layer 2 remote access

BBMD solves the multi-subnet discovery problem within a building. But it adds configuration complexity: every BBMD must be maintained, every BDT must stay synchronized, and every new subnet requires updating every existing BBMD.

For remote access scenarios — where a technician connects from outside the building — BBMD configuration becomes even more complex. The remote workstation either needs to register as a foreign device with a BBMD (requiring the BBMD to accept external registrations) or needs its own BBMD on the remote network.

Layer 2 remote access eliminates this complexity entirely. By extending the broadcast domain to the remote technician, Layer 2 connectivity allows WHO-IS/I-AM to work natively — no BBMD configuration, no foreign device registration, no BDT synchronization. The technician's workstation behaves as if it were physically on the BACnet subnet.

BBMD is the right tool for permanent multi-subnet setups within a building. For remote access, Layer 2 is simpler, more reliable, and does not require the building's BBMD configuration to accommodate external devices.

SiteConduit provides Layer 2 remote access for building automation networks, making BBMD configuration unnecessary for remote technicians. Protocol firewalling, time-limited sessions, and full audit trails — purpose-built for BACnet, Modbus, and Niagara environments.

Join the waitlist for early access, or visit our FAQ to learn more.