On paper, virtual local area networks (VLANs) and BACnet Broadcast Management Devices (BBMDs) seem completely at odds. VLANs are meant to separate and segregate traffic into multiple subnets. At the same time, BBMDs are designed to bypass all that work to broadcast messages across different parts of the network without limiting which devices should get what messages. It seems like these two should never be around each other, right?
Fate, or more accurately, IT/OT convergence, has brought these two opposing designs together. Modern IP networks make extensive use of VLANs to keep everything organized and secure, while modern OT networks using the BACnet protocol have to, by nature, use BBMDs to ensure communications.
These two systems have to work together. And they can, but it takes some understanding of both systems to design and configure an OT network that can accommodate both.
Quickly: What is a VLAN?
This might seem a bit rudimentary, but some facilities and OT technicians that still operate mainly with MS/TP may not deal with IT-related hardware in their day-to-day (I’ll admit, when I first started working with networking companies, VLANs were a mystery to me too!). The technical definition of a VLAN is a logical grouping of devices within a network that are segmented at the data link layer (Layer 2) of the OSI model.
For OT pros, think of them like a virtual switch: a software-defined partition of devices organized into their own subnet. VLANs allow IT administrators to partition a physical network into multiple logical networks, each with a dedicated broadcast domain. While they are all still physically connected to the system itself, they appear to be completely separate networks. Devices on different VLANs can’t communicate directly with each other unless there is routing (Layer 3) between them.
Sound familiar? If you’ve worked within a BACnet/IP environment for a while, you’ve probably encountered or defined your own VLAN. VLANs can be used just like physical BACnet switches to isolate BACnet devices into different segments to reduce broadcast traffic across the entire network or to segment devices based on physical location, function, or security requirements.
How to: Managing VLANs and BBMDs Together on an OT Network
We often hear of people struggling with managing VLANs and BBMDs on their network, of finding the balance on how to segregate traffic without blocking important messages between relevant devices.
We spoke with Robert Lastinger from Distech Controls on the subject, who summed up the solution in a simple way. “It’s important that you use VLANs to segregate logical groups of controllers, and then use subnetting and other tools to break it up further if you need to. Once you’ve done those two steps, BBMDs… are there to help you then get the communication across all of that where you need it.”
Let’s outline those two steps in detail.
Step one: Get your devices properly organized in VLANs
In this diagram of an Optigo Connect OT network, two VLANs have been created: VLAN 100 and VLAN 103. This would be an example of what not to do. VLAN 103 isn’t separating anything, which pretty much misses the point. When all the devices on the network are on the same VLAN, and when messages are broadcast, every device will see those messages, and be forced to respond. There might not be a ton of devices on this network, but on a system hundreds or thousands of devices, it can create some nasty traffic.
Want to know more about dealing with excessive broadcast traffic? We created this article to help tamp down on it before broadcast storms get out of hand.
One of the main purposes of VLANs is to reduce the traffic load on your network. To do that requires a subtle shift in thinking about how things should be grouped.
It’s a best practice to create VLANs around services and logical combinations, not devices that are geographically clustered. So, rather than grouping devices that are stationed in a room together, isolate all your CCTV devices to one VLAN, doors to another VLAN, alarms to yet another VLAN, and so on.
Don’t resort to grouping floors or rooms in a VLAN.
Don’t fuss if you only have a handful of devices on a VLAN. Since it’s a virtual partition, you don’t need to worry about wasting physical resources like a hardware switch on just a few devices. The point is to limit the devices on a VLAN to those that need to communicate with one another.
Step Two: Link only the devices that need to talk to each other with BBMDs
BBMDs, as you likely know, are designed to broadcast traffic between unroutable locations in the network. They transform broadcast messages (which IP routers and VLANs reject) into a unicast message that can reach the destination BBMD, which then re-broadcasts on its subnet. It’s a clever trick that’s allowed BACnet/IP devices to continue to work with more modern IT networks.
Here’s Optigo Networks Co-Founder and CTO, Pook-Ping Yao with a quick refresher on BBMDs: What is a BBMD?
The other major benefit of BBMDs is they help to guide and control the notoriously high traffic that BACnet devices create. But only if you configure them properly. Like VLANs, you want to think of the flow of traffic from BACnet segments, using BBMDs to enable proper communication between segments and servers, while restricting unnecessary messages from generating traffic where it doesn’t need to be. For example, subnets of temperature sensors only need a path back to the BMS, and not to other subnets that control lighting.
How many issues will you solve today?
BBMDs can be configured to talk to various destinations, but you should only ever have one BBMD per subnet. Duplicate devices, including duplicate BBMDs, can wreak havoc on your network and can be notoriously difficult to identify and resolve. That’s why OptigoVN has diagnostics specifically designed to track down duplicate devices without the need to manually investigate each device on a subnet.
Note: BBMDs aren’t typically standalone devices anymore. Many devices, like BACnet routers, can also have the BBMD function enabled when needed.
Recap: Best Practices for Managing VLANs and BBMDs on an OT Network
DO
- Use VLANs to segregate devices into subnets by function, service, or specific requirement like security.
- Make as many as you need to keep things organized and separated. Don’t worry about how many or how few devices there might be.
- Configure BBMDs on subnets to connect them only to the other subnets they need to talk to.
- Make it a habit to check for duplicates any time you change something on your network.
DONT
- Group VLAN devices together by location (like floor or room)
- Configure BBMDs to talk to ALL other subnets
- Assign more than one BBMD per subnet
Want to Know More About Managing VLANs and BBMDs?
Check out our webinar with Robert Lastinger from Distech Controls, for a live demo of VLANs and BBMDs on a BACnet MS/TP network, with key best practices you can apply to your networks today. This webinar will help you better understand how to segment your network traffic properly, with a mix of VLANs, subnets, and BBMDs.
The webinar digs into a lot of topics, including:
- Digging into an MS/TP network without segregation | 1:16 – 27:41
- Setting up VLANs on a network to limit traffic | 27:41 – 41:13
- Managing VLANs on the MS/TP network | 41:13
We focused this webinar on MS/TP networks because we know so many BACnet networks out there are running on hard-wired connections.
FAQ: Managing VLANs and BBMDs
1. What is a VLAN, and why is it important in OT networks?
A VLAN (Virtual Local Area Network) allows network segmentation, separating traffic for different systems or purposes while using the same physical network. This segmentation improves performance, security, and scalability, especially in complex OT networks.
2. What is a BBMD, and how does it function?
BBMD (BACnet Broadcast Management Device) enables BACnet/IP messages to cross between different subnets. It translates broadcast messages into unicast messages for transmission across IP routers and retranslates them on the destination subnet to maintain BACnet/IP communication.
3. What are common challenges with BBMDs?
A major issue is duplicate BBMDs, which occur when multiple devices are configured as BBMDs on the same subnet. This results in excessive traffic and potential network failures. Identifying and resolving duplicates manually can be time-consuming but is simplified with tools like Optigo Visual Networks (OptigoVN), which scans for and flags duplicate BBMDs.
4. How does VLAN management help with network stability?
Properly designed VLANs minimize unnecessary traffic and isolate sensitive systems. This reduces congestion, improves network security, and supports more predictable performance in operational environments.
5. What role does OptigoVN play in managing VLANs and BBMDs?
OptigoVN provides diagnostic tools to identify and resolve network issues, such as excessive traffic from misconfigured devices or duplicate BBMDs. Its add-on features, like Site Scope+, allow detailed analysis to pinpoint and fix problematic configurations.
6. What is the future of BBMDs with emerging technologies like BACnet/SC?
BACnet Secure Connect (BACnet/SC) may eventually replace BBMDs by eliminating the need for broadcast translations and enhancing security through encryption. However, adoption is still limited, and BBMDs remain crucial in current BACnet/IP networks.
7. How can I avoid common mistakes in VLAN and BBMD configurations?
- For VLANs, plan segmentation thoughtfully to ensure critical systems are isolated yet accessible.
- For BBMDs, maintain updated documentation of device configurations and avoid redundant setups. Use automated tools like OptigoVN to monitor and address issues proactively.
