BACnet BBMD communication issue over RMS VPN (OTD140 devices)

Networking Solutions Issue
1

We are experiencing an issue with BACnet/IP communication between two remote sites connected via Teltonika RMS VPN.

The topology is as follows (the diagram is attached as well):

-Two Teltonika OTD140 devices (Hotel & Pumpstation)
-Both devices are connected to the same RMS VPN hub
-Each device has a local BACnet/IP subnet:
-Hotel side: 192.168.197.0/24
-Pumpstation side: 192.168.198.0/24
-Devices behind routers:
-Hotel controller: 192.168.197.10 (not BBMD)
-Pumpstation controller: 192.168.198.10 (BBMD enabled)

shared image
shared image2040×1530 229 KB

  • Pumpstation controller (192.168.198.10) is configured as BBMD.
    Its BDT includes:
  • 192.168.198.10/32 :47808
  • 192.168.198.1/32 :47808
  • 192.168.197.1/32 :47808

The hotel’s side has no BBMD-capable controller, so we want to configure OTD140 (Hotel) as BBMD for the subnet 192.168.197.0/24. The main difference with the Pumpstation side is that Hotel’s OTD-140 is connected to the WAN port of the Siemens controller!!

Issue:

Although:

  1. IP connectivity between subnets is working (ping OK)
  2. UDP 47808 is allowed in firewall.
  3. BACnet traffic is visible locally on both sides.

We observe that:

  • BACnet broadcast traffic from 192.168.197.10 remains local (does not get forwarded correctly).
  • When BBMD is configured on the Hotel OTD140 using LAN interface (br-lan / eth0.1), forwarding does not occur.
  • When BBMD interface is set to WAN (usb0), traffic is forwarded, but communication still fails (likely due to incorrect BBMD identity/source IP)
    -BBMD messages stay unconfirmed every time.

As a result:

  • The two controllers (192.168.197.10 and 192.168.198.10) cannot communicate.
  • The Pumpstation controller still reports ‘‘communication failure’’.

–What we need clarification on

We would like to understand:

  1. Is BBMD over RMS VPN fully supported on OTD140 devices?
  2. Is there any limitation when binding BBMD to LAN interfaces while routing over VPN?
  3. What is the correct design when:
    -One side uses a controller as BBMD.
    -The other side uses the Teltonika device as BBMD.
  4. Should BBMD traffic be bound to LAN or WAN interface when using RMS VPN?
  5. What happens with BDT and BIP configuration?
  6. Are there known issues with BBMD forwarding through VPN interfaces (tun)?

Thank you in advance,
Manos Anastasiou

3

Greetings,

Could you please review the following topic: BACnetIP over RMS VPN hub with BACnet package - #4 by Mich
Would using a TAP (Layer 2) VPN instead of a TUN VPN work in your case? If so, the subnets would need to be unified.

Best Regards,
Justinas

4

Dear Justinas,

I hope you are well and thank you for your reply. We have 2 different subnets as described which cannot be altered. I tried to implement it on TAP according to the topic but no communication was achieved. Can we schedule with Teltonika team a remote session in order to find and implement the most appropriate configuration for my case?
I need some guidance in the BACnet service configuration , specifically what BBMD interface I need to enter and why (WAN, tun interface??), regarding each case. I think that the two routers need a different BACnet configuration as the pumpstation’s router is facing a BBMD device (and it doesn’t have to be one) but on the other hand the hotel’s OTD is facing a non-BBMD port (WAN port) and the BMS engineer request is to set the Teltonika router as BACnet router and BBMD of the subnet 192.168.197.0/24.

I am looking forward to hearing for your reply and proposals as the customer needs to open the infrastructure in a few weeks and needs its systems up and running.

Thank you in advance,
Manos Anastasiou
OT Network engineer

5

Greetings,

Apologies for the delayed response.

Could you please clarify whether you still require assistance or if the issue has already been resolved?

Best Regards,
Justinas

6

Dear Justinas,

I would like to inform you that the solution on the specific issue was not found, and it remains.

We found an alternative solution for our client to operate properly (on this specific case) but a same issue which will need special configuration for the BACnet communication will probably cause trouble to us in the future.

Best regards,
Manos Anastasiou