Facility Explorer FX60 Network Configuration

What Is the FX60

The Facility Explorer FX60 is a supervisory-class controller in the Johnson Controls Facility Explorer product family. It runs Niagara-based software (originally NiagaraAX, later Niagara 4 in the FX60E variant) on a QNX real-time operating system with the IBM J9 Java Virtual Machine. The FX60 manages networks of field controllers using open communication protocols—BACnet/IP, BACnet MS/TP, N2, LONWORKS, and Modbus—and provides a built-in web user interface for monitoring, trending, alarming, and scheduling.

Compared to its smaller sibling the FX20, the FX60 offers significantly higher capacity: 128 MB of RAM and 128 MB of flash storage versus the FX20's 64 MB of each. This additional memory allows the FX60 to host larger station databases, more concurrent driver instances, and more simultaneous user sessions. Both the FX20 and FX60 share the same physical form factor—a compact DIN-rail-mountable enclosure with identical port layouts—so the network configuration procedures described in this article apply to both controllers unless otherwise noted.

The FX60 is identified by the model number LP-FX6011N-1 (or similar LP-FX6011 variants). It ships with an embedded copy of FX Workbench and a web-based user interface accessible through any modern browser. Johnson Controls has confirmed that software release 14.4 (B14.4) is the final 14.x release that supports the FX20, FX30E, FX40, FX60, FX60E, and FX70 platforms. Organizations still running these controllers should plan accordingly for future software compatibility.

Network Interfaces: LAN1 vs. LAN2

The FX60 provides two 10/100 Mbps Ethernet ports labeled LAN1 and LAN2 on the bottom edge of the controller enclosure. Understanding the intended role of each port is critical to a clean network design.

LAN1: Primary Network Port

LAN1 is the primary network interface. In the vast majority of installations, LAN1 is the only Ethernet port you connect. It carries all traffic: platform connections from FX Workbench, web UI sessions from browsers, BACnet/IP communication with field controllers, and any supervisory-level integration traffic (oBIX, Niagara Fox, etc.). When you first power on a new FX60, LAN1 is the interface that responds at the factory default IP address.

LAN2: Secondary / Isolated Network Port

LAN2 exists for installations that require network isolation—separating BACnet/IP field-bus traffic from the corporate or supervisory LAN. If your building network design places BACnet/IP devices on a dedicated subnet that should not carry management traffic, you connect LAN2 to that isolated BACnet subnet and bind your BACnet/IP driver to the LAN2 interface. This keeps broadcast-heavy BACnet discovery traffic off the corporate backbone while still allowing FX Workbench and web UI connections through LAN1.

LAN1 and LAN2 must be configured on different subnets. The FX60 does not support bridging the two ports or assigning them addresses on the same subnet. If you attempt to place both interfaces on the same subnet, routing conflicts will cause unpredictable communication failures. In a dual-LAN deployment, a typical configuration might look like this:

LAN1 (Management/Supervisory):  10.1.50.20 / 255.255.255.0  Gateway: 10.1.50.1
LAN2 (BACnet/IP Field Bus):     192.168.100.20 / 255.255.255.0  No gateway

If you do not need network isolation, leave LAN2 disconnected. There is no requirement to use both ports, and connecting LAN2 without a clear architectural reason adds unnecessary complexity.

IP Configuration

Every new FX60 ships with a factory-default IP address of 192.168.1.149 and a subnet mask of 255.255.255.0. The default gateway is not set. To perform initial configuration, you must first connect a laptop directly to the FX60's LAN1 port with an Ethernet cable and assign your laptop a static IP address on the same 192.168.1.0/24 subnet—for example, 192.168.1.100 with a subnet mask of 255.255.255.0.

Step 1: Connect and Launch FX Workbench

Open FX Workbench on your laptop. Select File > Open > Open Platform. In the Host field, enter 192.168.1.149. Leave the Port field at the default 5011. Enter the default credentials (consult the controller's documentation or your project-specific credentials sheet). The platform connection establishes over TLS on port 5011.

Step 2: Navigate to TCP/IP Configuration

Once connected to the platform, open the station. In the Navigation Tree on the left side of FX Workbench, expand the Administration folder and double-click TCP/IP Configuration. On the TCP/IP Configuration screen, expand the Interfaces field so that the individual interface settings become visible.

Step 3: Assign a Static IP Address

Modify the following fields for LAN1 (and LAN2 if applicable):

• IP Address — the static address assigned to this controller on your building network
• Subnet Mask — must match the subnet mask used on the target network segment
• Default Gateway — the IP address of the router that provides access to other subnets or the internet (required for LAN1 if the controller needs to reach devices or services outside its own subnet)
• DNS Servers — configure if the controller needs to resolve hostnames (required for NTP time synchronization by hostname, email alerting, or oBIX integrations that reference external servers by name)

Click Save. The controller applies the new IP settings. You will lose your current platform connection because the IP address has changed. Reconfigure your laptop to the new subnet and reconnect to the controller at its new IP address on port 5011 to verify the change took effect.

Always use static IP addresses for supervisory controllers. While the FX60 supports DHCP, a supervisory controller that changes its IP address will break every platform connection, BACnet device binding, and bookmark configured to reach it. Static addressing is standard practice for BAS controllers in production environments.

HTTPS and Port 5011

The FX60 runs a platform daemon that listens for incoming connections from FX Workbench. By default, this daemon is configured to accept connections on HTTPS port 5011. This is the port used for all platform-level operations: installing or upgrading station software, commissioning the controller, transferring station backups, and performing host-level diagnostics.

The platform daemon uses SSL/TLS to authenticate both the controller and the client and to encrypt all traffic between FX Workbench and the FX60. The Facility Explorer platform supports TLS 1.0, 1.1, and 1.2. When FX Workbench initiates a platform connection, it defaults to a secure TLS connection and will prompt you to accept the controller's certificate if it has not been previously trusted.

In addition to the platform daemon on port 5011, the FX60's web user interface typically runs on HTTPS port 443 (or HTTP port 80, depending on station configuration). These are separate services: the web UI is served by the Niagara web server within the station, while the platform connection is handled by the platform daemon outside the station context.

Port 5011 must be reachable from any workstation that needs to perform platform-level management. If your network includes firewalls between the management VLAN and the BAS VLAN, create a rule permitting TCP port 5011 from authorized workstations to the FX60's LAN1 address. If you also need web UI access, permit TCP 443 (or 80) as well.

Johnson Controls recommends leaving the platform port at the default 5011 unless you have a specific reason to change it. If you do need to change the port—for example, to avoid a conflict with another service—you can modify it through the Platform Administration tools on the controller. Document any non-default port assignments carefully, as technicians arriving on site will assume 5011 by default.

BACnet Driver Configuration

The FX60 supports three BACnet driver types, each requiring a separate license and serving a different purpose:

• BACnet/IP Client (Import) Driver — allows the FX60 to discover and read/write points on other BACnet/IP devices on the network. This is the driver you use to integrate third-party BACnet equipment or to pull data from BACnet/IP field controllers into the FX60's station database.
• BACnet/IP Server (Export) Driver — exposes the FX60's own points as BACnet objects so that other BACnet clients (a head-end system, another supervisory controller, or a BACnet service tool) can read and write them.
• BACnet MS/TP Driver — communicates with BACnet MS/TP field controllers over the FX60's built-in RS-485 serial port. MS/TP is the standard protocol for wired field-level BACnet communication in Johnson Controls and many third-party systems.

Configuring the BACnet/IP Driver

In FX Workbench, the BACnet/IP driver lives under Config > Drivers > BacnetNetwork. When you add a BACnet/IP network using the New JCI Station wizard or manually through the palette, the driver creates a BACnet/IP port component. Key settings to configure on this port include:

• Network Adapter — bind the driver to the correct Ethernet interface. If you are running a single-LAN setup, bind to LAN1. If you are using LAN2 for an isolated BACnet network, bind the BACnet/IP driver to the LAN2 interface so that BACnet traffic stays on the dedicated subnet.
• UDP Port — defaults to 47808 (0xBAC0). Do not change this unless you have a documented reason; non-standard ports will prevent interoperability with other BACnet/IP devices.
• Network Number — assign a unique BACnet network number that does not conflict with any other network number in your BACnet internetwork. Every BACnet network segment (IP or MS/TP) must have a globally unique network number.
• Device Instance — set the BACnet device instance for the FX60 itself. This must be unique across the entire BACnet internetwork (0 to 4194302).

Configuring the BACnet MS/TP Driver

BACnet MS/TP uses the FX60's built-in non-isolated RS-485 port. In FX Workbench, drag the MstpPort component into /Config/Drivers/BacnetNetwork/Bacnet Comm/Network. Configure the following properties:

• Port Name — select the serial port corresponding to the RS-485 connector on the FX60
• Baud Rate — must match the baud rate of all devices on the MS/TP bus (typically 9600 or 38400)
• MS/TP Address — set a unique MAC address for the FX60 on this MS/TP trunk (0–127 for master devices, 128–254 for slave devices)
• Network Number — assign a unique network number for the MS/TP segment, different from the BACnet/IP network number and from any other MS/TP segment in the system
• Max Masters — set to the highest MS/TP master address on the trunk plus one, or leave at the default of 127 if you are unsure (setting this value correctly improves token-passing performance)

After configuring the MS/TP port, the FX60 acts as a BACnet router between the BACnet/IP network and the MS/TP segment, forwarding messages between the two transports automatically. This is one of the core functions of a supervisory controller: field controllers on the RS-485 bus become visible to BACnet/IP clients on the LAN through the FX60's routing function.

Connecting to FX Supervisory Controllers

There are two primary methods for connecting to the FX60 after initial IP configuration is complete: the FX Workbench platform connection and the web-based user interface.

Platform Connection via FX Workbench

The platform connection is the primary management interface. In FX Workbench, select File > Open > Open Platform. Enter the FX60's IP address in the Host field and leave the Port at 5011. Authenticate with valid credentials. The platform connection gives you full access to station engineering: adding and configuring drivers, editing control logic, managing user accounts, installing software updates, and performing station backups.

Web User Interface

For day-to-day monitoring and operator interaction, the FX60's embedded web server provides a browser-based UI. Navigate to https://<controller-ip> in a web browser. The web UI provides access to dashboards, alarm summaries, schedules, trends, and basic point commanding without requiring FX Workbench to be installed on the workstation. The web interface is particularly useful for facility operators who do not need engineering-level access.

Commissioning Wizard

After the initial platform connection, the FX60's Commissioning Wizard guides you through essential setup steps: configuring the station name, setting the time zone, adding network drivers (N2, BACnet, NDIO, NRIO, SNMP, Wireless TEC, Modbus), and establishing communication with downstream field controllers. The wizard is accessible from FX Workbench after a platform connection is established and is the recommended method for initial station setup on a new controller.

Common Mistakes

• Placing LAN1 and LAN2 on the same subnet. The FX60 does not support two interfaces on the same IP subnet. If both ports are assigned addresses within the same subnet, the controller cannot determine which interface to use for outbound traffic, resulting in intermittent communication failures with BACnet devices, dropped FX Workbench sessions, and unreliable web UI access. Always assign LAN1 and LAN2 to different subnets, or leave LAN2 disconnected if you do not need network isolation.
• Using DHCP for a supervisory controller in production. If the FX60 acquires an address via DHCP and that lease changes, every BACnet device binding, FX Workbench bookmark, and integration endpoint that references the old IP address will break. Platform connections will fail, and the web UI will become unreachable until someone discovers the new address. Always configure a static IP address for supervisory controllers. If your organization requires DHCP for asset tracking, use a DHCP reservation to guarantee the same address on every lease renewal.
• Blocking TCP port 5011 at the firewall. Network administrators who are not familiar with the Facility Explorer platform frequently block port 5011 because it is not a well-known port. Without port 5011 access, technicians cannot establish platform connections from FX Workbench, which means they cannot install software, commission the station, or perform engineering changes. When requesting firewall rules for FX60 controllers, always include TCP 5011 in addition to the standard web ports (443/80) and BACnet UDP 47808.
• Duplicate BACnet network numbers or device instances. Every BACnet network segment—whether IP or MS/TP—must have a unique network number, and every BACnet device must have a unique device instance. Duplicate network numbers cause routing failures: WHO-IS requests return conflicting responses, and Read-Property requests get routed to the wrong device. Before commissioning the FX60, obtain a network number allocation from the project's BACnet network plan and verify that the device instance does not conflict with any other device in the system.
• Mismatched MS/TP baud rates. If the FX60's MS/TP port is configured for 38400 baud but the field controllers on the trunk are set to 9600, no communication will occur. Every device on an MS/TP trunk must use the same baud rate. When adding the FX60 to an existing MS/TP bus, check the baud rate of the devices already on the trunk before configuring the FX60's MS/TP driver. A mismatch produces complete silence on the bus—no errors, no partial communication, just nothing.

Platform Compatibility

The FX60 has been supported across multiple Facility Explorer software releases. The following table summarizes the key compatibility points:

The FX60 runs on the QNX real-time operating system with the IBM J9 Java Virtual Machine. Its hardware specifications—128 MB RAM and 128 MB flash—define the upper limit of station size. Larger projects or those requiring current software releases should use the FX80 (with 1 GB RAM and 4 GB flash) or the newer FX90 supervisory controller.

The FX60 is BTL-listed as a BACnet Building Controller (B-BC) under ASHRAE 135-2004, which ensures interoperability with other BTL-certified BACnet devices. This listing covers BACnet/IP and BACnet MS/TP communication as well as standard BACnet services including WHO-IS, I-AM, Read-Property, Write-Property, and COV subscriptions.

For new installations, Johnson Controls recommends the FX80 or FX90 platform. However, the FX60 remains widely deployed in existing buildings and will continue to operate on its current software indefinitely—the end-of-software-support designation means no new software releases, not that the controller stops functioning.

Source Attribution

This guide draws on technical documentation from the following sources:

• Johnson Controls — FX20/FX60 Supervisory Controllers Installation Instructions (LIT-241017477)
• Johnson Controls — FX20/FX60 Supervisory Controllers Product Bulletin
• Johnson Controls — FX Supervisory Controllers Product Bulletin (LIT-12011406)
• Johnson Controls — Niagara BACnet Driver (FX Workbench 14.x User Guide)
• Johnson Controls — HTTPS Port for Platform Access (Facility Explorer Technical Bulletin)
• Johnson Controls — Facility Explorer Supervisory Products Networking Technical Bulletin
• Johnson Controls — Facility Explorer IP Networks for BACnet/IP Controllers Configuration Guide