BAS Network Ports for IT: Minimal Connectivity Rules (BACnet, Niagara, Metasys, MQTT)

"IT blocked it" is not a troubleshooting strategy. This page provides a minimal, vendor-aligned port checklist and a framework for describing BAS connectivity needs in IT language: source, destination, protocol, and purpose.

Problem

BAS devices, supervisors, workstations, and integrations cannot communicate because firewall rules are missing or overly broad. Projects stall while teams argue about which ports are needed.

Root Cause

• BAS requirements are not documented as specific flows (source → destination → protocol/port → purpose).
• Default ports are used without confirming which services are enabled or how security hardening changes defaults.

Solution

Step A: Start with a simple connectivity matrix

For each integration, document:

Field	Example
Source host(s)	Workstation 10.1.2.50
Destination host(s)	JACE-8000 10.10.5.20
Protocol	TCP
Port(s)	4911
Service purpose	Niagara station connection (foxs)
TLS/encrypted	Yes

Step B: Common BAS ports (starting point)

BACnet/IP

Service	Port	Notes
BACnet/IP discovery	UDP 47808	IANA-registered BACnet port

Niagara Fox connections

Protocol	Default port	Notes
fox (unencrypted)	TCP 1911	Not recommended for production
foxs (TLS)	TCP 4911	Niagara secure baseline
foxwss (Fox over WebSocket)	TCP 443	Passes standard HTTPS firewall rules

Metasys

Metasys and SCT documentation includes defined port sets and firewall configuration guidance. Implement only what your specific Metasys roles and features require. Reference Johnson Controls Network and IT Guidance for the authoritative port list for your deployment version.

MQTT (if used)

Protocol	Common port	Notes
MQTT (unencrypted)	TCP 1883	Avoid in production deployments
MQTT over TLS	TCP 8883	Preferred for production use

Step C: Design guardrails

• Segment BAS networks and restrict which hosts can initiate controller connections.
• Prefer TLS-enabled services (foxs, HTTPS, MQTT over TLS) where supported.
• If you need BACnet/IP discovery across subnets, use a deliberate BBMD/FDR strategy rather than broad network exposure.
• Never expose BACnet or controller management interfaces directly to the public internet.

Field Notes / Gotchas

• foxwss on port 443 often passes through corporate firewalls without special rules, making it useful for cloud-connected or remotely-managed sites.
• BACnet on UDP 47808 is bidirectional—ensure both ingress and egress rules exist in your firewall matrix.
• Always get port requirements in writing from the BAS contractor and cross-reference with vendor hardening guides before finalizing firewall rules.