BACnet Network Segmentation Devices

Secure, Scalable BACnet/SC Routing

Ready to Secure, Segment, and Scale Your BACnet Network Affordably?

Cimetrics BNS Devices help integrators reduce costs, meet IT security standards, and scale BACnet/SC deployments efficiently. Whether you need to connect mixed BACnet environments, contain broadcasts, or scale to thousands of devices, the SbC3100 and SbC3200 deliver the reliability, performance, and security your project demands.

Challenges Integrators Face

IT departments are often unwilling to allocate all the static IP addresses needed for BACnet/IP devices in large projects. SbC3100 solves this challenge by placing BAS devices on a separate network that is managed by the integrator using IP addresses independent from IT’s address assignments (private IP address range).

BAS integrators prefer to control device addressing directly, without depending on IT-managed DHCP or restrictions. SbC3100 allows integrators to assign IP addresses on a private network.

Many IT teams block BACnet/IP devices that don’t meet compliance standards (e.g., no DHCP support). The SbC3100 meets IT requirements on the customer-facing port, while the private port remains completely isolated from the IT network.

IT-managed networks often prohibit daisy-chained devices, Ethernet rings, or UL864 switches from being connected directly. The SbC3100’s private network is isolated from the customer’s IT network, allowing the integrator to choose the most appropriate hardware for the BAS system.

BACnet/SC Scaling Challenges

MS/TP and BACnet/IP devices must still connect into SC infrastructure, creating added complexity and security concerns. BAS manufacturers often rely on high-end, costly controllers to provide BACnet routing, which adds expense without solving scale challenges. BNS devices are affordable and scalable solutions for this problem.

Most BACnet/SC routers only support a few hundred devices, creating scalability issues on larger projects and driving up hardware costs. Our BNSD offers significantly greater capacity than competing products.

Once an SC hub reaches its device limit, new hubs (primary + failover) plus an SC-to-SC router must be added. BAS manufacturers typically use expensive controllers for this, yet their hubs and routers still only handle a few hundred devices- making networks harder to scale and increasing both hardware and support costs. BNSDs and hubs are highly scalable solutions for this problem.

When BACnet/IP traffic is routed into SC, every broadcast is distributed to all SC hubs and devices. On large deployments this can overwhelm the secure network and degrade performance unless properly filtered.

How Cimetrics BACnet Network Segmentation Devices Solve These Challenges

Cimetrics BNSDs secure and optimize BACnet networks, while also providing comprehensive routing:

Multi-protocol routing

SbC3100 routes between BACnet/IP ↔ BACnet/IP, BACnet/IP ↔ BACnet/SC, and BACnet/SC ↔ BACnet/SC

SbC3200 BACnet/IP ↔ BACnet/SC, BACnet/MSTP ↔ BACnet/MSTP, BACnet/MSTP ↔ BACnet/IP, BACnet/MSTP ↔ BACnet/SC

High-capacity performance

Supports up to 500 devices per SC network, far beyond typical vendor limitations.

BACnet firewall filtering

Controls traffic by device, object type, service, and direction.

Diagnostics

Wireshark-compatible packet capture provides deep visibility into BACnet/SC routing traffic and troubleshooting, optionally with traffic decryption.

High-density hub and Site CA (SbC Appliance)

Dedicated appliances deliver scalable SC hubs and full certificate authority (CA) management for large deployments.

Feature Comparison: SbC3100 vs SbC3200

Feature	SbC3100	SbC3200
Routing Support	BACnet/IP ↔ BACnet/IP, BACnet/IP ↔ BACnet/SC, BACnet/SC ↔ BACnet/SC	BACnet MS/TP ↔ BACnet/IP, BACnet MS/TP ↔ BACnet/SC, BACnet/IP ↔ BACnet/SC, MS/TP ↔ MS/TP
Device Capacity	250 (IP) + routes up to 500 SC devices between SC networks	supports up to 64 MS/TP devices, 250 BACnet/IP devices
Ports	2 Internet NICs	2x RS-485 + 1x Ethernet NIC
BACnet Firewall Filtering	Built-in	Built-in
Diagnostics	Wireshark-compatible packet capture	Wireshark-compatible packet capture on Ethernet port
Successor to Legacy Models	B3075	B6000