Axonius BACnet Scanner - Scan Device

Axonius BACnet Scanner - Scan Device performs a BACnet Who-Is scan on a device's IP address, discovers BACnet devices on the network, and correlates them with the Axonius asset for:

• Assets that match the results of the selected saved query, and match the Enforcement Action Conditions, if defined or assets selected on the relevant asset page.

Required Fields

These fields must be configured to run the Enforcement Action.

• Network Subnets - Network subnets in CIDR notation (for example, 192.168.1.0/24), separated by commas. The scanner will discover BACnet devices on these subnets via broadcast.

Additional Fields

These fields are optional.

• Port (default: 47808) - BACnet/IP port to use for discovery. The standard BACnet/IP port is 47808 (0xBAC0).

• Discover Timeout (seconds) (default: 5) - Timeout for BACnet discovery requests in seconds. Increase this value for slower networks or decrease it to fail faster on unreachable networks.

• Max Concurrent Devices (default: 20) - Maximum number of devices queried simultaneously. Lower this value if network resources are constrained or increase it to scan faster on high-bandwidth networks.

• Max Retries (default: 2) - Maximum number of retries per device if the initial discovery attempt fails. Setting this to 0 disables retries.

• Inter-Packet Delay (ms) (default: 50) - Delay between packets in milliseconds to prevent buffer overflows on Building Automation Systems and operational technology (OT) networks.

• Fetch Properties (default: True) - Enable fetching device properties from discovered BACnet devices.

• Fetch Object List (default: False) - Enable fetching the complete object list from discovered BACnet devices.

💡

Connection and Credentials

When Use stored credentials from the adapter is toggled off, some of the connection fields below are required to create the connection, while other fields are optional.

• Network Subnets - Network subnets in CIDR notation (for example, 192.168.1.0/24), separated by commas.
• Port - BACnet/IP port (default: 47808).

• Verify SSL (optional) - Select whether to verify the SSL certificate of the server against the CA database inside of Axonius. For more details, see SSL Trust & CA Settings.

• HTTPS Proxy (optional) - Connect the adapter to a proxy instead of directly connecting it to the domain.

• HTTPS Proxy User Name (optional) - The user name to use when connecting to the server using the HTTPS Proxy.

• HTTPS Proxy Password (optional) - The password to use when connecting to the server using the HTTPS Proxy.

• Gateway Name - Select the Gateway through which to connect to perform the action.

APIs

Axonius uses the BACnet/IP protocol - UDP port 47808 for device discovery and property queries.

The scanner uses the following BACnet services:

• Who-Is - Broadcast discovery to identify all BACnet devices on the network
• Read Property - Service to query device properties and object information

The scanner reads the following BACnet device properties:

• Object Name, Device Type, Vendor Name, Vendor Identifier, Firmware Revision, Application Software Version, Location, Description, Model Name, System Status, Max APDU Length Accepted, Segmentation Supported, Protocol Version, Protocol Revision

Required Ports

Axonius must be able to communicate via the following ports:

• UDP port 47808 (default BACnet/IP port, or the custom port specified in the configuration)

Required Permissions

• Network Access - Axonius must have network connectivity to the target IP ranges specified in the Network Subnets field.
• BACnet/IP Access - Firewall rules must allow BACnet/IP traffic (UDP port 47808 or custom port) between Axonius and the target devices.
• Broadcast Permission - Target networks must allow broadcast packets for the Who-Is discovery mechanism to function.
• Read Property Support - Target devices must support standard BACnet Read Property services. This is a standard feature supported by all BACnet devices.

Version Matrix

This Enforcement Action was tested only with the versions marked as supported, but may work with other versions. Please contact Axonius Support if you have a version that is not listed and it is not functioning as expected.

---