Page 37 - 240909_BACnet_Europe-Journal_41

Technik Technology

standard BACnet UDP Port 47808. It is good Security with BACnet/SC Datalink tions only originating an outbound connection
practice to change this port to a non-standard that doesn’t require firewall changes. If the hub
port if communicating over the Internet. The IP The open nature of BACnet/IP and broadcast is located behind the firewall, a port forwarding
routers/firewalls also provide additional features traffic created some pushback from IT depart- entry for access from the Internet is needed. But
that should be utilized. A list of IP addresses that ments. BACnet Secure Connect (BACnet/SC) for a remote node or application to success-
can communicate through the firewall can be was released to address these concerns by fully connect to the hub, it must have already
specified on the Internet facing firewall. Some incorporating the widely used IT security prac- been provided the credentials (certificate and
BACnet routers also provide this Allowlist fea- tices. BACnet/SC used connection-oriented key) and approved to be part of this network.
ture. BACnet/IP communication occurs over TCP instead of UDP and TLS 1.3 for security Temporary access can be granted by creat-
UDP and is unencrypted. Using VPNs can pro- with encrypted communications. Each device ing a certificate for a shorter time duration. The
vide additional security by encrypting the traf- must be authorized to be on the network and use of BACnet/SC provides security inherently.
fic over the Internet and restricting communica- assigned a certificate and key. The broadcast BACnet/IP and BACnet MS/TP devices can be
tion to only authorized VPN endpoints. There is discovery protocol and BBMD have been elimi- integrated with BACnet/SC using BACnet rout-
no need to use non-standard BACnet UDP Ports nated. BACnet/SC uses a hub and node model. ers that support all three datalinks, thus allow-
with VPNs. Setting up firewall rules or VPNs Devices/nodes primarily communicate via the ing current and future BACnet Systems to be
requires help from the IT department while the BACnet/SC hub with standard provisions for securely interconnected. 
BMS professional can configure the non-stand- node-to-node communication. The SC hub can
ard BACnet UDP port on their own. be on the Internet, with nodes at different loca-

Harpartap Parmar
Director of Product ManagementContemporary Controls
hparmar@ccontrols.comwww.ccontrols.com

Retrofit mit dem O3 Multisensor

Website

Video