Network switches in building automation: L2, L2+ and L3 for BACnet/IP

A practical guide for BMS engineers, integrators and facility maintenance teams

In a small installation, two BACnet/IP controllers can communicate through a basic Ethernet switch. In a larger building with many controllers, technical rooms, VLANs and shared IT infrastructure, however, switch selection affects reliability, troubleshooting, security and future expansion. The right question is not simply whether we need 8 or 24 ports, but which networking capabilities the project actually requires.

1. What does an Ethernet switch do?

A switch connects devices within a local area network. At Layer 2, it forwards Ethernet frames based on MAC addresses. Two BACnet/IP controllers in the same VLAN and IP subnet can communicate through a basic Layer 2 switch. Communication between different IP subnets is a separate function handled by a router or Layer 3 switch.

Important: managed and Layer 3 do not mean the same thing. A managed switch may provide Layer 2 functionality only. A Layer 3 switch additionally routes IP packets between subnets.

2. Unmanaged, managed L2, L2+ and L3 compared

L2+ is primarily a marketing category. Its actual features vary substantially by manufacturer and model. Do not assume that every product labelled L2+ performs all the functions of an L3 switch.

3. What does managed switching provide in practice?

• VLAN segmentation: logical separation of HVAC automation, energy meters, intercoms and corporate IT.
• RSTP/STP: reducing Layer 2 loop risks when redundant physical links are present; topology configuration requires validation.
• Port mirroring: copying traffic to a service laptop for BACnet/IP packet analysis in Wireshark.
• SNMP, syslog and port counters: information useful for locating broken links, packet errors and congestion.
• Storm control: limiting broadcast, multicast or unknown-unicast flooding.
• PoE: powering compatible equipment, provided the per-port and total power budget are sufficient.
• Security: limiting management access and permitted flows with the functions supported by the particular switch.

About IGMP snooping: IGMP snooping manages IP multicast traffic. Traditional BACnet/IP Who-Is discovery relies on IP broadcast rather than multicast. Enabling IGMP snooping alone therefore does not make BACnet discovery work across VLANs.

4. BACnet/IP: why is a controller not discovered?

BACnet/IP commonly uses Who-Is and I-Am messages for device discovery. Standard BACnet/IP may rely on local IP broadcast traffic. Broadcasts usually remain within one Layer 2 broadcast domain and are not forwarded automatically between IP subnets by ordinary routing.

Consider BACnet controllers in VLAN 10 using 192.168.10.0/24 and a management server in VLAN 20 using 192.168.20.0/24. Ping and direct unicast communication may work, but automatic BACnet discovery may fail. This does not necessarily mean the switch is faulty; it may be an expected result of the network architecture.

5. BBMD, Foreign Device Registration and BACnet/SC

A BACnet Broadcast Management Device (BBMD) transfers the relevant BACnet/IP broadcasts between IP subnets. A BACnet/IP architecture spanning multiple subnets commonly requires a properly configured BBMD in each subnet where broadcast distribution is needed, with coordinated Broadcast Distribution Tables (BDT). Multiple unmanaged BBMD configurations in the same segment can lead to duplicate traffic.

Foreign Device Registration (FDR) allows a device on a remote subnet to register with a BBMD and receive the required BACnet broadcasts. Connectivity, access rules and periodic re-registration must be planned.

BACnet Secure Connect (BACnet/SC) uses secure WebSocket/TLS connections and does not depend on the traditional IP broadcast mechanism. It requires compatible endpoints or gateways, certificate management and a suitable architecture.

Conventional BACnet/IP commonly uses UDP port 47808 (0xBAC0), although it is configurable. Firewall rules should allow only the required communication between defined endpoints. Exposing unsecured BACnet/IP directly to the public internet is inappropriate.

6. A VLAN is not an IP subnet and is not a firewall

VLANs create logical separation at Layer 2; IP subnets organise addresses at Layer 3. A one-to-one VLAN/subnet relationship is common, but the concepts are not identical. Inter-VLAN communication requires routing, while restrictions between segments require properly designed firewall or ACL policies. VLAN separation alone is not sufficient security.

One example might use VLAN 10 for BMS/BACnet controllers, VLAN 20 for EMS/meters and VLAN 30 for network equipment management. These are example IDs, not universal standard assignments.

7. Three typical selection scenarios

1. Small boiler room: three controllers and an isolated local service connection. A robust unmanaged industrial switch may be sufficient; choose managed L2 if future expansion or diagnostics matter.
2. Office building: dozens of BACnet/IP controllers, multiple plant rooms, central BMS and EMS. Managed Layer 2 access switches plus a central Layer 3 gateway are sensible. Document VLANs, access policies and BBMD/FDR where required by the communication design.
3. Hospital or multi-building campus: multiple buildings, IT/OT segmentation, redundancy and monitoring. Coordinate architecture with IT, use managed access segments and an appropriately designed Layer 3 core. BACnet/SC can be considered where products and certificate operations support it.

8. What belongs in the switch specification?

• RJ45 and SFP port counts; 100 Mb/s, 1 Gb/s or 10 Gb/s based on realistic requirements.
• Industrial operating temperature, DIN-rail installation, DC supply, redundant power options and EMC compliance.
• VLAN, RSTP, storm control, port mirroring, syslog, SNMPv3 and secure management.
• Explicit routing capabilities, SVIs, ACLs and static routes when specifying L2+ or L3 products.
• Required PoE standard, per-port power and total power budget, if applicable.
• Documented addressing scheme, BACnet Device IDs, UDP ports, BBMD/BDT/FDR configuration and commissioning tests.
• Configuration backups, ownership, firmware management, logging and service access.

9. Common BACnet/IP commissioning problems

10. Engineering recommendation

For professional building automation, managed Layer 2 switching is a practical default; a costly Layer 3 switch is not automatically needed in every control panel. L2+ can suit limited routing needs, while Layer 3 belongs where multiple IP networks require structured routing and segmentation. For BACnet/IP, the choice must also account for local broadcast, BBMD/FDR or BACnet/SC. The successful system depends on the complete communications and cybersecurity design, not a particular vendor label.

References and further reading

• Cisco Meraki – Layer 2 and Layer 3 switching
• Cisco – Networking and security for industrial automation
• ABB – BACnet networks, BBMD and foreign devices
• BACnet International – BACnet Secure Connect
• Aruba – Instant On 1960 switching and routing

This article is an engineering overview, not a substitute for project documentation, a site-specific cybersecurity assessment or manufacturer instructions.