BACnet Security: Network Segmentation Today, BACnet/SC for New Projects
BACnet/IP and MS/TP were designed in 1995 without authentication or encryption — fine on an isolated BAS VLAN, a real exposure once bridged onto general office IT. We help you close that gap with proper segmentation now and BACnet/SC on new builds.
How we secure your BACnet network
Network audit
We map your BACnet/IP and MS/TP segments, identify how the BAS network currently touches office IT, and flag any broadcast traffic reaching further than it should.
Dedicated BAS VLAN
The BACnet network moves onto its own VLAN, separated from office and guest traffic, with firewall rules limited to the UDP 47808 traffic your BMS server actually needs.
BBMD and Foreign Device lockdown
Foreign Device registration is restricted to known BBMD IP addresses only, so broadcast routing between subnets can't be hijacked by an unrecognised device.
BACnet/SC specification for new work
On new panels and controllers, we specify BACnet/SC — a TLS 1.3-encrypted WebSocket transport with X.509 certificate device authentication — where the BAS network can't stay fully isolated.
What proper BACnet security actually covers
BACnet/SC finalized
BACnet Secure Connect adds a TLS 1.3-encrypted WebSocket transport and X.509 certificate-based device authentication on top of the classic BACnet object model.
Isolated BAS VLAN
Building automation traffic stays off the general office and guest network by design, not by convention.
UDP 47808 scoped firewall rules
Only the BACnet/IP traffic your BMS server needs passes the firewall — nothing broader.
BBMD / Foreign Device allowlisting
Broadcast routing across subnets is limited to BBMD addresses you've explicitly approved.
BACnet/SC for new projects
TLS 1.3 encryption and X.509 device certificates where the BAS can't stay fully air-gapped from IT.
Honest phasing
Segmentation is the near-term fix for what's already installed; BACnet/SC is the long-term answer we specify going forward — we won't oversell one as a substitute for the other.
What's included
A segmentation and security review scoped to your existing BACnet installation or your next project's specification.
- BACnet/IP and MS/TP network mapping
- VLAN and firewall rule design (UDP 47808 scope)
- BBMD / Foreign Device IP allowlist
- BACnet/SC specification support for new controllers and panels
- Handover documentation for your IT and BMS teams
Frequently asked questions
Is BACnet secure by default?
No. BACnet was standardised in 1995 (ANSI/ASHRAE 135) with no built-in authentication or encryption. Classic BACnet/IP and MS/TP broadcast openly on whatever segment they sit on — that's fine on an isolated BAS VLAN, a real exposure once bridged onto general office IT.
What's the difference between segmentation and BACnet/SC?
Segmentation is a network design fix: a dedicated VLAN, firewall rules scoped to UDP 47808, and a controlled BBMD/Foreign Device list. BACnet/SC is a protocol-level fix: TLS 1.3-encrypted WebSocket transport with X.509 certificate device authentication, finalized in 2020.
Do I need BACnet/SC for an existing installation?
Not necessarily right away. Segmentation is the practical near-term fix for installs already in the field. BACnet/SC is worth specifying on new projects, or when devices are being replaced, especially where the BAS network can't stay fully isolated from IT.
What port does BACnet/IP use?
UDP port 47808 (0xBAC0 in hex). Firewall rules between the BAS VLAN and the rest of the network should be scoped to exactly this traffic, to and from the BMS server.
What is a BBMD and why does it matter for security?
A BACnet Broadcast Management Device relays broadcasts across IP subnets, since routers don't forward them by default. Foreign Device registration should be restricted to known BBMD IP addresses only — an open registration policy lets any device on the network announce itself into your BAS broadcasts.
Talk to an engineer about your BACnet network
Send us your current topology or your next project's spec — we'll tell you plainly where segmentation is enough and where BACnet/SC is worth the investment.