BACnet BBMD Setup: Multi-Subnet Discovery

Why BACnet Devices Disappear Across Subnets

BACnet/IP device discovery depends on broadcast messages—specifically the WHO-IS and I-AM services defined in the BACnet standard. When a BAS front-end or supervisory controller sends a WHO-IS request, it transmits a UDP broadcast on port 47808. Every BACnet/IP device on the same subnet receives that broadcast and responds with an I-AM containing its device instance, network number, and MAC address.

The problem is that IP routers do not forward broadcast traffic between subnets. This is by design—broadcast forwarding would flood every VLAN in your building with traffic from every other VLAN. But for BACnet, it means a supervisory controller on VLAN 10 (say, 10.1.10.0/24) cannot discover any BACnet/IP devices sitting on VLAN 20 (10.1.20.0/24). The WHO-IS broadcast stops at the Layer 3 boundary, and the devices on the other subnet remain completely invisible.

Symptoms of this problem include: the head-end shows zero devices from certain floors or zones, WHO-IS queries return partial results depending on which subnet the workstation sits on, and field controllers that were reachable before a network segmentation project suddenly vanish. In every case, the fix is the same: deploy a BBMD on each subnet and configure the Broadcast Distribution Tables so broadcast traffic gets relayed as directed unicast messages between BBMDs.

BBMD Configuration: Step-by-Step

Step 1: Plan Your BBMD Topology

Before touching any configuration screens, map out every IP subnet that carries BACnet/IP traffic. The BACnet standard (ASHRAE 135, Annex J) requires exactly one BBMD per subnet. Having zero means that subnet is isolated. Having two or more on the same subnet causes duplicate broadcast forwarding—traffic doubles or quadruples, and you get phantom devices or communication timeouts.

For a typical three-subnet campus, your plan might look like this:

Subnet A: 10.1.10.0/24  →  BBMD at 10.1.10.5  (e.g., JACE 8000)
Subnet B: 10.1.20.0/24  →  BBMD at 10.1.20.5  (e.g., BASrouter)
Subnet C: 10.1.30.0/24  →  BBMD at 10.1.30.5  (e.g., NAE55)

Pick a device on each subnet that is always powered on, has a static IP, and supports the B-BBMD device profile. Good candidates include supervisory controllers (JACE, NAE, NCE), dedicated BACnet routers (Contemporary Controls BASrouter), or software BBMDs (Chipkin CAS-1000-06).

Step 2: Build the Broadcast Distribution Table (BDT)

The BDT is a list of all BBMDs participating in the BACnet/IP network. Every BBMD must hold the same BDT, including an entry for itself. Each entry contains three fields:

• IP Address — the address of the BBMD on that subnet
• UDP Port — almost always 47808 (0xBAC0)
• Broadcast Distribution Mask — determines the forwarding method (see below)

For the three-subnet example above, every BBMD gets this identical BDT:

┌─────────────────┬───────┬─────────────────────┐
│  IP Address      │ Port  │ Distribution Mask    │
├─────────────────┼───────┼─────────────────────┤
│  10.1.10.5       │ 47808 │ 255.255.255.255      │
│  10.1.20.5       │ 47808 │ 255.255.255.255      │
│  10.1.30.5       │ 47808 │ 255.255.255.255      │
└─────────────────┴───────┴─────────────────────┘

Step 3: Understand the Broadcast Distribution Mask

The distribution mask controls how a BBMD delivers forwarded broadcasts to a remote subnet. There are two methods:

• Two-hop (mask = 255.255.255.255) — The local BBMD sends a unicast message to the remote BBMD, which then rebroadcasts it on its local subnet. This is the default and recommended method. It works across any IP infrastructure, including NAT boundaries and WAN links, because it only requires unicast reachability between BBMD addresses.
• One-hop (mask = remote subnet mask, e.g., 255.255.255.0) — The local BBMD sends a directed broadcast directly to the remote subnet's broadcast address (e.g., 10.1.20.255). This requires the intervening IP routers to be configured with ip directed-broadcast, which most network administrators disable for security reasons. Avoid one-hop unless you have a specific reason and your network team has explicitly enabled directed broadcasts.

Use 255.255.255.255 (two-hop) unless you have a documented reason not to. It is more reliable, more secure, and works in every network topology.

Step 4: Configure the BBMD on Each Device

The exact interface varies by manufacturer, but the process is the same everywhere: enable BBMD functionality, then enter the BDT entries.

Contemporary Controls BASrouter (Web Interface)

1. Open the BASrouter web interface (default IP shown on the front panel).
2. Navigate to the BACnet IP configuration page.
3. Check the BBMD Enable checkbox.
4. In the BDT section, add entries for every other BBMD (the BASrouter adds its own entry automatically). Enter the IP address and set the Broadcast Distribution Mask to 255.255.255.255.
5. Click Submit and reboot the device when prompted.

Tridium Niagara JACE / Supervisor

1. In Workbench, expand Drivers > BacnetNetwork > BACnet IP Port.
2. Set BBMD Mode to enabled.
3. Open the BBMD Table property sheet.
4. Add a row for each remote BBMD: enter the IP address, port 47808, and mask 255.255.255.255.
5. Save and restart the BACnet network.

Johnson Controls NAE / NCE (Metasys)

1. In the System Configuration Tool (SCT), select the engine and open BACnet Settings.
2. Enable BBMD on the BACnet/IP port.
3. Add BDT entries listing every BBMD in the network (including the local engine).
4. Download the configuration to the controller.

Software BBMD (Chipkin CAS-1000-06)

The CAS-1000-06 runs on Windows or Linux and reads its configuration from a settings.csv file. A minimal BDT configuration looks like:

# settings.csv for CAS-1000-06 BBMD
# Format: IP Address, UDP Port, Broadcast Distribution Mask
10.1.10.5, 47808, 255.255.255.255
10.1.20.5, 47808, 255.255.255.255
10.1.30.5, 47808, 255.255.255.255

Launch the application. Press B during runtime to display the current BDT. Press R to reload the settings file after edits without restarting the process.

Step 5: Open Firewall Rules

Every BBMD must be able to reach every other BBMD via UDP port 47808. Work with your network team to create firewall rules permitting UDP 47808 traffic between the BBMD IP addresses. If any BBMD sits behind a NAT gateway (common in multi-building campuses), you will also need port forwarding rules for UDP 47808 pointed at the BBMD's internal address.

# Example: iptables rules on a Linux host running a software BBMD
iptables -A INPUT  -p udp --dport 47808 -s 10.1.10.5 -j ACCEPT
iptables -A INPUT  -p udp --dport 47808 -s 10.1.20.5 -j ACCEPT
iptables -A INPUT  -p udp --dport 47808 -s 10.1.30.5 -j ACCEPT

Step 6: Verify with WHO-IS

After configuring all BBMDs, send a global WHO-IS from a workstation on any subnet. You should now see I-AM responses from devices across all subnets. If a subnet is still missing, check:

• That the BDT on the BBMD for that subnet matches the BDTs on all other BBMDs.
• That UDP 47808 is not blocked between the missing BBMD and the rest.
• That BBMD is actually enabled on the device (not just configured but toggled off).
• That there is not a second BBMD on the same subnet creating a forwarding loop.

Foreign Device Registration (FDR)

Foreign Device Registration is an alternative to BBMD for devices that need temporary or occasional access to the BACnet network from a different subnet. The most common use case is a technician's laptop running a BACnet service tool—you don't want to deploy a permanent BBMD on every subnet a technician might plug into.

With FDR, the device registers itself with an existing BBMD on a remote subnet. The BBMD adds the device to its Foreign Device Table (FDT) and begins forwarding broadcast traffic to it. The registration has a Time To Live (TTL)—typically 60 to 500 seconds—after which the device must re-register or it gets dropped from the FDT. Most BACnet tools handle re-registration automatically.

To configure FDR on a client device, you need three pieces of information:

1. The IP address of the BBMD to register with
2. The UDP port (47808 unless changed)
3. The TTL value in seconds (60–500 is typical; the BBMD must have FDR acceptance enabled)

The BBMD must be configured to accept foreign device registrations. On most platforms, this is a checkbox or toggle labeled Accept Foreign Device Registrations or FDR Enable. If a subnet has only devices that support FDR, that subnet does not need its own BBMD at all—the devices can register with a BBMD on a different subnet.

Common BBMD Configuration Mistakes

• Multiple BBMDs on the same subnet. This is the single most common BBMD issue in the field. Each duplicate BBMD re-forwards every broadcast it receives from the other, causing traffic to double or quadruple. Symptoms include network slowdowns, BACnet timeout errors, and devices appearing and disappearing. Before enabling BBMD on any device, confirm no other device on that subnet already has BBMD enabled.
• Mismatched BDT entries across BBMDs. If BBMD-A has three entries but BBMD-B only has two, broadcasts will flow in one direction but not the other. Every BBMD must have the exact same BDT—same IP addresses, same ports, same masks. After any change, verify the table on every BBMD in the network.
• Firewall blocking UDP 47808. IT teams routinely block unknown UDP ports. If WHO-IS works within a subnet but not across subnets despite correct BDT entries, the most likely cause is a firewall or ACL dropping the BBMD-to-BBMD traffic. Request explicit permit rules for UDP 47808 between all BBMD addresses.
• Using one-hop mode without directed broadcast support. Setting the distribution mask to the remote subnet mask (e.g., 255.255.255.0) tells the BBMD to send directed broadcasts, which most managed switches and routers drop by default. Stick with 255.255.255.255 (two-hop) unless your network infrastructure explicitly supports directed broadcasts.
• Forgetting to enable FDR acceptance on the BBMD. A technician's laptop configured as a foreign device will silently fail to register if the target BBMD does not have foreign device registration acceptance enabled. The laptop sends a Register-Foreign-Device request, the BBMD ignores it, and the technician sees no devices. Enable FDR on at least one BBMD that field technicians will target.

Platform and Version Compatibility

BBMD support is defined in the BACnet standard (ASHRAE 135, Annex J) and is implemented in the B-BBMD device profile. Any device or software listed as BTL-certified with B-BBMD support can act as a BBMD. In practice, the following platforms are commonly used:

If you are unsure whether a specific controller supports BBMD, check the device's PICS (Protocol Implementation Conformance Statement) document. Look for the B-BBMD device profile or the BIBBs NM-BBMDC-B (BBMD Configuration) in the supported services list.

Source Attribution

This guide draws on technical documentation from the following sources:

• Contemporary Controls — BACnet BBMD and FDR Setup Recommendations
• Contemporary Controls — BBMD Instruction Sheet (IS-MMBD0000-AA3)
• Chipkin Automation Systems — CAS BACnet BBMD (CAS-1000-06) Documentation
• Johnson Controls — Using BBMD to Communicate Across Multiple Subnets (Metasys)
• Beckhoff — BACnet Broadcast Management Device (TwinCAT Documentation)
• Optigo Networks — What is a BACnet Broadcast Management Device (BBMD)?
• ASHRAE Standard 135 — BACnet, Annex J: BACnet/IP Networking